Financing application privacy notice.

1. This notice in brief

This notice explains what personal data Rahoo Oy ("Rahoo", "we") processes, for what purposes and on what legal basis, to whom we disclose data and what rights you have. It is an information document under Articles 13 and 14 GDPR.

1.1 What Rahoo’s service does

Rahoo’s financing application service is available on websites, in software, on platforms and marketplaces and in other services offered by Rahoo’s partners. The purpose of the service is to speed up applying for business financing: you complete one application and we forward it to our financing partners — banks and finance companies — which may make you an offer of financing. The financing products and financing partners available vary depending on the partner service through which you apply.

1.2 What Rahoo is not

This delimitation is essential for understanding who is responsible for what:

• Rahoo is not a credit institution or a financial institution and does not grant credit for its own account.
• Rahoo does not make the credit decision. The financing decision is always made by the financing partner on its own criteria.
• Rahoo is not a party to the financing agreement. If you accept an offer, the agreement is concluded between you and/or the company you represent and the financing partner.
• Rahoo gives no guarantees as to offers of financing and makes no commitments on behalf of its financing partners.

1.3 Using the service is not consent

Using the service is not in itself consent to the processing of personal data within the meaning of the GDPR. We process personal data on the legal bases described in section 6 below. Where processing is based on consent — in practice marketing communications and non-essential cookies — we ask for consent separately, and you may withdraw it at any time.

1.4 Where this notice applies

This notice is available on Rahoo’s website and in all of Rahoo’s financing application processes, regardless of the channel through which you apply. It describes Rahoo’s own processing in every channel.

This notice does not replace the notices of other parties. The partner in whose service you are dealing and the financing partner that processes your application each have their own privacy notice covering their own processing.

The channel affects who collects your data and when you receive this notice. The channels are described in section 4.

2. Controller and contact details

Enquiries concerning data protection and requests to exercise data subject rights: support@rahoo.fi.

3. Whose personal data we process

We process data relating to the following groups of people:

• The person making the financing application — usually a representative of the company or a private trader.
• The officers of the company applying for financing — members of the board, the managing director and other persons entitled to sign for the company.
• The beneficial owners of the company — where the financing partner must establish them in order to meet its customer due diligence obligations.
• Guarantors and providers of collateral — where the financing requires a personal guarantee or a third-party pledge.
• Users of our website and service — as regards cookies and log data. This also covers partner services in which Rahoo’s application form is embedded (see section 4.3).

4. Which channel you are in and who is responsible for what

4.1 Four ways to apply for financing

There are four ways to apply for financing. The way you deal with us affects who collects your data and when you receive this notice. In every channel, Rahoo is the controller from the moment the data is with Rahoo.

4.2 Three parties and their responsibilities

An application for financing typically involves three parties. Each of them is a controller in its own right for its own processing:

When we forward your application to a financing partner, this is a disclosure to an independent controller — not processing on our behalf. From that moment on, the financing partner is itself responsible for processing your data and informs you by means of its own notice.

4.3 Joint controllership in a partner’s service (channel B)

Where Rahoo’s application process is embedded in a partner’s service, Rahoo’s code runs on the partner’s domain and stores on your device an identifier that is essential for the application to work, so that data about you is transferred to Rahoo before you submit the application. At this stage of collection and transfer, Rahoo and the partner are joint controllers within the meaning of Article 26 GDPR. Joint responsibility covers this stage only; after it, each party is independently responsible for its own processing.

In an embedded process, Rahoo’s component sets no cookies. It stores in the browser’s session storage only the identifier needed to continue the application. The identifier is essential for the application to work, does not require consent and is removed when you send the application. Rahoo does not take non-essential cookies into use in an embedded process without consent obtained through the partner’s consent management. The list is in section 19.

After you have sent the application, the partner’s site shows only a confirmation and a link to Rahoo’s own pages. You see and handle your offers on your own pages or through the link in the offer email, and they are not shown on the partner’s site.

The essence of the arrangement is as follows:

You may exercise your rights against either party irrespective of this arrangement (Article 26(3) GDPR).

