This Privacy Notice describes the rules according to which AltPay LTD processes the personal data of any person/legal entity using any services offered by ALTPAY.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of
such data.
ALTPAY: AltPay LTD (further ALTPAY or we);
Card:
payment card issued by ALTPAY;
Payment Account: payment account
at ALTPAY;
Payment Account Terms: regulated under General Terms
and Conditions available on the
www.altpay.uk website;
Policy:
this Privacy Notice;
Person (You): any person using any services
offered by ALTPAY (including user);
User: a person or an entity,
who uses the Services, agreed to the Terms of Use and is a holder of
an Account;
Data controller of personal data: AltPay LTD, registry code 11347482, address 40 Bank street, Level 18, Canary Wharf, London, E14 5NR, United Kingdom
Data Protection Officer- The responsible
person appointed by the ALTPAY.
ALTPAY principles while processing Person’s/ ALTPAY user personal data:
2.1. ALTPAY processes personal data only in accordance with this Policy and applicable laws;
2.2. ALTPAY collects and processes personal data only for the purposes stipulated in this Policy;
2.3. ALTPAY makes sure that the personal data which ALTPAY collects and processes is:
2.3.1. adequate, relevant and limited to what is necessary for the
purposes stipulated in this Policy;
2.3.2. accurate and up to
date and stored only for such period as is necessary for the purposes
stipulated in this Policy.
2.4. ALTPAY applies appropriate technological and organizational measures to ensure the availability, authenticity, integrity and confidentiality of personal data.
The personal data, which ALTPAY collects and processes includes the following:
3.1. Personal Details – Your personal details, including:
• Full name;
• Date of birth;
•
Personal identification code;
• Citizenship;
•
Residency;
• Residential address;
• e-mail
address;
• mobile phone number;
• occupation,
photo of person, which is provided to ALTPAY for the purpose of
identifying the person.
3.2. Identification Document Data – Data retrieved from Person’s
identification document which Person has forwarded to ALTPAY,
including the document number, issue date, expiry date and issuing
entity, photo of Person’s identification document, which Person has
forwarded ALTPAY for the purpose of identifying itself.
3.3. Due Diligence Data – Data which ALTPAY collects for the purpose of conducting customer due diligence under applicable anti-money laundering laws from Person and appropriate databases, including information about:
• whether Person have been
affiliated with money laundering or terrorist financing;
•
whether Person have been prosecuted for a crime;
•
whether Person have been subject to any international financial
sanctions;
• whether Person have (been) held a public
office or
• whether the Person is/ have been a close
relative or associate of someone who has held PO.
3.4. Transaction Data – Details of any transfers made to and from Person’s Payment Account, including the name and account number of the payer and the payee, the date, time, currency, amount and explanation of the transaction.
3.5. Card Data – Person’s Card data, including:
• Card number of the Person;
• the name printed on
Person’s Card;
• the expiry date of Person’s Card;
3.6. Device Data – Information regarding the device on which
Person is using the ALTPAY services, including the device’s model,
name or any other identifier and the IP address of the network from
which Person is using the ALTPAY IBA (Internet bank of AltPay)
3.7. Preference Data – Person’s preferences in the ALTPAY app/i-ALTPAY (language preferences, transaction limits, etc).
3.8. Contact Data – The contacts list on Person’s device.
3.9. Customer Support Data – Communication between Person and ALTPAY’s customer support (e-mails and calls).
3.10. Usage Data – Data about Person interaction with the IBA (e.g. information about which features of the IBA does Person use, which features do not use, etc).
3.11. Other Data – Other data not listed in this Section 3, which is generated as a result of using the ALTPAY Services (e.g. gif-images added to payments, comments added to claims, etc).
ALTPAY collects and processes personal data for the following purposes:
4.1. Compliance purposes (GDPR art 6 ( 1 ) ( a )) – to perform an obligation under applicable laws, including the obligation to:
• avoid money laundering, terrorist financing and fraud;
•
ensure the fulfilment of international financial sanctions;
•
ensure the security of ALTPAY’s payment services;
• comply
with the lawful inquiries and orders of:
• public
authorities, including foreign public authorities with whom ALTPAY is
obliged to cooperate under applicable laws;
• other
financial institutions with whom ALTPAY is obliged to cooperate under
applicable laws.
