Privacy policy

1. Scope

This policy covers the public website, the contact and enquiry forms, and personal data processed when assessing or administering a financing enquiry or agreement. It does not cover third-party websites reached through links published here.

2. Data we collect

We collect only what a given purpose requires. Depending on how you interact with us, this may include:

• Identification data: name, date of birth, nationality and identity document details where an application requires verification.
• Contact data: email address, telephone number and postal address.
• Financial data: income, existing commitments, bank statements and, for businesses, accounting information.
• Application data: the amount, purpose and term requested, and the documents you provide.
• Technical data: IP address, browser type and pages visited, collected in server logs for security and reliability.
• Correspondence: the content of messages you send us and our replies.

3. Purposes and legal bases

We process personal data for the following purposes, on the bases indicated:

• Responding to enquiries — performance of pre-contractual steps at your request, or our legitimate interest in answering you.
• Assessing an application — performance of pre-contractual steps and compliance with legal obligations relating to responsible lending.
• Administering an agreement — performance of the contract.
• Identity verification and anti-money-laundering checks — compliance with legal obligations.
• Site security, fraud prevention and abuse detection — our legitimate interest in keeping the service safe.
• Optional analytics — your consent, given through the cookie banner and withdrawable at any time.

4. Credit reference and verification searches

Where an assessment requires a search with a credit reference agency or a verification provider, we explain this and obtain the consent required in your jurisdiction before the search takes place. Some searches leave a record visible to other lenders; where that is the case, we tell you in advance.

5. Sharing

We do not sell personal data. We share it only where necessary, and only with:

• Service providers acting on our instructions, for example hosting, email delivery and document storage.
• Verification, credit reference and fraud prevention providers where an application requires it.
• Professional advisers bound by confidentiality.
• Public authorities, where disclosure is legally required.
• A prospective acquirer, in the event of a corporate transaction, under confidentiality obligations.

A current list of processor categories is available on request at contact@fortiscrest.com.

6. International transfers

Where personal data is transferred outside the jurisdiction in which it was collected, we rely on a transfer mechanism recognised by the applicable law, such as an adequacy decision or standard contractual clauses. Details of the mechanisms in use: [INTERNATIONAL TRANSFER MECHANISMS].

7. Retention

We keep personal data only as long as needed for the purpose it was collected for, and for any period required by law.

• Unsuccessful enquiries: retained for a limited period, then deleted — [ENQUIRY RETENTION PERIOD].
• Applications that do not proceed: [DECLINED APPLICATION RETENTION PERIOD].
• Agreements: for the duration of the agreement and the statutory period afterwards — [CONTRACT RETENTION PERIOD].
• Anti-money-laundering records: the period required by applicable law — [AML RETENTION PERIOD].
• Server logs: a short technical retention period — [LOG RETENTION PERIOD].

8. Your rights

Subject to your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have data deleted where we have no continuing lawful basis to keep it.
• Restrict or object to certain processing.
• Receive data you provided in a portable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Complain to a supervisory authority — the Commission Nationale pour la Protection des Données (CNPD), Luxembourg.

To exercise a right, write to contact@fortiscrest.com. We respond within the period set by applicable law and may need to verify your identity first.

9. Automated decision-making

Where any part of an assessment is automated in a way that produces a legal or similarly significant effect, we tell you, explain the logic in general terms, and provide a route to human review. Current use of automated decision-making: [AUTOMATED DECISION-MAKING DETAILS].

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control on a need-to-know basis, and defined retention schedules. No system is entirely without risk, and we ask you not to send sensitive documents by ordinary email.

11. Children

This website is not directed at children, and our services are available only to those of legal age to enter a contract in their country of residence.

12. Changes

We update this policy when our processing changes. The date at the top of the page reflects the current version, and material changes are highlighted on the site.