Echoes
    Legal

    Privacy Policy

    Last updated:

    1. Data Controller

    Echoes Srl. SB ("we," "us," or "the Company"), a Benefit Corporation registered in Milan, Italy, is the Data Controller for all personal data processed through this website and in connection with the European Ethical Bank (EEB) project.

    Data Controller: Echoes Srl. SB, Via Fatebenefratelli 15, Milan, Italy
    Data Processor: EEB operational entity (pending), Lithuania
    DPO Contact: info@echoes-holding.eu

    2. Data We Collect

    We collect and process the following categories of personal data:

    Identity Data

    Full name, date of birth, nationality, government-issued identification documents (passport, ID card).

    Financial Data

    Bank account details, source of funds declarations, capital placement history, tax identification numbers.

    Contact Data

    Email address, phone number, postal address, professional affiliation.

    Technical Data

    IP address, browser type, device information, cookies, and usage analytics.

    Communication Data

    Records of correspondence, meeting notes, and capital provider relations communications.

    3. Legal Basis for Processing

    We process personal data under the following legal bases as defined by Articles 6 and 9 of the GDPR:

    • Legal Obligation: Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements under EU Directive 2015/849 and Lithuanian national regulations.
    • Contractual Necessity: Processing required to fulfill shareholder agreements, partnership onboarding, and capital placement commitments.
    • Legitimate Interest: Capital provider relations communications, website analytics, and security monitoring.
    • Consent: Marketing communications, non-essential cookies, and newsletter subscriptions (opt-in only).

    4. Data Sharing & Transfers

    Personal data may be shared with regulatory authorities (Bank of Lithuania, ECB), legal advisors, AML/KYC compliance providers, and cloud infrastructure providers - all operating within the EEA. We do not transfer personal data outside the European Economic Area.

    5. Data Retention

    We retain personal data for the duration of our business relationship plus applicable statutory retention periods (typically 10 years for financial records under Italian and EU banking regulations). Technical and analytics data is retained for a maximum of 26 months.

    6. Your Rights

    Under the GDPR, you have the right to:

    • Access - Request a copy of your personal data.
    • Rectification - Correct inaccurate or incomplete data.
    • Erasure - Request deletion ("right to be forgotten"), subject to legal retention obligations.
    • Restriction - Limit processing in specific circumstances.
    • Portability - Receive your data in a machine-readable format.
    • Objection - Object to processing based on legitimate interest.
    • Withdraw Consent - At any time, without affecting prior processing.

    To exercise any of these rights, contact us at info@echoes-holding.eu. We will respond within 30 days.

    7. Supervisory Authority

    You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the Lithuanian State Data Protection Inspectorate.

    8. AI-Assisted Document Processing

    During onboarding, identity documents, business registry excerpts, and KYC dossiers you upload are sent to an AI vision model (Google Gemini 2.5 Pro/Flash, accessed via the Lovable AI Gateway) solely to extract structured text and pre-fill onboarding forms. The original files are stored in our encrypted Lovable Cloud storage with strict role-based access; the AI provider does not retain document contents after the API call and does not use them for model training.

    Subprocessor disclosure: Google LLC and Google Ireland Limited act as a subprocessor for AI document extraction, with processing routed via Lovable AI Gateway. All KYC decisions remain fully human. You may opt out of AI extraction by contacting our DPO before Step 1 submission. See the full AI Usage Policy for details.