Data Protection

Privacy Policy of UNIVERS Capital GmbH

§ 1 General Information on the Structure of Our Website and This Privacy Policy
The following general information provides details on the structure of the website and the organization of the operators. It applies regardless of where you are on our website and which functions you use.
To provide you with a clear overview of where and how we process your personal data, you will find three additional subpages linked above this text. These pages provide information on the respective data processing activities when visiting our website, after registering with UNIVERS Capital, and regarding the handling of your data as part of an application process.
The website “universcapital.de” and its subpages are operated by “UNIVERS Capital GmbH”. UNIVERS Capital GmbH provides the website and makes the UNIVERS platform available to the project companies as a service provider for their financial offerings.
As soon as your visit to the website goes beyond mere viewing and an interaction with the visitor takes place — for example, when the visitor clicks on the “Register” or “Customer Portal” fields — the visitor leaves the homepage of UNIVERS Capital GmbH and enters the platform, which falls within the area of responsibility of the respective project companies.
The type, scope, and purpose of the processing of personal data, as well as the identity of the responsible entity, may vary depending on which part of the website you are using.
Both operators of these websites take the protection of your personal data very seriously. Your data is treated confidentially and processed in accordance with the applicable data protection regulations and this privacy policy.

§ 2 Data Protection on the Website
When you access this website, various types of personal data are processed. Personal data refers to information that can be used to identify you personally.
This privacy policy explains which data we collect and how we use it. It also explains how and for what purposes this processing takes place.
If we receive personal data from you through other channels (e.g., by email), this privacy policy also applies.
Please note that data transmission over the Internet (e.g., communication by email) may have security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed.
If you have any questions regarding this privacy policy or the processing of your personal data, please contact the following responsible entity:

Controller responsible for data processing
UNIVERS Capital GmbH
Grolmanstraße 36
10623 Berlin, Germany
Technical Support: +49 (0) 30 – 810 56 61 18
Email: datenschutz@universcapital.de

— hereinafter also referred to as “UNIVERS Capital GmbH”

The processing of data on this website is carried out by the website operator. As the provider of this website, we are both the controller within the meaning of Article 4(7) GDPR and the service provider within the meaning of Section 2 No. 1 TTDSG.

Legal Basis for Data Processing
The processing of your personal data takes place exclusively:

i) on the basis of your consent,
ii) for the performance of a contractual relationship,
iii) based on the legitimate interest of the controller in processing the data, or
iv) for compliance with a legal obligation or the performance of a task carried out in the public interest.
Withdrawal of Your Consent to Data Processing
If data processing is based on your explicit consent, you may withdraw this consent at any time without providing reasons and with effect for the future.
An informal notification by email is sufficient.
The lawfulness of data processing carried out before the withdrawal remains unaffected.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Article 21 GDPR)
If data processing is based on the legitimate interest of the controller or on tasks carried out in the public interest (Article 6(1)(e) or (f) GDPR), you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation.
This also applies to profiling based on these provisions.
The respective legal basis for each processing activity can be found in this privacy policy.
If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defence of legal claims (objection pursuant to Article 21(1) GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such advertising purposes. This also applies to profiling insofar as it is related to such direct marketing.
If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Article 21(2) GDPR).

Data Subject Rights
Under applicable data protection laws, you have extensive rights regarding your personal data. You can exercise these rights by contacting us via email at datenschutz@universcapital.de.
These rights include, in particular:

Right of Access
Upon request, UNIVERS Capital will provide you, within the legally prescribed period, with comprehensive information about all personal data stored by UNIVERS Capital concerning you.
This information includes not only the personal data itself but also the purpose and nature of the processing.

Right to Rectification
You have the right to request that UNIVERS Capital correct, complete, or update your personal data at any time.
In certain circumstances, UNIVERS Capital may require proof of your identity before fulfilling this request.

Right to Data Portability
Where technically feasible, you have the right to have all personal data stored by UNIVERS Capital concerning you transferred to another company.

Right to Erasure
Upon your request, UNIVERS Capital will delete all personal data relating to you that is stored by UNIVERS Capital within the legally required period.
If a statutory retention obligation exists, the data will only be deleted after the expiry of this retention period. Until then, the data will be blocked internally and not used for other purposes.

Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data.
The right to restriction applies in the following cases:
If you dispute the accuracy of your personal data stored by us, we generally require time to verify this. During the verification period, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data was or is unlawful, you may request restriction of processing instead of deletion.
If we no longer require your personal data, but you require it for the establishment, exercise, or defence of legal claims, you have the right to request restriction of processing instead of deletion.
If you have objected to processing pursuant to Article 21(1) GDPR, a balance must be made between your interests and ours. Until it has been determined whose interests prevail, you have the right to request restriction of processing of your personal data.
If processing of your personal data has been restricted, such data — apart from storage — may only be processed with your consent or for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement.
This right exists without prejudice to any other administrative or judicial remedies.

Data Security
SSL and TLS Encryption
For security reasons and to protect the transmission of confidential content, such as orders or inquiries submitted to us as website operators, this website uses SSL or TLS encryption.
You can recognise an encrypted connection by the change in the browser address bar from “http://” to “https://” and by the padlock symbol displayed in your browser.
When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Encrypted Payment Transactions on This Website
If, after concluding a paid contract, you are required to provide us with payment details (e.g., bank account details for direct debit payments), these details are required for payment processing.
Payment transactions using standard payment methods (direct debit procedures) are carried out exclusively via an encrypted SSL or TLS connection.
You can identify an encrypted connection by the change in the browser address bar from “http://” to “https://” and the padlock symbol in your browser.
When communication is encrypted, payment data transmitted by you cannot be accessed by third parties.

§ 3 Recording of Telephone Conversations
Telephone conversations between UNIVERS Capital and platform customers are recorded in accordance with the requirements of the MiFID II conduct-of-business rules.
This obligation to record and retain recordings results from Section 83 (3) of the German Securities Trading Act (WpHG) as a specification of Delegated Regulation (EU) 2017/565 and the minimum requirements for risk management issued by BaFin (MaRisk BTO 2.2.1 (No. 4)).
Accordingly, data processing is carried out to fulfil legal obligations pursuant to Article 6(1)(c) GDPR.
The information regarding the responsible entity and data subject rights under Section 2 applies accordingly.
During the recording of telephone conversations, we process not only the content of the conversation but also technical information generated by the telephone system or provided by the telecommunications provider.
This includes:

the telephone numbers involved in the conversation,
the start time of the conversation,
the duration of the conversation.
Recording must always be expected without additional notification if the conversation takes place within UNIVERS Capital’s trading area.
Within UNIVERS Capital, access to your data is granted only to those departments that require it to fulfil the purpose of processing or legal requirements.
To fulfil legal obligations, access to recorded data may be granted to employees, competent supervisory authorities, and auditors.
In the event of legal disputes, we may transfer recordings to lawyers and courts if legally required to do so or if necessary to protect our legal interests.
For the operation of our telephone systems, we use service providers who work strictly according to our instructions and are required to maintain an appropriate level of data protection (so-called processors).
These service providers do not process your data for purposes other than those specified by us.
The retention period for recorded data is generally five or seven years pursuant to Section 83(8) WpHG.
If special circumstances justify a legitimate interest of UNIVERS Capital in retaining recordings for a longer period, retention may take place for a maximum period of ten years and two weeks.
After expiry of this period, the data will be automatically deleted.

§ 4 Data Protection Officer

Legally Required Data Protection Officer
We have appointed an external data protection officer for UNIVERS Capital GmbH.
You can contact the data protection officer at:
UNIVERS Capital GmbH
Data Protection Officer
Grolmanstraße 36
10623 Berlin, Germany
Phone: +49 (0) 30 – 810 56 61 18
Email: datenschutz@universcapital.de

§ 5 Retention Period
Your data will be stored for as long as necessary to provide our services.
If longer storage is required due to legal regulations, the data will be stored until the expiry of the relevant retention period.

§ 6 Copyright
The contents of our website, in particular the products presented and the data provided, are protected by copyright.
The contents may not be reproduced and/or published in whole or in part or stored in an information system without prior written consent.
The presentation of this website in external frames is only permitted with explicit written approval.

