Data protection policy

Data controller

The GDPR defines the data controller as the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data. Being a data controller therefore involves more than collecting information: it means deciding why this data is collected, how long it is kept, who can access it, and by what means it is protected against loss, alteration or unauthorised access. Lendovia acts in this capacity for all the processing described here: simulation forms, financing applications, and the creation and management of a client area.

This status carries an obligation to demonstrate compliance, known as the accountability principle: the data controller must be able to show, at any time and in particular to the CNIL, that its processing complies with GDPR principles. In practice, this involves keeping a record of processing activities listing each purpose, carrying out impact assessments where the level of risk warrants it, and formalising internal security procedures and processes for handling data subject requests.

This policy applies to all Lendovia's visitors, prospective and existing clients, regardless of the product concerned (personal loan, revolving credit, debt consolidation, borrower insurance). The point of contact for any question relating to data protection is Lendovia's Data Protection Officer (DPO), reachable via the client area, "My data and privacy" section. The DPO is responsible for informing, advising and monitoring compliance with the GDPR within the organisation; they are the natural point of contact with the CNIL as well as with you.

Data collected

The volume of information Lendovia holds about you is not fixed: it grows progressively as you move through your journey, and we never collect data in advance for which we would not yet have a use. This progression illustrates in practice the data minimisation principle set out by the GDPR, under which only data relevant to each step should be collected.

When you visit our credit simulator anonymously, without providing any contact details, we hold no data that directly identifies you: the amounts, terms and rates tested remain simple calculation parameters not linked to a person, except for the technical browsing data described in our cookie policy. As soon as you start a simulation by leaving your contact details to receive a personalised result — first name, email address, phone number — we process data that identifies you, but within a scope limited to what is necessary to contact you again and refine your proposal.

Submitting a complete financing application marks a change of scale: we then collect a much more detailed file, including proof of identity, proof of address, your payslips or tax notices, a bank account statement, details of your recurring expenses (rent, other credits, alimony paid) and, where applicable, documents relating to your project, such as a home-improvement quote or a vehicle purchase order — essential to process your application and assess your repayment capacity. Once the contract is signed, we enrich this file throughout the life of the credit: your client area login details, the history of your instalments and any incidents, exchanges with your advisor, and updated supporting documents in the event of renegotiation.

These categories of data break down as follows:

• Identity data: surname, first name, date and place of birth, marital status, proof of identity where required to verify the application.
• Contact details: postal address, email address, phone number, your client area login details.
• Employment and financial situation: occupation, employer, income, expenses, bank details, credit history where you provide it to us.
• Data entered during a simulation or application: amount requested, repayment term, purpose of the project financed, supporting documents submitted with your application.
• Login data: history of your exchanges with our advisors and your actions in your client area, for application-tracking and security purposes.

Purposes of processing

Your data is processed by Lendovia for five specific purposes, each based on its own legal basis detailed below:

• Assessment and management of financing applications — your data is used to calculate an indicative monthly payment, check the consistency of your situation (income, expenses, contribution), then process your application through to the decision to grant or refuse credit. An advisor — supported where relevant by decision-support tools — analyses your debt ratio and the stability of your income before offering you a suitable offer.
• Administrative and financial management of the signed contract — your data is used to manage the credit on a day-to-day basis: generating repayment schedules, monitoring direct debits, processing requests to defer an instalment, managing payment incidents, or processing an early repayment. If, for example, a direct debit is rejected by your bank, this data allows us to notify you of the incident and offer a solution before it worsens.
• Fraud and over-indebtedness prevention — your data is used to detect anomalies (identity theft, inconsistencies between documents provided, applications submitted simultaneously under different identities) and to verify, before any credit is granted, that you are not already registered with the FICP for a prior incident. This check protects both Lendovia against the risk of default and you against excessive debt.
• Compliance with our legal and regulatory obligations — vigilance regarding anti-money-laundering and counter-terrorist-financing measures, accounting and tax obligations to retain supporting documents, and the duty to respond to requests from competent authorities.
• Commercial prospecting — unless you object, your data may be used, if you are already a client, to inform you of a more advantageous renewal offer or to present you with complementary borrower insurance. This prospecting remains proportionate and never takes place before your initial application has been processed.

We do not process your data for purposes incompatible with these initial purposes, and we limit collection to only the data relevant to each of them, in accordance with the data minimisation principle set out by the GDPR.

Legal bases

Performance of the contract, or pre-contractual steps taken at your request before it is signed (Article 6(1)(b) GDPR), is the basis for the majority of our processing: it allows us to process your simulation, assess your application, and then manage the signed credit — repayment schedules, collection of monthly payments, early repayment or restructuring. Without this legal basis, we simply could not fulfil the mutual commitments the contract places on us and on you.

Legal obligation (Article 6(1)(c)) is the basis for all processing that regulations impose on us regardless of your wishes: verifying your identity and the origin of funds for anti-money-laundering and counter-terrorist-financing purposes, reporting certain atypical transactions to TRACFIN, registering with the FICP in the event of a confirmed incident, or retaining documents for the periods required by the French Monetary and Financial Code or the General Tax Code.

Legitimate interest (Article 6(1)(f)) covers processing we consider necessary for conducting our business, without disproportionately affecting your rights: fraud detection, securing your client area against fraudulent access, and prospecting addressed to our current and former clients regarding products similar to those already taken out. This legal basis requires an ongoing balancing of our interest against yours, and no longer applies as soon as you exercise your right to object.

