TRUSTPAY SP. Z O.O. (“TRUSTPAY”) Privacy Notice (the “Privacy Notice”) explains how TRUSTPAY manages the personal information it collects, uses and discloses. Personal information means information about an identifiable individual. Personal information does not include aggregate information that cannot be associated with a specific individual, and in certain jurisdictions, it may also exclude business contact information.

We respect your privacy, protect and process your personal data in accordance with the rules of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – “GDPR”) and other applicable regulatory enactments.

This Privacy Notice outlines the principles and the detailed practices we follow in protecting and managing your personal information. This includes personal information we collect from customers or prospective customers of TRUSTPAY (“Customers”). This includes the personal information we collect when you access or use our website, product, and services (collectively, the “TRUSTPAY Services”); or when you otherwise interact with us. This Privacy Notice does not apply to information that is not personal information. This Privacy Notice does not apply to websites that you may be able to access via links on our website and/or activities offered by third parties. We are not responsible for the collection or use of your personal data from these third party websites. Please ensure you review any relevant policies on these sites.

In this Privacy Notice, “you” and “your” shall refer to TRUSTPAY Customers who may provide personal information to TRUSTPAY and “we”, “us”, “our” and “ourselves” shall refer to TRUSTPAY.

TRUSTPAY develops and maintains high standards of inner security measures and technologies to provide you with secure processing and storage of the data we collect from you; and keep your data safe against unauthorized or unlawful processing and against accidental loss, destruction or damage, we implement all necessary protection measures and are following fully the high data protection standards contained in the applicable regulations.

This Privacy Notice outlines certain purposes for which TRUSTPAY requires the collection, use and disclosure of personal information from TRUSTPAY Customers in order to provide its requested services. TRUSTPAY will identify any additional purposes for which personal information is collected, used or disclosed before or at the time the information is collected.

Generally, we collect, use and disclose personal information to:

• Administer and service the business relationship with TRUSTPAY Customers and to provide TRUSTPAY Customers with the requested services, information and support;
• Process payment transactions and facilitate billing for TRUSTPAY Customers;
• Improve and personalize TRUSTPAY services;
• Determine a TRUSTPAY Customer’s financial status by collecting financial information from credit agencies, strategic partners or other financial institutions;
• Comply with any required reporting (i.e.: PFSA (Polish Financial Supervision Authority), Visa, MasterCard etc.);
• Track and analyse trends and usage in connection with TRUSTPAY services and enable different features of TRUSTPAY services;
• Safeguard your or our interests such as to verify your identity; to investigate and prevent suspicious activities or fraud, and to protect our rights or property;
• Send other information about TRUSTPAY and its products and services.

Information you provide us via the TRUSTPAY payment platform:

• Information you provide when applying for an account with TRUSTPAY (your name, surname, address, contact information, place and date of birth, tax residency, identification document, information on source of income, etc.).
• A short video of yourself and your selfie, which you provide as part of the on-boarding process.
• The log in credentials and settings you choose for your account.
• Information you give us through the TRUSTPAY payment platform when you contact us.
• Answers you give to surveys so we can improve our services.

Information TRUSTPAY collects if you get in touch.

If you use other ways to get in touch than the TRUSTPAY payment platform, we collect the following information so we can answer your questions or take action:

• The phone number you’re calling from and the information you give us during the call.
• The email address you use and the contents of your email (and any attachments).
• Public details from your social media profile (like LinkedIn) if you reach out to us via these platforms and the contents of your messages or posts to us.

Information we collect when you use the TRUSTPAY services.

We collect this information to give you services in a safe and lawful way, and to keep improving them. This includes:

• details about payments to and from your payment account;
• details about how you use our payment platform;
• all the countries you’re a tax resident in and your Tax Identification Number for each one.

Information we collect from your phone and PC:

• The mobile network and operating system you use, so we can analyse how our app works and fix any issues.
• Your IP address and device ID for security reasons (we’ll link your mobile phone number with your device).

When you apply for our services, we search your records at fraud prevention agencies and KYC (Know Your Customer) and AML (Anti Money Laundering) service providers to fulfil our legal obligations.

We may also collect information about you from public sources for AML reasons or market research. This includes:

• official public records, like Company registers;
• information published by the press or on social media.

We collect and process your information only for legitimate purposes in accordance with the rules of data protection and processing established by GDPR and other applicable rules as well as with data processing principles, which means that your personal information will be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have informed you about and limited only to those purposes;
• Accurate and kept up to date;
• Maintained only for as long as necessary for the purposes we have informed you about;
• Kept securely and protected against unauthorized or unlawful processing and against loss or destruction using appropriate technical and organizational measures.

When TRUSTPAY using your personal data, at least one of the following applies: contractual or legal obligation, legitimate interest, public interest, vital individual interest or consent.

We need to use your data for a contract we have with you, or to enter into a contract with you. We use details about you to:

• consider your application;
• give you the services we agreed to in line with our terms and conditions;
• send you messages about your account and other services you use if you get in touch, or we need to tell you about something;
• exercise our rights under contracts we’ve entered into with you;
• investigate and resolve complaints and other issues.

We need to use your data to comply with the law. We:

• confirm your identity when you sign up or get in touch;
• check your record at immigration and fraud prevention agencies;
• prevent illegal activities like money laundering, tax evasion and fraud;
• keep records of information we hold about you in line with legal requirements;
• adhere to applicable laws and regulations (according to which we sometimes need to share customer details with regulators, tax authorities, law enforcement or other third parties);
• compare the information we hold about your account with your tax residency information to make sure we don’t have a reason to doubt it.

