PRIVACY POLICY

This Privacy Policy (hereinafter – Policy) sets the main information about processing of personal data of heavyfinance.com (hereinafter – HEAVY FINANCE) website visitors and newsletter subscribers, clients, their representatives, beneficiaries and candidates to the job positions related to HEAVY FINANCE.

We would like to inform you that the controller of personal data is UAB HEAVY FINANCE, legal entity code 305576227, domicile address Birutės str. 18-1, Vilnius, Lithuania (hereinafter – Operator).

If you have any questions regarding the protection of your personal data or this Policy, you can contact us by e-mail [email protected].

When processing your data, we follow not only this Policy, but also the General Data Protection Regulation, the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania and other applicable legal acts and instructions and recommendations of supervisory authorities.

When processing your personal data, we adhere to principles of lawfulness, fairness, transparency, purpose limitation, data minimization and storage limitation, accuracy, we do not collect nor require data subjects to submit data which is not necessary.

This Policy may be updated. In such cases, an updated Policy version is published on the website of HEAVY
FINANCE.
1. Processing of personal data for the purpose of providing crowdfunding services, personal
identification, money laundering and terrorist financing requirements
1.1. Operator manages personal data of its clients’ (their representatives, employees) and persons’ who
ensure obligations of the clients for the purpose of providing crowdfunding services and, among other
things, including:
1.1.1. Implementation of money laundering and terrorist financing prevention requirements;
1.1.2. Dispute resolution;
1.1.3. Management of debts to Operator;
1.1.4. Implementation of other statutory requirements applicable to the activities of Operator.
1.2. For this purpose, the following data of clients of Operator and persons who ensure obligations of the
clients is processed:
1.2.1. Data verifying personal identity (first name, last name, personal identification number, date of
birth, etc.);
1.2.2. Contact data (registered address, e-mail address, telephone number, etc.);
1.2.3. Data about data subject’s relations with legal entities (position at the company, etc.);
1.2.4. Data used to access the client’s account on the website of HEAVY FINANCE (client’s account
ID, password, etc.);
1.2.5. Financial data (personal credit rating, financial liabilities, revenues, data on property, loans,
information about transactions concluded on the platform of HEAVY FINANCE, its volumes,
etc.);
1.2.6. Data on the client’s (lender) knowledge and experience in the field of investment;
1.2.7. Other data that you provide, and (or) is required for the provision of Operator services.
1.3. In order for you to log in to the HEAVY FINANCE platform through your Facebook or Google account,
we may receive your data (name, e-mail address, profile picture and / or other data) from these platforms.
You will be notified separately by the said platforms about the exact list of personal data that is
transferred to us in order to connect you to the platform (before transferring this data to us).
1.4. Client’s personal data is stored for 10 years from the date of the execution of transaction, submission of
the respective application or execution of transaction, unless legal acts establish longer terms of storage
of such data.
2. Processing of personal data for direct marketing purposes
2.1. On the HEAVY FINANCE website, you can subscribe to newsletters about the latest crowdfunding
projects published on the website, as well as news related to HEAVY FINANCE’s activities. In the
latter case, Operator processes your personal data for the purpose of direct marketing, i.e. for the purpose
of sending the respective newsletters.
2.2. The basis of processing the respective personal data is your consent, expressed by subscribing to
HEAVY FINANCE’s newsletters on our website. For this purpose, Operator processes your name and
e-mail address.
2.3. The retention period of your personal data is 3 years from the date of receipt of your consent, unless you
withdraw such consent before the end of the specified retention period.
2.4. Operator, pursuant to Article 69(2) of the Law on Electronic Communication, may also process its
current clients’ data for direct marketing purposes on the basis of a legitimate interest of the company.
2.5. You have the right to opt out of the HEAVY FINANCE newsletters sent to you at any time. You can do
this by clicking on the link at the bottom of the newsletters sent to you or by contacting us in writing
(by e-mail [email protected]).
3. Processing of personal data upon your requests
3.1. Upon contacting with Operator by e-mail, telephone, by submitting requests through social networks or
in any other way, Operator processes personal data that you submit in order to administer the requests
received, ensuring quality of the services provided, if necessary – to carry out a variety of legal
requirements and protect interests of Operator. The basis for the processing of such data in the cases
provided for is the legitimate interest of Operator.
3.2. When submitting a request, please observe at least the minimum requirements for the protection of
personal data – do not provide excessive personal data that is not necessary for the intended purpose,
i.e. the filing of request, complaint, letter.
3.3. The personal data that you submit with your request to Operator is usually stored up to 3 years. The
retention period may depend on the content and nature of the personal data provided to Operator, as well
