Last Updated: September 7, 2025

Finauthority respects your privacy and is committed to protecting personal data in a transparent, responsible and secure manner.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit Finauthority.org, create an account, submit or claim a company profile, write a review, provide supporting evidence, contact us, request a correction or otherwise interact with Finauthority.

It also explains the rights available to you in relation to your personal data.

Finauthority is an international financial company directory, research and review platform operated from the Czech Republic and intended for users and companies around the world.

We recognize that our work may involve information concerning financial transactions, complaints, company representatives and supporting documentation. We therefore aim to collect only information that is reasonably necessary for a legitimate purpose and to apply additional care where submitted materials may contain sensitive information.

Please read this Privacy Policy carefully.

1. Who We Are

The data controller responsible for the processing described in this Privacy Policy is:

Legal entity: FinAuthority

Registered office: Národní 135/14, Prague, Hlavní mesto Praha 110 00, Czech Republic

Country of registration: Czech Republic

General enquiries: kancelar@finauthority.org

Privacy enquiries: privacy@finauthority.org

Legal enquiries: legal@finauthority.org

Company Review & Verification: check@finauthority.org

In this Privacy Policy, references to “Finauthority”, “we”, “us” or “our” mean FinAuthority.

For purposes of the General Data Protection Regulation (“GDPR”), Finauthority generally acts as the data controller for personal data processed in connection with the Platform.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through or in connection with:

• Finauthority.org;
• user accounts;
• company profiles;
• company claiming and verification procedures;
• user reviews and ratings;
• evidence submitted in support of reviews;
• company responses;
• correction and complaint procedures;
• contact forms;
• regulatory and company research;
• newsletters and communications;
• security and fraud-prevention systems;
• future paid services, where applicable; and
• other services directly operated by Finauthority.

This Policy does not govern the privacy practices of third-party websites, financial companies, regulators, social networks or other external services linked from Finauthority.

3. Our Data Protection Principles

We seek to process personal data in accordance with the following principles.

Lawfulness, Fairness and Transparency

We process personal data only where we have an appropriate legal basis and aim to explain our processing clearly.

Purpose Limitation

We collect personal data for specified and legitimate purposes and do not use it for incompatible purposes without an appropriate legal basis.

Data Minimization

We seek to collect only the information reasonably necessary for the relevant purpose.

Accuracy

We take reasonable steps to maintain accurate personal data and provide mechanisms through which inaccurate information may be challenged or corrected.

Storage Limitation

We do not intend to retain personal data indefinitely where it is no longer necessary.

Security and Confidentiality

We apply appropriate technical and organizational safeguards based on the nature and risks of the processing.

Accountability

We seek to maintain appropriate records and procedures to demonstrate compliance with applicable data protection law.

4. What Is Personal Data?

“Personal data” means information relating to an identified or identifiable natural person.

Depending on the circumstances, this may include:

• name;
• email address;
• telephone number;
• IP address;
• account identifier;
• professional position;
• company affiliation;
• correspondence;
• transaction information;
• photographs;
• online identifiers;
• review history;
• technical information;
• documents; and
• combinations of information that can identify an individual.

Information about a legal entity is not necessarily personal data.

However, information identifying directors, employees, representatives, beneficial owners, customers or other individuals associated with a company may constitute personal data.

5. Personal Data We May Collect

The personal data we collect depends on how you interact with Finauthority.

5.1 Website Visitor Information

When you visit Finauthority, certain technical information may be collected automatically.

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• approximate geographic location derived from IP address;
• referral source;
• pages viewed;
• date and time of access;
• session identifiers;
• language settings;
• interaction information;
• error logs;
• security logs; and
• cookie or similar identifiers.

We use this information primarily to operate, secure, analyze and improve the Platform.

6. Account Registration Information

If you create a Finauthority account, we may collect:

• your name;
• username;
• email address;
• password in protected or hashed form;
• account role;
• profile information;
• company affiliation;
• account creation date;
• login history;
• authentication information;
• account preferences; and
• information relating to account security.

We do not have access to your password in plain text where appropriate technical password-security measures are used.

You are responsible for keeping your account credentials confidential.