When it’s in our “legitimate interest”. We need to use your data for our legitimate interests, or those of a third party. This means using data in a way that you might expect us to, for a reason which is in your and/or our (or a third party’s) interest and which doesn’t involve overriding your privacy rights. We:

• tell you about products and services through the payment platform, website or other channels, like social media companies, based on how you use our products and services and other information we hold about you. We do this so we can make sure our marketing is useful. That includes instructing platforms to show or not show TRUSTPAY adverts to existing customers. We don’t share any identifying information with social media companies other than your mobile advertising ID. You can disable or reset your mobile advertising ID in your device’s operating system;
• provide you with transaction reports;
• track, analyse and improve the services we provide to you and other customers and how you respond to ads we show. We may ask for feedback if you’ve shown interest in a service. We do this so that we can make our products better and understand how to market them;
• protect the rights, property or safety of us, our customers or others;
• carry out security and maintenance checks to make sure our app and other services run smoothly for you;
• manage TRUSTPAY’s business risk and financial affairs and protect our customers and staff.

Consent. We’ll ask for your consent to share information about you with companies we work with when we need your permission (see “Limiting use, Disclosure and Retention” below).

You don’t have to share information about yourself if you don’t want to. But if you don’t, you may not be able to use some (or any) of our services.

TRUSTPAY will use or disclose your personal information only for the purposes for which it was collected, except with your consent or as required or permitted by law. TRUSTPAY will retain your personal information as long as necessary for the fulfilment of those purposes, subject to statutory or regulatory retention requirements and legitimate business reasons.

In the course of daily operations, access to personal and other sensitive information is restricted to authorized employees who have legitimate business purposes for accessing it.

We do not license, sell, rent or trade your personal information to third parties unless it is necessary to provide you with requested services and you authorize or consent to the disclosure, or when such disclosure is otherwise described in this Privacy Notice or permitted or required by law.

Disclosure to Third Parties.

We may disclose or share your personal information with third parties in situations where:

• We have your consent;
• The third parties are (a) our suppliers or partners who assist us in providing, maintaining, and improving TRUSTPAY Services; and (b) financial institutions, processors, payment card associations, and other entities that are part of the payment process;
• We are required or permitted to do so by law or applicable regulators and self-regulatory organizations; and
• Merger, sale of company stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business is involved.

In such situations, TRUSTPAY only shares the personal information with third parties for appropriate purposes in providing the requested products and services to TRUSTPAY Customers. Additionally, TRUSTPAY uses contractual means to ensure that personal information shared with third parties is provided with comparable levels of protection and management as provided under this Privacy Notice. It is possible such third parties are outside of Poland and subject to their own respective jurisdictions.

We retain your personal information as long as necessary for the fulfilment of the identified purpose(s). We make reasonable efforts to ensure that personal information, which is no longer required to be retained, is disposed of or destroyed in a secure manner.

You can exercise your rights in relation to your Personal data in accordance to the relevant data protection legislation. In total, you have right to: access, correction, delete, limitation of data processing, transfer, objection on processing, objection on profiling, consent withdraw and complaint to the data protection authority. If you have any questions in relation to our use of your Personal data, contact us.

Your exercise of these rights is subject to certain exemptions to safeguard the public interest, e.g., the prevention or detection of crime, and our interests, e.g., the maintenance of legal privilege. If you exercise any of these rights, we will check your entitlement and respond in most cases within a month.

We may transfer and store the data we collect from you to organisations outside the European Economic Area (EEA). When we do this, we make sure that your data is protected and that:

• the European Commission says the country or organisation has adequate data protection, or
• we’ve agreed to standard data protection clauses approved by the European Commission with the organisation.

TRUSTPAY complies with its obligations under the applicable data protection laws by:

• keeping personal data up to date;
• storing and destroying it securely;
• not collecting or retaining excessive amounts of data;
• protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical and organizational measures are in place to protect personal data.

TRUSTPAY will use reasonable efforts to maintain your personal information in the as accurate, complete and up-to-date form as is necessary for the purposes for which it is to be used, in compliance with applicable legislation.

TRUSTPAY will put in place security safeguards appropriate to the sensitivity of the personal information in order to protect your personal information from unauthorized access, improper use and accidental destruction or loss.

We take reasonable measures, including administrative, technical, and physical safeguards, to help protect personal information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. Personal information, in both electronic and paper-based form, is stored in a highly secured environment with restricted access. TRUSTPAY Services uses encryption for protecting and maintaining the security of message transmissions over the Internet.

TRUSTPAY’s employees, as a condition of their employment, are required to comply with confidentiality, merchant privacy and security obligations. TRUSTPAY’s employees are also trained on the importance of privacy and maintaining the confidentiality of personal information.

From time to time, TRUSTPAY reviews and updates its security policies and measures in an effort to protect the information in the most effective manner possible.

TRUSTPAY shall make available to you, upon request, specific information about our policies and practices that apply to the management of your personal information.

You can check our Privacy Notice on our website or contact us to obtain a current copy of our Privacy Notice.

Upon request, TRUSTPAY shall inform you of the existence, use and disclosure of your personal information. You may verify the accuracy and completeness of your personal information and may request that it be amended, if appropriate, as provided by applicable legislation.

Subject to applicable legislation, our merchants may access, verify and update their personal information by logging into their account on the merchant portal or by calling our Support Centre If there is any error, we will promptly amend and correct the information in our possession.

You may direct any questions, concerns or complaints regarding TRUSTPAY’s privacy Notice and practices outlined above by contacting:

TRUSTPAY SP. Z O.O.br
Ul. Hoza 86/210, 00-682 Warszawa
E-mail: [email protected]