1. Who is the data controller and how can you contact the DPO?
This privacy policy is provided by Satispay Europe S.A., a financial intermediary that acts as an electronic money institution, and Satispay Invest S.A., an investment firm, both authorized and regulated under the laws of Luxembourg (jointly, “Satispay”).
Depending on the services offered, the two companies play different roles in the processing of personal data. Specifically:
- Satispay Europe S.A. acts as an autonomous controller for all data processing related to the provision of payment services;
- Satispay Invest S.A., depending on the processing activities performed, acts as an autonomous data controller or as a joint controller together with Satispay Europe S.A., in the context of data processing related to the provision of investment services. To this end, the two companies have entered into a specific agreement that outlines and allocates their respective liabilities regarding compliance with obligations under applicable data protection regulations.
Satispay has appointed a data protection officer (“DPO”) who may help with any questions about the data processing we carry out and/or how to exercise your rights. You can reach our DPO at dpo@satispay.com.
2. Whose personal data does Satispay process?
Satispay processes personal data concerning a range of individuals (“Data Subjects” or “you”), including:
- subjects using our services;
- legal representatives of user merchants and/or ultimate beneficial owners;
prospective users;
- individuals aged 14 to 17 seeking parental and/or guardian approval to complete the sign-up and use the payment services, as well as relatives, guardians and associates of such prospective users;
- suppliers, business partners and service providers;
- individuals whose personal data are shared with us by users when using our services (like phone contacts saved in phone books);
- individuals who contact Satispay for information via social networks and/or other communication channels.
3. How does Satispay collect personal data?
Satispay is committed to collecting only personal data strictly necessary for the pursuit of its purposes. In particular, Satispay collects personal data:
- from users during the sign-up process to Satispay app and their usage of our services (heads-up: as part of the registration process for payment services, users between 14 to 17 must always share their parent/guardian’s personal data);
- from other Data Subjects via phone, email or social media;
- from third-party companies that have provided guarantees on the lawfulness of the collection;
- through checks that Satispay carries out to ensure the accuracy of the received information and any public domain news about users.
4. What types of personal data does Satispay process? For what purposes and on what legal basis?
“Personal data” refers to any information capable of identifying directly or indirectly a natural person. In particular, Satispay processes personal identification data (like name, surname, home address, tax code, user ID, photo, age, etc.), contact information (like phone number, email address), financial data (bank account details), as well as other specific data tailored and necessary for each purpose. We only collect special categories of personal data (so-called “sensitive data”, like biometric data) and any negative news or data sources about users, where expressly required by law or in case of public interest.
Below, we detail the types of personal data we process, why we do it and the legal grounds.
4.1. To enable sign-up and provide the services requested by the users, including sending communications necessary for the provision of such services.
Legal basis
Processing is necessary for the performance of a contract or to take steps at the users’ request before entering into a contract (art. 6.1, lett. b, GDPR). Plus, we have a legitimate interest in ensuring our services are as effective and efficient as possible (art. 6.1, lett. f, GDPR).
Types of data
- personal identification data;
- contact information;
- financial data;
- data generated through the use of services, including browser and device information and IP address.
4.2. To prevent and detect financial crimes and fraud, as well as combat terrorism to ensure the security of our services.
To this end, Satispay also uses machine learning models as a measure to better identify potential risks and enforce protective actions against certain users.
Legal basis
Processing is necessary to comply with legal obligations to which Satispay is subject (art. 6.1, lett. c, GDPR), as well as to pursue a substantial public interest (art. 9.2, lett. g, GDPR). Also, we have a legitimate interest in avoiding financial crime and safeguarding our business (art. 6.1, lett. f, GDPR).
Types of data
- personal identification data;
- contact information (including phone numbers of contacts saved in users' address books, to the extent that users have given their consent for access to their address books);
- financial data;
- data generated through the use of services, including browser and device information, IP address.
4.3. To comply with legal obligations, such as verifying users’ identity and reporting suspicious activities to competent authorities.
To this end, Satispay also uses technologies that enable remote automated recognition.