7. Company Representative Information

If you create, manage or claim a company profile, we may collect information such as:

• your name;
• professional position;
• company affiliation;
• business email address;
• business telephone number;
• professional profile;
• authority to represent the company;
• corporate documentation;
• verification information;
• correspondence with Finauthority; and
• records relating to profile management.

We may take reasonable steps to verify that an individual claiming a company profile is legitimately connected to that company.

Questions or requests concerning the assessment or verification of a financial brand may be sent to check@finauthority.org.

8. Company Claim Verification

To prevent unauthorized individuals from controlling company profiles, Finauthority may use verification procedures.

Depending on the circumstances, verification may involve:

• confirmation through an official corporate email domain;
• confirmation through company contact information;
• corporate registration documents;
• authorization documents;
• confirmation from another authorized company representative;
• information appearing in official public registers; or
• other reasonable methods.

We will seek to avoid collecting identity documents unless they are reasonably necessary.

If identity documentation is requested, we may ask you to redact information that is not required for the verification.

Verification of a representative’s identity or authority does not mean that Finauthority endorses or certifies the financial company they represent.

9. Reviews and Ratings

When you submit a review, we may process:

• your account information;
• rating;
• review text;
• company reviewed;
• date of submission;
• information about your claimed experience;
• technical information associated with the submission;
• moderation history;
• communications relating to the review;
• verification status; and
• supporting evidence, where applicable.

We may also use technical or behavioral signals to identify suspected spam, duplicate accounts, coordinated review activity or other attempts to manipulate ratings.

10. Evidence Submitted With Reviews

Finauthority is designed to encourage evidence-based financial reviews rather than unsupported or fabricated allegations.

For this reason, we may allow or request users to provide supporting evidence where a review contains material factual claims.

Evidence may include, depending on the circumstances:

• correspondence with a company;
• account communications;
• transaction confirmations;
• deposit records;
• withdrawal requests;
• payment confirmations;
• screenshots;
• contracts;
• account notices;
• complaint correspondence;
• regulatory correspondence; or
• other documents relevant to the claimed experience.

Supporting evidence is not automatically public.

Unless clearly stated otherwise, documents submitted as evidence are intended primarily for verification and moderation purposes.

Finauthority does not intend to publish bank statements, identification documents, private correspondence or other supporting documents in full merely because they have been submitted as evidence.

11. Please Redact Sensitive Information Before Uploading Evidence

Before submitting supporting documents, users should remove or obscure information that is not necessary to establish the relevant facts.

In particular, please do not submit unnecessarily:

• full payment card numbers;
• card security codes;
• online banking passwords;
• account passwords;
• authentication codes;
• cryptocurrency private keys;
• cryptocurrency seed phrases;
• security questions or answers;
• complete government identification numbers;
• personal data concerning unrelated third parties;
• complete bank account credentials; or
• other information that could enable unauthorized access to financial assets or accounts.

Finauthority will never need your password, cryptocurrency private key or seed phrase to verify a review.

If anyone claiming to represent Finauthority requests such information, you should not provide it and should contact us immediately at privacy@finauthority.org or legal@finauthority.org.

12. How We Handle Review Evidence

Access to evidence submitted for review verification should be limited to persons who reasonably need access for purposes such as:

• verifying a review;
• investigating suspected review manipulation;
• resolving a dispute;
• assessing a correction request;
• responding to a legal claim;
• ensuring Platform integrity; or
• complying with applicable law.

Where practical, we may:

• redact unnecessary personal information;
• restrict document access;
• separate evidence from publicly displayed review content;
• record the outcome of verification without publicly displaying the underlying document; or
• delete evidence when it is no longer reasonably required.

A label such as Evidence Reviewed means that Finauthority reviewed information relevant to the review.

It does not necessarily mean that every statement made by the reviewer has been independently established as fact.

13. Sensitive Personal Data

Finauthority generally does not need special categories of personal data to operate its Platform.

These may include information revealing or concerning:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric identification data;
• health information; or
• information concerning a person’s sex life or sexual orientation.

Users should avoid submitting such information unless it is genuinely necessary and lawful to do so.

If special-category information is included incidentally in evidence, we may redact, restrict, delete or otherwise minimize the information.

Where processing of special-category data is genuinely necessary, we will do so only where an appropriate condition under applicable law is available, such as explicit consent, establishment or defence of legal claims, or another legally recognized basis.

