Privacy Policy

PERSONAL DATA PROTECTION POLICY

Introduction

• 1. This platform, hosted at www.oriva.com (the "Platform"), is operated by ORIVA Microfinance S.A., the Microfinance Institution trading under the name Oriva Microfinance Institution S.A., with its registered office at 1 Nestoros Street, Chalandri, 15231, Tax Identification Number (AFM) 801501758 ("Oriva", the "Company" or "We"), which operates in accordance with Law 4701/2020, as amended and in force. Our Company offers products and services in the field of microfinance, with the aim of fostering innovation and creating funding opportunities for small and medium-sized enterprises in Greece, under the direct supervision of the Bank of Greece.
  2. Through this Platform you can learn more about the various products and services we offer (you can find more information about our "Products & Services" at support@orivafinance.com), become our customer, and transact with us to manage the products and services you have acquired.
  3. At Oriva we pay close attention to protecting your personal data, focusing on lawfulness, security, and transparency in its processing. To this end, we have established this personal data protection policy (the "Policy").
  4. This Policy is addressed to all prospective and active customers of our Products and Services, to natural persons acting in their capacity as legal representatives of legal entities, to visitors of the Platform, and to other persons who access our Products & Services and digital channels, as well as to third parties who supply products to our customers and to other third parties whose data is provided by the aforementioned persons for the provision of our Products and Services ("You").
  5. This Policy has been adopted in accordance with Regulation (EU) 2016/679, namely the General Data Protection Regulation, also known as the GDPR, as well as in accordance with the legislation governing data processing, such as, for example, Law 4624/2019, which transposed the GDPR into Greek law, Law 3471/2006 (concerning the processing of personal data for communication purposes), and the decisions and guidance of the competent Authorities.
  6. Below you will find information about the terms under which your data is processed by Oriva, both in respect of processing carried out through our digital (and other remote) channels and through in-person interactions, including:

1. information about us, the data controller, and the relevant contact details for any matter relating to your personal data;
2. the types of personal data we collect, store, share, and use;
3. the purpose and legal basis of the processing;
4. security measures to protect and store your data, and retention policies;
5. the recipients of your personal data;
6. your rights and how to exercise them.
   1. When you use our Products and Services, including when you visit our Platform, we act as the Data Controller of the data you provide to us. For any matter relating to personal data, you can call 210 260 2751 or email us at support@orivafinance.com.
   2. This Policy should be read together with our Cookies Policy and our Terms and Conditions, as those texts form an integral part of this Policy and, together, constitute a single, legally binding document.
   3. By continuing to use the Platform and our Products and Services, and when you transact with us in general, you declare that you have read and understood this Policy, on the basis of which your personal data and information is processed. If you do not agree with the practices described in this Policy, please refrain from communicating and transacting with us. Should you need any clarification or further information, please do not hesitate to contact us before taking any action concerning the processing of your data. Please note, however, that any clarification provided to you in this regard does not constitute an amendment to or replacement of this Policy and is provided solely for clarification purposes and for your convenience. We invite you to review this Policy from time to time to stay informed of any changes we may make. If you do not agree with the amendments, please refrain from further use of this website, the Platform, and Oriva as a whole.
   4. Depending on the product or service you use, specific terms may apply and specific information about the processing of your data may be provided, which will prevail. You should read this Policy together with those specific terms.
   5. Oriva reserves the right to make amendments to this Policy, for example in order to comply with new requirements imposed by applicable laws, guidelines, or technical requirements, or where it revises the procedures or practices it applies. In the event of significant changes, you will be informed in good time and in an appropriate manner. Your continued use of the Platform confirms that you have been informed of this Privacy Policy and of any update to it.

