1. Who is the data controller and how can you contact the DPO?
SatisWelfare S.p.A. (“Satispay”), with a registered office in Milan, Piazza Fidia no. 1, tax code and registration number with the Milan Companies Register 12408640964.
Satispay has appointed a data protection officer (“DPO”) who may help with any questions about the data processing we carry out and/or how to exercise your rights. You can reach our DPO at dpo@satispay.com.
2. Whose personal data does Satispay process?
Satispay processes personal data of:
- legal representatives and/or ultimate beneficial owners of affiliated merchants that accept meal vouchers, shopping vouchers, and other corporate welfare products, as well as merchants who use payment services provided by Satispay Europe S.A., for the purpose of offering and providing value-added services;
- employers interested in offering welfare services to their employees and collaborators, as well as such employees and collaborators currently employed by those employers.
3. How does Satispay collect personal data?
In the course of providing its own services (collectively, the “Services”), Satispay collects personal data directly from data subjects or, in the case of data related to merchants, also through Satispay Europe S.A. In addition, Satispay may also collect the personal data of the legal representatives of merchants, of employers and/or of their “points of contact” from third parties, such as partners engaged to carry out lead generation campaigns and/or third-party companies that hold databases and have provided assurances as to the lawfulness of the collection. Personal data of employees and collaborators who benefit from the welfare services are also collected through their respective employers, who share such data with Satispay.
4. What types of personal data does Satispay process? For what purposes and on what legal basis?
Satispay processes personal identification data (like name, surname, VAT number, etc.), contact information (email address, phone number), financial data (e.g., revenue) and data related to the Services used for the following purposes and on the legal bases indicated below:
- to reply to and reach out to individuals interested in the Services, to the extent that such processing is necessary for the performance of pre-contractual measures taken at the request of the data subjects (Art. 6.1, letter b, GDPR). Communications between Satispay and data subjects, including phone calls, may be recorded and monitored to maintain appropriate documentation and verify any indications provided by the data subject regarding their needs and/or preferences in relation to the provision of the Services. In addition, in certain cases, calls may be made through automated tools (e.g., virtual assistants or bots) based on artificial intelligence systems;
- to ensure the proper provision and subsequent use of the Services, including sending communications necessary for the provision of such Services as well as customer support, to the extent that such processing is necessary for the performance of a contract to which the data subject is a party (Art. 6.1, letter b, GDPR). Communications between Satispay and data subjects, including phone calls, may be recorded and monitored to maintain appropriate documentation and verify any indications provided by the data subject regarding their needs and/or preferences in relation to the provision of the Services;
- to comply with legal obligations related to the provision of the Services, as well as with requests from competent authorities to which Satispay is subject (Art. 6.1, letter c, GDPR);
- to conduct analyses aimed at improving and optimizing the Services, as well as the development of new services, including through surveys, based on Satispay’s and/or employers’ legitimate interest (Art. 6.1, letter f, GDPR). Satispay, in fact, has a legitimate interest in constantly improving its services and/or developing new ones, also taking into account the specific needs of its customers, including the ultimate beneficiaries of its services. This interest is in line with customers’ legitimate expectations of receiving a service that is always functioning and tailored to their needs. Please note that surveys, sent by email and/or administered by phone, may also be addressed to the employees or collaborators of employers, as ultimate beneficiaries of the Services. In addition, communications between Satispay and data subjects, including phone calls, may be recorded and monitored for staff training and quality control purposes;
- to send communications promoting the Services and informing data subjects of updates and/or features related to the Services, based on Satispay’s legitimate interest (Art. 6.1, letter f, GDPR). Satispay, in fact, has a legitimate interest in informing its customers of all updates to the services provided and/or any new services, including those related to and/or complementary to services already purchased, as well as in informing its customers about the correct use of the services provided. This interest is in line with customers’ legitimate expectations of being kept up to date on the services purchased, as well as of being properly informed on how to make the best use of them, taking into account their needs;
- to send, through business partners, communications promoting the Services, based on the prior consent of the data subjects, provided directly to such partners (Art. 6.1, letter a, GDPR);
- to follow up on requests or communications of any nature from data subjects, based on Satispay’s legitimate interest in responding appropriately to any requests or communications from data subjects (Art. 6.1, letter f, GDPR). This interest is in line with the data subject’s legitimate expectations of receiving a complete and timely response to any requests submitted to Satispay;
- to establish, exercise or defend the rights of Satispay and/or its employees, as well as to carry out business transactions (for example, in the event of bankruptcy, merger, acquisition, reorganization, sale of assets and/or transfers), based on a legitimate interest in establishing, exercising or defending its own rights and/or the rights of its employees, as well as in carrying out transactions essential to its business (Art. 6.1, letter f, GDPR). This legitimate interest of Satispay prevails over the rights and freedoms of the data subject, as it is based on Satispay’s own right to judicial protection (guaranteed by law) and on Satispay’s need to ensure business continuity. The data subject can reasonably expect such processing to take place, and Satispay limits the processing of data to what is strictly necessary, applying appropriate confidentiality and security safeguards.
