1. Definitions

Terms not specifically defined in this Privacy Policy have the meaning defined in the GDPR, such as "personal data" and "processing" as defined in Art. 4 GDPR:

• Personal data: means any information relating to a natural person which can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.
• Processing: means any operation related to personal data, such as collection, recording, organisation, filing, storage, adaptation or alteration, disclosure or any other use.

2. Party responsible and data protection officer

Unless otherwise stated in this privacy policy, the controller for the processing of your personal data described herein is the data controller within the meaning of Art. 4 No. 7 DS-GVO:

Teylor AG („Teylor“)
Zwicky-Platz 3
8304 Wallisellen
Zürich
Schweiz

Telefon: +49 (0) 7531 5848130
E-Mail: info@teylor.com

The Data Protection Officer of Teylor is:

Herr Wolfgang von Sandersleben
DP Dock GmbH
Ballindamm 39
20095 Hamburg
Deutschland

E-Mail: teylor-ag@dp-officer.com

The representative in the European Union of Teylor is:

Teylor AG (Niederlassung Deutschland)
Lohnerhofstr. 2
78467 Konstanz
Deutschland

Telefon: +49 (0) 7531 5848130
E-Mail: info@teylor.com

3. Provision of the website and log files

3.1 Description and scope of data processing

If you visit our website or use our platform, the following data and information is automatically transmitted to us by the computer system of the calling computer:

• Browser type and browser version;
• Operating system used;
• Website from which you are visiting us (referrer URL);
• host name of the accessing computer;
• Date and time of the server request;
• IP address.

This data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

3.2 Purpose of data processing

The storage in log files takes place in order to ensure the functionality of the website and the platform as well as to be able to offer you the visit of our website and our platform in a technically effective way: e.g. the temporary storage of the IP address is necessary to enable the delivery of the website or the platform to the user's computer; furthermore, the correct display of the website and platform requires an adaptation to the needs of your device.

Furthermore, this data is collected to ensure the security of our information technology systems, in particular to defend against attempted attacks on our servers and the website or platform.

3.3 Legal basis for data processing

The legal basis for processing for the purpose of technically optimal presentation of the platform and the website is Art. 6 para. 1 lit. b) DS-GVO, which permits the processing of data for the performance of a contract or pre-contractual measures.

3.4 Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website or the platform, this is the case when the respective session has ended.

In the case of storage of data in log files for the purpose of system security, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is no longer possible.

3.5 Possibility of objection and removal

The collection of data for the provision of the website or the platform and the storage of the data in log files are absolutely necessary for the operation of the website or the platform. Consequently, there is no possibility to object.

4. Use of cookies and analysis tools

We use cookies, similar technologies (collectively referred to as "cookies") and analytics tools to store information about your preferred activities, to better tailor our offers to your interests and to increase the speed of your requests, as well as for advertising purposes. You can find more details on this in our separate Cookie Policy.

5. Data processing in the provision of the platform

5.1 Description and scope of data processing

5.1.1 Registration

In order to make use of mediation of loans on our platform, you must register via the website. This requires us to collect and process certain personal data as registration details as part of the registration process. This data includes the following:

• Email address;

• User ID for registration, password if applicable;

• Choice of language of the platform;

  Circumstances of the registration, which are, among others, the log data (section III) at the time of registration, reconfirmation of the registration by the platform user.

5.1.2 After registration

After registration, a personal user account is generated for the user on the platform. In the protected user area, the user can view and manage his user data, which we store for him. This user data includes, in particular, user master data, company data and uploaded documents which you make available to us for evaluation via the mechanisms provided on the platform, as well as credit mediation-related data (such as due date and repayment of the loan).

5.2 Purpose of data processing

We collect and process your personal data mentioned in section V.1. for the following purposes:

• for the establishment, execution or termination of the platform usage and brokerage contract with the platform user;
• for the configuration of options of the user area, e.g. language;
• to ensure that you are presented with and can use the Platform in the most effective and appealing way possible (e.g. through statistical analysis);
• for the technical realisation of the functions of the platform, in particular for the retrievability of the user data stored in the user area for the user, uploading of documents and their forwarding to the lending partner banks selected by the user;
• to monitor the use of the platform in accordance with the law and the contract (e.g. by means of user name, password);
• to provide technical support;
• to inform the user about changes to our services.

