Privacy statement

Last updated: 1 October 2026

Aveya (aveya.be) is a service of Adefin bv. This statement describes how we process your personal data when you use the website, submit a financing application and use your personal page (the portal), in accordance with Regulation (EU) 2016/679 ("GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who is the controller?

Adefin bv
Registered office: Hundelgemsesteenweg 575 box 002, 9820 Merelbeke-Melle, Belgium
Contact for privacy questions: [email protected]

2. Which personal data do we process?

When you submit an application:

• the quote or order form you upload and what it contains: the vehicle, the price, the VAT regime, the seller and the buyer's details;
• your name, email address and language, and your phone number if it is on the quote;
• how you identified yourself and when;
• whether you finance as a company, self-employed person or private individual, your VAT number and your company's details;
• your wishes: term, monthly budget and what matters to you.

Data we look up to assess your application:

• the validity of your VAT number (VIES, European Commission);
• information about your company, its directors and annual accounts (Crossroads Bank for Enterprises, Belgian Official Gazette and National Bank of Belgium, via jaarrekening.be), and the dates on which the accounts were filed (Central Balance Sheet Office of the National Bank);
• a check of your name, your company and its directors against sanctions and terrorist lists (European Union, United Nations, the Belgian national list and the US OFAC list);
• at our initiative, public information on the internet about politically exposed positions, adverse media and other directorships.

While following up your application: the documents you upload, your messages and answers, the offers you receive and the documents you sign. When you sign, we record your name, the time, your IP address, your browser details and a digital fingerprint of the signed document.

When you use the contact form: your name, email address, phone number (optional) and your message.

Technical data: your IP address, browser details and the time of your visit, for security and to prevent abuse. We only collect analytics with your consent (see section 10).

3. Why do we process these data and on which legal basis?

• To handle your application: reading your quote, calculating offers, presenting them to you and to the financier, and following up the contract and delivery. Legal basis: steps taken at your request before entering into a contract, and its performance (Art. 6(1)(b) GDPR).
• To assess your identity and creditworthiness and screen sanctions lists. Legal basis: our legitimate interest and that of the financier in responsible lending and fraud prevention (Art. 6(1)(f) GDPR) and, where applicable, legal obligations, including those on preventing money laundering and terrorist financing (Art. 6(1)(c) GDPR).
• To email you about your application, such as the confirmation, your offers, requested documents and a sign-in link. Legal basis: performance of your application (Art. 6(1)(b) GDPR).
• To answer your question via the contact form. Legal basis: our legitimate interest in answering questions and, where relevant, pre-contractual steps (Art. 6(1)(b) and (f) GDPR).
• To understand how the site is used (analytics). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 129 of the Belgian Electronic Communications Act), which you can withdraw at any time via "Manage cookies" at the bottom of the page.
• To secure the site and prevent abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data and do not use it for advertising.

4. Automated assessment

Based on the data above, we automatically calculate a credit score and automatically prepare the offers that fit your application. An application is never refused solely by automated means: if the calculation does not produce a suitable offer, a staff member reviews your application personally. You have the right to human intervention, to express your point of view and to contest a decision (Art. 22 GDPR); write to [email protected]. The financier takes the final decision on the financing.

5. How long do we keep your data?

• Applications that do not lead to a contract: up to 24 months after the last activity.
• Applications that lead to a contract: for the duration of the contract and afterwards for as long as legal retention obligations require (including accounting and anti-money-laundering obligations, as a rule 10 years).
• Contact form messages: up to 12 months after our answer.
• Technical logs: at most 12 months, then deleted or anonymised.
• Sign-in links work once and expire after 20 minutes (link on request) or 72 hours (link in our emails).

6. Who do we share your data with?

• Financiers to whom your application is presented in order to offer you a proposal and contract. They act as independent controllers and have their own privacy statement.
• Hetzner Online GmbH, our hosting provider, with servers in Germany.
• Resend (Resend, Inc., USA) to send our emails.
• Anthropic (Anthropic PBC, USA), whose AI we use to read your quote and look up public information to assess your application. Anthropic does not use these data to train its models.
• jaarrekening.be, through which we consult company data and annual accounts.
• PostHog (PostHog, Inc.), via its EU instance in Frankfurt, only with your consent for analytics.

We do not share your data with other third parties unless required by law.

7. International transfers

Resend and Anthropic are based in the United States. Transfers to them rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or the EU-US Data Privacy Framework, with the supplementary measures that apply, in accordance with Chapter V GDPR. A copy of the safeguards is available via [email protected].

8. Your rights

• the right of access to your data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure, insofar as we are not legally required to keep your data;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on our legitimate interest;
• the right to human intervention in an automated assessment (see section 4);
• the right to withdraw your consent at any time, without affecting the lawfulness of earlier processing.

Write to [email protected]. We answer within one month (extendable by two months for complex requests, Art. 12(3) GDPR) and may ask you to prove your identity.

9. Security

We take appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), password-free sign-in with one-time links, access to an application only for authorised persons, and a digital fingerprint of every signed document. No system is completely secure; in the event of a breach affecting your rights, we notify the Data Protection Authority within 72 hours where required, and you directly where necessary.

10. Cookies and local storage

Strictly necessary (no consent required under Art. 129 of the Belgian Electronic Communications Act):

• sessionid: keeps track of your application in progress and your portal sign-in;
• csrftoken: protects forms against abuse;
• aveya.consent (localStorage): remembers your cookie choice.

Analytics (PostHog), only with your consent. If you click "Accept analytics", PostHog sets a limited number of cookies and localStorage entries (prefixed ph_) to attribute visits to an anonymous visitor identifier. Page text is masked and session recordings are off. If you click "Reject" or make no choice, nothing is collected. You can change your choice at any time via "Manage cookies" at the bottom of the page. We do not use advertising or social media cookies.

11. Complaints

If you believe we process your data unlawfully, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, [email protected], www.dataprotectionauthority.be. You can also bring the matter before the competent Belgian court.

12. Changes

We may update this statement when our processing or the law changes. The date at the top shows the latest version; we announce important changes by email where possible.

13. Contact

For any question about this statement or your data: [email protected].