Privacy.
Clearly explained.

This English translation is provided for convenience only. The German version is legally binding; in the event of any discrepancy, the German version prevails. Datenschutzerklärung (German version)

1. Controller

The controller responsible for data processing on this website (finaure.eu and docs.finaure.eu) is:

Further details can be found in our legal notice.

2. Overview: what this website processes

Personal data is processed in five places: during technical operation (when the website is accessed), when you write to us via the contact form, when you sign up for the newsletter, and – only if you consent – for audience measurement with Google Analytics and for ad measurement with Meta. Without your consent, this website does not load any analytics or advertising services and does not set any analytics or advertising cookies. We do not embed fonts, videos or other content from third-party providers.

3. Hosting and delivery

This website is hosted and delivered by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When the website is accessed, Netlify processes the technically necessary connection data on our behalf (see section 4). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Netlify. Netlify is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, standard contractual clauses have been agreed (Art. 46(2)(c) GDPR).

Name resolution (DNS) for our domain is provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is used solely as a DNS service; traffic generated when you visit the website does not pass through Cloudflare.

The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

4. Server log files

When the website is accessed, information transmitted by your browser is recorded automatically: IP address, date and time of access, page accessed, browser type and version, operating system and referrer URL. This data serves to ensure trouble-free operation and the security of the systems (legal basis: Art. 6(1)(f) GDPR). We do not evaluate it for any other purpose and do not combine it with other data. The log data is stored by the hosting provider only for as long as is necessary for these purposes and is then deleted.

When you open the home page, we also determine from your IP address the country from which you are visiting and, together with your browser’s language setting, redirect you to the matching language version (for example, visitors from Spain to the Spanish page). Netlify performs the country lookup during delivery; we do not store the country or the IP address for this purpose and do not create a profile from it (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in offering you the website in your language). A language you have chosen yourself always takes precedence (see section 7).

5. Contact form

If you write to us via the contact form or the enquiry form on the “Individual” page, we process the data you provide in order to handle your enquiry:

• Contact form: name, email address, optionally telephone number, selected topic, your message and optionally how you heard about Finaure
• “Individual” enquiry form (assets over €150m): name, email address, optionally telephone number and your message

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at a contract (e.g. trial period), and otherwise your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the form. You may withdraw your consent at any time with effect for the future, for example by email to info@finaure.eu. Completing the mandatory fields is necessary for us to be able to handle your enquiry; without them, it is not possible to contact us via the form.

We use the voluntary information on how you heard about Finaure only internally, to understand how prospective customers find us. It is not passed on to analytics or advertising services. The legal basis for this is our legitimate interest in evaluating our communication channels (Art. 6(1)(f) GDPR).

Protection against misuse: To prevent automated spam submissions, the form contains a field that is invisible to humans. In addition, we limit excessive requests within a short period: for this purpose, we store with our host Netlify an irreversible hash of your IP address (not the address itself) together with a counter for a ten-minute time window. Entries from expired time windows are deleted with the next form request (legal basis: Art. 6(1)(f) GDPR).

Captcha (Cloudflare Turnstile): In addition, we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) on the forms to check whether a submission comes from a human. For this purpose, your IP address and technical characteristics of your browser are transmitted to Cloudflare when the form is loaded. The legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR); access to your device is strictly necessary for this (Section 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework.

Transmission by email: Your details are delivered to us as an email. We use the Brevo service (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) to send it. The email is received in our mailbox at Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) and processed there and with Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Data processing agreements pursuant to Art. 28 GDPR have been concluded with all providers. Processing takes place in the EU; insofar as Microsoft transfers data to the USA in individual cases, this is based on the EU-US Data Privacy Framework and standard contractual clauses.

Storage period: We delete your enquiry as soon as it has been conclusively dealt with, provided that no statutory retention obligations prevent this. If your enquiry leads to a contract, the retention periods under commercial and tax law apply (generally six to eight years for business correspondence and accounting records).

6. Newsletter

You can sign up for our newsletter on our website. In it, we inform you about the launch of Finaure, new features and offers. The only mandatory information is your email address.

Double opt-in: After signing up, you receive an email with a confirmation link. We only add you to the mailing list once you click it. To document your consent, the time of sign-up and confirmation and the IP address used are logged.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the form. You can withdraw it at any time with effect for the future, via the unsubscribe link in every email or by email to info@finaure.eu. The lawfulness of processing carried out before withdrawal remains unaffected.

Sending via Brevo: The mailing list is managed and the newsletter sent via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR; processing takes place in the EU. Protection against misuse is the same as for the contact form (section 5).

Open and click tracking: Our emails contain a small image that is loaded from Brevo’s servers when the email is opened (tracking pixel), and links are redirected via Brevo. This tells us whether and when an email was opened and which links were clicked; the IP address, time and email client or device type are also recorded. We use this analysis to improve our emails. It is part of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give when signing up. You can withdraw it at any time by unsubscribing from the newsletter; we then delete the tracking data together with your address from the mailing list.

Storage period: We store your email address until you unsubscribe. We then remove it from the mailing list. We keep the record of your consent for up to three years after you unsubscribe so that we can prove it in the event of a dispute (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).

7. Consent and cookies

On your first visit, we ask you in a notice window whether you consent to audience measurement (“Statistics” category) and ad measurement (“Marketing” category). You can decline, accept or make individual choices under “Settings”. We store your choice in the cookie finaure_consent (valid for finaure.eu and docs.finaure.eu, lifetime 12 months). This cookie is technically necessary in order to respect your decision and contains only the selected setting (legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). Once it expires, we ask you again.