§ 7 Scope of Application of This Privacy Policy
This privacy policy applies exclusively to the shared website operated by UNIVERS Capital.
This privacy policy does not apply to services offered by other companies or individuals, including products or websites displayed in search results, websites that may contain services provided by UNIVERS Capital GmbH, or other websites linked to UNIVERS Capital GmbH services.
This privacy policy does not cover how other companies or organisations process information that advertise services and may use cookies, pixel tags, or other technologies to provide and deliver relevant advertisements.

§ 8 Analytics Tools and Advertising
If cookies are used on our websites for analytics or advertising purposes, we will inform you about this through the cookie consent technology provided by Usercentrics.
Unless the cookies used are classified as essential, you have the option to grant or withdraw your consent.
Further information regarding the cookies currently in use and your consent status can be accessed via the fingerprint icon in the lower left corner of our homepage.

§ 9 Changes
An update of the content of this privacy policy may become necessary due to organisational, legal, or regulatory changes.
The most current version of this privacy policy is always published on this website.

§ 10 Newsletter
Newsletter Data
You may subscribe to our newsletter at any time, regardless of whether you are registered with us.
If you wish to receive our newsletter, we require your email address and information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter, as this is a process independent of registration.
No additional data is collected unless provided voluntarily.
We use this data exclusively for sending the requested information and do not share it with third parties.
The processing of the data entered into the newsletter registration form is based exclusively on your consent (Article 6(1)(a) GDPR).
You may withdraw your consent to the storage of your data, your email address, and its use for sending newsletters at any time by contacting us via email at datenschutz@universcapital.de or by using the “unsubscribe” link contained in the newsletter.
The lawfulness of processing carried out before withdrawal remains unaffected.
The data stored by us for the purpose of newsletter subscription will be retained until you unsubscribe from the newsletter and will then be deleted.
Data stored by us for other purposes remains unaffected.

Newsletter Service Provider
Newsletter distribution is carried out using the service provider Braze.
The privacy policy of the service provider can be found here:

https://www.braze.com/company/legal/privacy/
The service provider is used on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR and a data processing agreement pursuant to Article 28(3)(1) GDPR.
If personal data is transferred to the United States, the service provider must comply with the requirements of the Standard Contractual Clauses pursuant to Article 46 GDPR.
The use of personal data transmitted to the service provider takes place exclusively according to instructions from UNIVERS Capital and based on the data processing agreement.
In addition, the service provider is entitled to use the transmitted recipient data in pseudonymised form — meaning without assigning it to an individual user — to optimise or improve its own services, for example:

technical optimisation of newsletter delivery,
improvement of newsletter presentation,
statistical analysis.

Performance Measurement (iGoDigital)
The newsletters contain a so-called web beacon, i.e. a pixel-sized file that is retrieved from our server or, if a newsletter service provider is used, from that provider’s server when the newsletter is opened.
During this retrieval, technical information is collected, including:

browser information,
system information,
IP address,
time of retrieval.
This information is used to technically improve our services and to analyse target groups and reading behaviour based on:
retrieval locations (which can be determined using the IP address),
access times.

Statistical analysis also includes determining:

whether newsletters are opened,
when they are opened,
which links are clicked.

For technical reasons, this information may be assigned to individual newsletter recipients.
However, neither we nor, where applicable, our service provider intend to monitor individual users.
The analysis is used solely to understand the reading habits of our users and to adapt our content accordingly or send different content based on user interests.
A separate withdrawal of consent for performance measurement is unfortunately not possible.
In this case, the entire newsletter subscription must be cancelled.
For this purpose, the iGoDigital cookie may also be used on our website.

