Back to content

Last updated: 16/11/2020

Privacy Policy

General provisions

1. According to the Joint Controller Agreement No. 20180919  from September 19, 2018, your personal data controller is the Paysera network. The contact details of Paysera are available at www.paysera.com. Contact details of the data protection officer authorised by Paysera: dpo@paysera.com.

2. Personal data collected by Paysera is processed in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania, the General Data Protection Regulation (hereinafter — the GDPR) and other legal acts. All employees, agents, and employees of the agents of Paysera who know the secret of personal data must keep it safe even after termination of the employment or contractual relationship.

3. Paysera, in accordance with the applicable legal requirements, shall ensure the confidentiality of personal data and the implementation of appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, accidental loss, alteration, destruction, or other unlawful processing.

4. This Privacy Policy sets out the basic rules for the collection, storage, processing, and retention of your personal data, other information relating to you, the scope, purpose, sources, recipients, and other important aspects of your personal data when you use Paysera as a payment service provider.

5. By accessing and / or using the information on this website and / or our services, you acknowledge and confirm that you have read, understood, and agree to this Privacy Policy. Also, after you register with the system and start using our services, this Privacy Policy becomes a Supplement to the General Payment Services Agreement.

6. Paysera reserves the right, at its sole discretion, to modify this Privacy Policy at any time by publishing an updated version of the Privacy Policy on the website and, if the changes are substantial, notifying registered users by email. An amended or updated version of this Privacy Policy shall take effect upon its publishing on the website.

7. If the user of the services is a legal entity, this Privacy Policy applies to individual persons whose data is transmitted to us by the legal entity. The user shall inform the data subjects (managers, recipients, agents, etc.) of the transfer of their data to Paysera in accordance with Article 14 of the GDPR.

Purposes of the processing. Data providers, terms, and recipients

8. The main purpose for which Paysera collects your personal data is to provide the payment services of Paysera to clients who send and receive payments. As a payment service provider, Paysera is bound by law to establish and verify your identity prior to entering into financial services transactions with you, also, at the time of the provision of the services, to request further information, as well as assess and store this information for the retention period set out by legislation. Taking this into account, you must provide correct and complete information.

9. PURPOSE: Client identification, provision of payment services (account opening, transfers of funds, payment processing, and other), or implementation of other legal obligations of the payment service provider.

9.1. Personal data is processed for this purpose in compliance with legal requirements related to:

9.1.1. establishment and verification of the client's identity;

9.1.2. conclusion and execution of agreements with the client or in order to take steps at the request of the client;

9.1.3. execution of transfers of funds and transmission of necessary information together with a transfer in accordance with legislation;

9.1.4. implementation of the "Know Your Client" requirements;

9.1.5. continuous and periodic monitoring of the client’s activity;

9.1.6. risk assessment;

9.1.7. updating client data in order to ensure its accuracy;

9.1.8. prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, determination of politically exposed persons or financial sanctions imposed on the client;

9.1.9. ensuring proper risk and organisation management.

9.2. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document and a copy of the document, a face photo, direct video transmission (direct video broadcast) recording, citizenship, email address, phone number, current account number, IP address, current activity, current public function, and other data required by legal acts governing the prevention of money laundering and terrorist financing.

9.3. This personal data is collected and processed on the basis of a legal obligation imposed on the payment service provider, i.e. the Law on Payments, the Law on Electronic Money and Electronic Money Institutions, laws on the prevention of money laundering and terrorist financing, and other applicable legal acts, and is required in order to open an account and / or provide a payment service.

9.4. Data retention period: 10 (ten) years after the termination of the business relationship with the client. This personal data must be retained for 8 (eight) years according to the Law on Prevention of Money Laundering and Terrorist Financing. This data is retained for another 2 (two) years on the basis of legal interests of Paysera according to the ordinary limitation period of the lawsuit.

9.5. Data providers: the data subject, credit and other financial institutions and their branches, state and non-state registers, databases for checking the data of identity documents (databases of expired documents and other international databases), authority check registers (registers of notarised authority and other databases), the Register of Incapacitated and Disabled Persons, the Population Register, other databases, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), companies maintaining registers of international sanctions, law enforcement agencies, bailiffs, legal entities (provided you are a representative, employee, founder, shareholder, participant, contractor, or the real beneficiary of these legal entities), partners or other legal entities that engage us or are engaged by us in the provision of services, social networks where you have a profile linked to our system, and other persons.

9.6. Groups of data recipients: supervisory authorities, credit, financial, payment and / or electronic money institutions, pre-trial investigation institutions, state tax agencies, payment service representatives or partners of Paysera (if the transaction is carried out using their services), recipients of transaction funds receiving the information in payment statements together with the funds of the transaction, the recipient’s payment service providers and correspondents, participants, and / or parties related to national, European, and international payment systems, debt collection and recovery agencies, companies processing consolidated debtor files, lawyers, bailiffs, auditors, other entities having a legitimate interest, other persons under an agreement with Paysera or on other lawful bases.

10. PURPOSE: Debt management.

10.1. Personal data under this purpose is processed in order to manage and collect debts, submit claims, demands, lawsuits and other documents, and to provide documents for debt collection.

10.2. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document, email address, phone number, current account number, IP address, current account statements, and other data related to the circumstances in which the debt arose.

10.3. Data retention period: the due date for the debt is 10 (ten years) from the day the debt is incurred, and after the opening of legal proceedings, the time limit is extended until the debt is repaid and for 24 (twenty-four) months after the repayment. The data retention period is based on the limitation periods for proceedings set out by the Civil Code of the Republic of Lithuania.