14. Information Concerning Criminal Allegations

Reviews or documents may occasionally contain allegations concerning fraud, theft or other potentially criminal behavior.

Finauthority does not encourage users to submit unnecessary personal information concerning alleged criminal activity by identifiable natural persons.

Where such information is submitted, we may assess whether retaining, publishing or otherwise processing the information is lawful, necessary and proportionate.

We may redact personal information, restrict publication or request additional evidence where appropriate.

Finauthority does not determine criminal guilt.

A user’s allegation does not constitute a judicial finding.

15. Information You Send to Us

If you contact Finauthority, we may process:

• your name;
• email address;
• telephone number, if supplied;
• organization;
• message;
• attachments;
• correspondence history;
• complaint or request details; and
• information necessary to respond.

This includes communications relating to:

• general enquiries;
• company profile corrections;
• company review and verification requests;
• regulatory information;
• complaints;
• rights of reply;
• privacy requests;
• legal notices;
• copyright requests;
• review disputes;
• partnerships; and
• media enquiries.

Relevant contact addresses include:

General enquiries: kancelar@finauthority.org
Privacy enquiries: privacy@finauthority.org
Legal enquiries: legal@finauthority.org
Company Review & Verification: check@finauthority.org

16. Corrections, Complaints and Rights of Reply

When someone asks us to correct or investigate information, we may process personal data necessary to evaluate the request.

This may include:

• identity and contact details;
• relationship to the affected company;
• disputed information;
• supporting documents;
• correspondence;
• evidence;
• previous versions of relevant content; and
• records of our decision.

We may retain an appropriate record of significant corrections or disputes in order to maintain editorial accountability and to establish how a decision was reached.

17. Information Obtained From Public Sources

Finauthority conducts independent research into financial companies and brands.

This means we may obtain professional or business-related personal data from publicly accessible sources.

Sources may include:

• financial regulator registers;
• government databases;
• corporate registers;
• company websites;
• official company disclosures;
• professional profiles;
• court or administrative records where lawfully accessible;
• regulatory warnings;
• press releases;
• public documents;
• archived website information;
• official social media accounts;
• credible publications; and
• other legitimate public sources.

Information may concern, for example:

• company directors;
• officers;
• founders;
• authorized representatives;
• beneficial owners where legally public;
• regulated persons;
• responsible managers; or
• other individuals whose professional role is relevant to understanding a financial company.

We do not treat the fact that information is publicly accessible as permission to use it without limitation.

We assess processing according to applicable data protection law, the nature of the information, the context in which it was made public, the relevance to our research and the legitimate interests involved.

18. Information Received From Third Parties

We may also receive information from:

• financial companies;
• authorized company representatives;
• users;
• regulators;
• public authorities;
• professional advisers;
• service providers;
• complainants;
• correspondents; or
• other persons providing legitimate information to Finauthority.

When personal data is obtained from a source other than the individual concerned, we will provide information required by applicable law where necessary, subject to applicable exceptions.

19. Why We Process Personal Data

Depending on the circumstances, Finauthority may process personal data for the following purposes.

Operating the Platform

To provide access to Finauthority, accounts, company listings and Platform features.

Managing Accounts

To register users, authenticate access and maintain account security.

Maintaining Company Profiles

To create, verify, update and manage company listings.

Conducting Research

To research financial companies, legal entities, regulatory status, ownership, warnings and other relevant information.

Publishing Information

To provide users with useful and structured information about financial companies.

Managing Reviews

To receive, publish, moderate and organize user reviews and ratings.

Verifying Review Authenticity

To assess whether reviews appear to originate from genuine experiences and to reduce manipulated, fabricated or coordinated reviews.

Reviewing Evidence

To assess documents and information submitted to support material claims.

Allowing Company Responses

To enable companies to respond to user reviews or research findings.

Handling Corrections and Disputes

To investigate inaccuracies, correction requests, complaints and rights of reply.

Preventing Abuse

To identify spam, account abuse, security threats, rating manipulation and fraud.

Communicating With Users

To respond to enquiries, notifications and service-related communications.

Improving Finauthority

To understand how the Platform is used and improve functionality, content and user experience.