Consent (Article 6(1)(a)) applies where none of the preceding bases can justify processing — typically for electronic communications sent to prospects not yet in a contractual relationship, or for cookies not strictly necessary for the site to function. It must be freely given, specific, informed and unambiguous; you may withdraw it as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal.

Data recipients

Internally, access to your data is compartmentalised according to the need-to-know principle: sales advisors responsible for assessing applications see the information necessary to review your file (income, expenses, project financed); risk management and fraud prevention teams access the elements necessary to verify your identity and detect anomalies, without necessarily seeing the detail of your commercial exchanges; customer service has an application-tracking-oriented view; collections teams only intervene if a payment incident occurs. Each access is logged and limited to only the data useful for the task performed.

Your data is also passed on to technical processors who act on Lendovia's behalf and according to its written contractual instructions, governed by the safeguards required by the GDPR: confidentiality clauses, security measures, and audit rights. These are typically a hosting provider ensuring secure storage of data within the European Union, an electronic signature provider for contracts signed online, and a letter, email or SMS sending provider for your repayment schedules, reminders or notifications. None of these providers is authorised to reuse your data for its own purposes.

Finally, your data may be passed on to public authorities in cases precisely governed by law: registration with the FICP (the French register of individuals' credit repayment incidents) held by the Banque de France in the event of a confirmed incident on your credit; reporting to TRACFIN, the French financial intelligence unit, where a transaction suggests a risk of money laundering; disclosure to judicial authorities on request or by court order; or transmission to banking and financial sector supervisory authorities as part of their oversight duties.

Transfers outside the European Union

The data processing described in this policy is hosted within the European Union. Should a processor nevertheless process all or part of your data outside the Union — for example as part of international technical support — such a transfer could only take place within a legal framework guaranteeing a level of protection equivalent to that offered by the GDPR.

The mechanism most commonly used for this purpose is the standard contractual clauses (SCCs). These are model contracts drafted and approved by the European Commission, which the data exporter and importer undertake to sign without altering their substance. The Commission designed them to address a concrete difficulty: enabling the international data flows required for economic activity, while imposing precise obligations on the organisation outside the Union — data security, limited access, notification in the event of an access request by a foreign authority, and the data subject's right to act directly against the importer in the event of a breach. These clauses thus recreate, by contractual means, a level of safeguards comparable to that prevailing within the Union, even where the destination country does not benefit from a European Commission adequacy decision.

In the absence of standard contractual clauses, other mechanisms recognised by the GDPR could be used: an adequacy decision, by which the Commission finds that a third country offers a level of protection deemed sufficient, or binding corporate rules within a single group. You may, on request to our Data Protection Officer, obtain information on the safeguards governing a particular transfer.

Your rights

The GDPR grants you seven rights over your personal data, which you may exercise with Lendovia at any time:

• Right of access — you can obtain confirmation that your data is processed by Lendovia and receive a copy of it, along with details of the purposes, categories of data, recipients and associated retention periods. This allows you, for example, to check what remains in your file after a credit has been closed.
• Right to rectification — you can have inaccurate data corrected, such as a misspelled address or an out-of-date number, or have incomplete data completed, for example after a house move or a change in employment situation not yet reflected in your file.
• Right to erasure ("right to be forgotten") — you can request the deletion of your data where its retention is no longer justified, for example if you abandoned your project before signature. It is not absolute: certain data remains due under our legal or accounting obligations, even after such a request.
• Right to restriction — you can, for example while we verify data you are disputing, require that your data be kept without being further used. It then remains stored in our systems, but "frozen", for as long as the restriction remains in force.
• Right to portability — you can retrieve the data you yourself provided to us, in a structured, machine-readable format, in order to transmit it to another organisation, for example as part of a credit buyout elsewhere. It only covers data arising from the contract or your consent, excluding any data we ourselves would have calculated.
• Right to object — you can object, on grounds relating to your particular situation, to processing based on our legitimate interest, and you can object without justification and at any time to processing for commercial prospecting purposes. In the latter case, your request puts an immediate end to all solicitation, without affecting the management of your ongoing financing application.
• Post-mortem directives — you can set directives regarding the fate of your data after your death, either general or specific to Lendovia, in particular designating the person responsible for carrying them out. In the absence of directives, your heirs may, under the conditions set out by the French Data Protection Act ("loi Informatique et Libertés"), exercise certain of your rights to close your accounts or obtain the information needed to settle the estate.

To exercise these rights, you can write to our Data Protection Officer via your client area, "My data and privacy" section, specifying the right you wish to exercise and enclosing proof of identity if necessary. We undertake to respond to you within one month, extendable by two months for complex or numerous requests, with an indication of the reasons for this extension.

Complaints

If, after contacting us, you consider that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), the reference authority for personal data protection.

Before contacting the CNIL, we recommend that you contact us directly: most difficulties are resolved at this stage, particularly where a simple data update or a shorter response time is involved. If, despite this approach, your rights are still not respected, you can lodge a complaint online at cnil.fr, by post, or in person during the CNIL's opening hours.

For your complaint to be handled effectively, it is helpful to prepare in advance the identity of the organisation concerned, a precise description of the facts and the processing being disputed, the dates of any exchanges already had with Lendovia, and any correspondence exchanged with our Data Protection Officer. Once lodged, the CNIL acknowledges receipt of the complaint, examines it and may request further explanations from the organisation in question; depending on the case, it carries out checks, issues recommendations, or initiates enforcement proceedings if a serious breach of the GDPR is found. Lodging a complaint is free of charge and does not deprive you of any other remedy, in particular the possibility of bringing the matter before the competent civil or administrative courts.