5. Who can receive personal data?
Where strictly necessary, Satispay may share personal data with:
- service providers for IT, communication, marketing, compliance, customer support and management;
- our staff, including Satispay’s group staff (who provides intercompany services), as well as business partners for reasons related to the Services;
- employers offering welfare services to their employees and collaborators. Specifically, Satispay may share the names of employees/collaborators using welfare services, without disclosing further details regarding how such services are used;
- where requested, competent authorities, including financial institutions, courts, law enforcement agencies, and public administrations.
These recipients may act as autonomous data controllers or as data processors. Data processors follow Satispay’s instructions.
6. Where is data stored and where may it be transferred?
Personal data is stored on servers located in the European Union. If needed for specific purposes, personal data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the data is processed safely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.
7. How does Satispay ensure the security of personal data?
Satispay has set up strong internal data security measures as well as technical and organizational measures (like segregation, encryption, pseudonymization and anonymization) to keep personal data safe from accidental loss, misuse, alteration, destruction and/or unauthorised access.
8. How long does Satispay retain personal data?
Satispay retains personal data as long as needed to fulfil specific purposes and comply with applicable laws. In particular:
- for the purposes outlined in paragraphs 4.a), 4.b) and 4.g) above, Satispay retains personal data for the duration of the relevant contractual or pre-contractual relationship. For the purposes outlined in paragraphs 4.a) and 4.b), with regard to any recordings of phone calls with the customer, including any full transcripts of the call, Satispay retains such data for a period of 24 hours from when the call was made. Should technical issues prevent deletion after 24 hours, the recording will in any case be automatically deleted after a maximum of 72 hours. After this period, Satispay retains only a summary of the content of the call. Where the call was made through an automated system based on artificial intelligence, the recording and any transcript may be retained for a maximum period of 7 days from when the call was made;
- for the purposes outlined in paragraphs 4.c) and 4.h) above, data is retained for the time required by applicable law. Specifically, Satispay retains such data for 10 years after the end of the relevant contractual relationship;
- for the purposes outlined in paragraphs 4.d) and 4.e) above, Satispay retains personal data until the data subject asks us not to use it anymore or requests its deletion and, in any case, no longer than the duration of our contractual relationship. With regard to any recordings of phone calls with the customer, including any full transcripts of the call, for the purpose outlined in paragraph 4.d), Satispay retains such data for a period of 24 hours from when the call was made. Should technical issues prevent deletion after 24 hours, the recording will in any case be automatically deleted after a maximum of 72 hours. After this period, Satispay retains only a summary of the content of the call;
- for the purpose outlined in paragraph 4.f), data is retained until consent is withdrawn or a deletion request is made and, in any event, no longer than the duration of the marketing campaign for which the data subject’s consent was collected.
In any case, personal data may be stored longer in the event of disputes or requests by the competent authorities.
9. What rights can data subjects exercise?
Data subjects may exercise the following rights at any time:
- the right to know whether their personal data is being processed and, if so, to obtain a copy (right to access);
- the right to correct inaccurate or outdated personal data (right to rectification);
- where applicable, the right to have their personal data deleted (right to erasure);
- where applicable, the right to limit the processing of their personal data;
- the right to receive and transmit their personal data to another data controller in a commonly used format (right to data portability);
- where applicable, the right to object to data processing based on legitimate interest (right to object). If you wish to object to direct marketing communications, you can also click “Unsubscribe” at the bottom of any communication;
- the right to withdraw consent for specific data processing activities.
To exercise your rights, you may contact dpo@satispay.com.
You also have the right to lodge a complaint with the relevant Data Protection Authority. However, we encourage reaching out to us first to resolve any issues amicably and promptly.