Complying With Legal Obligations

To respond to lawful requests, comply with accounting or regulatory obligations and protect legal rights.

Establishing or Defending Legal Claims

To preserve information reasonably necessary to establish, exercise or defend legal rights.

20. Legal Bases for Processing

Under the GDPR, personal data must be processed on an appropriate legal basis.

Depending on the activity, we may rely on one or more of the following.

Performance of a Contract

We may process data where necessary to provide a service requested by you or perform our contractual relationship with you.

Examples include:

• creating and maintaining your account;
• providing profile management features;
• processing requested Platform services; and
• administering paid services, if introduced.

Legitimate Interests

We may process personal data where necessary for legitimate interests pursued by Finauthority or another party, provided those interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests may include:

• operating a trustworthy financial information platform;
• researching financial companies;
• maintaining accurate company profiles;
• providing transparency concerning financial services;
• verifying regulatory claims;
• preventing misleading or manipulated reviews;
• investigating suspected abuse;
• securing our Platform;
• defending editorial independence;
• responding to disputes;
• maintaining records concerning corrections;
• improving our services; and
• establishing or defending legal claims.

Where required, we assess the nature of the data, reasonable expectations of individuals and potential impact on privacy.

Consent

We may rely on your consent where appropriate.

Examples may include:

• optional marketing communications;
• certain non-essential cookies;
• specific voluntary processing activities; or
• processing particular information where consent is the appropriate legal basis.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal Obligation

We may process personal data where necessary to comply with applicable law, court orders or legally binding requirements.

Legal Claims

Where permitted by applicable law, information may be processed where necessary for the establishment, exercise or defence of legal claims.

This can be particularly relevant where evidence, complaints or disputed publications must be preserved.

21. Public Company Profiles and Personal Data

Some personal data may appear publicly on Finauthority where it is genuinely relevant to a company’s identity, management or regulatory context.

Examples may include:

• name of a director;
• professional title;
• authorized representative;
• founder;
• responsible regulated person;
• official company contact;
• professional affiliation; or
• information appearing in an official regulator or corporate registry.

We seek to avoid publishing unnecessary private contact information about individuals.

Where possible and appropriate, business contact information is preferred over private contact information.

Individuals may contact us if they believe personal information appearing in a company profile is inaccurate, excessive, outdated or unlawfully published.

We will assess requests in light of applicable data protection law as well as legitimate interests relating to accuracy, transparency, freedom of expression and information, and the public nature of relevant professional roles.

22. Public Reviews

Where you submit a review for publication, certain information may become publicly visible.

Depending on Platform settings, this may include:

• display name or username;
• rating;
• review;
• date;
• company reviewed;
• verification labels; and
• subsequent edits or company responses.

We recommend that reviewers avoid publishing:

• home addresses;
• private telephone numbers;
• identification numbers;
• full account numbers;
• card details;
• passwords;
• unnecessary information about third parties; or
• any other information they do not wish to make public.

Supporting evidence is treated separately from the public review unless we explicitly agree otherwise.

23. Company Responses

Responses posted by company representatives may be publicly displayed.

A representative’s name or professional role may also be displayed where appropriate.

Company representatives should not disclose private information about reviewers in public responses.

For example, a company should not publicly disclose:

• a reviewer’s home address;
• full financial account details;
• identity document numbers;
• payment card details;
• private correspondence unrelated to the dispute; or
• other unnecessary personal information.

Finauthority may redact or remove such information.

24. Cookies and Similar Technologies

Finauthority may use cookies and similar technologies for purposes including:

• essential website functionality;
• authentication;
• account security;
• remembering preferences;
• fraud prevention;
• analytics;
• performance monitoring; and
• other purposes permitted by law.

Where legally required, non-essential cookies will not be activated until the appropriate consent has been obtained.

Users should be provided with appropriate controls to:

• accept optional cookies;
• reject optional cookies;
• manage cookie preferences; and
• withdraw consent.

Further information is provided in our separate Cookie Policy.

25. Analytics and Platform Measurement

We may use analytics tools to understand how users interact with Finauthority.

Depending on the configuration used, information may include:

• pages visited;
• session duration;
• navigation patterns;
• device information;
• browser information;
• approximate location;
• referral source; and
• technical performance information.