4.2. Contractual purposes (GDPR art 6(1)(b)) – to perform or enter into a contract between Person and ALTPAY.
4.3. Fraud monitoring purposes (GDPR art 6(1) (f)) – to monitor and decrease payment fraud.
4.4. Analytical purposes (GDPR art 6(1)(f)) – to gain a better
understanding of the preferences of ALTPAY’s customers and how do
customers interact with the ALTPAY.
Note that upon processing
personal data for Analytical Purposes, the data is part of a large
mass of data. ALTPAY does not analyze Person’s individual
preferences or Person’s individual interaction with the ALTPAY.
4.5. Marketing Purposes (GDPR art 6(1)(a)) – to send marketing
e-mails of ALTPAY’s products and services.
ALTPAY does not process personal data for profiling or other automated decision making.
ALTPAY needs Person’s consent for processing personal data for the following purposes:
• Marketing purposes;
• Additional Features.
If ALTPAY would want to process personal data for any new
purpose, which requires Person’s consent, then ALTPAY will not
process personal data for such new purpose, before ALTPAY has
received Person’s consent for such processing.
The consent for the processing of personal data can be withdrawn at any time. Send an email to info@altpay.uk to delete personal data or write message via ALTPAY website https://altpay.uk/contacts.
The withdrawal of Person’s consent does not affect the legality of processing personal data prior to the withdrawal of Person’s consent.
There is no statutory obligation for Person to provide ALTPAY its
personal data. However, there are statutory obligations for ALTPAY to
collect personal data. In order for ALTPAY to provide Person its
services, ALTPAY needs to collect and process personal data. In case
ALTPAY is not able to collect or process personal data, ALTPAY will
not able to provide Person its services.
ALTPAY collects Due Diligence Data from sources other than Person itself. Such sources include:
• databases of people affiliated with money laundering or
financing terrorism;
• databases of people, who have been
accused of a crime;
• databases of people subject to
international financial sanctions;
• databases of people who
have held a public office, etc.
Some of these databases are publicly available and some of them are not. In addition, ALTPAY uses other public databases for collecting Due Diligence Data.
ALTPAY stores personal data for the following periods:
9.1. Transaction Data – 7 years after Payment Account is closed. ALTPAY is obliged to store this data for such period under accounting and taxation laws.
9.2. Personal Details, Identification Document Data, Due Diligence Data, Card Data – 5 years after termination of the business relationship with ALTPAY, which, upon the request of the FCA may be extended up to another 5 years. ALTPAY is obliged to store this data for such period under Money Laundering and Terrorist Financing Prevention Act.
9.3. Device Data, Preference Data, Contact Data – Until the closure of Payment Account.
9.4. Customer Support Data, Usage Data – 1 year as of its creation, except for e-mails and chat logs, which are stored at least until the closure of Payment Account. ALTPAY stores this data for such period as within this period the data is still relevant for Analytical Purposes. E-mails and chat logs are necessary for providing customer support until such time when Person is no longer a customer of ALTPAY.
9.5. Other Data – Deleted after closing Payment Account. This data is necessary only for enabling Person the use of the ALTPAY and is not necessary after Payment Account is closed.
After the periods stipulated in this Section ALTPAY will delete personal data
ALTPAY stores personal data on servers/cloud located within the European Economic Area.
In connection with the processing of personal data, person has the following rights:
Right to information – Person has the right to receive the information provided in this Policy. The valid version of this Policy will be available on the https://altpay.uk/ website at any given time.
Right to access – Person has the right to ask ALTPAY to provide Person with a copy of its personal data which ALTPAY processes.
Right to Rectification – Person has the right to ask ALTPAY to rectify Person’s personal data in case the data is incorrect or incomplete.