Legal basis
Processing is necessary for the performance of a contract or to take steps at the users’ request before entering into a contract (art. 6.1, lett. b, GDPR), as well as to comply with legal obligations to which Satispay is subject (art. 6.1, lett. c, GDPR). Also, we process biometric data and any negative news or data sources about users to pursue a substantial public interest (art. 9.2, lett. g, and art. 10 GDPR).
Types of data
- personal identification data;
- contact information;
- financial data;
- biometric data;
- data generated through the use of services, including browser and device information, IP address.
4.4. To send communications to: (i) teach new users about the functionalities of our app; (ii) inform users on current services, updates on our app, and/or new features related to the services they’ve been using, including through the sending of surveys.
Legal basis
We have a legitimate interest in increasing the use and awareness of our services (art. 6.1, lett. f, GDPR).
Any direct marketing activities are carried out without the prior consent of the users when allowed by applicable law.
Types of data
- personal identification data;
- contact information;
- financial data;
- data generated through the use of services (like balance/budget set, activation date of payment/investment service, date of the first payment/investment, number of payments/investments within a certain period).
4.5. Promote services similar to those already used by the Data Subject on social media or send communications to: (i) promote our services, including through profiling activities; (ii) conduct marketing campaigns; (iii) inform users about new partnerships with third parties, promoting the products/services of such third-party companies
For this purpose, Satispay may also use machine learning models that help optimize the content of promotional campaigns. For users under 18, Satispay limits profiling to be less intrusive.
Legal basis
Processing is based on the prior consent of the users (art. 6.1, lett. a, GDPR).
Types of data
- personal identification data;
- contact information;
- data generated through the use of services (like balance/budget set, activation date of payment/investment service, date of the first payment/investment, number of payments/investments within a certain period);
- data about participation in some previous promotional campaigns.
4.6. To ask users for their opinion about our services, our app and their experience with merchants, for example through surveys, interviews or via the app
Legal basis
We process personal data based on our legitimate interest in optimising the app and our services. Similarly, we pursue the legitimate interest of merchants in improving the services they offer you (Art. 6.1, letter f, GDPR).
Types of data
- personal identification data;
- contact information;
- financial data;
- data generated through the use of services (e.g., balance/budget set, date of activation of the payment and/or investment service, date of first payment/investment, number of payments/investments in a given period).
4.7. To carry out statistical and trend analyses, as well as any further data tracking activities, aimed at improving the services and giving users the best user experience possible.
Legal basis
We have a legitimate interest in improving our services (art. 6.1, lett. f, GDPR). For this purpose, personal data may also be aggregated and/or anonymized in such a way that identification of Data Subjects is no longer possible.
Types of data
- personal identification data;
- financial data;
- some data generated through the use of services (like balance/budget set, activation date of payment/investment service, date of the first payment/investment, number of payments/investments within a certain period);
- data generated through the interaction with previous communications.
4.8. To follow up on requests or communications of any nature coming from Data Subjects.
Legal basis
Processing is necessary for the performance of a contract or to take steps at the Data Subjects’ request before entering into a contract (art. 6.1, lett. b, GDPR). Also, we have a legitimate interest in properly replying to requests or communications coming from Data Subjects (art. 6.1, lett. f, GDPR).
Types of data
- personal identification data;
- contact information;
- any other information as may be necessary to properly reply to the requests or communications coming from Data Subjects.
4.9. To establish, exercise or defend Satispay’s rights and/or those of our employees, as well as to carry out corporate transactions (e.g., in case of bankruptcy, merger, acquisition, reorganization, sale of assets, and/or assignments).
Legal basis
We have a legitimate interest in establishing, exercising or defending our rights and/or the rights of our employees, as well as in carrying out transactions essential for our business (art. 6.1, lett. f, GDPR).
Types of data
- Personal identification data;
- any other information as may be necessary for the pursuit of this purpose.
To find out how Satispay processes personal data through the use of cookies and similar technologies, please see the cookie policy available here.
4.10. Assessing suitability for the services offered and likelihood of repayment of the financing granted: we may use automatic assessment models (scoring), profiling tools and machine learning models.
