Privacy policy (Datenschutzerklärung)

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

Raisin SE
Schlesische Straße 33/34
10997 Berlin, Germany
Telephone: +49 30 217 84 002
Email: kundenservice@raisin.com
Website: www.raisin.com
Registered office: Berlin, Germany
Commercial Register: Amtsgericht Charlottenburg
Registration Number: HRB 271733 B
VAT Identification Number: DE287376984

Management Board:
Dr. Tamaz Georgadze (CEO)
Dr. Frank Freund
Katharina Lüth
Michael Stephan

Chairman of the Supervisory Board:
Prof. Dr. Axel Weber

Data Protection Officer (Datenschutzbeauftragter):
Raisin SE
Data Protection Officer
Schlesische Straße 33/34
10997 Berlin, Germany
Telephone: +49 30 217 84 002
Email: datenschutz@raisin.com

2. Data we collect and why

• Customer account: email address, password (stored only as a secure hash), first and last name, display name, country and notification preference. Purpose: creating and managing your account. Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual steps).
• Sign-in with Google: if you choose it, we receive your name, email address and Google account identifier from Google. Legal basis: Art. 6(1)(b) GDPR.
• Identity verification: Name, date of birth, nationality, country of residence, address, document type, issuing country and expiry date, together with uploaded identity documents (passport or ID card) and proof of address (e.g. electricity bill), as well as verification status, reviewer messages and decision history. Purpose: Verifying customer identity before providing account services and fulfilling applicable anti-money-laundering (AML) and Know Your Customer (KYC) requirements. Article 6(1)(c) GDPR, in conjunction with Sections 9, 10 and 11 of the German Money Laundering Act (Geldwäschegesetz – GwG), where applicable. Processing is necessary for Raisin SE to comply with its statutory customer due-diligence and identity-verification obligations. Article 6(1)(b) GDPR may additionally apply to personal data strictly necessary for entering into or performing the contractual relationship with the customer.
• Savings wallets and investment requests: selected bank and offer, requested amounts, approved deposits, request status and timestamps. Purpose: managing your savings orders and showing balances and earnings. Legal basis: Art. 6(1)(b) GDPR.
• Saved items and comparisons: banks and offers you save and the filters of comparisons you run while signed in. Legal basis: Art. 6(1)(b) GDPR.
• Messages to support: subject and text of messages sent from your dashboard. Purpose: answering your inquiry. Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR.
• Newsletter: your email address. Legal basis: your consent, Art. 6(1)(a) GDPR.
• Email communication: if you email us, we process your email address and message content to reply. Legal basis: Art. 6(1)(b) or (f) GDPR.

3. Cookies and local storage

This website does not use advertising or analytics tracking cookies. It uses only storage that is strictly necessary to provide the service you request (§ 25(2) TDDDG; Art. 6(1)(b) and (f) GDPR):

• Sign-in session token in your browser’s local storage, so you stay signed in.
• Your chosen display language (English or German).

4. Third-party service providers (processors)

We use the following providers, bound by data processing agreements under Art. 28 GDPR:

• Website hosting and delivery
• Database, authentication and private file storage
• Google sign-in: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (only if you choose this option)
• Email delivery

Interest rate data and bank logos are loaded from official bank sources; following an external link to a bank’s website is subject to that bank’s privacy policy.

5. International data transfers

Some providers may process data outside the European Economic Area, in particular in the United States. Where this happens, transfers rely on an adequacy decision (e.g. the EU–US Data Privacy Framework for certified companies) or on EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.

6. Storage and retention

• Account data: for as long as your account exists; deleted after account closure unless statutory retention applies.
• Verification data and documents: Retained for five years after the end of the calendar year in which the business relationship ends, in accordance with Section 8(4) of the German Money Laundering Act (GwG), unless a longer statutory retention period applies. In any event, the applicable statutory maximum retention period must be observed. .
• Wallet, deposit and order records: Retained for the applicable statutory retention periods under German commercial and tax law, including Sections 257 HGB and 147 AO. Depending on the type of record, retention periods may be six, eight or ten years.
• Support messages:Retained for 30 days after account closure or resolution of the support request, unless longer retention is necessary to comply with legal obligations or establish, exercise or defend legal claims.
• Newsletter email: until you withdraw consent.
• Server logs: Retained for 30 days, unless a longer period is necessary for security investigations, incident management or compliance with legal obligations.

7. Data security

We use technical and organisational measures under Art. 32 GDPR, including encrypted HTTPS connections, hashed passwords, row-level access rules so customers can only access their own records, private storage for identity documents with access limited to the customer and authorised administrators, download links that expire after five minutes, administrator-only review tools and an audit history of verification decisions.

8. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• not be subject to a decision based solely on automated processing (Art. 22); verification decisions on this website are made by a human administrator

Withdrawal of consent: you can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), e.g. by unsubscribing from the newsletter or contacting us.

9. Privacy contact

For privacy questions or to exercise your rights, contact: [privacy contact email], . Signed-in customers can also use the Messages page in their dashboard.