Your GDPR rights

1. Straight from your account

Tip: export your data before deleting your account — deletion is irreversible and we cannot restore it afterwards.

2. Full list of your rights

Right of access (Art. 15 GDPR)

To obtain confirmation whether we process data about you, a copy of it, and information about purposes, recipients and retention periods. The first copy is free; for manifestly unfounded or excessive repeat requests we may charge a reasonable fee or refuse.

Right to rectification (Art. 16 GDPR)

To correct inaccurate data and complete incomplete data. Most records you can correct yourself in the application.

Right to erasure (Art. 17 GDPR)

To request deletion of your data where it is no longer necessary, you withdraw consent, or you object to the processing. The right is not absolute — we cannot delete accounting records of payments made before the statutory retention period expires.

Right to restriction (Art. 18 GDPR)

To ask us to temporarily “freeze” processing while we verify the accuracy of the data or the merits of your objection.

Right to portability (Art. 20 GDPR)

To receive your data in a structured, commonly used, machine-readable format (CSV) and transfer it to another provider. The export always contains your full history, regardless of plan.

Right to object (Art. 21 GDPR)

To object to processing based on legitimate interest. We will stop processing unless we demonstrate compelling legitimate grounds which override your interests.

Withdrawal of consent (Art. 7(3) GDPR)

At any time and as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Right not to be subject to automated decisions (Art. 22 GDPR)

We take no automated decisions with legal effect concerning you. Automatic categorisation and AI summaries are suggestions you can reject.

3. How to submit a request

1. 1Send an email to [TO BE FILLED IN] or a letter to [ADDRESS TO BE FILLED IN].
2. 2State the email address of your account — this allows us to identify you.
3. 3Describe which right you are exercising and, if it concerns specific records, which ones.
4. 4If we have reasonable doubts about your identity we may request additional information (Art. 12(6) GDPR). We do not ask for a copy of an ID document unless there is no other way.

Response time: within one month of receiving the request. For complex or numerous requests the period may be extended by a further two months; we will inform you of the extension and the reasons within the first month.

Cost: exercising your rights is free of charge. A fee may be charged only for manifestly unfounded or excessive (for example repetitive) requests.

4. Sample request text

To [TO BE FILLED IN]
Subject: Request to exercise GDPR rights

Dear Sir or Madam,

I, [first and last name], a user of Finora with email address [account email], hereby exercise the following right under Regulation (EU) 2016/679:

☐ access to my personal data (Art. 15)
☐ rectification of data (Art. 16) — specifically: ……………
☐ erasure of my data (Art. 17)
☐ restriction of processing (Art. 18)
☐ data portability (Art. 20)
☐ objection to processing (Art. 21)
☐ withdrawal of consent (Art. 7(3)) — for: ……………

Please reply to this email address.

Date: ……………
Name: ……………

5. If you are not satisfied with our response

Write to us again first — most cases are misunderstandings that are resolved quickly. If that does not help, you have the right to lodge a complaint with the supervisory authority:

• Commission for Personal Data Protection (CPDP)
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Phone: +359 2 915 3518
• Email: kzld@cpdp.bg
• Website: https://www.cpdp.bg

You also have the right to an effective judicial remedy before the competent court and the right to compensation for damage suffered under Art. 79 and 82 GDPR.