Privacy policy

1. Who handles your data

The data controller is [TO BE DEFINED] (“Finnoba”, “we”), a company incorporated in Peru, based in Lima. Write to info@finnoba.xyz about anything related to your data.

This policy covers the finnoba.xyz site, the app.finnoba.xyz application, and the forms and contact channels we offer.

2. What data we collect

Depending on how you use the platform, we process:

• Identity and contact: name, ID document, date of birth, nationality, country of residence, email, phone and address.
• Verification data: a copy of your ID, a selfie or liveness check where applicable, tax residency, source of funds and the result of the international sanctions-list screening.
• Financial data: bank accounts used to send or receive money, amounts lent or requested, payments and their history.
• If you apply for business financing: RUC, recent months' sales, export invoices or contracts, outstanding debt and use of funds.
• If you complete the application form: registered company name, RUC, contact name and role, email, WhatsApp, sector, destination markets, monthly revenue band, months trading formally, the amount and purpose of the financing you need, urgency, whether you hold a signed purchase order not yet invoiced, and what financing alternative you use today.
• Usage data: the emails and messages we exchange with you, and technical server logs such as your IP address, browser and access time.

3. What we use it for, and on what legal basis

• To handle your registration, review your profile and perform the agreements we sign with you: legal basis, performance of the contract and the pre-contractual steps you request.
• To verify your identity and source of funds, and to comply with anti-money-laundering and counter-terrorist-financing rules as well as tax and accounting obligations: legal basis, compliance with legal obligations.
• To assess a business's credit risk and follow up on payments: legal basis, performance of the contract and our legitimate interest in collecting what was lent.
• To measure demand for our pilot and contact you about it, when you complete the application form: legal basis, your express consent. The form neither assesses nor pre-approves anything; it only collects information.
• To send you pilot updates and commercial communications: legal basis, your consent. You can withdraw it at any time.
• To run, maintain and protect the platform against fraud and abuse: legal basis, our legitimate interest.

We don't make automated decisions with legal effects on you without human review: today every application is assessed by the team.

4. What happens if you don't give us your data

Identity, verification and financial data are necessary to operate: without them we can't open an account, receive your money or disburse a loan, because the law requires us to verify them. The data we ask for to send you updates is optional, and declining it doesn't affect anything else.

5. Who we share it with

We don't sell your data. We share it only with:

• Providers acting on our instructions and under contract: hosting and infrastructure, identity verification, email, payment processing and accounting. They only access what they need to deliver their service.
• Competent authorities, where the law requires us to report or to answer a request.
• Credit bureaus and collection agencies, in the case of borrowing businesses with overdue payments, as set out in the individual agreement.
• External auditors and legal advisors, bound by confidentiality.

6. Data that leaves Peru

Some of our providers host servers outside Peru, mainly in the United States and the European Union. That means a cross-border transfer of your data. Where it happens, we require those providers to give contractual guarantees equivalent to what Peruvian law demands. By accepting this policy you consent to that transfer.

7. How long we keep it

We keep your data for as long as the relationship lasts and, afterwards, for the periods required by anti-money-laundering, tax and commercial rules, which generally are no less than five years from the close of the operation.

If you only signed up for updates and never operated, we delete your data two years after the last contact, or sooner if you ask.

8. How we protect it

We apply reasonable technical and organisational measures: encryption in transit, role-based access, access logging and providers that meet recognised security standards.

No system is infallible. If an incident affects your data, we'll tell you and notify the authority where required.

9. Your rights

You can ask us for access to your data, its correction, its cancellation or deletion, object to certain processing, ask us to restrict the use of your data, and withdraw your consent where the processing relies on it.

Write to info@finnoba.xyz from the email you registered, saying which right you want to exercise. We may ask you to prove your identity. We respond within the periods set by law: twenty business days for access and ten business days for the other rights.

Some requests we can't fully honour while a legal duty to retain the information applies, such as anti-money-laundering record-keeping. When that happens, we explain it to you in writing.

10. Cookies and technical logs

This site uses no analytics, profiling or advertising cookies. Our hosting provider keeps technical logs — IP address, browser, timestamp — for security and operational reasons.

On the application form page we keep a daily visit count: a single number per day, with no cookie and nothing that identifies you. It tells us what share of the people who open the form go on to send it. Of your IP address we store only a salted hash, which serves solely to rate-limit repeated submissions from one connection and cannot be turned back into the address.

The application uses strictly necessary cookies to keep you signed in. If we add analytics tooling in the future, we'll announce it on this page and ask for your consent before switching it on.

11. Minors

The platform isn't aimed at people under 18 and we don't knowingly collect their data. If we find an account belonging to a minor, we close it and delete the information.

12. Changes to this policy

We may update this policy. The version in force is always the one published on this page, with its update date. If a change is material, we'll email you before it takes effect.

13. Complaints

If you think we're mishandling your data, write to us first at info@finnoba.xyz — we want to fix it. You can also file a complaint with Peru's National Authority for Personal Data Protection, at the Ministry of Justice and Human Rights.