§ 11 Plugins and Tools

Google Tag Manager
Google Tag Manager is a solution that allows us to manage so-called website tags via an interface (and thus integrate Google Analytics and other Google marketing services into our online offering).
The Tag Manager itself (which implements the tags) does not process any personal data of users.
With regard to the processing of users’ personal data, please refer to the following information regarding Google services.
Usage guidelines:
https://www.google.com/intl/de/tagmanager/use-policy.html

Google Web Fonts
This website uses so-called web fonts provided by Google to ensure a consistent presentation of fonts.
When you access a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
For this purpose, the browser you use must connect to Google’s servers.
As a result, Google becomes aware that our website has been accessed via your IP address.
The use of Google Web Fonts serves to ensure a consistent, appealing, and above all understandable presentation of our online services.
Ensuring the comprehensibility and consistent, device-independent readability of our services is necessary for effective contract conclusion and is therefore required within the meaning of Article 6(1)(b) GDPR.
If your browser does not support web fonts, a standard font installed on your computer will be used.
Further information on Google Web Fonts can be found at:
https://developers.google.com/fonts/faq
and in Google’s privacy policy:
https://policies.google.com/privacy?hl=en

Zenloop
To optimise our website and our products, we ask you to provide feedback and rate our services.
For this purpose, we use the so-called Net Promoter Score (NPS).
This serves to protect our legitimate interests, based on a balancing of interests, in the optimal marketing and improvement of our services pursuant to Article 6(1)(f) GDPR.
The NPS service is provided by:

zenloop GmbH
Brunnenstraße 196
10119 Berlin, Germany

When submitting a rating, the web server automatically stores a so-called server log file containing, for example:

your IP address,
date and time of access,
amount of data transferred,
requesting provider.
These access data are not analysed and are automatically overwritten no later than seven days after the end of your website visit.

Salesforce
We use the CRM system provided by:

salesforce.com Germany GmbH
Erika-Mann-Str. 31
80636 Munich, Germany

The system is used to process user enquiries more quickly and efficiently (legitimate interest pursuant to Article 6(1)(f) GDPR).
Salesforce uses user data exclusively for the technical processing of enquiries and does not disclose it to third parties.
To use Salesforce, at least a valid email address must be provided.
Pseudonymous use is possible.
During the processing of service enquiries, it may become necessary to collect additional data, such as:

name,
address.
If users do not agree to the collection and storage of data in Salesforce’s external system, we offer alternative contact options for submitting service requests via:
email,
telephone,
fax,
post.
Further information can be found in Salesforce’s privacy policy:
https://www.salesforce.com/de/company/privacy/

§ 12 Additional Service Providers

Trustpilot A/S
UNIVERS Capital GmbH may contact users of the platform by email and invite them to review our services and/or products in order to further optimise them (the “purpose”).
For the purpose of obtaining customer feedback, we cooperate with an external company:
Trustpilot A/S (“Trustpilot”)
For this purpose, we share the following user data with Trustpilot:

name,
email address,
reference number.

Users who would like to learn more about how Trustpilot processes their data can consult Trustpilot’s privacy policy.
UNIVERS Capital GmbH may also use such reviews in other advertising materials and promotional content for marketing and sales purposes.

§ 13 Data Processing When Visiting Our Website
As soon as you access our website, your personal data is processed by us through the use of cookies.
Initially, only your IP address is processed, insofar as this is necessary for the operation of our website.
When you visit our website for the first time, a cookie banner will appear in accordance with Section 25 TTDSG, allowing you to select the scope of further data processing by choosing specific cookie categories.
You can change your selection at any time afterwards within the cookie settings.

Responsibility
The processing of cookies in connection with your visit to our website is the responsibility of UNIVERS Capital GmbH.

Cookies
Websites sometimes use so-called cookies.
Cookies do not cause any damage to your computer and do not contain viruses.
Cookies help us make our services more user-friendly, effective, and secure.
Cookies are small text files stored on your computer and saved by your browser.

Three categories of cookies are distinguished:

Essential cookies required to ensure basic functions of the website.
Functional cookies used to provide and improve website services.
Marketing cookies used to display advertisements relevant to your interests.

Most of the cookies we use are so-called session cookies. These are automatically deleted after the end of your visit.
Other cookies remain stored on your device until you delete them.
These cookies enable us to recognise your browser during your next visit.
Only device and browser information is stored for this purpose.

You can configure your browser settings so that:

you are informed when cookies are set,
cookies are accepted only in individual cases,
cookies are generally rejected,
cookies are automatically deleted when closing the browser.
Disabling cookies may limit the functionality of this website.

