Privacy Policy – finanzoo

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Finanzoo GmbH
Maxfeldstr. 69
90409 Nürnberg, Germany
Managing director: Thomas Jahn
Email: service@finanzoo.de

The current version of this privacy policy is always available at www.finanzoo.de/en/privacy-policy.html.

2. General information on data processing

We only collect and process personal data of our users to the extent necessary to provide a functioning website and our content and services, or to the extent permitted by a legal basis. The collection and use of personal data regularly only takes place after the user's consent or on the basis of a statutory permission.

The following legal bases apply in particular:

Art. 6(1)(a) GDPR – consent (e.g. for optional cookies, newsletter, consents given via the contact form)
Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (e.g. registration, subscription, payment processing, API access)
Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. commercial and tax retention obligations)
Art. 6(1)(f) GDPR – legitimate interest (e.g. server log files to ensure IT security, fraud prevention in the cancellation/withdrawal form)

3. Server log files

When you access our website, our hosting provider automatically collects information in so-called server log files, which your browser automatically transmits. This includes: IP address (shortened/anonymized where technically possible), date and time of the request, referrer URL, page accessed, amount of data transferred, browser type and version, and the operating system used.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technical error-free operation and security of our website). Log files are stored for security reasons (e.g. to investigate misuse) for a maximum of 30 days and are then deleted or anonymized.

4. Hosting

Our website and the associated database are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The purpose is the technical provision of finanzoo.de. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a reliable and secure provision of our service) in conjunction with a data processing agreement pursuant to Art. 28 GDPR.

5. Cookies, login and session data

We use technically necessary cookies to make our website usable. This includes in particular session cookies to keep you logged in, as well as authentication cookies (e.g. for secure sign-in via external login providers). These cookies are automatically deleted at the end of the session or after a defined period of validity.

The legal basis is Art. 6(1)(b) GDPR (necessity for performance of the contractually owed service) or Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). We only use non-essential cookies with your prior consent (Art. 6(1)(a) GDPR); you may withdraw this consent at any time with effect for the future.

Consent manager: On your first visit we show a cookie banner that lets you choose whether, in addition to necessary cookies, you also allow analytics and, in the future, marketing cookies. "Accept all" and "Reject all" are presented as equally weighted options. Your choice is stored locally in your browser's localStorage (key fz_consent_v1) on our own server; it is not shared with third parties. As long as you have not consented to analytics cookies, related scripts (e.g. a future Google Analytics integration) will not be loaded. Our consent manager is technically prepared for Google Consent Mode v2: before any decision, advertising and analytics storage default to "denied" for Google services; this status is only updated after you give consent.

Functional visitor tracking (fz_vid): Independently of your cookie choice, we set a first-party cookie (fz_vid, valid for 365 days) containing a randomly generated identifier to anonymously understand which pages lead visitors to a registration or purchase (funnel/conversion analysis on our own servers, no disclosure to third parties). The legal basis is our legitimate interest in optimizing our offering (Art. 6(1)(f) GDPR). This cookie does not involve third-party analytics scripts. Should we add further third-party analytics or marketing services in the future (e.g. Google Analytics, advertising or affiliate tracking), these will only be activated after your consent via the consent manager described above.

Payment processing (Stripe): The script of our payment provider Stripe is not loaded globally on every page, but only when you access the card entry or checkout area of our website to prepare or complete a payment. For further details on Stripe, see section 8.

Embedded fonts/icons: Country flag icons (flag-icons) are served exclusively from our own server; no connection to external content delivery networks is established.

6. Registration, user account and subscription

When you register, we collect the data you provide (e.g. name, email address, password in encrypted form). As part of a paid subscription (Premium or Business), we additionally process billing address and payment information, to the extent necessary for contract performance.

The legal basis is Art. 6(1)(b) GDPR. The data is stored for the duration of the membership and for up to 12 months thereafter, in order to allow you to log in again with the same usage data and to be able to trace legitimate claims (e.g. in connection with the free trial). The data is then deleted unless statutory retention obligations require otherwise.

As an alternative to password-based sign-in, you can secure your account with a passkey. The private key of a passkey remains exclusively on your device or within your authenticator (e.g. device PIN, biometric unlock) and is never transmitted to us. We only store the public key and a credential identifier required for sign-in. The legal basis is Art. 6(1)(b) GDPR.

7. Sign-in with Google, Microsoft or Facebook (Social Login)

You may alternatively register and sign in using an existing account with Google, Microsoft, or Facebook (Meta). If you use this feature, you are redirected to the respective provider's sign-in page. Authentication takes place exclusively with your credentials stored at that provider; we never receive your password.

After successful authentication, the respective provider transmits to us the data required to create or link your user account, in particular a unique user identifier and, to the extent released by the provider, your name and email address. For Facebook, we limit the requested permissions to the public profile ("public_profile"); we do not request any further Facebook data (e.g. friend list, interests).

The legal basis is Art. 6(1)(b) GDPR (performing the registration or sign-in at your request). The providers of the Social Login features are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; and Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. All three providers may, within their own responsibility, transfer data to the USA or to affiliated companies outside the EU; to the extent known to us, these providers rely on EU Standard Contractual Clauses pursuant to Art. 46 GDPR as an appropriate safeguard. With regard to Meta/Facebook in particular, we note that supervisory authorities scrutinize the related data processing especially closely; please refer directly to the respective provider's privacy notices for further information:

8. Payment processing

We use the following payment service providers to process payments:

Stripe: Payments by credit card, SEPA direct debit and other payment methods are processed via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. In this process, your payment data (e.g. card data, name, email address, billing address) is transmitted to Stripe. Stripe may also transfer data to the USA; this transfer is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR as an appropriate safeguard for an adequate level of data protection. The legal basis is Art. 6(1)(b) GDPR.

