Privacy policy

Data controller

BMT FINANCES, SAS with share capital of 1 161 216,00 €, registered with the 312 425 556 R.C.S. Paris.

For any questions about data protection: info@bmt-finanziamento.com.

Data collected

• Identification and contact data: first name, surname, email, phone, address, date of birth.
• Financial and professional data: employment status, income, outgoings, existing loans; for businesses, company and financial data.
• Supporting documents uploaded to the customer area.
• Connection and security data: IP address, date and time, log of sensitive actions.
• Cookie preferences.

We do not collect special categories of data (Art. 9 GDPR).

Purposes and legal bases

• Review of the loan application and creditworthiness assessment: pre-contractual measures (Art. 6.1.b) and legal obligations (Art. 6.1.c).
• Management of the account and the contractual relationship: performance of the contract (Art. 6.1.b).
• Anti-money laundering and fraud prevention: legal obligations (Art. 6.1.c) and legitimate interest (Art. 6.1.f).
• Replying to messages: pre-contractual measures or legitimate interest.
• Website security: legitimate interest.
• Marketing communications and optional cookies: consent (Art. 6.1.a), which may be withdrawn at any time.

Automated decisions

Loan applications are always reviewed by an adviser: we do not take decisions based solely on automated processing that produce legal effects concerning you.

Recipients

• Authorised staff of BMT FINANCES, within the limits of their duties.
• Technical service providers acting as processors (hosting: Namecheap, Inc.; email delivery).
• Where provided for by law and after specific notice, credit reference systems.
• Administrative and judicial authorities, upon lawful request.

Your data is never sold.

Transfers outside the European Union

Some providers (hosting, measurement tools if accepted) may process data outside the European Union. In such cases, transfers are governed by an adequacy decision of the European Commission (e.g. EU-US Data Privacy Framework) or by standard contractual clauses.

Retention period

• Applications not concluded: 36 months from the last contact.
• Credit agreements: for the duration of the agreement and 10 years after its termination (accounting and anti-money laundering obligations).
• Customer account: until deletion, subject to retention obligations.
• Contact messages: 3 years.
• Security logs: 12 months.
• Cookie consent: 13 months.

Security

We apply appropriate technical and organisational measures: encrypted connection, passwords protected with robust hashing algorithms, two-factor authentication available, documents stored outside the public space, access control and a log of sensitive operations.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time.

You can exercise these rights from the customer area (data download, deletion request) or by writing to info@bmt-finanziamento.com. We will respond within one month.

You also have the right to lodge a complaint with the supervisory authority: the CNIL (France, lead authority), the Garante per la protezione dei dati personali (Italy) or the authority of your country of residence.

Changes

We may update this policy. The date of the last update is shown at the bottom of the page.