Privacy Policy for payment services: Satispay Europe S.A

Satispay Europe S.A. (“Satispay” or “we” or “us”) is a financial regulated intermediary that acts as an electronic money institution (“EMI”) authorized under the laws of Luxembourg.

At Satispay, we take the protection of personal data seriously. As a data controller, Satispay follows the applicable laws on data protection to make sure we handle personal data correctly when providing our services.

Satispay has appointed a data protection officer (“DPO”) who may help with any questions about the data processing we carry out and/or how to exercise your rights. You can reach our DPO at dpo@satispay.com.

Satispay processes personal data concerning a range of individuals (“Data Subjects” or “you”), including:

• consumers/merchants using the services (“Users”);
• merchants’ legal representatives and/or ultimate beneficial owners;
• prospective Users;
• individuals aged 14 to 17 seeking parental and/or guardian approval to complete the sign-up and use the services, as well as relatives, guardians and associates of such prospective Users;
• suppliers, partners and service providers;
• individuals whose personal data are shared with us by Users when using our services (like phone contacts saved in phone books);
• individuals who contact Satispay for information via social networks and/or other communication channels.

Satispay is committed to collecting only personal data strictly necessary for the pursuit of its purposes. In particular, Satispay collects personal data:

• from Users during the sign-up process and their usage of our services (heads-up: users between 14 to 17 must always share their parent/guardian’s personal data as part of their registration process);
• from other Data Subjects via phone, email or social media;
• from third-party companies that have provided guarantees on the lawfulness of the collection;
• through checks that Satispay carries out to ensure the accuracy of the received information and any public domain news about Users.

“Personal data” refers to any information capable of identifying directly or indirectly a natural person. In particular, Satispay processes personal identification data (like name, surname, home address, tax code, user ID, photo, age, etc.), contact information (like phone number, email address), financial data (bank account details), as well as other specific data tailored and necessary for each purpose. We only collect special categories of personal data (so-called “sensitive data”, like biometric data) and any negative news or data sources about Users, where expressly required by law or in case of public interest.

Below, we detail the types of personal data we process, why we do it and the legal grounds.

According to the purposes for which it is processed, Satispay may share personal data with:

• other Users for service-related reasons (like, payment to merchants, P2P);
• service providers for IT, communication, compliance, marketing, customer support and management;
• our staff, including Satispay group’s staff (who provide intercompany services), and business partners for service-related reasons;
• suppliers of commercial information;
• where requested, parents, guardians or associated people with Users;
• where requested, regulatory authorities, financial institutions (like banks and regulated payment services providers), competent courts, law enforcement agencies (including the police), public administrations.

These recipients may act as autonomous data controllers or as data processors. Data processors follow Satispay’s instructions.

Personal data is stored on servers located in the European Union. If needed for specific purposes, personal data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the data is processed safely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.

Satispay has set up strong internal data security measures as well as technical and organizational measures (like encryption, pseudonymization and anonymization) to keep personal data safe from accidental loss, misuse, alteration, destruction and/or unauthorised access.

Special measures are implemented to safeguard data concerning minors, enhancing their protection and security.

Satispay keeps personal data as long as needed to fulfil specific purposes and comply with applicable laws (such as tax or anti-money laundering laws). In particular:
* for the purpose outlined in paragraph 4.1 above, we keep your personal data for the duration of our agreement;
* for the purposes mentioned in paragraphs 4.2, 4.3, 4.7 and 4.8 above, we keep your personal data as long as necessary and as required by applicable law. In particular, for anti-money laundering and terrorism prevention, the law requires us to hold such data for 5 years after our services to you end;
* for the purposes outlined in paragraphs 4.4 and 4.6 above, we keep your data until you ask us not to use it anymore or request its deletion and, in any case, no longer than the duration of our contractual relationship;
* for the purpose mentioned in paragraph 4.5 above, we keep your data until you withdraw the consent or request for the data to be deleted and, in any case, no longer than the duration of our contractual relationship.

In any case, personal data may be stored longer in the event of disputes or requests by the competent authorities.

You may exercise at any time the following rights:

• the right to know whether your personal data are being processed, and, if this is the case, access it (right of access);
• the right to correct inaccurate or outdated personal data (right to rectification);
• if possible, the right to obtain the erasure of your personal data (right to erasure). To this end, you may also use the “Delete Account” option within the Satispay app;
• if possible, the right to limit data processing (right to restriction of processing);
• the right to receive and share your personal data with another controller in a common format (right to data portability);
• if possible, the right to object to data processing based on legitimate interest (right to object). If you wish to opt-out from direct marketing communications, you can also click on “Unsubscribe” at the bottom of each communication or use the “Notifications” section in the app;
• right to withdraw consent for specific data processing activities. You may click on “Unsubscribe” at the bottom of each communication or through the “Notifications” section in the app.

To exercise your rights, you may contact support@satispay.com or dpo@satispay.com.

You also have the right to lodge a complaint with the relevant Data Protection Authority. However, we encourage reaching out to us first to resolve any issues amicably and promptly.