NOWPayments: For payments in cryptocurrency (e.g. Bitcoin), we use the payment service provider NOWPayments. The data required to process the transaction (e.g. transaction ID, amount, wallet address) is transmitted to NOWPayments. The legal basis is Art. 6(1)(b) GDPR.

PayPal and Klarna: Where offered during checkout, you may also pay via PayPal or Klarna. These payment methods are technically provided through Stripe as so-called "payment methods"; the data required for the payment (e.g. name, email address, payment amount) is transmitted to Stripe and, depending on the selected payment method, to PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, or Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden. The legal basis is Art. 6(1)(b) GDPR. For further information, please refer to the privacy notices of PayPal and Klarna.

Payment data is only stored for as long as necessary for contract performance and to comply with tax and commercial retention obligations (see section 10).

9. Contact form and cancellation/withdrawal form

If you send us inquiries via the contact form, cancellation form or withdrawal form, your details (name, email address, message text, and, if applicable, contract type and reason) are stored by us to process the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The legal basis is Art. 6(1)(b) GDPR (performance or initiation of a contract), alternatively Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). To prevent abuse (e.g. automated spam submissions), we additionally collect technical data such as IP address and time of submission on the basis of Art. 6(1)(f) GDPR. The data is deleted as soon as it is no longer required for the purpose for which it was collected, generally after processing has been completed and any follow-up period has expired.

On the contact form, you can optionally subscribe to our newsletter via a separate checkbox. This sign-up is voluntary and based on your consent (Art. 6(1)(a) GDPR) and is independent of the submission of your actual inquiry. You may withdraw this consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter email or by contacting service@finanzoo.de.

10. Invoice data and statutory retention periods

Invoices and the underlying accounting records contain personal data (e.g. name, address, contract data, payment amount). This data is subject to statutory retention obligations under German law (§ 147 Fiscal Code (AO) and § 257 Commercial Code (HGB)) and is therefore stored for up to 10 years, even if the underlying contractual relationship has since ended. The legal basis is Art. 6(1)(c) GDPR.

11. API access (Business subscription)

Customers with a Business subscription receive a personal API key. This is stored together with the respective user account in order to be able to assign requests and monitor usage quotas. The legal basis is Art. 6(1)(b) GDPR. API keys are deactivated upon cancellation of the Business subscription and deleted after expiry of the retention period mentioned in section 6.

12. Storage of consents

Where we base processing on your consent (e.g. agreement to our terms and conditions, privacy policy, or optional cookies), we log the time, content and version of the respective consent. This serves to prove that consent was properly obtained vis-à-vis supervisory authorities and is our statutory obligation under Art. 7(1) GDPR. The legal basis for this logging itself is Art. 6(1)(c) GDPR in conjunction with Art. 6(1)(f) GDPR.

13. Free trial period

To prevent abusive repeated use of the free trial, we store, for up to 12 months after the end of a trial period or after termination of a user account, information that prevents the same person from using the free trial again (e.g. email address, account identifier). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing our trial offer free of abuse).

14. Recipients and categories of recipients

We only disclose your personal data to third parties where a legal basis exists for doing so. The following categories of recipients have access to your data for the purposes described above:

IONOS SE (hosting, technical operation, and sending emails via the IONOS mail server; data processing agreement under Art. 28 GDPR)
Stripe Payments Europe, Ltd. (payment processing, possible transfer to the USA based on EU Standard Contractual Clauses)
NOWPayments (processing of cryptocurrency payments)
PayPal (Europe) S.à.r.l. et Cie, S.C.A. and Klarna Bank AB, if you select this payment method
Google, Microsoft, or Meta Platforms (Facebook), if you use the respective Social Login feature

Data is disclosed to other third parties only where legally required or where you have given your prior consent.

15. Retention periods at a glance

Server log files: up to 30 days
Session/login cookies: until the end of the session or the defined period of validity
Account and subscription data: duration of membership plus up to 12 months thereafter
Invoice and accounting data: up to 10 years (§ 147 AO, § 257 HGB)
Contact, cancellation and withdrawal inquiries: until processing is completed plus a reasonable follow-up period
Proof of consent: for as long as a legitimate interest in such proof exists, at least until expiry of the applicable statutory limitation periods

16. Your rights as a data subject

You have the right at any time to:

request information about the personal data we process concerning you pursuant to Art. 15 GDPR,
request rectification of inaccurate data or completion of your data pursuant to Art. 16 GDPR,
request erasure of your data stored by us pursuant to Art. 17 GDPR, unless statutory retention obligations apply,
request restriction of processing of your personal data pursuant to Art. 18 GDPR,
request data portability pursuant to Art. 20 GDPR, i.e. to receive the data you provided in a structured, commonly used and machine-readable format,
object to the processing of your personal data pursuant to Art. 21 GDPR, to the extent the processing is based on Art. 6(1)(f) GDPR,
withdraw any consent given at any time with effect for the future pursuant to Art. 7(3) GDPR.

To exercise these rights, simply send an email to service@finanzoo.de.

17. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR (Art. 77 GDPR).

The supervisory authority responsible for Finanzoo GmbH is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

18. Data security

We use the common TLS (Transport Layer Security) encryption method while you visit our website. Whether an individual page of our website is transmitted in encrypted form can be recognized by the closed padlock/key symbol in your browser's address bar. Access to our databases is technically and organizationally restricted to selected employees.

19. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services in the privacy policy, e.g. when new services are introduced. The new privacy policy will then apply to your next visit.

Last updated: October 2026