Controller: Montold Asset Management GmbH, Fischerhüttenstraße 81a, 14163 Berlin, Germany, e-mail: info@montold.com ("we", "us").
Data protection officer: Kertos GmbH, Brienner Straße 41, 80333 Munich, Germany, e-mail: dsb@kertos.io.
We are an alternative investment fund manager registered with BaFin. We manage funds that grant loans exclusively to companies, including small and medium-sized enterprises, not to consumers. This policy covers the personal data we process from the first contact about a loan until the loan relationship ends and all retention periods have expired. It also covers loans applied for through partner platforms, in particular zeos.montold.com (section 6), and the use of this website.
Sole proprietors and freelancers who apply for or take out a loan;
managing directors, board members and other legal representatives of borrowers and of the companies in their ownership and control structure;
shareholders and beneficial owners of borrowers and of the companies in their ownership and control structure;
guarantors;
contact persons at borrowers, credit intermediaries and partner platforms.
Business data: company name, legal form, registered office and business address, commercial register data, ownership and control structure, business accounts and statements including all transactions, revenue, earnings and liquidity data, and, for platform financing, sales, stock, returns and payout data.
Personal data: name, date and place of birth, nationality, residential address, identity document details and copies, proof of address, role and ownership share, politically exposed person status, creditworthiness and scoring information.
Communication data: e-mail address, phone number and the content of communications, for example by e-mail or chat.
Sources. We collect data from the applicant and the persons acting for it. We also receive data from credit bureaus (section 8), public registers, credit intermediaries, account information service providers such as finAPI GmbH, and service providers for identification and electronic signatures. For financing via zeos.montold.com, we also receive data from Zalando SE and Zalando Payments GmbH (section 6).
| Purpose | Legal basis |
|---|---|
| Assessing creditworthiness and risk before a loan | Art. 6(1)(b) GDPR (pre-contractual steps at the applicant's request); Art. 6(1)(f) GDPR for data of representatives, beneficial owners and guarantors |
| Concluding, administering and terminating loans | Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR for persons who are not themselves parties |
| Taking, valuing, monitoring and realising security | Art. 6(1)(b) and (f) GDPR |
| Customer due diligence, identification, ongoing monitoring and record-keeping under the Money Laundering Act | Art. 6(1)(c) GDPR together with § 11a GwG |
| Screening borrowers, legal representatives and beneficial owners against sanctions lists before payout and before returning overpayments | Art. 6(1)(c) GDPR together with EU sanctions regulations and the Foreign Trade and Payments Act (AWG); otherwise Art. 6(1)(f) GDPR |
| Securing, enforcing and collecting claims | Art. 6(1)(b) and (f) GDPR |
| Communication with borrowers, guarantors, intermediaries and platforms | Art. 6(1)(b) and (f) GDPR |
| Fraud prevention and IT security | Art. 6(1)(f) GDPR |
| Regulatory reporting, audits, accounting and tax obligations | Art. 6(1)(c) GDPR |
Where we rely on legitimate interests, they are our interest, and the interest of the funds we manage, in sound credit decisions, preventing fraud and losses, enforcing claims and keeping our systems secure.
Loans applied for via zeos.montold.com are granted by Montold SME Lending Fund II GmbH & Co. KG, which we manage. The platform is operated by Puls Technologies GmbH on our behalf. In addition to sections 3–5, the following applies.
Data we receive from others
Zalando SE: the preliminary credit limit and indicative terms calculated by Zalando SE; and, once the applicant has given its instruction, sales, stock, returns and payout data and credit reports Zalando SE has obtained from CRIF GmbH.
Zalando Payments GmbH: results and records of the customer due diligence it has carried out on the applicant, its representatives and beneficial owners, on which we rely under § 17 GwG.
finAPI GmbH, through Puls Technologies GmbH: account data, including transactions, of the bank accounts the applicant connects.
ZealiD: identification data and qualified electronic signatures of representatives, where we cannot rely on Zalando Payments GmbH's identification, and for signing loan documents.
Puls Technologies GmbH: data the applicant enters or uploads on the platform, such as company data, data of representatives and beneficial owners, and documents for customer due diligence; and data that Puls has collected in providing its own platform services to the applicant, passed on at the applicant's instruction.