as other circumstances. If it necessary for the defense of the rights and legitimate interests of Operator
(or other persons), proper administration of the requests, resolution of dispute or complaint, as well as
in other cases provided for by the laws, your personal data may be stored for a longer period of time.
4. Processing of personal data for statistical purposes
4.1. While implementing the requirements of the Law on Crowdfunding, Operator processes your personal
data for statistical purposes (e.g., the amount of concluded transactions, amount of investments, etc.).
such data is processed in such a way that it would not be possible to identify a specific data subject.
4.2. The retention period of personal data processed for this purpose depends on the requirements of the legal
acts applicable to Operator and regulating Operator’s obligation to publish statistical data.
5. Processing of personal data of staff candidates
5.1. Operator processes your personal data (CV, motivational letter, etc.) when you provide the respective
data as a candidate to the job position proposed by Operator. The basis for processing the respective
personal data is your consent, expressed by submitting the respective data.
5.2. The retention period of data you submit depends on the duration of the selection process of the respective
position carried out by Operator. After the respective selection process is finished, Operator will process
your personal data only if you give a separate consent.
5.3. If you submit your CV, motivational letter or other personal data to Operator when no selection is
published, the respective personal data may be retained and used for later selections of the staff for up
to 1 year.
5.4. By sending your CV, motivational letter or other personal data for the use for selection procedures that
are carried out or will be carried out in the future, please abide by at least the minimum requirements of
data protection and do not provide excess information that is not related to your candidacy.
6. Sources and recipients of personal data
6.1. Unless otherwise stated in this Policy, we receive data about you directly from you (e.g. when you
register on the HEAVY FINANCE platform). When assessing the reliability of project owners in
accordance with the Law on Crowdfunding and acts adopted by the Bank of Lithuania, as well as
administering loan agreements in favor of financiers, resolving disputes and (or) in other cases specified
in this Policy, we have the right to obtain additional data related to you from other sources (e. g. public
registers, credit bureau systems, etc.). As far as the change of the platform operator is concerned, your
personal data processed by the previous platform operator for the purposes specified in this Policy before
the date of the change of the platform operator shall be securely transferred to the Operator (i.e. the new
platform operator). The latter processes the received data in order to achieve the same objectives
specified in the Policy, thus ensuring the continuity of the platform’s activities.
6.2. Operator may use certain service providers while carrying out its activities (e.g. companies providing
data storage services, companies implementing and supporting software, companies providing debt
administration services, companies providing communications services, etc.) to whom your personal
data may be transferred. Your personal data is transferred to the respective service providers only when
and to the extent which is necessary for the provision of the respective services.
6.3. Operator may also provide your personal data to the following recipients:
6.3.1. State institutions and registers (Bank of Lithuania, Department of Lithuania Statistics, notaries,
bailiffs, law enforcement institutions, etc.);
6.3.2. Persons administering joint debtors’ data files (e.g., UAB “Creditinfo Lietuva”);
6.3.3. Providers of payments and other services, as well as other financial institutions that Operator
relies on in its activities;
6.3.4. Other companies where this is necessary for financial accounting, auditing, risk assessment or
provision of services;
6.3.5. Other third parties involved in the provision of our services and (or) having legal basis to obtain
such data;
6.3.6. In case of change of operator of the HEAVY FINANCE crowdfunding platform – to the new
operator of the platform.
6.4. In all cases, reasonable effort is made to ensure the implementation of the requirements of legal acts and
to protect personal data from loss or unauthorized use.
7. Your rights as data subject
7.1. As data subjects, you have the following rights:
7.1.1. to access your personal data and how it is processed;
7.1.2. to require rectification of incorrect, inaccurate or incomplete data;
7.1.3. to require deletion of your personal data;
7.1.4. to restrict the processing of your personal data;
7.1.5. to require transferring your personal data to another data controller or to provide it directly to
you in a form convenient to you;
7.1.6. to disagree with the processing of your personal data if its processed on the basis of a legitimate
interest;
7.1.7. to withdraw your consent to the processing of your personal data.
7.2. If you believe that your personal data is processed unlawfully or your rights regarding the processing of
personal data have been violated, you have the right to contact the State Data Protection Inspectorate.
7.3. However, we recommend that you first contact Operator (by e-mail [email protected]) immediately
before contacting the State Data Protection Inspectorate. In this way, we will together find the most
operative and mutually optimal solution to the problem.