1. Data Controller Information
Finance Innovation Hub acts as the data controller for personal information collected through our website and services. Contact details are provided in our footer section.
2. Lawful Basis for Processing
Consent (Art. 6(1)(a)): Marketing communications and optional services
Contract (Art. 6(1)(b)): Service delivery and client management
Legitimate Interest (Art. 6(1)(f)): Business operations and website analytics
Legal Obligation (Art. 6(1)(c)): Regulatory compliance and record-keeping
3. Data Subject Rights
Right of Access (Art. 15): Request information about processing and copies of data
Right to Rectification (Art. 16): Correct inaccurate or incomplete data
Right to Erasure (Art. 17): Request deletion of personal data
Right to Restrict Processing (Art. 18): Limit how we process your data
Right to Data Portability (Art. 20): Receive data in a structured format
Right to Object (Art. 21): Object to processing based on legitimate interests
4. Data Categories and Sources
Contact Information: Name, email, phone, address (directly provided)
Professional Information: Company, role, industry (directly provided)
Technical Data: IP address, browser information (automatically collected)
Usage Data: Website interactions, preferences (automatically collected)
5. Data Recipients
Internal Recipients: Authorized staff members on need-to-know basis
Service Providers: Technology partners, analytics services, marketing platforms
Legal Authorities: When required by law or legal process
6. International Transfers
Data may be transferred to countries outside the EEA. We ensure adequate protection through standard contractual clauses, adequacy decisions, or other approved mechanisms.
7. Retention Periods
Client Data: Duration of relationship plus 7 years for legal compliance
Marketing Data: Until consent is withdrawn or 3 years of inactivity
Website Analytics: 26 months maximum for Google Analytics data
Communication Records: 3 years for business correspondence
8. Security Measures
We implement appropriate technical and organizational measures including encryption, access controls, regular security assessments, and staff training.
9. Data Protection Impact Assessments
We conduct DPIAs for high-risk processing activities and consult with supervisory authorities when required.
10. Breach Notification
We maintain procedures to detect, investigate, and report data breaches to supervisory authorities within 72 hours and to affected individuals when required.
11. Exercising Your Rights
To exercise your GDPR rights, contact us using the information in our footer. We will respond within one month and may request identity verification.
12. Supervisory Authority
You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with GDPR requirements.