The partner to which the arrangement applies in your case is the partner in whose service you complete the application. An up-to-date list of the partners with which the arrangement is in force is available at www.rahoo.fi/en/joint-controllers.

No joint controllership arises in channels A, C and D: in channel A Rahoo has no code of its own in the partner’s service, and in channels C and D you deal with Rahoo on its own site.

4.4 When an application reaches us from a partner’s system (channel A)

In channel A we have not collected your data from you but have received it from the partner. Article 14 GDPR applies to this situation.

You receive this notice while completing the application. The partner presents it, or a link to it, on its own application form before you submit the application, and you accept it at the same time. Where you already have the information, we do not send it to you again (Article 14(5)(a) GDPR).

In all other respects this channel works in the same way as the others:

• We tell you where the data came from. The source is the partner in whose service you completed the application (Article 14(2)(f) GDPR).
• Your rights are the same as if you had completed the application directly with us. See section 18.
• If for any reason you have not received this notice with the application, you will receive it from us within one month at the latest of our having obtained your data — or, if we contact you before that, at the latest at the time of the first contact (Article 14(3) GDPR).

The partner is responsible for having a legal basis for disclosing the application to Rahoo and for having told you about the disclosure beforehand.

5. What data we process and where it comes from

We collect personal data only to the extent necessary to provide and develop the service (data minimisation, Article 5(1)(c) GDPR).

5.1 From you

5.2 From the partner

• The complete financing application, where you have completed it on the partner’s own form (channel A). In that case the source of the data is that partner, and we tell you so in accordance with section 4.4.
• The object of the financing, for example the product or invoice being financed.
• Data based on customer history, for example purchase or invoicing history.
• Detailed financial data of the company, for example financial statements and accounting extracts, including directly from the company’s accounting software with the applicant’s permission.

5.3 From registers maintained by public authorities

The sources are the Finnish Patent and Registration Office and the Business Information System (YTJ), the Finnish Tax Administration and the transport register of the Finnish Transport and Communications Agency Traficom.

We retrieve this data through a service provider that compiles it from public authority registers. The service provider acts as a technical intermediary, and the original sources are the registers named above.

• Official company data: name, business ID, officers, industry and financial statement data, and information on ownership structure and beneficial owners in so far as it is available from the register.
• Registrations and tax debt data: the prepayment register, the register of parties liable for VAT, the employer register and the tax debt register.
• Vehicle and equipment data, where the financing concerns a vehicle or other registrable equipment.

The applicant’s verified personal data is obtained from strong electronic identification.

5.4 From credit reference agencies and identification services

• From strong electronic identification: verified personal data such as name and personal identity code.
• From credit reference agencies — Dun & Bradstreet and Suomen Asiakastieto — payment default entries, payment behaviour data and creditworthiness assessments concerning the company applying for financing. The processing of this data is described in more detail in section 8.
• From sanctions and PEP list services: information on whether a person appears on international sanctions lists or is a politically exposed person. See section 9.

5.5 From financing partners

• The stage and outcome of the processing of the application.
• The financing offer made to the applicant and its terms, such as amount, loan period, interest rate, fees and validity period. Rahoo passes the offer on to the applicant.
• The terms of any financing granted, such as amount, loan period and interest rate.
• Whether financing has arisen from the application, as well as drawdowns of the financing and its termination. The financing partner is bound by confidentiality, so it discloses this information only with your consent. We ask for your consent on the application form, and its content is set out in section 7.5 of the terms of use.

5.6 From cookies and log data

• Device, operating system and browser.
• IP address and approximate location.
• Online behaviour in our service and in the application form on partners’ websites: pages, clicks, the stages of completing the form.

Continuing the application. While you complete an application, we store a short-lived identifier in your browser so that your application is kept if you reload the page or return to it after a while. The identifier relates to your application only and expires within 24 hours at the latest. We do not use it for advertising or visitor tracking. The identifier does not in itself contain your name or contact details, but we process it as personal data because it can be used to link that data to you. The storage is essential in order to provide the service you have requested, so it does not require consent (section 205(2) of the Act on Electronic Communications Services).