Where analytics requires consent under applicable law, it will be activated only after appropriate consent.

We seek to configure analytics in a privacy-conscious manner and avoid collecting information that is unnecessary for legitimate measurement purposes.

26. Marketing Communications

Finauthority may offer newsletters, regulatory updates, research alerts or other communications.

Where required by law, we will send electronic marketing only after obtaining appropriate consent.

Where applicable law permits communications on another basis, recipients will still be provided with an appropriate method to opt out.

You may unsubscribe from marketing communications at any time.

Service messages relating to matters such as:

• account security;
• profile changes;
• review moderation;
• correction requests;
• legal notices; or
• essential Platform operations

are not necessarily considered marketing communications.

27. Payments

If Finauthority introduces paid services, we may process information necessary for:

• billing;
• subscription management;
• invoices;
• refunds;
• fraud prevention;
• accounting; and
• compliance with tax obligations.

Payment card details may be processed directly by an authorized third-party payment service provider rather than stored by Finauthority.

Where possible, Finauthority will avoid storing complete payment card data.

Specific payment providers and additional processing information may be disclosed when paid services are implemented.

28. Service Providers

Finauthority may use carefully selected service providers to help operate the Platform.

These may include providers of:

• website hosting;
• cloud infrastructure;
• content delivery;
• data storage;
• cybersecurity;
• backups;
• email delivery;
• authentication;
• customer support;
• analytics;
• anti-spam services;
• review fraud detection;
• payment processing;
• accounting;
• professional advisory services; and
• technical maintenance.

Where these providers process personal data on our behalf, we seek to put appropriate contractual and data-protection arrangements in place.

Service providers should only process personal data in accordance with applicable instructions and legal requirements.

29. When We May Share Personal Data

We do not disclose personal data indiscriminately.

Personal data may be disclosed where reasonably necessary to:

Service Providers

Organizations supporting operation of Finauthority may receive limited data necessary for their services.

Professional Advisers

Lawyers, accountants, auditors, security consultants or other professional advisers may receive information where reasonably necessary.

Courts and Authorities

We may disclose information in response to valid legal requirements, court orders or requests from competent authorities where legally required.

Protection of Rights

Information may be disclosed where necessary and lawful to protect the rights, safety or security of Finauthority, our users or others.

Corporate Transactions

If Finauthority undergoes a legitimate merger, acquisition, restructuring, investment or sale, personal data may form part of the transaction subject to appropriate safeguards.

With Your Instruction or Consent

Information may also be shared where you specifically request or authorize us to do so.

30. Disclosure of Review Evidence to Companies

Submitting evidence to Finauthority does not automatically mean that the underlying documents will be provided to the company being reviewed.

When a company disputes a review, Finauthority may communicate sufficient information to allow a meaningful response while seeking to protect unnecessary personal data.

Depending on the circumstances, we may:

• summarize the relevant evidence;
• confirm that evidence was reviewed;
• disclose a redacted portion;
• request the reviewer’s permission for additional disclosure; or
• withhold documents where disclosure would be inappropriate.

However, disclosure may sometimes be necessary where required by law, court proceedings or the establishment, exercise or defence of legal claims.

Users should therefore avoid submitting information that is irrelevant or unnecessarily sensitive.

31. We Do Not Sell Review Evidence

Finauthority does not sell documents or supporting evidence submitted by users for review verification.

Such materials are not intended to be made available to advertisers or sold as commercial databases.

We do not permit a company to purchase access to private supporting evidence merely because the company has a paid, sponsored or claimed profile.

32. Advertising and Personal Data

If Finauthority introduces advertising or affiliate relationships, commercial arrangements will be handled separately from our independent editorial and regulatory assessments.

We do not intend to allow advertisers to purchase:

• access to private review evidence;
• private complaint documentation;
• confidential account information; or
• the identity of anonymous reviewers merely because they are advertisers.

If future advertising technologies involve additional processing of personal data, this Privacy Policy and our cookie controls will be updated as appropriate before or when such processing is introduced.

33. International Data Transfers

Finauthority is operated from the European Union but is intended to serve users and companies internationally.

Some service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data subject to GDPR is transferred outside the EEA, we will seek to ensure that an appropriate transfer mechanism is available.

