Privacy policy
Last updated: [DATE]
1. Who we are
The controller of your personal data is [Company name], [street and number], [postcode and city], [country] (“FLS”, “we”, “us”).
Contact for privacy questions: [privacy@yourdomain.example]. Our data protection officer can be reached at the same address, or by post at the address above marked for the data protection officer.
2. What data we collect
We only collect data needed to prepare the offer you asked for.
a) Data you give us
- Contact details: first name, phone number, email address.
- Request details (optional): product of interest, amount range, and when you would like to start.
- Consent: whether you agreed to be contacted.
b) Data created automatically when you use the site
- Campaign data: UTM parameters from the link you clicked, and the address of the page that referred you to us, if your browser sends it.
- Technical data: your IP address is processed briefly by our server to protect against spam and abuse. It is not stored with your request.
Please do not send special categories of data, such as health information, in the form. If you do, we will delete it.
3. Why we use your data, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your request and preparing an offer | Article 6(1)(b) GDPR: steps taken at your request before entering a contract |
| Contacting you by phone or email about your request | Article 6(1)(a) GDPR: your consent |
| Sharing your details with partners you agree to | Article 6(1)(a) GDPR: your consent |
| Protecting the site against spam and abuse | Article 6(1)(f) GDPR: our legitimate interest in a secure service |
| Measuring which campaigns bring requests | Article 6(1)(f) GDPR: our legitimate interest in understanding our marketing |
| Meeting legal and tax obligations | Article 6(1)(c) GDPR: legal obligation |
We do not make decisions about you based solely on automated processing that has legal or similarly significant effects (Article 22 GDPR).
4. Who receives your data
- Partners: financial and insurance partners you choose to be connected with. We only share the details they need to make an offer, and only after your consent.
- Service providers (processors): hosting, email and telephone providers, and IT support. They act on our instructions under a data processing agreement (Article 28 GDPR).
- Authorities: where we are legally required to disclose data.
We never sell your personal data. Where a provider is located outside the European Economic Area, we use the safeguards required by GDPR, such as Standard Contractual Clauses.
5. How long we keep your data
- Open requests: up to [12] months after your last contact, unless you ask us to delete them earlier.
- Requests you asked us to close: deleted within [30] days, except where a legal retention period applies.
- Consent records: kept for as long as we need to prove your consent, and for the limitation period after that.
- Server logs: deleted automatically after [7] days.
6. Cookies and similar technologies
The site uses only technically necessary storage. We do not set advertising or tracking cookies. If we add analytics or marketing tools later, we will ask for your consent first and update this section.
Fonts: the page loads the Plus Jakarta Sans font from Google Fonts. Your browser therefore connects to Google, which receives your IP address. Google processes this data under its own privacy terms.
7. Security
All connections to the site should use HTTPS encryption. Access to stored requests is protected by access controls and a secret access token. We limit access to staff who need it for their work.
8. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you (Article 15),
- have inaccurate data corrected (Article 16),
- have your data deleted (Article 17),
- restrict how we use your data (Article 18),
- receive your data in a portable format (Article 20),
- object to processing based on our legitimate interests (Article 21), including direct marketing at any time.
To use any of these rights, email [privacy@yourdomain.example]. We will reply within one month. We may ask you to confirm your identity first.
9. Withdrawing consent
You can withdraw any consent at any time. Withdrawal applies from that moment on and does not affect processing carried out before it. Each contact we send includes a way to stop further contact.
10. Complaints
If you believe we handle your data unlawfully, you can complain to a supervisory authority. For [Company name], the competent authority is [name and address of the state data protection authority]. You can also contact the authority in the country where you live.
11. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. For significant changes we will inform you by email if we hold your address.