Finiqua Finance Ltd
Last updated: 20 October 2026
We, Finiqua Finance Ltd, together with our subsidiaries (together referred to as “the company”, “we” or “us”), take the protection of your personal data seriously. This Privacy Policy explains how we handle personal data in our company.
As part of our responsibilities under data protection law, we must comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), which protects the personal data of individuals. In this policy we refer to you as the “data subject”, and also as “customer”, “user” or “you”.
Where we decide, alone or jointly with others, on the purposes and means of processing personal data, we are obliged to inform you transparently about the type, scope, purpose, duration and legal basis of that processing (see Articles 13 and 14 GDPR).
Sections 1 to 12 and section 14 apply to all processing of personal data by us. Section 13 describes the processing that takes place when you visit our websites. Use the contents below to go directly to any section.
Contents
2. Controller and contact details
3. Data Protection Officer and EU representative
5. Retention periods and erasure
7. Service providers (processors)
8. Transfers to third countries
9. Automated decision-making and profiling
10. Obligation to provide personal data
11. Disclosure required by law
13.1 Personal data we process on our website
13.3 Recipients of website data
1. Definitions
This Privacy Policy uses the following definitions, based on Article 4 GDPR:
Personal data (Art. 4 No. 1 GDPR): any information relating to an identified or identifiable natural person (“data subject”). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or information relating to their physical, physiological, genetic, mental, economic, cultural or social identity. Identifiability can also be achieved by linking such information with other additional knowledge. The origin, form or embodiment of the information is irrelevant; photos, video or audio recordings can also contain personal data.
Processing (Art. 4 No. 2 GDPR): any operation performed on personal data, whether or not by automated means. This includes in particular the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, or alteration of the purposes for which they were originally processed.
Controller (Art. 4 No. 7 GDPR): the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor (Art. 4 No. 8 GDPR): a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller’s instructions (for example, an IT service provider). In terms of data protection law, a processor is not a third party.
Third party (Art. 4 No. 10 GDPR): any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or processor, are authorised to process the personal data. This also includes other legal entities belonging to the group.
Consent (Art. 4 No. 11 GDPR): any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
2. Controller and contact details
We are the controller responsible for the processing of your personal data within the meaning of Article 4 No. 7 GDPR:
Finiqua Finance Ltd
2850 Shaughnessy Street, Unit 2300
Port Coquitlam, BC V3C 6K5
Canada
Email: [email protected]
For further information about our company, please see our legal notice at https://finiqua.com/legal-notice/.
3. Data Protection Officer and EU representative
We have appointed a data protection officer for our company. This person also acts as our data protection representative in the EU. You can contact them at:
SBS DATA PROTECT GmbH
For the attention of the Managing Director, Mr Thilo Noack
Hans-Henny-Jahnn-Weg 49, DE-22085 Hamburg, Germany
Email: [email protected]
4. Legal bases for processing
In principle, processing of personal data is prohibited by law and is only permitted where one of the following legal bases applies:
Art. 6(1)(a) GDPR (consent): the data subject has, voluntarily, in an informed and unambiguous manner, by a statement or other unambiguous affirmative act, indicated that they consent to the processing of their personal data for one or more specific purposes.
Art. 6(1)(b) GDPR (contract): processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
Art. 6(1)(c) GDPR (legal obligation): processing is necessary for compliance with a legal obligation to which the controller is subject (for example, a legal obligation to retain data).
Art. 6(1)(d) GDPR (vital interests): processing is necessary to protect the vital interests of the data subject or another natural person.
Art. 6(1)(e) GDPR (public interest): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Art. 6(1)(f) GDPR (legitimate interests): processing is necessary for the purposes of the legitimate (in particular legal or economic) interests pursued by the controller or by a third party, except where those interests are overridden by the interests or rights of the data subject (in particular where the data subject is a minor).
For each processing activity described in this policy, we indicate the applicable legal basis. Processing may rely on more than one legal basis.
5. Retention periods and erasure
Unless a specific retention period is stated in this policy, your personal data will be deleted or blocked as soon as the purpose or legal basis for storing it no longer applies. Your data is stored on our servers in Germany, subject to any disclosure described in sections 7 and 8.
Data may be kept beyond the stated retention period in the event of an (impending) legal dispute with you or other legal proceedings, or where storage is required by law. If a statutory storage period expires, the personal data will be blocked or deleted unless further storage is necessary and there is a legal basis for it.
| Type of data | Retention period |
|---|---|
| Log data | 7 days |
| Contact form data | 3 years after processing |
| Cookie and local storage data | Per cookie; see section 13.4 (consent cookie: 1 year; other entries: [duration to be confirmed]) |
| Marketing data | 24 months, or until consent is revoked |
6. Data security
We use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties (for example, TLS encryption for our website). These measures take into account the state of the art, the implementation costs, the nature, scope, context and purpose of the processing, and the existing risks of a data breach (including its likelihood and effects) for the data subject. Our security measures are continuously improved in line with technological development.
