Skip to content

Information for co-applicants

Information for co-applicants

You are receiving this information because another person — the one who submitted a financing enquiry — has passed data about you on to us. We inform you about this pursuant to Art. 14 GDPR. No reply or confirmation from you is required.

1. Who is responsible for the processing?

  • FA – FinanzAktiv e.U., owner Christian Kunz, MBA
  • Getreidegasse 3, 9020 Klagenfurt am Wörthersee, Austria
  • E-Mail: office@kreditdirekt.at

FA – FinanzAktiv e.U. brokers residential property financing as a non-tied credit intermediary; the KreditDirekt platform is the digital tool used for that. No data protection officer has been appointed; given the nature and scope of our processing operations there is no obligation to do so under Art. 37 (1) GDPR.

2. Where does your data come from? (Art. 14 (2) (f))

Your data comes from the person who submitted the financing enquiry (the first applicant) and from the documents that person uploaded. Details provided by you and responses from the credit institutions involved may be added later.

3. Which data do we process? (Art. 14 (1) (d))

  • Master data: name, date of birth, address, nationality, marital status, contact details
  • Details of employment and income
  • Details of expenses, existing liabilities and assets
  • Details of the financing project and of the property
  • Documents concerning you — such as proof of income, bank statements, loan and leasing agreements and, where the receiving credit institution requires it, identity documents

We do not collect special categories of personal data (Art. 9 GDPR).

4. For which purposes and on which legal basis?

  • Preparing, reviewing and submitting the financing enquiry in which you are involved as a co-applicant — Art. 6 (1) (b) GDPR where you are a party to the brokerage contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in preparing a jointly requested financing).
  • Compliance with legal obligations under the Austrian Mortgage and Real Estate Credit Act, the professional rules for credit brokerage and tax retention duties — Art. 6 (1) (c) GDPR.
  • Evidence and logging of our review and procedural steps — Art. 6 (1) (c) and (f) GDPR.

5. Who receives your data? (Art. 14 (1) (e))

  • The credit institutions selected for the specific case — never all partner banks. For any further processing they are controllers in their own right.
  • A brokerage partner for submitting financing enquiries: with individual credit institutions the submission is made through a brokerage partner who forwards the data solely on our behalf and on our instructions to the credit institution we have determined.
  • Hetzner Online GmbH (hosting and document storage, EU), FPC GmbH (technical operation, Austria) and World4You Internet Services GmbH (e-mail dispatch, Austria) as processors.
  • OpenAI Ireland Ltd. as a processor for the AI assistant and for reading documents. On the place of processing and the third country reference see section 5 of the privacy notice.
  • Tax accountancy, legal representation and public authorities, where required by law or necessary to pursue legal claims.

6. How long do we store your data? (Art. 14 (2) (a))

Your data shares the retention period of the case it belongs to: if no brokerage comes about, the documents are deleted after 6 months; an enquiry that is not pursued after 90 days from the last activity. Once the brokerage has taken place we keep the records covered by the statutory retention obligations — records relevant for tax purposes, for example, for seven years from the end of the calendar year to which they relate (§ 132 BAO). The full overview of retention periods is set out in section 7 of the privacy notice.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we base a processing operation on a legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21). Any consent given can be withdrawn at any time with effect for the future (Art. 7 (3)).

To exercise these rights please contact office@kreditdirekt.at or the address given in section 1. We will respond without undue delay and at the latest within one month.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority in Austria is:

  • Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
  • Barichgasse 40–42, 1030 Vienna
  • Telephone: +43 1 52 152-0
  • E-Mail: dsb@dsb.gv.at
  • Web: https://www.dsb.gv.at

9. No automated decision-making in individual cases

There is no decision based solely on automated processing within the meaning of Art. 22 GDPR. No score is formed and nobody is filtered out by the system; every case is reviewed on the merits by a responsible person. The decision on granting the loan is taken solely by the respective credit institution.