5.3 Legal basis for data processing

Insofar as we process your above personal data in connection with the initiation and execution of a contract with you, the legal basis for this data processing is Art. 6 para. 1 lit. b) DS-GVO (fulfilment of a contract, pre-contractual measures). This concerns the registration and processing of the platform use and brokerage contract as well as the initiation of the credit agreement with cooperating partner banks.

If the processing is necessary to protect our legitimate interests or those of a third party and your interests, fundamental rights and freedoms, which require the protection of personal data, do not outweigh our interest, the legal basis is Art. 6 (1) sentence 1 lit. f) DS-GVO (protection of legitimate interests). This is the case in matters of security of the operation and data of other users of our platform as well, if we have reason to suspect that your access is being used in an unauthorised manner or otherwise poses a risk. In this case, our interest in measures that also preventively ensure secure operation and protection of the data of other users outweighs your interest in ensuring that your data is not used for these purposes. You can object to the processing of this data at any time. Section XVII.6 applies to the objection.

5.4 Duration of processing

Subject to a request for deletion, the data will be stored for as long as we need this data to perform the platform usage and brokerage contract with you. We will also delete your data or restrict its use (cf. below) if you finally log off from the platform using the delete function and thus terminate the platform use and brokerage contract.

Longer-term storage takes place in the following cases:

• if we are obliged to do so due to legal or official regulations or measures, e.g. if the data, such as billing data, fall within the scope of legal retention obligations. As a rule, this data will not be retained for longer than the retention period of four years (for correspondence) or 10 years (for accounting-related data) required by commercial and tax law;
• if we have a legitimate interest in storing the data which outweighs your interest in deleting it, e.g. if the data is needed to assert claims against you.

Deletion then takes place after the longest running reason for storage has ceased to apply and in the ordinary course of business.

6 Data processing for the arrangement of partner loans

6.1 Description and scope of data processing

In the context of the platform user's application for a loan as well as the review, support and administration of the loan agreement, it is necessary that you provide us with information in this context and that we process data which may also have a personal reference under certain circumstances. The processing of your personal data in the context of credit mediation is carried out as explained below:

6.1.1 Credit assessment

Obtaining information from credit agencies

We initially carry out a credit check of the platform user on the basis of the data which we receive from the credit agencies named below in order to present the platform user with a suitable financing partner (the "lending bank") on the basis of the default risks determined in this way and the purpose and amount of the intended loan.

For this purpose we use Creditreform Düsseldorf / Neuss Waterkamp, Zirbes & Coll. KG, Heesenstr. 65, 40549 Düsseldorf (the "Creditreform"). We transmit the following data to Creditreform for this purpose:

• Company name;
• company address;
• Company form

Creditreform then calculates and transmits a risk score of the platform user to us. On the basis of the risk score and taking into account the purpose and the amount of the intended loan, we look for one or more suitable financing partners from our cooperating partner banks and present you with the corresponding products.

Determination of the individual score value of the platform user according to the specifications of the partner bank.

The further referral to some of our partner banks (e.g. to Raisin Bank) requires a further determination of the platform user's credit risk based on additional criteria and the processing of further platform user-related data. If the platform user decides to make an offer to take out a loan with such a partner bank, we calculate the potential default risk of the platform user according to the individual specifications of this partner bank based on the information of the credit agencies, the company data of the platform user, the previous history of borrowing via our platform, the purposes and the amount of the intended financing and transmit this score value to the corresponding partner bank bearing the default risk.

Obtaining the Schufa information on behalf of the lending bank

In the last step, depending on the requirements of the lending bank with which the platform user has applied (e.g. Raisin Bank), it may be necessary for us to obtain creditworthiness information from SCHUFA Holding AG Kormoranweg 5, 65201 Wiesbaden (hereinafter "SCHUFA") on behalf of and in accordance with the instructions of such partner bank about the shareholders or beneficial owners of the platform user, who may also act as guarantors for the loan applied for by the platform user. For this purpose, we must transmit personal data (name, date of birth, registration address) of the shareholders or beneficial owners of the platform user to SCHUFA so that you can be clearly identified there.

SCHUFA then calculates and transmits a risk score of the shareholders or beneficial owners of the platform user and provides us with this and other personal data of the shareholders or beneficial owners of the platform user, such as your place of birth, your telephone number or your previous addresses, for forwarding to the relevant lending bank.