7. Service providers (processors)
As with any large company, we use external domestic and foreign service providers to process our business transactions (for example in IT, logistics, telecommunications, sales and marketing). These service providers act only in accordance with our instructions and are contractually obliged to comply with data protection regulations in accordance with Article 28 GDPR.
Where personal data is passed on between us and our subsidiaries (for example for advertising purposes), this is done on the basis of existing data processing agreements (DPAs).
8. Transfers to third countries
As part of our business relationships, your personal data may be passed on or disclosed to third-party companies, which may be located outside the European Economic Area (EEA), that is, in third countries. This takes place only to fulfil contractual and business obligations and to maintain your business relationship with us. The legal basis is Art. 6(1)(b) or (f) GDPR, in each case in conjunction with Art. 44 et seq. GDPR. We will inform you of the relevant details of any transfer at the appropriate points in this policy.
The European Commission has determined, by means of so-called adequacy decisions, that some third countries provide a level of data protection comparable to the EEA standard. A list of these countries and copies of the adequacy decisions are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
In other third countries to which personal data may be transferred, a consistently high level of data protection may not be guaranteed due to a lack of legal provisions. In such cases, we ensure that data protection is adequately safeguarded. This is possible through binding corporate rules, the standard contractual clauses of the European Commission for the protection of personal data under Art. 46(1) and (2)(c) GDPR, certificates, or recognised codes of conduct.
9. Automated decision-making and profiling
We do not intend to use personal data collected from you for automated decision-making, including profiling.
10. Obligation to provide personal data
We do not make the conclusion of contracts with us dependent on you providing personal data beforehand. As a customer, you are under no legal or contractual obligation to provide us with your personal data. However, we may only be able to provide certain services to a limited extent, or not at all, if you do not provide the necessary data. If this is exceptionally the case for a product presented or offered by us, we will inform you of this separately.
11. Disclosure required by law
We may be subject to a special legal or statutory obligation to provide lawfully processed personal data to third parties, in particular public authorities (Art. 6(1)(c) GDPR).
12. Your rights
You can assert your rights as a data subject with regard to your personal data at any time by contacting us using the details in section 2. As a data subject, you have the right to:
Access (Art. 15 GDPR): request information about the personal data we process about you, including the purposes of processing, the categories of data, the categories of recipients to whom it has been or will be disclosed, the planned storage period, the existence of rights to rectification, erasure, restriction or objection, the right to lodge a complaint, the origin of data if it was not collected from you, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.
Rectification (Art. 16 GDPR): demand the immediate correction of incorrect data, or the completion of incomplete data stored by us.
Erasure (Art. 17 GDPR): demand the deletion of your data, unless the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
Restriction (Art. 18 GDPR): demand the restriction of processing where the accuracy of the data is disputed by you, or the processing is unlawful.
Data portability (Art. 20 GDPR): receive the data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller.
Objection (Art. 21 GDPR): object to processing based on Art. 6(1)(e) or (f) GDPR. This is particularly the case where processing is not necessary for the fulfilment of a contract with you. If your objection is not directed at direct advertising, please explain the reasons why we should not process your data as we have done. In the event of a justified objection, we will examine the situation and either discontinue or adapt the processing, or point out our compelling legitimate grounds for continuing it.
Withdraw consent (Art. 7(3) GDPR): withdraw any consent you have given us, at any time, by declaration or other unambiguous confirmatory act. This also applies to consent given before the GDPR came into force on 25 May 2018. Withdrawal does not affect the lawfulness of processing carried out before it. Following withdrawal, we may no longer continue the processing based on that consent.
Complain (Art. 77 GDPR): lodge a complaint with a data protection supervisory authority about the processing of your personal data. A list of the German data protection supervisory authorities and their contact details is available at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
13. Visiting our website
Information about our company and the services we offer is available at https://finiqua.com/legal-notice/ and the associated subpages (together, “our websites”). When you visit our websites, your personal data may be processed.
13.1 Personal data we process on our website
When you use our websites for information purposes, we collect, store and process the following categories of personal data:
Log data. When you visit our websites, a log data record (server log file) is stored temporarily and anonymised on our web server. It consists of:
the page from which the page was requested (referrer URL);
the name and URL of the requested page;
the date and time of the request;
a description of the type, language and version of the web browser used;
the IP address of the requesting computer, shortened so that a personal reference can no longer be established;
the amount of data transferred;
the operating system;
the status of the request (access status / HTTP status code);
the GMT time zone difference.
Contact form data. When you use our contact forms, the data transmitted through them is processed, for example gender, surname and first name, address, company, email address, and the time of transmission.