Personal Data and Data Processing

• 1. Under the General Data Protection Regulation 2016/679 (GDPR), personal data means any information that can lead, either directly or in combination with other information, to your identification as a natural person.
  2. The processing of personal data consists of the collection, recording, organisation, structuring, storage, modification, retrieval, consultation, use, transmission, restriction, or erasure of personal data that has come, or will come, to Oriva’s knowledge.
  3. Oriva processes the personal data that you, or a legal representative, have submitted or are about to submit to Oriva, and which is necessary for the commencement, maintenance, and performance of your transactional relationships with Oriva, whether existing or future, depending on the product or service provided and Oriva’s applicable procedures and policies. It is your responsibility to ensure that the personal data you provide to us is, at all times, complete, accurate, and up to date, in every case where it changes or whenever Oriva considers it necessary in order to maintain your transactional relationships or to fulfil an obligation of Oriva arising from the law and applicable regulatory provisions.
  4. Specifically, the data we collect about you includes:

1. Identity data (name, identity card number, Tax Identification Number (AFM), tax residence, date of birth, copies of documents certifying the above data).
2. Demographic data (gender, marital status).
3. Contact details (address, email, telephone number).
4. Application login data (login credentials, e.g. username, password). Please note that Oriva retains only the customer’s username as it is. The password is kept encrypted solely for the purpose of verifying its authenticity when you wish to log in to the application, and Oriva does not know the password itself.
5. Biometric data (photograph, image). Oriva processes your biometric data only during your identification as part of the digital registration process, and not while you use the application. Oriva retains the above information about you for the purpose of remote electronic identification, in order to comply with the regulatory framework for the prevention of money laundering and terrorist financing, as in force from time to time, and specifically in order to comply with the regulatory framework of the Bank of Greece. The legal basis for the processing is your explicit consent, which you may withdraw at any time, without such withdrawal affecting the lawfulness of the processing carried out prior to the withdrawal. Oriva has assigned this processing activity to a third-party partner. The data is retained for a period of five (5) years after the end of our business relationship. After that period, your data will be erased, unless its retention is required by another law or regulation for a longer period.

The remote electronic identification (e-KYC) procedure is carried out in accordance with the terms of Bank of Greece Executive Committee Act (PEE) 178/1/2.10.2020. The Institution is required to inform the Bank of Greece of any significant change to this procedure.

1. Financial data, transaction data, and related banking data connected with the use of our Products and Services (depending on the type of product or service provided, or for the assessment of your financial capacity in order to determine, settle, or restructure your debts, such as: tax returns, tax assessments, ENFIA (property tax) declarations, financial data of sole proprietorships, information on other sources of income, valuations of your assets, information on real estate provided as collateral, insurance policies). Oriva knows your account number and IBAN, but not your PIN or other credentials. Any credentials you hold for using the services and products of other payment institutions are kept at the relevant payment institution, and Oriva has neither access to nor knowledge of them.
2. Data concerning your financial and credit situation, obtained when you apply for credit products, such as data obtained from third-party service providers that hold creditworthiness data (e.g. Teiresias, the Hellenic Development Bank, eGOV), which include information on previous loans, details such as income data, age, professional or student status, transaction data relating to the product in question (such as the products you have purchased, the purchase amount, the merchant’s name), data relating to your employment, and financial obligations concerning you or third parties connected with you.
3. Communication content (the content of messages, including the recording of your voice during a call to the call centre).
4. Technical data and cookies, including: the type of device you use and its operating system, the internet protocol address (IP address), the ISP you use to connect your device to the internet, your time zone, screen resolution, the device’s location, including specific geographic locations, information about app usage, application performance measurement data, application response times, download errors, the duration of page visits, interaction information (such as scrolling, clicks, and mouse movements over specific elements), the methods used to access and exit pages, date/time and/or click data, the types of content you view or interact with, and other websites and applications you have visited. For more information about the processing of this data, please see our Cookies Policy.

Your personal data is collected:

• 1. Directly from you, in cases such as:

1. when you complete applications expressing your interest in acquiring our Products and Services or in partnering with us;
2. in the context of the transactional relationship you maintain with Oriva;
3. when you take part in promotional activities and marketing campaigns;
4. when you use our online and digital services;
5. when you contact us by email or telephone, by calling our call centre, or when you interact with us on social media.
   1. From third parties, such as:
6. from public-sector sources accessible to credit institutions and similar organisations (when searching data from sanctions lists, beneficial-owner registers, politically exposed persons – PEPs, data obtained from eGovKYC, and data such as the credit score obtained from Teiresias and the credit bureaus we work with);
7. in the context of information that Oriva receives from third-party natural or legal persons or public-sector bodies in the exercise of its legal rights;
8. when we receive information from other financial institutions and payment institutions concerning your payments to us;
9. when a request concerning you is submitted to us (when a transaction is disputed, or when a complaint is lodged);
10. when you apply for credit products, we may request information about you from third-party credit bureaus and creditworthiness assessment organisations regarding your creditworthiness, your financial situation, and previous and current debts (the information collected from the Teiresias Interbank Information System includes, among others: dishonoured cheques, unpaid bills of exchange and promissory notes, bankruptcy petitions and decisions rejecting bankruptcy petitions due to insufficient assets of the debtor, reorganisation petitions and decisions, declared bankruptcies, payment orders and rent payment orders, auctions of real and movable property, mortgages, mortgage pre-notations, seizures of real estate, and petitions and decisions for the judicial settlement of debts). Please note that, where a third party submits a corresponding loan application, we may search for the above information about you on account of your existing relationship, e.g. marital status;
11. We may also access other relevant registers (including commercial registers, land registries and the national cadastre, and registers containing information on income, credit history, debts owed to third parties, addresses, and invalid identity documents) and retrieve information held by tax or other authorities in order to cross-check the information you have submitted.
12. from our partners in the context of marketing campaigns (competitions, offers, customer satisfaction surveys, data analytics providers);
13. from publicly accessible sources.
    1. By automated means, in cases such as:
14. when you use our digital application and other digital means;
15. when you accept the use of cookies, tracking beacons, or other similar technologies.

Purposes and Legal Basis for Processing

• 1. Oriva processes your data for specific legitimate purposes, which include, in brief:
• identifying you / confirming your identity and taking measures to combat criminal acts, in accordance with the law;
• providing our Products and Services, including our Platform, and communicating with you in your capacity as our customer;
• communicating with you when you submit a relevant request to Oriva without being our customer (e.g. when you call our call centre or contact us through our contact form);
• sending marketing material and carrying out promotional activities;
• ensuring the proper operation of our digital channels, mainly our application, and improving the products and services we provide.
  1. When processing your personal data, Oriva always relies on the appropriate legal basis that permits its processing for the relevant purpose. The legal bases on which Oriva’s processing relies include:
• Performance of the contract we have entered into with you, when you accept our General Terms and Conditions and make use of our products and services.
• Your consent, when you voluntarily provide us with your data.
• Our legitimate interest, which is reasonably balanced against the protection of your privacy.
• Our compliance with our legal obligations, as defined by the relevant legislation.
  1. The table below sets out in detail the purposes for which we process your data, lists which of your data we use for each purpose, and includes the relevant legal bases on which we rely for the processing.

• 1. Processing of third-party data to provide our services to our customers: We may process the personal data of third parties (including identity data, demographic data, contact details, and financial/transaction/banking data) who are not in a direct contractual relationship with us, where a customer has provided information about them in order to obtain any Product or Service we offer. This data is provided directly by our (prospective) customer or retrieved directly from third parties, on the basis of our legitimate interest, e.g. in cases where we need to verify our customer’s identity or assess their creditworthiness in order to receive our Products and Services. This includes cases where:
     1. you have supplied your products or services (as a merchant) to our customer and our customer must provide us with evidence of that transaction; you have a family relationship (e.g. you are married) or have previously entered into a contract (e.g. as a guarantor or lender) with our customer.
     2. We may obtain access to data concerning you in order to identify our customer or verify their creditworthiness.
  2. Where processing is based on consent, that consent is requested separately and may be withdrawn at any time, without affecting the lawfulness of the processing prior to the withdrawal. You also have the option to withdraw your consent to receiving commercial communications by email at any time, by clicking the unsubscribe button that you will find in the communication you receive.
  3. Where the legal basis for processing your data is the legitimate interest of our Company, you have the right to object by contacting us at our contact details. In any case, you can adjust your communication preferences at any time, where possible, through the Platform. We remind you that disabling certain communication functions may not be possible, taking into account Oriva’s legal obligations to provide you with information or to notify you of certain events.
  4. We will process your personal data on the basis of our legitimate interest, where required in the context of defending our rights, as well as Oriva’s compliance with its legal obligation, when we receive documents, requests, orders, reports, warrants, etc. from third parties, legal authorities, or bodies, such as supervisory, prosecutorial, judicial, and tax authorities and supervisory bodies, for the investigation of crimes and your protection against fraud, or for combating any form of crime and infringement of legal assets.
  5. In certain cases, we may choose to anonymise certain data. In such a case, your data is no longer considered personal, as it cannot identify you directly or indirectly, and we may therefore continue to process it indefinitely.

