GDPR Compliance

1. Our Commitment to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that regulates the use of personal data across the EU. FORTIS LEASE is fully committed to compliance with the GDPR requirements. We believe that true data privacy means giving you control over your own data.

2. Your Rights Under GDPR

As a user located in the European Economic Area (EEA), you have specific rights regarding your personal data. We are dedicated to ensuring you can exercise these rights:

• Right to Access: You have the right to request copies of your personal data.
• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure ("Right to be Forgotten"): You have the right to request that we erase your personal data, under certain conditions (e.g., if the data is no longer necessary for the loan contract).
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, machine-readable format.
• Right to Object: You have the right to object to our processing of your personal data, under certain conditions.

3. Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so.

• Contractual Necessity: Processing is necessary for the performance of a loan agreement to which you are a party or to take steps at your request prior to entering into a contract.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (e.g., anti-money laundering laws).
• Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g., marketing newsletters). You can withdraw this consent at any time.
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., fraud prevention, network security) unless there is a good reason to protect your data which overrides those legitimate interests.

4. Data Controller vs. Data Processor

FORTIS LEASE acts as a Data Controller for the information you provide directly to us (such as your contact details and financial information). This means we determine the purposes and means of processing your personal data.

We may use third-party service providers (Data Processors) to process data on our behalf (e.g., cloud hosting, email delivery). We ensure all our processors are GDPR compliant through strict Data Processing Agreements (DPA).

5. Data Retention

We will retain your personal data only for as long as is necessary for the purposes set out in this policy. We will retain and use your data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable banking laws), resolve disputes, and enforce our legal agreements and policies.

6. International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.