Depending on the destination and recipient, this may include:

• a European Commission adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules where applicable;
• another legally recognized transfer mechanism; or
• a specific derogation permitted by applicable law in exceptional circumstances.

Where necessary, we may also assess additional safeguards relating to international transfers.

Information about applicable safeguards may be requested through privacy@finauthority.org.

34. How Long We Keep Personal Data

We do not intend to retain personal data for longer than reasonably necessary for the purposes for which it was collected.

Retention periods depend on:

• the nature of the information;
• the purpose of processing;
• account status;
• whether content remains published;
• whether a complaint or dispute exists;
• applicable legal requirements;
• limitation periods;
• security requirements; and
• the need to establish or defend legal claims.

As a general framework:

User Account Data

Usually retained while the account remains active and for a reasonable period after closure where necessary for security, dispute resolution or legal compliance.

Security Logs

Generally retained for a limited period necessary to detect security incidents, investigate abuse and protect the Platform.

Reviews

Published reviews may remain available while relevant to the Platform unless removed under our policies or applicable law.

Review Evidence

Supporting documents should be retained only for as long as reasonably necessary to verify the review, resolve disputes or preserve legitimate evidence.

Evidence may be retained longer where a dispute, legal claim or investigation is ongoing.

Company Representative Verification

Verification records may be retained while the representative manages the profile and for an appropriate period thereafter to prevent unauthorized claims and maintain auditability.

Communications and Complaints

Records may be retained for a reasonable period necessary to respond, establish what actions were taken and address subsequent disputes.

Billing Information

Where paid services exist, relevant accounting information may be retained for periods required by applicable tax and accounting law.

Legal Claims

Relevant information may be retained for as long as reasonably necessary in connection with actual or reasonably anticipated legal proceedings.

Where possible, information that no longer needs to identify an individual may be anonymized instead of retained as personal data.

35. Deleting Your Account

Registered users may request deletion of their accounts subject to legal and legitimate retention requirements.

Deleting an account does not necessarily require immediate deletion of every item previously submitted.

For example:

• reviews may need to be assessed separately;
• records may need to be retained to prevent fraud or repeated abuse;
• transactions may be subject to legal retention requirements;
• records may be required for existing disputes;
• content may have been anonymized; or
• information may need to be preserved for legal claims.

Where appropriate, we may remove or anonymize account identifiers while retaining information that can lawfully continue to be processed.

36. Data Security

We take the security of personal data seriously.

Depending on the nature of the processing and available technology, safeguards may include:

• encryption in transit;
• secure authentication;
• password hashing;
• role-based access controls;
• access logging;
• restricted administrative access;
• secure backups;
• system monitoring;
• protection against malicious traffic;
• software updates;
• data minimization;
• employee or contractor confidentiality obligations; and
• procedures for responding to security incidents.

Access to sensitive review evidence should be more restricted than access to ordinary publicly available Platform information.

Nevertheless, no website, database or online transmission method can be guaranteed to be completely secure.

Users should also protect their accounts and devices.

37. Personal Data Breaches

If we identify a personal data breach, we will investigate the incident and take appropriate measures.

Where required by applicable law, this may include:

• notifying the competent supervisory authority;
• notifying affected individuals where the breach is likely to result in a high risk to their rights and freedoms;
• securing affected systems;
• limiting further exposure; and
• documenting the incident and response.

38. Children

Finauthority is intended primarily for adults researching financial companies and services.

Account creation and company management features are intended for users aged 18 or older.

We do not knowingly seek to collect personal data from children for the purpose of providing financial company review services.

If we learn that a child’s personal data has been submitted inappropriately, we may take steps to remove or restrict the information.

Parents or guardians who believe that personal data relating to a child has been submitted to Finauthority may contact us at privacy@finauthority.org.

39. Your Data Protection Rights

If GDPR applies to the processing of your personal data, you may have the following rights, subject to applicable conditions and exceptions.

Right of Access

You may request confirmation as to whether we process your personal data and obtain access to relevant information.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete information.

Right to Erasure

You may request deletion of personal data in certain circumstances.