5. Recipients of Your Data

5.1. In order to provide you with all the Products and Services we offer, we work with third-party partners, to whom we transmit your data solely for those purposes. Specifically, we transmit your personal data to:

1. Providers of identification and certification services for natural persons;
2. providers that host and develop our digital channels, including our application, and maintain our information systems;
3. providers that support our operations through the execution and clearing of transactions, risk assessment and fraud detection, and the prevention of money laundering and terrorist financing;
4. Banking and financial services and payment networks, including Visa and Mastercard;
5. Debt collection companies;
6. Customer service providers;
7. Courier services, e.g. to send you your physical card;
8. Communication services, to send messages and Push notifications;
9. Advertisers and analytics service providers for the promotion and advertising of our products and services (advertising companies, public relations firms, research companies, search engines);
10. Credit bureaus, in the context of mutual data-sharing agreements. This means that, in order to assess your creditworthiness based on your transactions with other credit institutions, we receive and provide relevant information to the credit bureau. The information we share may also be further disclosed by the credit bureau to other credit institutions, in accordance with the applicable agreements and regulations;
11. Public or private creditworthiness assessment companies, when the relevant information is requested for credit products you have applied for from other credit institutions. When processing and collecting direct debits or other payments you owe under a loan agreement, we may also disclose your personal data to third-party payment service providers.
    1. We will disclose your personal data to third parties if you instruct us to do so. For example, you may authorise third parties to act on your behalf (including lawyers, accountants, your relatives, or third parties, by power of attorney). We reserve the right to request evidence of the relevant authorisation for the third party to act validly on your behalf.
    2. We may also transmit your personal data to third parties in the following cases:
12. at any time, where required by law, we may disclose information to the competent supervisory authorities;
13. for the purpose of detecting, investigating, and preventing fraud and, in general, helping to protect us against fraudulent activities, in order to reduce credit risk;
14. for the detection, investigation, and prevention of money laundering and terrorist financing activities;
15. in the event of non-performance or inadequate performance of your obligations, we may transmit data concerning your outstanding obligations to debt management service providers, credit information bureaus, and legal service providers;
16. when selling (part of) our business or transferring your obligations towards us to third parties, we may also disclose your data.
    1. The data we collect about you is not transferred outside the European Economic Area (EEA). If a transfer outside the EEA is required, we take all appropriate measures to ensure the security of your personal data in accordance with this Policy and applicable legislation.

6. Data Retention Periods

• 1. We will retain the information concerning you for as long as is necessary to fulfil the purposes for which it was collected. After that, we will erase it. Data retention periods may differ depending on the purposes for which the information was collected. Please note that, in certain cases, you have the right to request the erasure of the information. However, we are sometimes legally required to retain the information, for example for tax and accounting purposes.
  2. To determine how long we retain your personal data, we take into account the nature of your data, its volume, the purpose, security, etc. You have the right to ask us to erase your data. To exercise your rights, please see Section … of this Data Policy.

• 1. Please note that any of the above data may be retained for a longer period if this is required by law, by any supervisory authority, or is necessary for the defence of a legal claim brought against us, against you, or against third parties, or where we need to defend our legal rights.
  2. The retention periods for third-party data processed in the context of our contractual relationship with the customer follow the retention periods of that contractual relationship.

7. Your Rights and Choices

• 1. You can exercise your rights in relation to the protection of your personal data using Oriva’s contact details mentioned above. For your convenience, we provide below a detailed table of your rights:

1. Right of access: You can ask us to confirm whether Oriva is processing your personal data, obtain access to any data we process about you, and receive relevant information about its processing, such as: what data Oriva holds, why it uses it, to whom it transmits it, whether it transfers it to third countries, how it protects it, how long it retains it, what rights you and Oriva have, and where it was collected in cases where it was not collected from you (unless disclosure of such information is prohibited by law). You can request a copy of the information we process in order to check the information we hold about you. The copy may be requested free of charge.
2. Right to rectification: You can ask us to update, correct, or erase your personal data at any time (to the extent permitted by applicable legislation and provided this does not affect the services we provide to you). If we are unable to carry out the relevant correction for technical or legal reasons, we will refer you to how you can correct any inaccuracy yourself. Oriva reserves the right to verify the accuracy of the data before proceeding with its correction, and is required to inform the recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. Please note that we may reject requests that jeopardise the privacy of other persons whose data we store, or that are unreasonable, repetitive, or would require disproportionate effort on our part. We must also comply with certain legal obligations that prevent us from immediately erasing your personal data. Such obligations arise, for example, from the legal framework for combating money laundering, tax legislation, and the consumer protection framework. In any case, where we cannot satisfy your request concerning your personal data, we will notify you in good time. We remind you that you must inform us in the event of any change to the data you have provided to us during the conclusion of the contract or in our future cooperation, in particular if it is found that the personal data we process about you is inaccurate.
3. Right to erasure: You can request the erasure of your data where (a) you have withdrawn the consent on which the processing is based, (b) it is no longer necessary for the purposes for which it was collected, (c) you find that it is being processed unfairly or unlawfully, or (d) you object to the processing. Oriva reserves the right to refuse the exercise of the above right if the processing of the data is necessary (i) for the purpose for which it was collected, (ii) for compliance with a legal obligation, or (iii) for the establishment, exercise, or defence of legal claims. When you terminate the contracts between us, you can request the erasure of your data. Erasure will be carried out only when the above conditions are met.
4. Right to restriction: You can ask Oriva to exercise the right to restrict processing, that is, to retain but not use your personal data, where (a) its accuracy is contested, so that you can verify its accuracy, (b) the processing is unlawful but you do not wish it to be erased, (c) the processing of the data is no longer necessary for the purposes for which it was collected, but our company still needs it for the establishment, exercise, or defence of legal claims, or (d) you object to its processing and are awaiting verification of the outcome, that is, whether our company’s legitimate grounds override your own legitimate claims.
5. Right to data portability: You have the right to ask Oriva to provide you with your personal data in a structured format, or to request that it be transferred directly to another data controller. The condition is that the data has been provided on the basis of consent or in the context of the performance of the contract, and that the data is held by automated means and not in printed form. A further condition is that the data has been provided by you; it does not apply where the data has been inferred by us on the basis of the data you have provided.
6. Right to lodge a complaint with the Supervisory Authority: We strive to protect your personal data and to ensure its secure processing and storage. However, if you believe that we have infringed your rights, please contact us to resolve any problems and concerns. You have the right to lodge a complaint with the local supervisory authority regarding our processing of your personal data. In Greece, the supervisory authority for data protection is the Hellenic Data Protection Authority – www.dpa.gr/.
7. Right to human intervention: When you apply for credit products, we will carry out automated creditworthiness and risk assessments to decide whether to grant a loan and to determine the relevant factors (e.g. its maximum amount). In the event of a fully automated decision, you have the right to object to the decision and to request that it be reviewed with human intervention.
8. Opt-out: Where processing is based on our legitimate interest, you can object to any such processing at any time. If you exercise your right to object, we have the right to demonstrate compelling legitimate grounds for the processing that override your rights and freedoms relating to your privacy; however, your fundamental rights and freedoms will not be affected. We remind you that where processing is based on our legitimate interest and is carried out for marketing purposes, you can opt out at any time, and we will not be able to demonstrate any overriding interest in this respect.
9. Right to withdraw your consent: Where the processing of your data is based on your consent, you can withdraw it at any time. In certain cases, withdrawing your consent may mean that we will not be able to provide you with certain elements of our Products or Services.
   1. True and accurate information: In order for us to respond to and/or satisfy your request accurately, you must always provide specific, accurate, and true data and/or details. Otherwise, we will not be liable for any errors. In addition, we have the right to reject requests that are unfounded, excessive, abusive, submitted in bad faith, or unlawful. We may also request clarifications in order to understand your concerns and expectations, so as to handle your request more effectively.
   2. Identity verification: We have the right to ask you for proof of your identity, in order to be able to satisfy your rights.
   3. Cost: You will not have to pay to exercise your rights in relation to your personal data, unless otherwise provided by law or in cases where the request is unfounded or excessive. In such a case, we may charge a reasonable fee, of which we will inform you before proceeding with your request.
   4. Time frames: Requests are handled within one (1) month, with the possibility of an extension of two (2) further months where the request is exceptionally complex or where the data subject has submitted multiple requests, in accordance with the legislation. Should we need more than one month to handle your request for the above reasons, we will inform you accordingly.

