GDPR Compliance

When you use the platform to process personal data, you are typically the controller and Fininvo is your processor. We process personal data only on your documented instructions, as set out in the Data Processing Agreement, which applies automatically to every customer. For our own limited processing (billing, account administration, security telemetry and our marketing website), we act as controller, as described in the Privacy Policy.

Where we are your processor, direct requests to your organisation (the controller); we support their response with in-product tools and, where needed, direct assistance. Where we are controller, email privacy@fininvo.com; we respond within one month, extendable as the GDPR permits for complex requests.

• Tools to access, correct, export and delete personal data within the platform.
• A Data Processing Agreement with full GDPR Article 28 processor commitments and Annexes.
• Assistance with data subject requests, DPIAs and prior consultations (DPA Sections 9 and 10).
• Personal data breach notification without undue delay, and within 72 hours (DPA Section 11).
• A published list of sub-processors with entity, purpose, location and a 30 day change notice mechanism.
• Documented technical and organisational measures (DPA Annex II and the Security page) to support your records of processing.

Cross-border transfers from the EU or UK are protected by the Standard Contractual Clauses (Module Two or Three, as applicable) and the UK International Data Transfer Addendum, incorporated by reference in the DPA with the selections stated there, together with technical safeguards including encryption in transit and at rest. We assess transfer risk for the destinations involved and apply supplementary measures where needed.

We are an India-based company. Where Article 27 of the GDPR or UK GDPR requires a local representative for our controller processing, contact eu-rep@fininvo.com and we will provide the current representative details for your region, or respond directly where no appointment is required. This mailbox is monitored by our data protection team.

You always have the right to lodge a complaint with your local data protection supervisory authority (for example, the CNIL in France, the ICO in the United Kingdom, or your member state authority). We would, however, appreciate the chance to address your concern first at dpo@fininvo.com.