The right to erasure is not absolute and may not apply where processing remains necessary for purposes permitted by law, including certain legal obligations, freedom of expression and information or the establishment, exercise or defence of legal claims.

Right to Restriction

You may request that processing of your data be restricted in certain circumstances.

Right to Data Portability

Where the applicable legal conditions are met, you may request certain personal data in a structured, commonly used and machine-readable format.

Right to Object

Where processing is based on legitimate interests, you may object to processing based on grounds relating to your particular situation.

We will consider the objection in accordance with applicable law.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Right to Complain

You may lodge a complaint with a competent data-protection supervisory authority.

Rights Concerning Automated Decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

40. Exercising Your Rights

Requests concerning personal data may be submitted to:

privacy@finauthority.org

Please clearly describe:

• who you are;
• the right you wish to exercise;
• the relevant account, profile, review or information; and
• any information reasonably necessary to locate the data.

We may need to verify your identity before acting on a request.

Verification information will be limited to what is reasonably necessary in the circumstances.

We will never request your Finauthority password for the purpose of processing a privacy request.

We aim to respond within the periods required by applicable law.

Under GDPR, valid requests are generally addressed within one month, although that period may be extended where legally permitted for complex or numerous requests.

You will be informed where an extension applies.

41. Rights Concerning Public Company Information

Requests involving information published as part of financial company research may require balancing several rights and legitimate interests.

For example, an individual may request deletion of information identifying them as a director of a financial company.

In evaluating such a request, we may consider:

• whether the information is accurate;
• whether it remains current;
• the person’s role;
• whether the information appears in an official public register;
• whether it is relevant to understanding the company;
• potential impact on the individual;
• public interest;
• freedom of expression and information;
• Finauthority’s legitimate interests; and
• applicable legal obligations.

The fact that information is unfavorable does not by itself make the processing unlawful.

Likewise, information should not remain published merely because it was once publicly available if retaining it is no longer lawful or proportionate.

42. Objections to Legitimate Interest Processing

Where we rely on legitimate interests, you may object on grounds relating to your particular situation.

We will assess your objection and cease the relevant processing where required unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing remains necessary for the establishment, exercise or defence of legal claims.

Direct-marketing objections will be respected as required by law.

43. Automated Tools and Review Integrity

Finauthority may use automated or semi-automated tools to assist with:

• detecting spam;
• identifying duplicate submissions;
• identifying suspicious account behavior;
• detecting coordinated review activity;
• prioritizing content for moderation;
• identifying security threats; or
• detecting technical anomalies.

Such signals may assist human moderation.

Where required by law, we will not rely solely on automated decision-making to make decisions producing legal or similarly significant effects on individuals without providing appropriate safeguards.

Automated indicators should not be treated as conclusive evidence that a review is fraudulent.

44. Anonymized and Aggregated Information

We may create statistical, aggregated or anonymized information that no longer identifies an individual.

For example, we may analyze:

• number of reviews submitted;
• percentage of reviews supported by evidence;
• categories receiving the most complaints;
• geographic distribution of Platform activity;
• general fraud patterns; or
• overall Platform usage.

Properly anonymized information is not personal data under GDPR.

We may retain and use such information for research, statistical, security and business purposes.

45. Accuracy of Your Information

We ask users and company representatives to provide accurate information.

If your personal or professional information changes, you should update your account or contact us where appropriate.

Finauthority may also update public company information when newer or more reliable sources become available.

Company representatives or users wishing to submit material relevant to the assessment of a financial brand may contact check@finauthority.org.

46. Privacy and Editorial Independence

Privacy requests are considered independently from commercial relationships.

A company does not obtain greater access to personal data because it:

• advertises on Finauthority;
• purchases a premium feature;
• claims its profile;
• enters into a partnership; or
• pays Finauthority for any commercial service.

Likewise, paying Finauthority does not entitle a company to obtain the identity of an anonymous reviewer or access private evidence supporting a review.

Any disclosure must have an appropriate legal basis.

47. Legal Requests for User Information

Finauthority may receive requests from courts, regulators, law-enforcement authorities, lawyers or other parties seeking information about users.

We will not automatically disclose information merely because a request has been made.

Where appropriate, we may assess:

• the identity and authority of the requester;
• legal basis of the request;
• jurisdiction;
• scope of information requested;
• necessity and proportionality; and
• whether disclosure is mandatory or otherwise legally justified.

