Privacy notice

1. Controller and contact

The controller responsible for personal data processing is the operator of Aurea Finance:

For privacy questions and to exercise your rights, contact davide@aureaimpresa.com or write to the postal address above.

Further operator details are in our legal notice.

2. Visiting the website

When you visit, technically necessary connection data is processed, including your IP address, requested page, time, browser and device information, and technical error and security events. This supports delivery of the website, troubleshooting and protection against misuse.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in reliable and secure operation. The website cannot be delivered without the necessary connection data. Vercel provides hosting and delivery.

3. Enquiries, account and financing profile

Contact form and correspondence

We process your name, email address, message and any optional phone and company details to answer your enquiry. We record when you requested contact and confirmed that request. Please do not send identity copies or bank details through the contact form.

Client account

Registration, sign-in, email confirmation and password reset involve your name, email address, credentials, language and technical authentication information. Supabase provides authentication.

Financing profile

The financing check initially processes your entries in your browser, such as company, legal form, German state, trading history, revenue, funding need, project and additional notes. Your profile is transferred to our service when you register with a prepared profile or save it in the client area. A saved draft is not yet a request submitted for review.

Processing supports your enquiry, steps before entering a contract and the services you request under Article 6(1)(b) GDPR where you are the contracting party. If you act for a company or make a general enquiry, we rely on Article 6(1)(f) GDPR: our interest in handling business enquiries and communicating with the relevant representatives.

Required fields are necessary for the relevant function. We cannot reply without contact details or provide an account or complete review without the required account or profile information. Optional fields are marked. Confirming a contact or review request does not subscribe you to marketing emails.

4. Documents and internal review

For a submitted request, you can upload identity documents and requested company and financial documents. We process their contents, filenames, file types, sizes, versions, upload times and review notes, together with processing stages, messages and internal notes about the request. This allows us to identify the relevant person, check completeness and review your project.

You can access your own documents in the client area. Authorised Aurea administrators can access requests and documents to handle them. Files are kept in non-public storage with restricted access. Technical providers may process data when providing and securing these services.

The legal bases described in section 3 apply to this processing. The current review process requires a complete identity document; without it, Aurea cannot complete preparation. This is not a statement that you are generally required by law to give us an identity copy. Please upload only documents needed for your request. Contact Aurea before uploading if you have questions about what is required.

We currently do not share your request or documents with banks, finance providers or referral partners. If such a transfer is proposed later, we will first inform you about the recipient, purpose and legal basis. Disclosures required by law, for example to competent authorities, are unaffected.

The financing check compares your inputs with published product criteria using predefined rules. It does not obtain a credit bureau report or make a binding credit decision. Aurea’s review is carried out by people; this process does not involve a solely automated decision with legal or similarly significant effects.

5. Technical providers and emails

We use the following technical services to operate the website. They do not conduct the substantive financing review:

Vercel

Vercel Inc., USA: hosting, delivery, technical logs and the usage statistics described in section 6. Data processing addendum.

Supabase

Supabase Pte. Ltd., Singapore: authentication, database and protected file storage. Our project is configured in the EU West (Ireland) region. This does not exclude other technical processing outside the EEA. Data processing addendum.

Resend

Plus Five Five, Inc., USA: delivery of transactional emails, processing the recipient address, message content, links and delivery information. Automated request and document notifications link to the client area; uploaded files are not attached. Data processing addendum.

Namecheap Private Email

Namecheap, Inc., USA: our business email mailbox. Direct email correspondence involves senders, recipients, message contents and any attachments you include. Please use the client area for requested documents. Provider privacy information.

Links to product providers or other external websites take you to those providers when clicked. Their own privacy notices apply there. Opening a product link does not automatically send your request stored with Aurea.

6. Usage statistics

We use Vercel Web Analytics to measure public page usage and the steps “financing check started”, “results viewed” and “request submitted”. Data includes page path, time, referring page, approximate geographic region, browser and device type. The only additional property we send for these three events is the interface language.