Cookie Consent with Usercentrics
This website uses the cookie consent technology of Usercentrics to obtain your consent for storing certain cookies on your device or using certain technologies and to document this consent in compliance with data protection regulations.
The provider of this technology is:

Usercentrics GmbH
Rosental 4
80331 Munich, Germany
Website: https://usercentrics.com/de/

(hereinafter “Usercentrics”)
When you access our website, the following personal data is transmitted to Usercentrics:

your consent(s) or withdrawal(s) of consent,
your IP address,
information about your browser,
information about your device,
time of your visit to the website.
In addition, Usercentrics stores a cookie in your browser to associate your given consent or withdrawal of consent.

The data collected in this way is stored until:

you request deletion,
you delete the Usercentrics cookie yourself,
or the purpose for storing the data no longer applies.
Mandatory statutory retention obligations remain unaffected.

Server Log Files
The provider of the website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.
These include:
browser type and browser version,
operating system used,
referrer URL,
hostname of the accessing device,
time of the server request,
IP address.
This data is not combined with other data sources.

New Relic – Server Monitoring and Error Tracking
With the help of server monitoring and error tracking, we ensure the availability and integrity of our online services.
The data processed in this context is used to technically optimise our online services.
For these purposes, we use the service:

New Relic, Inc.
Attn: Legal Department
188 Spear Street, Suite 1200
San Francisco, CA 94105
USA

New Relic processes aggregated performance data, including:

performance values,
utilisation data,
comparable technical metrics,
which provide information about the stability and possible irregularities of our online services.
In the event of errors or abnormalities, individual requests from users of our online services are recorded in pseudonymised form in order to identify and resolve sources of problems.
Pseudonymisation means in particular that users’ IP addresses are stored in shortened form by removing the last two digits (IP masking).
Aggregated data is deleted after three months.
Pseudonymised data is deleted after seven days.
Further information regarding the processing of personal data by New Relic can be found in the service provider’s privacy policy:
https://newrelic.com/termsandconditions/privacy

Contact Form / Chat Tool
If you send us enquiries via a contact form, the information provided in the enquiry form, including your contact details, will be stored by us for the purpose of processing your enquiry and handling any follow-up questions.
We do not disclose this data without your consent.
The data entered into the contact form remains stored by us until:
you request deletion,
you withdraw your consent for storage,
or the purpose for data storage no longer applies (e.g. after your enquiry has been fully processed).
Mandatory statutory provisions, particularly retention obligations, remain unaffected.
Enquiries via Email, Telephone, or Fax
If you contact us by email, telephone, or fax, your enquiry, including all resulting personal data (such as name and request details), will be stored and processed by us for the purpose of handling your matter.
We do not disclose this data without your consent.
The data transmitted to us through contact enquiries remains stored until:
you request deletion,
you withdraw your consent,
or the purpose for storing the data no longer applies (e.g. after completion of your request).
Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.

§ 14 Purposes and Legal Bases of Processing

Cookies
Cookies required for carrying out electronic communication processes or providing certain functions requested by you (e.g. shopping cart functionality) are stored on the basis of UNIVERS Capital’s legitimate interest pursuant to Article 6(1)(f) GDPR.
The website operator has a legitimate interest in storing cookies to ensure technically error-free and optimised provision of its services.
Where other cookies (e.g. cookies for analysing your browsing behaviour) are stored, these are addressed separately in this privacy policy.

Usercentrics
Usercentrics is used to obtain legally required consent for the use of certain technologies.
The legal basis for this processing is Article 6(1)(c) GDPR.

Server Log Files
The collection of server log data is based on Article 6(1)(f) GDPR.
The website operator has a legitimate interest in ensuring technically error-free presentation and optimisation of its website. For this purpose, server log files must be collected.

New Relic
We use New Relic based on our legitimate interests in the security, error-free operation, and optimisation of our online services pursuant to Article 6(1)(f) GDPR.

Contact Form / Chat Tool
The processing of data entered into the contact form is based exclusively on your consent (Article 6(1)(a) GDPR).
You may withdraw your consent at any time.
An informal notification by email is sufficient.
The lawfulness of processing carried out before withdrawal remains unaffected.
Enquiries via Email, Telephone, or Fax
The processing of relevant data in connection with your enquiries is based on Article 6(1)(b) GDPR, where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures.
In all other cases, processing is based on:

your consent (Article 6(1)(a) GDPR), and/or
our legitimate interests (Article 6(1)(f) GDPR),
as we have a legitimate interest in effectively handling enquiries addressed to us.