Reminder about an unfinished application. If your application is left unfinished, we may send you an email reminder with a personal link that lets you continue. The link is valid for 30 days at most and stops working when you send the application. Do not share the link. Anyone who has the link can, while it is valid, continue your application and see the information entered in it.

Your own pages. You see the status of a sent application, your offers and attachments on your own pages or through the link in the offer email. You log in to your own pages by identifying yourself, for example with a code sent to your email or with online banking credentials. We record when an offer has been opened so that we can show that it was delivered.

Log data. We record technical log data on the use of the service, such as the time, the function used, the website the request came from and browser data. We use it to detect and prevent misuse and to investigate errors.

Legal bases. Continuing the application, the reminder and your own pages are based on the taking of steps prior to entering into a contract (Article 6(1)(b) GDPR) or, if you represent a company, on legitimate interest (Article 6(1)(f) GDPR). Recording the opening of offers and the log data are based on legitimate interest (Article 6(1)(f) GDPR) and our obligation to ensure information security (Article 32 GDPR). Retention periods are set out in section 16 and information on cookies in section 19.

6. Purposes of processing and legal bases

Every processing operation has a legal basis under Article 6 GDPR. The bases are not alternatives to one another: the same data may be processed on a different basis for a different purpose.

Processing based on legitimate interests. Where processing is based on legitimate interests, we have carried out a balancing test assessing the relationship between our interests and your rights. You may request the outcome of the balancing test from support@rahoo.fi. You always have the right to object to processing based on legitimate interests (see section 18).

7. Processing of the personal identity code

We process the personal identity code because unambiguous identification of the applicant is necessary when applying for financing and for the financing partner’s credit decision. Under section 29(2) of the Finnish Data Protection Act (1050/2018), the personal identity code may be processed for the unambiguous identification of the data subject in, among other things, the granting of credit and the collection of debts, and in credit institution and credit reference activities.

We also observe the restrictions in the same section:

• We do not enter the personal identity code unnecessarily in documents (section 29(4)).
• We do not use the personal identity code alone, or the combination of the personal identity code and a name, to verify identity (section 29(5), in force since 1 January 2024). Identification is carried out by means of strong electronic identification.

8. Processing of credit information

In addition to the GDPR, the processing of credit information is governed by the Finnish Credit Information Act (527/2007). Rahoo may obtain credit information concerning the company applying for financing, but does not do so for every application. The credit reference agencies we use are Dun & Bradstreet and Suomen Asiakastieto.

8.1 What credit information we process

We process credit information concerning the company applying for financing, such as payment default entries, payment behaviour data and creditworthiness assessments. This data is necessary in order for us to direct the application to those financing partners whose basic requirements it may meet.

Rahoo does not obtain personal credit information. We do not make a credit information enquiry about you as a private individual or as a guarantor. If a financing partner needs personal credit information for its credit decision, it obtains that information itself and is responsible for it as a controller in its own right.

8.2 Prior information and a negative decision

The obligations under section 19(5) and (6) of the Credit Information Act — to provide information before personal credit information is obtained and to give notice in connection with a negative decision — are directed at the party that obtains the information. Since Rahoo does not obtain personal credit information, these obligations rest with the financing partner.

If an assessment of your creditworthiness has been made solely by automated means, you have the right under section 16 of the Credit Information Act to require the assessment to be carried out again. Address the request to the financing partner that made the assessment. Rahoo’s own pre-screening is described in section 14.

9. Customer due diligence, PEP status and sanctions

Granting financing requires the financing partner to meet its obligations under the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017). The financing partner is responsible for customer due diligence as regards its own obligations. In so far as data the financing partner needs for that purpose is collected or forwarded in the application process, it may consist of the following:

• The company’s beneficial owners and ownership structure.
• Whether the applicant or a beneficial owner is a politically exposed person (PEP) or a family member or close associate of such a person. PEP status is defined in Chapter 1, section 4(11)–(13) of the Act on Preventing Money Laundering, and the related enhanced due diligence obligation is laid down in Chapter 3, section 13.
• Sanctions list matches and information on the origin of funds.