Legal basis
Processing is necessary for the performance of the contract or pre-contractual measures requested by the user (Art. 6.1, letter b, GDPR and Art. 22.2, letter a, GDPR). We also have a legitimate interest in protecting the security of the service and assess the solvency of Data Subjects (Art. 6.1, letter f, GDPR).
Types of data
Automatic assessment models may consider, in combination, factors such as:
- identification data;
- contact details;
- financial data;
- order amount;
- Satispay payment history;
- accuracy of personal data;
- payment method information;
- use of in-app services and features;
- technical signals (device, IP);
- results from public databases or insolvency reports, as well as information provided by third-party suppliers for scoring/anti-fraud purposes.
A negative assessment may result in the refusal of access to certain Satispay services.
5. Who can receive personal data?
According to the purposes for which it is processed, Satispay may share personal data with:
- other users for service-related reasons (like, payment to user merchants, P2P);
- service providers for IT, communication, compliance, marketing, customer support and management;
- our staff, including Satispay group’s staff (who provides intercompany services), and business partners for reasons related to the various services offered;
- suppliers of commercial information;
- where requested in the context of the provision of payment services, parents, guardians or associated people with users;
- suppliers providing digital identity verification services for users;
- where requested, regulatory authorities, financial institutions (like banks, regulated payment services providers, intermediaries, and investment funds), competent courts, law enforcement agencies (including the police), and public administrations.
These recipients may act as autonomous data controllers or as data processors. Data processors follow Satispay’s instructions.
6. Where is data stored and where may it be transferred?
Personal data is stored on servers located in the European Union. If needed for specific purposes, personal data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the data is processed safely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.
7. How does Satispay ensure the security of personal data?
Satispay has set up strong internal data security measures as well as technical and organizational measures (like segregation, encryption, pseudonymization and anonymization) to keep personal data safe from accidental loss, misuse, alteration, destruction and/or unauthorised access.
Special measures are implemented to safeguard data concerning minors, enhancing their protection and security.
8. How long does Satispay retain personal data?
Satispay retains personal data as long as needed to fulfil specific purposes and comply with applicable laws (such as tax or anti-money laundering laws). In particular:
* for the purpose outlined in paragraph 4.1 above, we keep your personal data for the duration of our agreement;
* for the purposes mentioned in paragraphs 4.2, 4.3, 4.7, 4.8 and 4.9 above, we keep your personal data for 5 years after our services to you end;
* for the purposes outlined in paragraphs 4.4 and 4.6 above, we keep your data until you ask us not to use it anymore or request its deletion and, in any case, no longer than the duration of our contractual relationship;
* for the purpose mentioned in paragraph 4.5 above, we keep your data until you withdraw the consent or request for the data to be deleted and, in any case, no longer than the duration of our contractual relationship.
In any case, personal data may be stored longer in the event of disputes or requests by the competent authorities.
9. Which rights may you exercise?
You may exercise at any time the following rights:
- the right to know whether your personal data are being processed, and, if this is the case, access it (right of access);
- the right to correct inaccurate or outdated personal data (right to rectification);
- if possible, the right to obtain the erasure of your personal data (right to erasure). To this end, you may also use the “Delete Account” option within the Satispay app;
- if possible, the right to limit data processing (right to restriction of processing);
- the right to receive and share your personal data with another controller in a common format (right to data portability);
- if possible, the right to object to data processing based on legitimate interest (right to object). If you wish to opt out from direct marketing communications, you can also click on “Unsubscribe” at the bottom of each communication or use the “Notifications” section in the app;
- right to withdraw consent for specific data processing activities. You may click on “Unsubscribe” at the bottom of each communication or through the “Notifications” section in the app;
- the right to obtain human intervention if a decision regarding the suitability of one of our services is based solely on automated processes and produces legal or similar effects.
To exercise your rights, you may contact support@satispay.com or dpo@satispay.com.
You also have the right to lodge a complaint with the relevant Data Protection Authority. However, we encourage reaching out to us first to resolve any issues amicably and promptly.