Right to erasure – Person has the right to ask ALTPAY to erase Person’s personal data, unless ALTPAY is obliged to continue processing personal data under law or under a contract between Person and ALTPAY, or in case ALTPAY has other lawful grounds for the continued processing of Person’s personal data. ALTPAY will, in any case, delete personal data as soon as it no longer has lawful grounds for processing Person’s personal data.
Right to restriction – Person has the right to ask ALTPAY to restrict the processing of Person’s personal data in case the data is incorrect or incomplete or in case Person’s personal data is processed unlawfully.
Right to data portability- Person has the right to ask ALTPAY to provide Person or, in case it is technically feasible, a third party, personal data, which Person itself has provided ALTPAY and which is processed in accordance with Person consent or a contract between Person and ALTPAY.
Right to object – Person has the right to object to processing personal data in case Person believe that ALTPAY has no lawful grounds for processing Person’s personal data. For any processing conducted in accordance with Person consent, Person can always withdraw its consent.
Right to file complaints – Person has the right to file complaints regarding Processing personal data.
Person can exercise its rights stipulated in this Section 11 by using the respective functionalities of the ALTPAY or sending a respective request to info@altpay.uk.
ALTPAY will make its best efforts to respond to Your application submitted in accordance with this Section 11 within 2 weeks. Under GDPR article 12(3) ALTPAY must respond to Your application within 1 month. In case it is necessary due to the number and complexity of applications filed with ALTPAY, ALTPAY may, under GDPR article 12(3), also respond to Your application within 3 months.
ALTPAY does not open Child Account as according to ALTPAY Terms and Conditions it can be opened by a person with an active legal capacity of at least 18 years of age.
Upon processing personal data, ALTPAY may share elements of Person’s personal data with the following third parties:
• public authorities and other financial institutions whom ALTPAY
is obliged to disclose personal data under law;
• server
hosts/ cloud service providers who host ALTPAY’s servers/ clouds;
•
payment processors and payment network operators who process Person’s
transactions;
• identification service providers who help
ALTPAY verify Person’s identity and acquire Due Diligence Data;
•
card manufacturers who manufacture Person’s Card;
•
communication service providers who facilitate e-mails, calls, SMS
messages and other communication between Person and ALTPAY;
•
couriers who help ALTPAY deliver letters (e.g. letters with Your Card
and PIN codes);
• partners, with whom ALTPAY has arranged You
a gift, a discount or another special offer;
• other parties
involved with the provision of ALTPAY’s services.
The partners listed in Section 12 above may be located within and outside of the European Economic Area but ALTPAY makes sure that the servers on which personal data is stored are, in any case, located within the European Economic Area.
Upon sharing personal data with third parties, ALTPAY will apply the following safeguards:
• ALTPAY enters into a data processing agreement with the relevant
third party;
• ALTPAY makes sure that such third party
undertakes to implement appropriate technical and organizational
measures ensuring the processing of personal data in accordance with
this Policy and applicable laws;
• ALTPAY makes sure that
personal data will not be forwarded to any countries which the
Commission of the European Union has not recognized as ensuring an
adequate level of data protection.
ALTPAY cannot apply the safeguards stipulated in Section 14 above
upon sharing personal data with public authorities and other
financial institutions whom ALTPAY is obliged to disclose personal
data under law.
ALTPAY may unilaterally amend this Policy from time to time. Upon amending this Policy, ALTPAY will notify person about the new Policy by e-mail and/or via the IBA (Internet bank of AltPay). In case the new Policy refers to processing personal data for any new purpose, which requires Person’s consent, then ALTPAY will not process personal data for such new purpose, before it has Your consent for processing Your personal data for such new purpose.
In case You have inquiries, requests or complaints regarding the processing of Your personal data, You may forward them to:
•
info@altpay.uk
• https://altpay.uk/contacts
In case You have complaints regarding the processing of Your personal data, You may file them with the Data Protection Inspectorate or the Data Protection Authority of the state in which You have permanent residence.