Privacy Policy

1. Data Controller

The data controller responsible for your personal data is FINIUM TECHNOLOGIES S.L., CALLE GREMI DE SABATERS, 21, 07009 Palma de Mallorca, Spain, Tax ID ESB56799265. Contact email: contact@finiumlegal.com.

2. Personal Data We Collect

We may collect account information, communications, support requests, technical data, usage data, and materials you provide in connection with product use, onboarding, or inquiry handling.

3. Legal Basis for Processing

We process personal data on the basis of contract performance, consent where applicable, legitimate interests, and legal obligations under GDPR.

4. Business Outreach

We may collect publicly available professional contact details, such as name, role, business email address, firm name and publicly available professional information, from company websites, professional directories and other public business sources. We use this information to contact relevant organisations and professionals about Finium’s services and to understand market needs. We rely on our legitimate interests in developing relevant business relationships, subject to an assessment of individuals’ rights and expectations. You may object to this processing or request that we stop contacting you at any time by emailing contact@finiumlegal.com or replying “stop” to an outreach email. We maintain a minimal suppression record where necessary to honour such requests.

5. How We Use Your Personal Data

We use personal data to provide and improve the website and services, manage accounts, support case preparation workflows, respond to inquiries, maintain security, and comply with legal obligations.

6. Data Sharing and Disclosure

We may share personal data with service providers, legal or professional advisors where relevant and authorized, and competent authorities where required by law. Our current service providers are listed in the Subprocessors section below.

7. Subprocessors

We use the following categories of service providers ("subprocessors") to help operate our website and services. A living, up-to-date version of this list is maintained on our Trust Center.

• Render – hosting infrastructure (Frankfurt, EU)
• Microsoft Azure – data storage and AI-supported processing (EU regions)
• Scraper.Tech – platform data collection
• Google – YouTube Data API and Programmable Search
• Resend Inc. – email delivery; may process data in the United States under Standard Contractual Clauses (we are working to confirm EU-region processing)
• Slack – internal operational alerts (no client content is shared)
• Sprinto – compliance management
• Plausible – cookieless website analytics (EU)

8. Email Notifications

We send account-related emails, including weekly digests and incident alert emails, on the basis of contract performance and legitimate interest. Every such email includes an unsubscribe link, and notification preferences can be managed in your account settings.

9. International Data Transfers

Where personal data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, subject to contractual, operational, and legal retention requirements. A summary schedule:

• Account data: retained for the life of the account plus any applicable statutory retention period
• Monitoring and incident data, including evidence records: retained per client instruction and case needs
• Email delivery logs: retained for 12 months

The detailed internal retention schedule is maintained by our compliance program and available on request.

11. Your Rights Under GDPR

Under GDPR, you may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent where applicable, and the right to lodge a complaint with a supervisory authority.

12. Data Security

We implement appropriate technical and organizational measures to protect personal data, including controls related to transport, storage, access, scheduled monitoring, and internal review processes.

13. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the website, understand usage, and improve performance. For details on the specific cookies and storage we use, see our Cookie Policy.

14. Children’s Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.

15. Automated Decision-Making

We may use AI-supported tools to help sort, cluster, and highlight potentially relevant incident materials. These tools are intended to support human review and case preparation. We do not rely on solely automated decision-making that produces legal effects on you without human involvement.

16. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those external sites.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes may be communicated by email or prominent notice on the website.

18. Supervisory Authority

If you have concerns about how we process your personal data, you may lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es.

19. Data Subject Access Requests

To exercise your data protection rights, send a request to contact@finiumlegal.com. We may ask you to verify your identity before processing the request, and we will respond within 30 days as required by GDPR Article 12(3).