Data protection information

Who is responsible for processing my personal data?

FLiP GmbH Gemeinnützige Gesellschaft zur Förderung finanzieller Bildung Am Belvedere 1 1100 Vienna is responsible for processing your data.

Contact for data protection related inquiries:

Erste Social Finance GmbH 3532 3200 Am Belvedere 1 1100 Vienna E-mail:
contact@erstesocialfinance.com

Competent supervisory authority for data protection matters:

Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
https://www.dsb.gv.at/

Who is the data protection officer?

Gregor König is our Data Protection Officer, also known as the Data Protection Officer. If you have any questions, suggestions or complaints regarding the processing of your data, you can contact him and his team at:
Gregor König – Data Protection Officer Erste Group Bank AG Am Belvedere 1 1100 Vienna E-Mail:
datenschutz@erstegroup.com

For what purposes will my personal data be processed?

• Provision and functionality of the website: This includes the temporary storage of data (e.g. IP address, date and time of access, browser type) to enable the delivery of the website, to ensure its functionality and to guarantee the security of the information technology systems (e.g. in server log files).

• Contract fulfillment and pre-contractual measures: If you make an inquiry, place an order or wish to use a service, data is processed in order to fulfill these inquiries or orders (e.g. transmission of information material, processing of inquiries).

• Newsletter dispatch: If you register for a newsletter, your data will be used to send the newsletter.

• Communication: Processing of inquiries via contact forms or by e-mail.

• Statistics and analysis: Recording user behavior to optimize the website .

• Security: Measures to prevent fraud and misuse.

Further information on data processing in connection with the operation of our website can be found in the “Cookies” section.

When you book a visit or contact us, we process the personal data you provide in order to process your request.

What is the legal basis for processing my personal data?

The processing of personal data is permitted under Art. 6 (1) GDPR if at least one of the following legal bases applies:

• a) Consent (Art. 6 para. 1 lit. a GDPR): The data subject has given their voluntary, informed and unambiguous consent to the processing of their personal data for one or more specific purposes. This is often the case when registering for newsletters or using non-essential cookies. Consent can be revoked at any time.
• b) Performance of a contract (Art. 6 para. 1 lit. b GDPR): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Examples of this include processing an order in an online store or responding to a specific service request.
• c) Compliance with a legal obligation (Art. 6 para. 1 lit. c GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject. This may, for example, be statutory retention obligations for business documents.
• d) Protection of vital interests (Art. 6 para. 1 lit. d GDPR)
• e) Performance of a task carried out in the public interest or in the exercise of official authority (Art. 6 para. 1 lit. e GDPR)
• f) Legitimate interests (Art. 6 para. 1 lit. f GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. A careful balancing of interests is necessary here. Examples of this include ensuring IT security, fraud prevention or measuring the reach of a website.

Am I obliged to provide my personal data? What happens if I do not want to?

We rely on your personal data for our business relationship (bookings, answering contact inquiries). If you do not wish this, we may unfortunately not be able to provide certain services. If we only process your data on the basis of your consent, you are not obliged to give this consent and provide the data.

To whom will my personal data be passed on?

Your personal data may be forwarded to:

• Processors commissioned by us and other service providers (controllers), e.g. for IT, back office, legal and tax advice, insofar as they require the data for their task.
• third parties, insofar as this is mandatory for the fulfillment of the contract or legal regulations.
• validation services such as Rundfunk und Telekom Regulierungs-GmbH, if this is necessary to verify an electronic signature or electronic seal transmitted by you
• Trust service providers, e.g. A-Trust, when we electronically sign a document containing your data.

Data may also be passed on to third parties if and for as long as you have consented to this. If you use this website, you can choose the external services yourself – you can find a list of our partners in this regard under Detailed information.

Will my personal data be transferred to a third country?

Your personal data may be transferred to a third country in the following cases:

• If this is necessary in order to assert, exercise or defend legal claims or if there is a legal obligation, e.g. at the request of the authorities under a mutual legal assistance agreement.
• If it is necessary for your contract or for pre-contractual measures.
• Our processors and sub-processors may be located in third countries. If the transfer is not based on an adequacy decision of the European Commission, we transfer the data on the basis of suitable or appropriate guarantees. We will be happy to provide you with these on request.
• In other cases in which data is transferred to a third country, you will be informed separately.

How long will my personal data be stored?

(All links as of September 2024)
Your personal data will be stored for as long as is necessary for the respective purpose, for example if a law prescribes storage. The key legal provisions for us are, for example

• German Commercial Code § 212 (7 years)
• Federal Fiscal Code § 132 (7 years or for the duration of tax proceedings)

An overview of other statutory retention obligations applicable in Austria can be found here, for example:
https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-speicher-und-aufbewahrungsfristen.html
The bank has a legitimate interest in retaining your personal data in the following cases:

• Financing applications can be stored for up to one year after they have been created. This serves our legitimate interest in documenting customer contact and being able to process the application quickly when you come back to us.
• SWIFT messages are stored for 30 years to prevent and combat fraud and to prevent money laundering and terrorist financing.
• Data on receivables sold is retained for 30 years from the date of sale. This serves the bank’s legitimate interest in averting possible objections arising from the sale of receivables.
• Your personal data may also be retained for the purpose of documenting past claims, as a decision-making aid for entering into new or extended customer relationships. Specifically:
  • 7 years in the event of a claim if
    • the amount of loss at the time the case was closed was a maximum of 20,000 euros or
    • there is otherwise no interest in a business relationship due to special circumstances
  • 12 years in the event of a claim if
    • the amount of loss was more than 20,000 euros when the case was closed or
    • insolvency proceedings were opened against your assets during our ongoing business relationship.
  • 30 years in particularly serious exceptional cases after detailed examination of the individual case.

The retention period begins when the claim has been closed, i.e. as soon as there is no longer a debt/claim or insolvency proceedings have been terminated or lifted. In addition, data on past claims must be retained for regulatory purposes, e.g. the data is also used for our model for calculating defaults. However, only a limited group of people have access to this data. It is no longer visible to customer advisors. The data also has no effect on an existing or future business relationship.