Privacy Policy

Data processing purposes, providers, deadlines, recipients

14. The main purpose for which Paysera collects your personal data is to provide the payment services of Paysera to clients who send and receive payments. As a provider of payment services between individuals, Paysera is bound by law to identify and verify your identity prior to entering into financial services transactions with you, also, at the time of the provision of the services, to request further information, as well as assess and store this information for the retention period set out by legislation. Taking this into account, you must provide correct and complete information.

PURPOSE:

Client identification and verification, provision of payment services (account opening, transfers of funds, payment processing, and other), prevention of money laundering and terrorist financing, or implementation of other legal obligations of the payment service provider.

15. Personal data is processed for this purpose in compliance with legal requirements related to: identification and verification of the client's identity; conclusion and execution of agreements with the client or in order to take steps at the request of the client; execution of transfers of funds and transmission of the necessary information together with a transfer in accordance with legislation; implementation of the "Know Your Client" requirements; continuous and periodic monitoring of the client’s activity; risk assessment; updating client data in order to ensure its accuracy; prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, determination of politically exposed persons or financial sanctions imposed on the client; ensuring proper risk and organisation management.

16. For this purpose, the following personal data may be processed: name, surname, identity document number, address, date of birth, a face photo, citizenship, other data from the identity document (including but not limited to a copy of the document), direct video transmission (direct video broadcast) recording, email address, phone number, current payment account number, IP address, current professional or work activity, current public function, data on the client's participation in political activities, inclusion in sanctions lists, other data required by applicable anti-money laundering and counter-terrorist financing laws, as well as client location data, planned service, account usage purpose (personal/business), planned investment amount, income received, main source of funds, beneficial owner, business relationship correspondence with the client, documents and data confirming the monetary operation or transaction, or other legally valid documents and data related to the execution of monetary operations or transactions, tax residence country, connection with the EEA/EU, tax identification number, devices used, SIM card issuing country, history of monetary transactions.

17. This personal data is collected and processed on the basis of a legal obligation imposed on the payment service provider, i.e. the Law on Payment Services, the Law on Anti-Money Laundering and Terrorist Financing, and other applicable legal acts, and is required in order to open an account and/or provide a payment service.

18. Data retention period: 10 (ten) years after the termination of the business relationship with the client. This personal data must be retained for 5 (five) years according to the Law on Prevention of Money Laundering and Terrorist Financing (no more than 40 years). This data is retained for another 2 (two) years on the basis of the legal interests of Paysera.

19. Data providers and sources: the data subject directly, credit and other financial institutions and their branches, state and non-state registers, databases for checking the data of identity documents (databases of expired documents and other international databases), authority check registers (registers of notarised authority and other databases), the Register of Incapacitated and Disabled Persons, other databases, companies processing consolidated debtor files, institutions maintaining registers of international sanctions, law enforcement agencies, bailiffs, legal entities (provided you are a representative, employee, founder, shareholder, participant, contractor, or the real beneficiary of these legal entities), partners or other legal entities that engage us or are engaged by us in the provision of services, social networks where you have a profile linked to our system, and other persons. Data can be processed using artificial intelligence tools.

20. Groups of data recipients: supervisory authorities, credit, financial, payment and/or electronic money institutions, pre-trial investigation institutions, state tax agencies, payment service representatives or partners of Paysera (if the transaction is carried out using their services), recipients of transaction funds receiving the information in payment statements together with the funds of the transaction, the recipient’s payment service providers and correspondents, participants, and/or parties related to national, European, and international payment systems, debt collection and recovery agencies, companies processing consolidated debtor files, lawyers, bailiffs, auditors, other entities having a legitimate interest, other persons under an agreement with Paysera or on other lawful bases.

PURPOSE: Dispute and debt management.

21. Personal data under this purpose is processed in order to resolve disputes, manage and collect debts, submit claims, demands, complaints, lawsuits, etc.

22. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document, email address, phone number, current account number, IP address, current account details, and all other data related to the circumstances in which the dispute or debt arose.

23. Data retention period: the due date for the debt is 10 (ten years) from the day the debt became known (if the debt consists of several elements – from the date the last element became known), and after the opening of legal proceedings – until the complete fulfilment of the parties' obligations to each other. The data retention period is based on the limitation periods for proceedings set out by the Civil Code of the Republic of Albania.

24. Data providers: the data subject directly, credit, financial, payment and/or electronic money institutions, state and non-state registers, companies/institutions processing consolidated debtor files or others, providers of electronic communications services, other persons.

25. Groups of data recipients: companies processing consolidated debtor files, credit, financial, payment and/or electronic money institutions, lawyers, bailiffs, courts, pre-trial investigation institutions, state tax agencies, debt collection and recovery agencies, and other entities having a legitimate interest.

26. Please note that if you have a debt to Paysera and you are postponing the performance of your obligations for more than 30 (thirty) days, Paysera has the right to provide the information on your identity, contact details, and credit history, i.e. financial and property liabilities and information on their execution, and debts and their payment to companies managing debtors' databases.