Security. Loans are secured by the applicant's inventory held in Zalando fulfilment centres and by its payout claims against Zalando Payments GmbH. We process stock and payout data to value, monitor and realise that security (section 5).
Recipients. Puls Technologies GmbH operates the application process as our processor. We share data with Zalando SE and Zalando Payments GmbH to the extent needed to administer, secure and realise collateral and to collect assigned payout claims.
Data of representatives and beneficial owners is usually provided by the applicant. We ask applicants to pass this information on to them.
We use automated procedures to analyse transaction, sales, inventory and financial data and to prepare credit decisions. Every credit decision is reviewed and made by a member of our staff. We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.
To assess creditworthiness and prevent fraud, we request information about applicants, their legal representatives, beneficial owners and guarantors from credit bureaus. We may also report data on the application, conclusion and performance of loans to them, including non-contractual conduct. The legal basis is Art. 6(1)(b) and (f) GDPR, based on our legitimate interest in sound credit decisions, risk assessment and fraud prevention. Credit bureaus also process the data for their own purposes, such as scoring. For financing via zeos.montold.com, credit reports may also reach us through Zalando SE (section 6). On request, we tell you which credit bureaus we have used.
Within our company, only staff who need data for the purposes above have access to it. We pass data to:
| Category of recipient | Purpose |
|---|---|
| Funds managed by us | Lender and contract partner of the borrower |
| IT, hosting and platform service providers acting as our processors | Operating our systems and loan application platforms, collecting information for customer due diligence |
| Partner platforms through which loans are arranged, and their payment service providers | Referral, administration and realisation of collateral, collection of assigned claims |
| Providers of identification and electronic signature services | Identifying persons and signing contract documents |
| Credit bureaus | Credit information (section 8) |
| Credit intermediaries | Arranging and processing applications they have referred |
| Third parties under § 17 GwG | Customer due diligence carried out on our behalf or relied upon |
| Collection agencies | Collection of overdue claims |
| Auditors, tax advisers and lawyers | Audits, accounting, legal advice and legal claims |
| Supervisory and other authorities, courts and the Financial Intelligence Unit | Where required by law |
All service providers acting on our behalf are contractually bound to comply with data protection law. On request, we tell you the specific recipients of your data (Art. 15(1)(c) GDPR).
We process data within the EU and the EEA. Where a service provider may transfer data to a third country, in particular IT service providers to the United States, the transfer is based on an adequacy decision (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR).
Records of customer due diligence under the Money Laundering Act: five years from the end of the business relationship (§ 8(4) GwG).
Loan contracts, business correspondence and accounting records: for the periods required by commercial and tax law (§ 257 HGB, § 147 AO), counted from the end of the calendar year in which the record was made.
Data needed to enforce or defend claims: until the claims are time-barred, normally three years from the end of the year in which they arose (§§ 195, 199 BGB).
Applications that do not lead to a loan: six months after the application is closed, unless a longer period applies under the Money Laundering Act.
Data is then deleted, or blocked where deletion is not yet possible.
To conclude a loan, we need the data required for the credit assessment and for customer due diligence. Under § 11(6) GwG, the contracting party must provide the information and documents needed for due diligence. Without this data, we cannot grant a loan.
After a loan has been granted, we may request further information and documents, for example to administer and monitor the loan and its security, or to update customer due diligence and for ongoing monitoring under the Money Laundering Act. The borrower is obliged to provide them under the loan documents and, for anti-money laundering and counter-terrorist financing purposes, under § 11(6) GwG. If they are not provided, we may be required to take measures up to terminating the business relationship (§ 10(9) GwG).
This section covers our own website, aifm.montold.de. Platforms through which loans are applied for, such as zeos.montold.com, are covered by their operators' privacy notices. We use no analytics or tracking on our website. When you visit it, the hosting provider processes technically necessary connection data (IP address, date and time, page requested) to deliver the website and keep it secure (Art. 6(1)(f) GDPR).
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). Rights may be limited by statutory retention duties, in particular under the Money Laundering Act.
Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds, or the processing serves legal claims.
You may lodge a complaint with a data protection supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
We update this policy when our processing changes.
Version 2.0, valid from 12.11.2026