13.2 Purposes and legal bases
We process the personal data described above in accordance with the GDPR and other applicable data protection regulations, and only to the extent necessary. Where processing is based on Art. 6(1)(f) GDPR, the purposes stated also represent our legitimate interests.
Log data is processed for statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis: Art. 6(1)(a) or (f) GDPR).
Contact form data is processed to handle customer enquiries (legal basis: Art. 6(1)(b) GDPR).
13.3 Recipients of website data
The following categories of recipients, which are usually processors (see section 7), may have access to your personal data:
Data processing service providers for the operation of our website and the processing of data stored or transmitted by our systems (for example, data centre services, payment processing, IT security). The legal basis for the transfer is Art. 6(1)(b) or (f) GDPR, insofar as these are not processors.
Government bodies and authorities, insofar as this is necessary to fulfil a legal obligation (legal basis: Art. 6(1)(c) GDPR).
Persons engaged to carry out our business operations (for example, auditors, banks, insurance companies, legal advisers, supervisory authorities, and parties involved in company acquisitions or the establishment of joint ventures). The legal basis for disclosure is Art. 6(1)(b) or (f) GDPR.
Consent management provider (CookieFirst), which stores and processes your cookie consent choices on our behalf (see section 13.4). The legal basis for the transfer is Art. 6(1)(b) or (f) GDPR.
For safeguards applying when data is transferred to third countries, see section 8. We will only pass on your personal data to other third parties where you have given your express consent under Art. 6(1)(a) GDPR.
13.4 Cookies and similar technologies
We use cookies and similar technologies on our websites, including browser local storage. Cookies are small text files that your browser stores on your device and that allow certain information to flow to the party that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. Local storage works in a similar way, keeping information in your browser.
Cookies can contain data that makes it possible to recognise the device used. In some cases they only contain information on certain settings that is not personally identifiable. Some of the cookies listed below contain a unique identifier that allows the provider to recognise a returning visitor’s browser. Such identifiers are personal data under the GDPR.
We distinguish between session cookies, which are deleted when you close your browser, and persistent cookies, which remain stored beyond the individual session. By function, the cookies on our websites fall into the following categories:
Necessary: strictly necessary to move around the website, use basic functions, save your cookie preferences and ensure the security of the website. They do not collect information about you for marketing purposes or store which websites you have visited.
Functional: support particular features and the presentation of the website.
Cookies that are absolutely necessary to provide the service you have expressly requested are processed under Art. 6(1)(b) GDPR. Any use of cookies that is not absolutely technically necessary, including any performance, advertising, targeting or sharing cookies, is only permitted with your express and active consent under Art. 6(1)(a) GDPR. We will only pass on personal data processed through cookies to third parties if you have given your express consent under Art. 6(1)(a) GDPR.
You can change or withdraw your cookie preferences at any time using the cookie banner on our websites. The list below shows the cookies found on our websites. It does not reflect individual visitors’ choices.
Cookies and local storage used on our websites
| Name | Category | Storage type | Duration | Purpose and provider |
|---|---|---|---|---|
| cookiefirst-consent | Necessary | Cookie | 1 year | Saves your cookie preferences for this website. Provider: CookieFirst. |
| cookiefirst-consent | Necessary | Local storage | Persistent | Saves your cookie preferences for this website. Provider: CookieFirst. |
| cookiefirst-id | Necessary | Local storage | Persistent | Contains a unique ID so that CookieFirst can identify unique visitors to this website. Provider: CookieFirst. |
| elementor | Functional | Local storage | Persistent | Supports the WordPress page builder used for this website. |
Last reviewed: 6 October 2026
13.5 Contact form
If you send us an enquiry through the contact form, your message (including any contact details you provide) will be stored and processed by us for the purpose of handling and answering your enquiry and for any follow-up questions. We will not pass this data on to third parties unless this is necessary to process and respond to your enquiry, or you have given us your consent to do so.
If you contact us as part of an existing contractual relationship, or in advance to obtain information about our range of services, the data you provide is processed for that purpose in accordance with Art. 6(1)(b) GDPR. The data you enter in the contact form remains with us until the purpose for storing it no longer applies (for example, once your enquiry has been handled). Mandatory statutory provisions, in particular retention periods, remain unaffected.
13.6 Retention of website data
Your data is only processed for as long as is necessary to fulfil the purposes described above. Third parties we engage store your data on their systems for as long as is necessary in connection with providing their services under the relevant order. Retention periods are set out in section 5.
14. Changes to this policy
As data protection law, technology and our organisation develop, we regularly review this policy to determine whether it needs to be amended or supplemented. We will inform you of any changes, in particular on our website.
This policy was last updated on 20 October 2026. The next scheduled review is due on 20 April 2027.