Legal basis. Rahoo is not an obliged entity within the meaning of Chapter 1, section 2 of the Act on Preventing Money Laundering: Rahoo does not grant credit, is not a party to the financing agreement and does not handle client funds. As regards Rahoo, the processing under this section is therefore based on steps taken prior to entering into a contract (Article 6(1)(b)) and on legitimate interests (Article 6(1)(f)): a financing application cannot be forwarded to a financing partner without the data the financing partner is required by law to have. As regards the financing partner, the basis for processing is a legal obligation (Article 6(1)(c)).

10. Special categories of personal data and criminal offence data

We do not collect or request special categories of personal data within the meaning of Article 9 GDPR — such as health data, political opinions, religious beliefs, trade union membership or biometric identifiers.

If you provide such data on your own initiative in the attachments to an application, we delete it as soon as reasonably practicable and do not forward it to financing partners.

We process data relating to criminal convictions and offences (Article 10 GDPR) only where there is a basis for doing so under section 7 of the Data Protection Act. Information on a business prohibition is not criminal offence data but company data obtained from a public register.

11. Is providing data mandatory

Providing data is not a statutory obligation, but it is a condition for using the service. The data marked as mandatory on the application form is necessary in order for the application to be processed and forwarded to a financing partner. If you do not provide that data, we cannot process your application.

Marketing consent and acceptance of non-essential cookies are voluntary. Not giving them has no effect on applying for financing.

12. To whom we disclose data

We do not sell personal data. On request, we will tell you the names of our service providers.

13. Transfers outside the EU and the EEA

Our servers and the primary storage of data are within the EU (Stockholm, Sweden). Some of the services we use are, however, United States services, in which case personal data may be transferred outside the EU and the EEA.

We use the following safeguards for transfers:

• An adequacy decision (Article 45 GDPR), where the recipient is certified under the EU–US Data Privacy Framework.
• Standard contractual clauses (Article 46(2)(c) GDPR), where an adequacy decision cannot be applied.
• A transfer impact assessment and supplementary safeguards, such as encryption in transit and at rest and access control.
• Data minimisation: we do not transfer personal identity codes or credit information by email or in integrations where this can be avoided.

You may request a copy of the safeguards used from support@rahoo.fi.

14. Automated decision-making and profiling

14.1 What automated decision-making means

Automated decision-making means a decision based solely on automated processing of personal data, without human assessment, which produces legal effects concerning you or similarly significantly affects you.

14.2 How we use it and on what basis an application is directed

When you apply for financing, your application is automatically compared against the basic requirements set by our financing partners. If an application does not meet a financing partner’s basic requirements, it is not forwarded to that financing partner. This screening is not a credit decision but a matching exercise: the application is forwarded to those financing partners from which an offer is possible at all.

The following data is taken into account in the comparison:

We do not publish financing-partner-specific thresholds, because they are the financing partners’ trade secrets and they change. You may always ask us for a more detailed explanation of why your application did not proceed to a particular financing partner.

14.3 Legal basis

Under Article 22(2) GDPR, solely automated decision-making is permitted on three grounds only: it is necessary for entering into or performing a contract, it is authorised by Union or Member State law, or it is based on explicit consent.

Rahoo’s pre-screening is based on Article 22(2)(a) GDPR: it is necessary in order for a financing application to be processed and forwarded to a financing partner.

14.4 Your rights

Under Article 22(3) GDPR you have the right:

• to require that the decision be made by a natural person, that is, that your application be processed manually;
• to express your own point of view;
• to contest the decision and to obtain an explanation of how it was reached.

In addition, under section 16 of the Credit Information Act you have the right to require a new assessment if an assessment of your creditworthiness has been made solely by automated means.

Exercise your rights by sending a request to support@rahoo.fi. We will reply within one month of receiving the request at the latest. If the request is complex, we may extend the period by up to two further months and will inform you of this within one month (Article 12(3) GDPR).

14.5 Financing partners’ own decision-making

Financing partners make their own credit decisions independently and may use their own automated systems in doing so. Rahoo is not responsible for those systems. Ask the financing partner directly for more information on how automated decision-making has been applied to your application.

