Política de privacidad

Effective date: 1 January 2025  |  Last updated: 1 October 2026

1. About This Policy

Egrigo Finance ("we", "us", "our", "the Company") is a licensed financial services provider operating in the European Economic Area. We are committed to protecting your personal data and your right to privacy under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and all applicable national implementing legislation.

This Privacy Policy explains:

• What personal data we collect and why
• The legal basis on which we process it
• How long we keep it
• Your rights under GDPR
• How to contact us and our Data Protection Officer

Please read this policy carefully. By using our platform or applying for a loan product, you confirm that you have read and understood it.

2. Data Controller

The data controller responsible for your personal data is Egrigo Finance. You can contact us at:

• Email: privacy@egrigo.com
• Website: egrigo.com/contact

3. Personal Data We Collect

We collect and process the following categories of personal data:

a) Identity & Contact Data

• Full name, date of birth, nationality
• Government-issued ID number (passport, national identity card, driver's licence)
• Email address, telephone number, residential and correspondence address

b) Financial Data

• Gross and net income, employment status, employer name and address
• Monthly expenses, existing liabilities and credit commitments
• Bank account details (sort code, account number, IBAN) for disbursement and repayments
• Credit history obtained from credit reference agencies

c) Application & Loan Data

• Loan purpose, product type, requested amount and term
• Application status, loan agreement, repayment schedule
• Documents uploaded during KYC (Know Your Customer) verification

d) Technical & Usage Data

• IP address, device identifiers, browser type and version
• Pages visited, time spent on Platform, referral URLs
• Cookie identifiers (see our Cookie Policy)

e) Communications Data

• Records of messages sent through our platform or by email
• Contact form submissions and support requests
• Notification preferences

f) Special Category Data

We do not intentionally collect special category data (health data, biometric data, political opinions, etc.). If you voluntarily provide any such information, we will handle it in accordance with Article 9 GDPR.

4. How We Collect Your Data

• Directly from you — when you register, complete your profile, or apply for a loan
• Automatically — through cookies and analytics tools when you use our Platform
• Third parties — credit reference agencies, fraud prevention databases, identity verification providers

5. Legal Basis for Processing

Under GDPR Article 6, we process your data on the following legal bases:

6. How We Use Your Data

• Evaluate and process loan applications and make credit decisions
• Verify your identity and prevent fraud, money laundering, and terrorist financing
• Set up and manage your loan account, schedule repayments, and issue statements
• Communicate with you about your account, repayment status, and important notices
• Comply with regulatory obligations including AML, tax reporting, and supervisory requests
• Improve our products, platform, and customer experience
• Defend against legal claims and enforce our contractual rights

7. Sharing Your Data

We do not sell your personal data. We may share it with the following categories of recipients, all of whom are bound by appropriate data protection agreements:

• Credit reference agencies — to assess creditworthiness (they may retain a record of our search)
• Fraud prevention agencies — to detect and prevent fraud and financial crime
• Identity verification providers — for KYC purposes
• Banking and payment partners — to process disbursements and repayments
• Technology service providers — cloud hosting, email delivery, analytics (acting as data processors)
• Regulatory and law enforcement authorities — where required by law or court order
• Professional advisors — legal, accounting, auditing (under strict confidentiality obligations)

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions. You may request details of specific safeguards by contacting us.

9. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including:

• Active accounts: for the full duration of our relationship
• Closed loan accounts: minimum 7 years after the end of the relationship, in line with financial services regulations and AML requirements
• Unsuccessful applications: 2 years from the date of decision
• Marketing data: until you withdraw consent or opt out

After the applicable retention period, data is securely deleted or anonymised.

10. Your Rights Under GDPR

You have the following rights in relation to your personal data:

• Right of access — obtain a copy of the data we hold about you (Article 15)
• Right to rectification — correct inaccurate or incomplete data (Article 16)
• Right to erasure — request deletion in certain circumstances (Article 17)
• Right to restriction — limit processing in certain circumstances (Article 18)
• Right to data portability — receive your data in a structured, machine-readable format (Article 20)
• Right to object — to processing based on legitimate interest or direct marketing (Article 21)
• Right to withdraw consent — at any time for consent-based processing, without affecting prior processing
• Right to lodge a complaint — with your national supervisory authority

To exercise any of these rights, contact us at privacy@egrigo.com. We will respond within one month as required by GDPR Article 12.

11. Automated Decision-Making

We may use automated processes in our credit assessment. Where a decision is made solely by automated means and has a significant effect on you (such as declining a loan application), you have the right to request human review, express your point of view, and contest the decision. Contact us to exercise this right.

12. Security of Your Data

We implement appropriate technical and organisational security measures including:

• 256-bit SSL/TLS encryption for all data in transit
• Encryption of sensitive data at rest
• Strict access controls — staff access data on a need-to-know basis only
• Regular security audits and penetration testing
• Incident response procedures in compliance with GDPR Article 33 (72-hour breach notification)

13. Anti-Phishing & Fraud Warning

14. Cookies

We use cookies and similar tracking technologies. Please see our Cookie Policy for full details and how to manage your preferences.

15. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email to registered users at least 30 days before they take effect. The current version is always available at egrigo.com/privacy.

16. Contact & Supervisory Authority

Data Protection Officer: privacy@egrigo.com

If you are unsatisfied with our response to a data protection concern, you have the right to lodge a complaint with your national supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.

This Privacy Policy was last updated on 1 October 2026. Egrigo Finance recommends all users review this policy periodically. The content of this page does not constitute legal advice. Please consult a qualified legal professional for advice specific to your situation.