PURPOSE: To support and administer relations with clients, inform clients about existing and new services, provide services, prevent disputes, and collect evidence (recording phone conversations), correspondence of business relations with the client.

27. Personal data is processed for this purpose in order to: maintain the business relationship and communication with the client; provide services to the client; protect the interests of the client and/or Paysera; prevent disputes, provide evidence of business communication with the client (recordings of conversations, correspondence); perform quality assessment and ensure the quality of services provided by Paysera; where it is necessary for the execution of the agreement, in order to take steps at the request of the client, or in implementing a legal obligation; inform the client about the services provided by Paysera, their prices, specifics, changes in the contracts concluded with the client, etc.; send Paysera systemic and other notifications related to the services provided.

28. For this purpose, the following personal data may be processed: name, surname, address, date of birth, email address, phone number, IP address, client location data, current account statements, phone conversation recordings, correspondence with the client, and any other data necessary for the purpose.

29. Data retention period: 5 (five) years after the termination of the business relationship with the client. The retention period may be extended for a period not exceeding 2 (two) years, provided there is a reasoned request from a competent authority. Such data retention period is required under the laws on the prevention of money laundering and terrorist financing.

30. Data providers: the data subject directly, providers of electronic communications services.

31. Data recipients: supervisory authorities, companies processing consolidated debtor files, lawyers, bailiffs, courts, pre-trial investigation institutions, debt collection and recovery agencies, other entities having a legitimate interest, other entities under an agreement with Paysera.

32. The data subject confirms that they understand that such information notifications are necessary for the performance of the General Payment Services Agreement and/or its annexes concluded with the client, and do not constitute direct marketing messages.

PURPOSE: Provision of services through third parties.

33. Personal data for this purpose is processed in order to ensure the widest possible range of services received by Paysera clients, with certain services being provided by third parties.

34. For this purpose, the following personal data may be processed: name, surname, citizenship, personal identification number, address, contact information.

35. The client is clearly informed about any data processing for the purpose of providing services through third parties, and the data is processed only with the client's expressed consent.

36. Data retention period: 1 (one) year.

37. Data providers: the data subject directly, Paysera, third parties providing services.

38. Data recipients: third parties providing services, Paysera, data subject.

PURPOSE: Protection of interests of Paysera and the client (video - camera surveillance on the premises of Paysera).

39. Personal data for this purpose is processed in order to ensure the security of Paysera and/or the client, to protect the life and health of the client and/or their representative, and other rights of Paysera and the client (video surveillance and recording in the premises of Paysera) in pursuit of the legitimate interest to protect clients, employees, and visitors of Paysera and their property, as well as the property of Paysera.

40. For this purpose, the following personal data may be processed: video recordings on the premises managed by Paysera.

41. Before entering the premises of Paysera where video surveillance is conducted, you are informed about the surveillance by special markings.

42. Data retention period: 1 (one) year.

43. Data providers: the data subject directly who visits the premises of Paysera where video surveillance is conducted and is captured by the surveillance camera.

44. Data recipients: courts, prosecution, police, responsible employees of Paysera.

PURPOSE: Direct marketing.

45. For this purpose, personal data is processed in order to provide clients with offers on the services provided by Paysera and find out the clients' opinions on the above-mentioned services.

46. The following personal data may be processed for this purpose, including: name, surname, email address, and phone number.

47. For this purpose, Paysera sends newsletters and direct marketing messages after obtaining the client's consent. Paysera may use a newsletter service provider while ensuring that said provider complies with the personal data protection requirements set out in the Joint Controller Agreement. The client may revoke their consent upon receiving newsletters or direct marketing messages by clicking on the Revoke your consent link as well as informing Paysera at any time about their refusal to process personal data for direct marketing purposes by e-mail support@paysera.al.

48. Data retention period: until the termination of the business relationship with the client or until the day the client objects to the data processing for this purpose.

49. Data providers: the data subject directly.

50. Data recipients: The data for this purpose may be transmitted to search or social networking systems (the possibility to object data processing is ensured by the websites of these systems), as well as to newsletter service providers.

PURPOSE: Statistical analysis, service improvement.

51. Your personal data collected and anonymised for the aforementioned purposes may be processed according to Article 6.1(f) of the GDPR for the purpose of statistical analysis and for improving technical and organisational measures, information technology infrastructure, ensuring the adaptation of the provided service to the devices used, creating new Paysera services, increasing satisfaction with existing services, testing and improving technical measures and IT infrastructure. For this purpose, personal data shall be processed in such a way that, by including it in the scope of statistical analysis, it is not possible to identify the data subjects concerned. The collection of your personal data for the purpose of statistical analysis is based on the legitimate interest to analyse, improve, and develop the conducted activity.

52. You have the right to disagree and object to your personal data processing for such purpose at any time and in any form by informing Paysera thereof. However, Paysera may continue to process the data for statistical purposes if it proves that the data is processed for compelling legitimate reasons beyond the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.

PURPOSE: Prevention of service misuse and criminal offences, and ensuring proper delivery of services.