§ 15 Data Processing After Registration on “universcapital.de”
You can register on our website in order to use additional functions and services available on the platform.
The data entered for this purpose is used exclusively for the purpose of using the respective service or offering for which you have registered.
The mandatory information requested during registration must be provided completely; otherwise, we reserve the right to reject the registration.
As a provider of financial services, we are, among other things, legally obligated to ensure the identity of our users in order to prevent money laundering.
The mandatory information required for this purpose includes personal master data as well as the bank details necessary for processing the contractual relationship.
The identity verification itself is carried out by a service provider. We only receive confirmation or rejection of your identity and do not receive any data from the actual identification process.
To register with UNIVERS Capital, only your email address is initially required.

Once you actively use our services, the following personal data may be requested:

First name / surname
Title (optional)
Gender
Nationality
Mobile phone number (optional)
Email address
Telephone number (optional)
Address (optional)
Date and place of birth (optional)
Identification data (identity document details: number, issuing authority, validity, etc.)
Tax residency
Tax identification number (optional)
Voluntary additional information (marital status, occupation, award system data)

The processing of the data entered during registration is based on your consent (Article 6(1)(a) GDPR).
You may withdraw your consent at any time.
An informal notification by email is sufficient.
The lawfulness of processing carried out before withdrawal remains unaffected.
The data collected during registration is stored for as long as you are registered on our website and is subsequently deleted.
Statutory retention obligations remain unaffected.

Responsibility
The processing of personal data in connection with your registration and use of our services is the responsibility of:
UNIVERS Capital GmbH
Processing of Data (Customer and Contract Data)
We collect, process, and use personal data only insofar as this is necessary for establishing, structuring, or modifying the legal relationship (master data).
This processing is carried out on the basis of Article 6(1)(b) GDPR, which permits processing necessary for the performance of a contract or for pre-contractual measures.
Personal data relating to the use of our websites (usage data) is only collected, processed, and used insofar as necessary to enable users to access the service or to invoice the service.
Customer data collected will be deleted after completion of the order or termination of the business relationship.
Statutory retention obligations remain unaffected.
Data Transfer Upon Conclusion of Contracts for Services and Digital Content
We only transfer personal data to third parties where this is necessary for contract processing, for example to service providers responsible for:

identification procedures,
payment processing.
Further transfer of data does not take place unless:
you have expressly consented to such transfer, or
transfer is necessary based on legitimate interests.
Your data will not be transferred to third parties for advertising purposes without your explicit consent.
The legal basis for processing is Article 6(1)(b) GDPR, which permits processing necessary for the performance of a contract or pre-contractual measures.

§ 16 Purposes and Legal Bases of Processing
You Have Registered with Us
As part of registration, we necessarily process your login data, such as your email address.
The purpose of processing at this stage is to expand our community and initiate a potential business relationship between UNIVERS Capital GmbH and you.
We consider your registration in our portal as the first step towards business and contractual initiation initiated by you.
Therefore, the legal basis for processing is the initiation and performance of contractual measures pursuant to Article 6(1)(b) GDPR.
You may withdraw your consent to receiving emails from us at any time.
Following your withdrawal, we will no longer send you further emails.
We store your data as long as the respective legal basis exists.
If you have not made an investment with us, we will delete your data immediately upon your request.
Otherwise, we will delete your account after three months if we determine that you have not logged into your account during this period.
Your data will not be transferred to a third country outside the EU or the European Economic Area (EEA).
Your data will also not be transferred to additional third parties.
It remains within UNIVERS Capital GmbH.
You Have Registered and Completed Identification
If you have registered on our platform and completed identification, this indicates that you intend to make an investment with one of the project companies available on the platform.
The purpose of processing is the initiation and/or execution of a contract.
The legal basis is therefore pre-contractual measures pursuant to Article 6(1)(b) GDPR.
Once you open an investment account through the platform, you additionally enter into a contractual relationship regarding account custody with the respective financial institution:

Tangany GmbH
In this case, the legal basis is also Article 6(1)(b) GDPR.
In addition, we are required under the German Money Laundering Act (GwG) to verify your identity when opening the account.
This obligation is based on a legal requirement pursuant to Article 6(1)(c) GDPR.
If you wish to open an account, we transfer your data to the account-holding institution so that your bonds can be recorded.
The purpose of this transfer is the fulfilment of contractual obligations in connection with opening the account with our partner institutions.
If you have not yet invested, we delete your data after a certain period of inactivity on the platform, but not earlier than seven years.
The German Money Laundering Act requires a retention period of seven years for identification data after opening an account or custody account.
Your data will not be transferred to a third country outside the EU or EEA.
You Have Already Invested
In this case, the purpose of processing is the execution and administration of an existing contractual relationship.
It is necessary for us to know to whom we must make interest payments on behalf of the project companies.
Your data is processed on the basis of contract execution and administration pursuant to Article 6(1)(b) GDPR.
Furthermore, your data is processed due to legal obligations pursuant to Article 6(1)(c) GDPR.
Relevant regulations include:
German Money Laundering Act (GwG),
German Banking Act (KWG),
German Investment Code (KAG).
As long as your investment exists, we cannot and are not permitted to delete your data.
The deletion of personal data itself constitutes processing within the meaning of Article 4(2) GDPR and requires a legal basis.
Due to the aforementioned legal requirements and the German Fiscal Code (AO), we are subject to statutory retention obligations that prohibit deletion of certain data for a legally defined period.
These retention periods also apply after termination of your investment with us.
Only after expiry of these retention periods may deletion take place.
The retention periods amount to a maximum of ten years after termination of your investment.

§ 17 Data Processing During the Application Process
We process applicant data solely for the purpose and within the scope of the application process, in accordance with applicable legal requirements.
The application process requires applicants to provide us with applicant data.
If we provide an online application form, the required applicant data is marked accordingly and primarily concerns personal master data.
Otherwise, it results from the respective job descriptions.
Generally, this includes:
personal information,
postal and contact details,
application documents such as cover letters,
CVs,
certificates and supporting documents.
Applicants may voluntarily provide additional information.
By submitting an application, applicants agree to the processing of their data for the purposes of the application process in accordance with the type and scope described in this privacy policy.
Where available, applicants may submit applications via an online form on our website.
The data is transmitted to us in encrypted form according to current technical standards.
Applicants may also submit applications via email.
However, please note that emails are generally not transmitted in encrypted form and applicants are responsible for ensuring encryption themselves.
Therefore, we cannot assume responsibility for the transmission path between the sender and receipt on our server.
We therefore recommend using an online application form or postal submission.
Deletion takes place — unless there is a justified withdrawal by the applicant — after a period of six months.
This allows us to answer any follow-up questions regarding the application and fulfil our obligations under equal treatment legislation.
Invoices relating to reimbursement of travel expenses are archived in accordance with tax law requirements.

§ 18 Purposes and Legal Bases of Processing
If applicant data is processed by UNIVERS Capital GmbH through other channels, such processing takes place to fulfil our (pre-)contractual obligations within the scope of the application process pursuant to:
Article 6(1)(b) GDPR, and
Article 6(1)(f) GDPR, where processing is necessary, for example, in connection with legal proceedings.
In Germany, Section 26 BDSG additionally applies.
Furthermore, processing takes place on the basis of your consent where you have allowed us to retain your application for future opportunities.
If applicants voluntarily provide special categories of personal data pursuant to Article 9(1) GDPR, processing takes place additionally pursuant to Article 9(2)(b) GDPR, for example:
health data (such as disability status),
ethnic origin.
If special categories of personal data pursuant to Article 9(1) GDPR are specifically requested from applicants, processing takes place additionally pursuant to Article 9(2)(a) GDPR, for example health data required for performing a particular occupation.
Data provided by applicants may be further processed for employment purposes if the application is successful.
If an application is unsuccessful, the applicant’s data will be deleted.
The same applies if an application is withdrawn, which applicants may do at any time.