Form contents, company details, email addresses and documents are not sent as analytics data. Page views in the client area and authentication flows are excluded; a successful submission is counted without a request identifier. Query strings and fragments of the visited URL are removed before transmission.

Vercel uses a hash derived from the incoming connection instead of analytics cookies. Vercel states that visitor identification is discarded after 24 hours; this is not a deletion deadline for all statistics. The statistics provided to Aurea are used for aggregate analysis, not to assess individual customers’ creditworthiness.

The legal basis is Article 6(1)(f) GDPR: our interest in improving the clarity and operation of the service. You may object on grounds relating to your particular situation. Our website also disables analytics when your browser sends an enabled Do Not Track or Global Privacy Control signal.

More about Vercel Web Analytics

7. Cookies and browser storage

The client area uses technically necessary session cookies for authentication. Your selected language is stored locally in the browser so it can be remembered on future visits. After “Save profile & continue”, a prepared financing profile is kept temporarily in the browser tab’s storage; the application offers to restore it for 24 hours. The local draft is removed after successful transfer to your account.

This storage supports the functions you choose. Where information is stored on or read from your device, we rely on section 25(2)(2) TDDDG; the GDPR legal bases described above also apply to personal data. You can delete cookies and website data through your browser. Doing so may remove your sign-in session, language preference and drafts not yet transferred to your account.

8. Processing outside the EEA

Some providers and their subprocessors are based outside the European Economic Area, particularly in the United States and Singapore. Processing or technical access outside the EEA may therefore occur even though the database is located in Ireland.

The linked data processing agreements from Vercel, Supabase and Resend provide, in particular, for European Commission Standard Contractual Clauses for relevant international transfers. They describe the applicable safeguards and subprocessors. You can request information about the safeguards applicable to your data and a copy from us using the contact in section 1.

9. Retention and deletion

Retention depends on the purpose and progress of your enquiry, use of your account and any applicable record-keeping obligations. The relevant criteria are whether the data is still needed for the requested service, outstanding questions or the establishment, exercise or defence of legal claims. Data must be deleted when its purpose has ended and no overriding retention requirement remains.

• Account data and saved requests remain available while you use the client area. Any need to retain data afterwards depends on the criteria above; keeping a request does not by itself justify retaining an identity copy indefinitely.
• Marking a request as completed does not delete the request or its files. Earlier document versions also initially remain in the file after replacement. These status changes do not themselves trigger deletion.
• A profile temporarily saved during registration can be transferred to your account within 24 hours. The temporary copy is deleted after successful transfer. Expired registration drafts can no longer be transferred and are deleted through technical cleanup; the 24-hour period is the transfer window.
• Technical logs and delivery information are retained according to troubleshooting, security and evidence-of-delivery needs. Providers’ storage and backup cycles may delay removal of copies.

To request deletion of your account, request or particular documents, email davide@aureaimpresa.com. We will assess the scope and tell you if any data must be retained for legal reasons.

10. Your rights

Subject to the conditions in the GDPR, you have the following rights:

• Access to your personal data and a copy (Article 15).
• Correction of inaccurate data and completion of incomplete data (Article 16).
• Erasure and restriction of processing (Articles 17 and 18).
• Portability of data you provided where processing is automated and based on consent or a contract (Article 20).
• Objection to processing based on legitimate interests on grounds relating to your particular situation (Article 21). You may object to direct marketing at any time.
• Withdrawal of any consent you have given, with effect for the future. Earlier processing remains lawful to the extent it was lawful before withdrawal.

Use the contact in section 1. A proportionate identity check may be needed to locate and protect your data. Please do not send additional identity copies unless requested.

You may also complain to a data protection supervisory authority, particularly where you usually live, work or where you believe an infringement occurred. The authority for the region where our operator is based is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information: LDI NRW — contact and complaints.