Where legally permitted and appropriate, we may challenge requests that appear invalid, excessively broad or unsupported.

Nothing in this Policy prevents Finauthority from complying with a valid and binding legal obligation.

Legal requests should be directed to legal@finauthority.org.

48. Third-Party Websites

Company profiles may link to:

• financial company websites;
• regulator websites;
• official registers;
• social networks;
• news sources;
• external documentation; and
• other third-party resources.

Finauthority does not control how those third parties process personal data.

We recommend reviewing the privacy policies of external services before providing information to them.

49. International Users

Finauthority is intended to operate internationally.

Users outside the European Union may have additional privacy rights under the laws applicable to them.

Where local privacy law applies to Finauthority and provides rights beyond those described in this Policy, we will seek to honor those legally applicable requirements.

As the Platform expands, we may publish supplementary privacy notices for particular jurisdictions where appropriate.

50. No Sale of Personal Data

Finauthority does not sell personal data to third parties in exchange for payment as part of its core business model.

In particular, we do not sell:

• user account databases;
• private review evidence;
• identity-verification documents; or
• private complaint correspondence.

Certain privacy laws may define terms such as “sale” or “sharing” more broadly than an exchange of personal data for money.

If future advertising or technology practices trigger such legal definitions, we will update our disclosures and provide legally required choices before or when those practices are implemented.

51. Data Protection Contact

Finauthority has established a dedicated privacy contact for questions and requests concerning personal-data processing:

privacy@finauthority.org

If Finauthority becomes legally required to appoint a formal Data Protection Officer under applicable law, the identity and direct contact details of that Data Protection Officer will be published in this Privacy Policy.

Until such an appointment is required or made, privacy enquiries should be directed to the dedicated privacy address above.

52. Supervisory Authority

Because Finauthority’s main establishment is in the Czech Republic, the Czech supervisory authority responsible for data-protection matters is:

Office for Personal Data Protection
Úřad pro ochranu osobních údajů

Pplk. Sochora 27
170 00 Praha 7
Czech Republic

Email: posta@uoou.gov.cz

Individuals may have the right to lodge a complaint with this authority or, where applicable, another competent supervisory authority in the European Economic Area.

We encourage users to contact Finauthority first where appropriate so that we have an opportunity to investigate and address the issue, but this does not restrict your legal right to contact a supervisory authority.

53. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to Finauthority;
• new Platform features;
• changes in our processing activities;
• new service providers;
• legal or regulatory developments;
• security improvements; or
• changes to international operations.

The date at the beginning of the Policy indicates when it was last updated.

Where changes materially affect the way we process personal data, we will provide additional notice where required by applicable law.

Previous versions may be retained where appropriate for transparency.

54. Language

The primary version of this Privacy Policy is the English-language version.

Translations may be provided for convenience and accessibility.

Where legally permissible, if a translation differs materially from the English version, the English version will be used to determine the intended meaning.

This does not limit rights that cannot lawfully be excluded under applicable local law.

55. Contact Us About Privacy

For questions, requests or concerns concerning this Privacy Policy or Finauthority’s processing of personal data, contact:

Finauthority

Národní 135/14
Prague, Hlavní mesto Praha 110 00
Czech Republic

Privacy enquiries: privacy@finauthority.org

General enquiries: kancelar@finauthority.org

Legal enquiries: legal@finauthority.org

Company Review & Verification: check@finauthority.org

Website: Finauthority.org

When contacting us about a privacy matter, please provide enough information for us to identify and investigate your request, but do not send passwords, cryptocurrency seed phrases, private keys or unnecessary financial credentials.

Related Finauthority Policies

This Privacy Policy should be read together with, where applicable:

• Terms and Conditions
• Cookie Policy
• Legal Notice
• Financial and Regulatory Disclaimer
• Editorial Standards and Independence
• Research and Rating Methodology
• User Review and Evidence Policy
• Corrections, Complaints and Right of Reply Policy
• Advertising, Affiliate and Conflict of Interest Disclosure
• Company Profile and Claiming Policy
• Content Moderation and Notice-and-Action Policy
• Copyright and Intellectual Property Policy