Privacy Policy

Who we are and this policy

Novus Capital operates a peer-to-peer investment platform that connects investors with vetted business loans. For the purposes of the GDPR, Novus Capital is the controller responsible for the personal data processed through the platform.

This policy applies to visitors to our website, registered users, and investors, and it covers all personal data we process in connection with our services. It does not apply to third-party websites that may be linked from our platform, which have their own privacy practices.

Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and verification data — your name, date of birth, nationality, government-issued identification, and photographs or video used to confirm your identity.
• Contact data — your email address, telephone number, and postal or residential address.
• Financial and transaction data — your bank account details, payment information, investment activity, account balances, and tax-related information.
• Account and profile data — your login credentials, settings, preferences, and communication choices.
• Technical and usage data — your IP address, device and browser information, and details of how you use our website, collected through cookies and similar technologies.
• Communications — the content of messages you send us through support channels and other correspondence.

How we collect your data

We collect personal data in three main ways:

• Directly from you — when you register, complete identity verification, invest, deposit or withdraw funds, or contact us.
• Automatically — when you use our website, through cookies, server logs, and similar technologies.
• From third parties — including identity-verification and anti-fraud providers, payment and banking partners, and publicly available sources such as sanctions and politically-exposed-person databases used for regulatory checks.

Why we use your data and our legal bases

We process your personal data only where we have a valid legal basis under the GDPR. Our purposes and the corresponding legal bases are:

• To provide our services — creating and managing your account, processing investments and payments, and operating the platform. Legal basis: performance of a contract with you.
• To meet our legal and regulatory obligations — including identity verification, anti-money-laundering and counter-terrorist-financing checks, tax reporting, and record-keeping. Legal basis: compliance with a legal obligation.
• To protect and improve our services — securing the platform, preventing fraud and abuse, and analysing and improving how our services work. Legal basis: our legitimate interests, where these are not overridden by your rights and freedoms.
• For marketing and optional features — sending you communications you have asked for and using non-essential cookies. Legal basis: your consent, which you can withdraw at any time.

Identity verification and anti-money laundering

As a provider of regulated financial services, we are required by law to verify the identity of our users and to monitor activity in order to prevent money laundering and terrorist financing. We carry out identity verification with the help of specialist third-party providers, who process your identity documents and verification data on our behalf and under our instructions.

We are legally required to keep the records generated by these checks and to report suspicious activity to the competent authorities where the law requires it.

Who we share your data with

We do not sell your personal data. We share it only where necessary, with the following categories of recipients:

• Identity-verification, anti-fraud, and compliance providers that help us meet our legal obligations.
• Payment institutions and banking partners that process deposits, withdrawals, and payouts.
• Technology providers that host our platform and provide IT, security, analytics, and communication services.
• Professional advisers, such as auditors, lawyers, and accountants, where relevant.
• Competent authorities, regulators, and courts, where we are legally required to disclose data.
• Other parties in connection with a transfer or assignment of loans or claims, or a reorganisation of our business.

Where third parties process personal data on our behalf, we put in place written agreements that require them to protect your data and to use it only for the purposes we specify.

International data transfers

We primarily process your personal data within the European Economic Area (EEA). Where we transfer data to a country outside the EEA, we ensure an appropriate level of protection — for example, by relying on an adequacy decision of the European Commission or by putting in place the standard contractual clauses approved by the Commission.

How long we keep your data

We keep your personal data only for as long as necessary for the purposes described in this policy. Where the law requires us to retain certain records — in particular data collected for anti-money-laundering and accounting purposes — we keep them for the period prescribed by law, which is generally at least five years after the end of our business relationship with you. When data is no longer required, we securely delete or anonymise it.

Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember your preferences, and understand how the site is used. Strictly necessary cookies are essential for the website to function; other categories are used only with your consent, which you can manage through our cookie settings. Further details are set out in our Cookie Policy.

How we keep your data secure

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include encryption, access controls, and regular review of our security practices. No method of transmission or storage is completely secure, but we work continuously to safeguard the data entrusted to us.

Your rights

Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:

• Access — to obtain confirmation of whether we process your data and to receive a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted where there is no lawful reason for us to keep it.
• Restriction — to limit how we use your data in certain circumstances.
• Portability — to receive certain data in a structured, commonly used, machine-readable format.
• Objection — to object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdrawal of consent — to withdraw any consent you have given, without affecting processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) in Bulgaria, or with the supervisory authority in your country of residence.

Children's privacy

Our services are intended for adults only. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected such data, we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, our practices, or the law. The date at the top of this page shows when it was last updated, and where changes are significant we will take reasonable steps to notify you.

How to contact us

If you have any questions about this policy or wish to exercise your rights, you can contact us using the contact details published on our website. We will respond to your request within the time limits set by applicable data-protection law.