15. Use of artificial intelligence in the service

15.1 How we may use artificial intelligence

We may use artificial intelligence in the service to assist, for example, in reading attachments to applications, structuring financial data, customer service and preparing summaries and analyses of the application and the applicant company for financing partners. In using artificial intelligence we observe the following principles:

• We make it clear when you are dealing with artificial intelligence — for example in an AI-assisted chat service (Article 50 of the EU Artificial Intelligence Act (EU) 2024/1689, applicable from 2 August 2026).
• We update this notice before taking into use any new AI-assisted use that affects the processing of your personal data.
• If we use artificial intelligence in a way falling within the high-risk systems of the Artificial Intelligence Act — in practice the assessment of the creditworthiness of a natural person — we inform you expressly that you are subject to the use of a high-risk artificial intelligence system (Article 26(11)).
• On request you receive a clear and meaningful explanation of the role of the artificial intelligence system in the decision-making and of the main elements of the decision (Article 86).
• Artificial intelligence does not make decisions. A summary or analysis prepared by artificial intelligence is a tool for the financing partner. The financing partner makes the credit decision itself, and artificial intelligence does not decide whether an application is forwarded.
• The AI service provider processes the data only on our behalf under a data processing agreement. Under our agreement, the service provider may not use the data to train artificial intelligence models.
• No identifying data is sent to artificial intelligence. Identifying data of the company and of individuals is removed from the data sent for the analysis. Only Rahoo and the financing partner handling the application see the analysis.
• The use of artificial intelligence does not extend the amount of data collected and does not change the legal bases described in this notice. The rights set out in section 14.4 remain unchanged.

15.2 Financing partners’ use of artificial intelligence

Financing partners make their credit decisions independently and may use artificial intelligence in doing so. Rahoo has no information on whether an individual financing partner uses artificial intelligence or how it does so. If you wish to know, ask the financing partner directly. If a financing partner’s system is a high-risk system within the meaning of the Artificial Intelligence Act, the financing partner is obliged to tell you about its use and to give you an explanation of the decision.

16. How long we retain data

We retain personal data only for as long as is necessary for the purpose for which it was collected, or for as long as the law requires.

When Rahoo’s intermediary assignment ends. Rahoo intermediates financing and is not a party to the financing agreement. The retention period therefore runs from the end of Rahoo’s own assignment. The intermediary assignment is deemed to have ended when the last of the following has occurred:

• the financing partner’s decision or offer has been forwarded to you, or the application has otherwise been resolved;
• the related communication between you and Rahoo has ended.

In practice the retention period begins when the last of these events has been recorded in Rahoo’s system. This is an event known to Rahoo and capable of being verified.

Limits of the right to erasure. Where we have a statutory obligation to retain data, we cannot delete it at your request. Where there is no statutory obligation, we assess separately whether the data is needed for the establishment, exercise or defence of a legal claim.

An obligation to retain data is not a right to use it: even where we must retain data, we may not use it for any purpose other than the one for which the retention obligation exists.

Deletion means deletion. When the retention period ends, the data is either deleted or irreversibly rendered non-identifiable. Marking a record as deleted is not deletion.

Backups. When data is deleted from the live system, it may remain in backups until the backup is replaced — at most seven days from deletion. We do not use data held in a backup for any other purpose, and if a backup is ever restored, the deletions are carried out again.

17. Information security

We protect personal data by the technical and organisational measures required by Article 32 GDPR:

• encrypted data traffic and encryption of data at rest;
• separate encryption of personal identity codes and restricted visibility of them;
• a server environment within the EU (Stockholm, Sweden);
• role-based access control and the principle of least privilege — access to data only for those who need it in their duties;
• personal user accounts and two-factor authentication for personnel and for users at financing partners and partners;
• short-lived identifiers and identification before applications and offers are handled;
• logging of logins and user management, monitoring for misuse and monitoring of anomalies;
• automated security testing of software changes;
• only anonymised data in development and testing;
• confidentiality undertakings by personnel;
• assessment of subcontractors and data processing agreements under Article 28 GDPR.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (Article 34 GDPR). We will notify the supervisory authority of a breach within 72 hours (Article 33 GDPR).