If you choose a language using the language switcher, we store this choice in the cookie finaure-lang (lifetime 12 months). It contains only the language code and ensures that the home page is shown to you in the chosen language in future, rather than based on country or browser language. It is set only when you click and is strictly necessary for this function you requested (legal basis: Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR).

All other cookies and any access to your terminal device take place only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw or change your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. If you withdraw your consent, we delete the relevant analytics or advertising cookies in your browser.

8. Audience measurement with Google Analytics

If you consent, we use Google Analytics 4 to understand how our website is used: which pages are accessed, how visitors find us and which offerings attract interest. This enables us to improve the content and structure of the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is integrated via Google Tag Manager, provided by the same provider.

Our own server as an intermediary: Your browser does not send the data directly to Google, but to our tracking server at data.finaure.eu. This server is operated on our behalf by Stape Europe OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, in a data centre in the Netherlands. The server removes your IP address before the data is forwarded to Google. Google therefore does not receive your IP address by this route. When Tag Manager is loaded, your browser may additionally establish a technical connection to Google servers (googletagmanager.com); for technical reasons, your IP address is transmitted to Google in this process.

Data processed: pages accessed and their titles, date and time, length of visit, referrer (the page you came from), information on browser, operating system, device type and screen resolution, language setting, and interactions on the website: clicks on “Register” or “Login” (including the selected plan and billing interval), the successful submission of the contact form (without your entries), answers in the offer survey and copying of the discount code. To recognise your browser, cookies with a random identifier are set: _ga and _ga_PDT6EC2NMC (by Google Analytics) and FPID and FPLC (by our tracking server data.finaure.eu). We do not transmit names, email addresses or form contents to Google.

Settings: We have deactivated data sharing with Google for Google’s own purposes, Google Signals (linking with Google accounts) and the granular collection of location and device data. We use Google’s consent mode (Consent Mode): your decision is transmitted to Google, and no analytics data is collected without consent. The data is not used for personalised advertising.

Storage period: The cookies _ga, _ga_PDT6EC2NMC and FPID remain stored in your browser for a maximum of two years, and FPLC for a maximum of 20 hours, unless you delete them earlier or withdraw your consent. The event data collected is automatically deleted in Google Analytics after 14 months.

Data processing and transfers to third countries: Data processing agreements pursuant to Art. 28 GDPR have been concluded with Google and with Stape. A transfer of data to the USA to Google LLC or to Stape’s parent company, Stape, Inc., cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, and for transfers within the Stape group, standard contractual clauses apply (Art. 46(2)(c) GDPR).

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent is voluntary; if you decline, you can use the website without restriction. Further information on data protection at Google can be found at policies.google.com/privacy.

9. Ad measurement with Meta (Facebook and Instagram)

If you consent to the “Marketing” category, we transmit information about your visit to Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). This allows us to measure whether our ads on Facebook and Instagram lead to visits and enquiries, to show visitors to our website relevant ads there (audiences) and to let Meta optimise the delivery of our ads.

Only via our server: We do not embed a Meta pixel or any Meta scripts on the website; your browser does not connect to Meta. The data is sent from your browser to our tracking server data.finaure.eu (Stape, see section 8) and from there to Meta via the “Conversions API” interface.

Data processed: pages accessed (address and title), date and time, referrer, your IP address and information about your browser and device (user agent), as well as the following interactions: clicks on “Register” (including the selected plan), the successful submission of a form (contact, partner enquiry, individual enquiry or newsletter, in each case without your entries) and clicks on our email address. Meta needs the IP address and browser information in order to match the data to a Facebook or Instagram account; unlike with Google Analytics, our server therefore does not remove the IP address here. We do not transmit names, email addresses or form contents to Meta. For recognition, our tracking server sets the cookies _fbp (random identifier) and, if you reach us via an ad, _fbc (identifier of the ad click).

Storage period: The cookies _fbp and _fbc remain stored in your browser for a maximum of 90 days unless you delete them earlier or withdraw your consent. We create audiences from website visitors with a maximum duration of 180 days. How long Meta stores the transmitted data is governed by Meta’s terms.

Joint controllership: We and Meta are joint controllers for the collection of the data and its transmission to Meta (Art. 26 GDPR). The details are set out in an agreement with Meta (facebook.com/legal/controller_addendum). Under this agreement, we inform you about the processing; Meta is responsible for requests concerning the data stored by Meta. You may also exercise your rights against us. Meta is solely responsible for any further processing.

Transfers to third countries: Meta also transfers data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); in addition, Meta uses standard contractual clauses (Art. 46(2)(c) GDPR).

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). It is voluntary and independent of your consent to audience measurement; if you decline, you can use the website without restriction. Further information on data protection at Meta can be found at facebook.com/privacy/policy.

10. Links to other websites

Our website contains links to external services, for example to LinkedIn, Instagram or YouTube, and to the Finaure application. These are simple links, not embedded content: data is only transmitted when you click a link. The privacy notices of the respective provider apply to the linked services.

11. Your rights

Under the GDPR, you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An email to info@finaure.eu is sufficient to exercise your rights. No automated decision-making, including profiling (Art. 22 GDPR), takes place on this website.

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit, HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, datenschutz.hessen.de.

13. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in the browser’s address bar.

14. Note on the Finaure application

This policy relates to the website. The use of the Finaure application itself (registration, trial period, subscription) is governed by the separate platform privacy policy; the contractual terms can be found in our terms and conditions. Online banking credentials are processed exclusively by the BaFin-regulated provider finAPI GmbH and are never stored by Finaure.

15. Changes to this policy

We will amend this privacy policy as soon as the data processing on this website changes, for example when new services are used. The version published here applies.

Last updated: October 2026