6.1.2 In the context of the application process

In the context of applying for a loan from a partner bank that is eligible for the platform user, we collect and process the following information:

• Requested loan amount;
• Desired term of the loan;
• Company purpose and industry;
• Intended use of the loan amount;
• Account details (bank and IBAN main business account);
• Data relating to the signatory of the loan agreement: name and surname; sex; address; telephone number; tax identification number; date of birth; nationality; authority to sign.
• Circumstances of communication with you relating to the offer, insofar as this relates to the brokered offer.

We also require information relating to your business (the "Business Data"). These include but are not limited to:

• Company name, address and registered office;
• email address;
• Type of company (AG, GmbH, etc.);
• Number of employees;
• Length of time the company has been in existence;
• Branch of business;
• power of representation (details of the natural person(s) authorised to represent the company (e.g. managing director/ board of directors);
• Commercial register number;
• Tax information (e.g. tax identification number);
• Information on beneficial ownership, turnover, balance sheets and depreciation;
• Bank statements;
• Details of corporate relationships and shareholdings.

In order to execute the platform usage and brokerage agreement between you and us and to carry out pre-contractual measures, we will transmit the aforementioned data to the loan-granting bank selected and confirmed by you and will also receive data from it for the purpose of transmitting it to you.

6.1.3 Obtaining guarantees

On our platform we provide functionalities for the automated creation of personal guarantees. If you want to act as a guarantor for a Platform User's credit application, you can use this function to enter your data as a guarantor or upload the guaranty you have signed. In this case, we will collect and process your data required for the creation of the guarantee and transmit it to the lending bank. Furthermore, our platform enables the platform user to upload and download written guarantees for transmission to the lending bank.

6.2 Purpose of data processing

The purpose of the processing of your data mentioned in section VI. 1. is the mediation of the offers of our partner banks to the platform user. In detail, we use your data:

• for the identification of offers from our partners that are suitable for you;
• for the initiation of a credit agreement with the partner requested by you, in particular to avoid duplicate entries and to carry out preliminary checks;
• for the processing of mediation-related queries insofar as the contract with the partner bank has not yet been concluded; this does not exclude the possibility that we may later provide support on behalf of some of our partner banks during the term of the contract;
• Provision of documents and information required by our partners to make a decision on a loan application, e.g. excerpts from the commercial register, information on shareholdings or the applicant's individual score.

6.3 Legal basis for data processing

Insofar as we process your data mentioned in section VI. 1.1. (with the exception of section 1.1.3), 1.2, in order to be able to present and arrange a suitable partner bank for you as a platform user based on the information provided by the credit agencies, we process this data on the basis of Art. 6 para. 1 sentence 1 lit. b) DS-GVO, as this processing is necessary for the fulfilment of our platform use and brokerage contract and the initiation of a credit agreement with the lending bank is based on the request of the platform user.

Insofar as we transmit the individually determined score value of the platform user to the lending bank as the separately responsible party in accordance with section VI. 1.1.2, the legal basis for the transmission is Art. 6 para. 1 sentence 1 lit. f) DS-GVO. The legitimate interest of the lending bank lies in the assessment of your contractual default risk. You have the right to object to this processing of your personal data vis-à-vis the lending bank or us. Please refer to section XVII. 6 of this data protection declaration for the legal consequences of the objection.

If we process your creditworthiness-related data as a partner or as the beneficial owner of the platform user for the purpose of obtaining SCHUFA information in accordance with section 1.1.3, the respective partner bank (e.g. Raisin Bank) bears sole responsibility under data protection law. The general terms and conditions and data protection provisions of the respective banks apply, which you can find under the corresponding link in section XV.1. The legal basis for the lending bank commissioning us as its processor within the meaning of Art. 28 DS-GVO is the fulfilment of the legal obligation of the lending bank pursuant to Section 25a KWG, and thus Art. 6 (1) sentence 1 lit. c) DS-GVO. More detailed information on the activities of SCHUFA can be found in the SCHUFA information sheet pursuant to Art. 14 DS-GVO or online at www.schufa.de/datenschutz.

Insofar as we process your personal data in order to enable you to create or upload and transmit your guarantee to the lending bank of the platform user in accordance with section VI. 1.3, we process this data on the basis of Art. 6 (1) sentence 1 lit. b) DS-GVO, as this processing is necessary at your request for the initiation of a guarantee agreement with the lending bank.