18. Your rights

18.1 How to exercise your rights

Send your request to support@rahoo.fi. We may ask you to verify your identity if we cannot otherwise reliably identify you. We will reply within one month at the latest; in complex cases we may extend the period by up to two further months and will inform you of this within one month. Handling requests is free of charge unless a request is manifestly unfounded or excessive.

If you completed the application in a partner’s service (channel A or B), you may also address your request to the partner. See sections 4.3 and 4.4.

18.2 Complaint to the Data Protection Ombudsman

If you consider that we process your personal data unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman. We hope you will contact us first.

19. Cookies and web tracking

A cookie is a small file stored on your device when you use the service. The use of cookies is governed by section 205 of the Finnish Act on Electronic Communications Services (917/2014). The same applies to other ways of storing information on your device, such as the browser’s session storage.

In the application process we use essential cookies only. An essential cookie is one without which the service you have requested does not work. Storing it does not require consent (section 205(2) of the Act on Electronic Communications Services).

Consent. If we take into use cookies other than essential ones, they will require your consent. Consent is not requested in this notice but separately, before anything is stored, and rejecting will be as easy as accepting. We will update this section before doing so.

In the application process we use the following essential cookies and similar storage methods, such as the browser’s session storage. All of them are Rahoo’s own, and they are not used for advertising or visitor tracking.

• Continuing the application: keeps your unfinished application while you complete it. Valid for 24 hours at most.
• Security and session: protects the form against misuse and maintains the session while the application is completed. Valid for 24 hours at most.
• Logging in to your own pages: makes logging in easier immediately after identification. Valid for one hour at most.

Your browser may hold older cookies from an earlier period. If you have used the service before, cookies may have been stored in your browser that the service no longer sets, reads or uses to send data. They disappear on their own when they expire, and you can also remove them yourself in your browser settings.

User account. A user account, that is your own pages, may be created for the person making the application, allowing them to follow their applications and see the offers received. A user account is not a cookie. Logging in is described in section 5.6.

Differences between channels. In channel B, where Rahoo’s application form is embedded in a partner’s service, Rahoo’s component sets no cookies. It stores in the browser’s session storage only the identifier needed to continue the application, which is removed when you send the application. If Rahoo were to take non-essential cookies into use there, consent would be obtained by the partner on its own site, because the storage takes place in the partner’s service (see section 4.3). In channel A, Rahoo sets no cookies at all in the partner’s service — only the partner’s own cookies are used there, and the partner is responsible for them. In channels C and D you deal with Rahoo on its own site, and the cookies there are the same essential ones.

The partner is responsible for its own cookies and for the consent relating to them. They appear in the partner’s own cookie list, not here.

The storing of cookies on a device is supervised by the Finnish Transport and Communications Agency Traficom. The processing of personal data collected by means of cookies is supervised by the Office of the Data Protection Ombudsman.

20. Marketing and advertising

• Offers of financing relating to an application are not direct marketing but part of the service you have requested. They are based on a contract and on steps taken prior to entering into a contract.
• Newsletters and other marketing communications are sent only with your separate consent. You may withdraw your consent at any time using the link in every message or by writing to support@rahoo.fi. Withdrawal has no effect on your use of the service.
• Targeted advertising on third-party platforms. If you give consent to marketing cookies, we may share identifiers and event data with advertising platforms so that we can target advertising and measure its effectiveness.

Rahoo and an advertising platform may be joint controllers within the meaning of Article 26 GDPR in so far as data is collected on Rahoo’s site and transferred to the platform. The essence of the arrangement corresponds to that described in section 4.3: Rahoo obtains consent and provides information, the platform is responsible for its own processing, and you may exercise your rights against either party.

21. Changes to this notice

We develop our service continuously, so we may update this notice. The current version is always available on our website. We will inform you of material changes by email or in the service before the change takes effect.

Previous versions are available on request from asiakaspalvelu@rahoo.fi.

22. Contact

Questions about this notice, data protection and data subject rights: support@rahoo.fi.