8. Security Measures

• 1. We take appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of your data, that is, to ensure that your personal data is transmitted, stored, and processed in accordance with appropriate technical information security standards and security procedures, as well as in accordance with the terms of this Policy and applicable data protection laws. We have adopted clear rules and strict controls to protect your data and our systems:
     1. Acceptable use: We have established strict guidelines on how our information systems are accessed and used, we monitor access, and we require the immediate reporting of any security incidents or credential leaks.
     2. Information classification: We classify information as public, internal, or confidential, and restrict access accordingly, in order to prevent unauthorised disclosure.
     3. Third-party security: We ensure that contracts with third parties include clear requirements for information protection, confidentiality, and access control.
     4. Access management: We restrict system access to authorised users, enforce strong authentication, regularly review access rights, and prohibit shared accounts.
     5. Physical security: We control physical access to our premises and IT systems, allowing entry only to authorised and trained personnel.
     6. Operational security: We carry out annual risk assessments, continuously monitor our systems, and keep detailed logs of key activities.
     7. Security testing: We carry out regular security audits and penetration tests, and act immediately to address any identified risks.
     8. Training: We provide annual security training to all our staff and partners, with the aim of reducing human error and strengthening the security culture.
     9. Risk Management: Data management is governed by the Institution’s ICT and Security Risk Management Framework, which is approved annually by the Board of Directors, ensuring the confidentiality, integrity, and availability of information.
  2. We take measures and strive to protect you 24 hours a day, 7 days a week, using technology and security measures that meet or exceed industry standards and averages, but you must also use our e-banking services carefully and exercise due diligence, for example:
     1. You are required to do everything possible and everything that can reasonably be expected of you to keep your data (such as your login details) secure; to log out immediately once you have completed the relevant actions; and not to allow anyone else to access your login details or to carry out transactions using them.
     2. Please notify us as soon as possible if you believe that your details have been lost, stolen, destroyed, or used improperly, or if you believe that someone may have accessed your accounts without your authorisation, or has discovered or disclosed your security details to third parties.
     3. Regularly run virus and malware scans on your devices.
     4. In malicious emails, website addresses may appear authentic at first glance, but a closer look may reveal a web address different from the one it should be, or claims to be. In our genuine emails, the link address includes the name of the person sending it to you, or the relevant department to which the message belongs (e.g. info, jon.doe), and always ends as: [@orivafinance.com]. If you receive an email claiming to be from Oriva and requesting personal information – such as passwords, passport numbers, national identity numbers, etc. – do not provide or enter such information. These messages are fraudulent and should be ignored immediately.
     5. Oriva will under no circumstances send emails requesting personal data from its customers. If you receive such messages and are unsure what to do, or need any other clarification, please do not hesitate to contact us at dpo@orivafinance.com.
  3. Your personal data is managed exclusively by our specially authorised staff, who carry out their duties under our control. To carry out the processing, Oriva selects individuals or third parties with the relevant professional qualifications who provide sufficient guarantees as to their technical knowledge and personal integrity to maintain confidentiality. Oriva, through its respective contractual commitments and those of its partners, takes all necessary security measures to protect and safeguard the confidentiality and integrity of personal data. In any case, the security of your personal data is subject to reasons beyond Oriva’s control, as well as to reasons arising from technical network problems not controlled by Oriva, or to reasons of force majeure.

9. Amendments

• 1. This Policy was last updated on 13.05.2026. We will regularly update this Policy to clarify our practices and to reflect new or different privacy practices, such as when we add new services, products, functions, or features to the Platform.
  2. You acknowledge and agree that any use of the Products and Services, as well as the Platform, after any amendments constitutes confirmation of your acceptance of this Policy. Please read this Policy carefully and refer to it periodically for the most recent information about our privacy practices.
  3. If you wish to receive any clarification or information about the changes, or have any reservation or question about them (the changes), you can contact us at the contact details mentioned above. Please note that any information/clarification about changes to this Policy provided to you in the manner described above does not constitute a substitute for, or any amendment to, this Policy.