10.4. Data providers: the data subject, credit, financial, payment and / or electronic money institutions, state and non-state registers, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), other persons.

10.5. Groups of data recipients: companies processing consolidated debtor files, credit, financial, payment and / or electronic money institutions, lawyers, bailiffs, courts, pre-trial investigation institutions, state tax agencies, debt collection and recovery agencies, and other entities having a legitimate interest.

10.6. Please note, that if you have a debt to Paysera and you are postponing the performance of your obligations for more than 30 (thirty) days, Paysera has the right to provide the information on your identity, contact details, and credit history, i.e. financial and property liabilities and information on their execution, and debts and their payment to companies managing debtors' databases (such as the credit institution UAB "Creditinfo Lithuania" in Lithuania*), as well as to debt collection companies. You can access your credit history by contacting the credit bureau directly.

11. PURPOSE: To support and administer relations with clients, prevent disputes, and collect evidence (recording phone conversations), correspondence of business relations with the client.

11.1. Personal data is processed for this purpose in order to:

11.1.1. maintain the business relationship and communication with the client;

11.1.2. protect the interests of the client and / or Paysera;

11.1.3. prevent disputes, provide evidence of business communication with the client (recordings of conversations, correspondence);

11.1.4. perform quality assessment and ensure the quality of services provided by Paysera;

11.1.5. where it is necessary for the execution of the agreement, in order to take steps at the request of the client, or in implementing a legal obligation.

11.2. For this purpose, the following personal data may be processed: name, surname, address, date of birth, email address, phone number, IP address, current account statements, phone conversation recordings, and correspondence with the client.

11.3. Data retention period: 5 (five) years after the termination of the business relationship with the client. The retention period may be extended for a period not exceeding 2 (two) years, provided there is a reasoned request from a competent authority. Such data retention period is required under the laws on the prevention of money laundering and terrorist financing.

11.4. Data providers: the data subject.

11.5. Data recipients: supervisory authorities, companies processing consolidated debtor files, lawyers, bailiffs, courts, pre-trial investigation institutions, debt collection and recovery agencies, other entities having a legitimate interest, other entities under an agreement with Paysera.

12. PURPOSE: Credit rating assessment, credit risk management, and automated decision-making.

12.1. The personal data for this purpose is processed to assess the creditworthiness of clients, to manage the credit risk, and to meet the requirements related to operational risk management and capital adequacy, so that Paysera can offer to provide funding.

12.2. The following personal data may be processed for this purpose: name, surname, address, date of birth, email address, telephone number, current account number, IP address, current account statements, the client's balance on the account, financial liabilities, credit and payment history, income, education, workplace, current work position, work experience, available assets, data on family members, a credit rating, and other information.

12.3. Data retention period: 10 (ten) years after the termination of the business relationship with the client.

12.4. Data Providers: the data subject, credit and other financial institutions and their branches, law enforcement agencies, other registers and state institutions, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), individual persons who provide data about spouses, children, and other individuals related by kinship or affinity, co-debtors, guarantors, collateral providers, etc., legal entities when the client is a representative, employee, contractor, shareholder, participant, owner, etc. of these legal entities, and partners or other legal entities who Paysera employs for service provision.

12.5. Data recipients: credit, financial, payment and / or electronic money institutions or service providers assisting in the assessment of creditworthiness, and companies processing consolidated debtor files.

12.6. In order to conclude or offer to enter into a funding agreement with you and to provide you with services, Paysera will, in certain cases, apply decision-making based on the automated processing of your personal data. In this case, the system checks your creditworthiness with a set algorithm and assesses whether the service can be provided. If the automated decision is negative, it may be changed by the client providing more data. Paysera takes all the necessary measures to protect your rights, freedoms, and legitimate interests. You have the right to demand human intervention, express your opinion, and challenge an automated decision. You have the right to oppose an automated decision by contacting Paysera directly.

13. PURPOSE: Protection of interests of Paysera and the client (video surveillance on the premises of Paysera).

13.1. Personal data for this purpose is processed in order to ensure the security of Paysera and / or the client, to protect the life and health of the client and / or their representative, and other rights of Paysera and the client (video surveillance and recording in the premises of Paysera) in a pursuit of the legitimate interest to protect clients, employees, and visitors of Paysera and their property, as well as the property of Paysera.

13.2. For this purpose, the following personal data may be processed: video recordings on the premises managed by Paysera.

13.3. Before entering the premises of Paysera where video surveillance is conducted, you are informed about the surveillance by special markings.

13.4. Data retention period: 1 (one) year.

13.5. Data providers: the data subject who visits the premises of Paysera where video surveillance is conducted and is captured by the surveillance camera.

13.6. Data recipients: courts, pre-trial investigation institutions, lawyers (only in case of an attempt to attack).

14. Informing the client about services. Personal data for this purpose is processed in order to inform the client about the services provided by Paysera, their prices, specifics, changes in the terms of the agreements concluded with the client, and for sending system and other messages relating to the provided Paysera services.

14.1. The following personal data may be processed for this purpose: email address, phone number.

14.2. The data subject confirms that they are aware that such messages are necessary for the execution of the General Payment Services Agreement and / or its supplements concluded with the client, and they are not considered to be direct marketing messages.

14.3. Data retention period: 24 (twenty-four) months after the termination of the business relationship with the client.

14.4. Data providers: the data subject.

14.5. Data recipients: the data for this purpose is not provided to other persons.

15. Direct marketing. For this purpose, personal data is processed in order to provide the client with offers on the services provided by Paysera.

15.1. The following personal data may be processed for this purpose: email address, phone number.

15.2. With this document, you confirm that you are aware of the fact that the aforementioned data may be processed for the purpose of direct marketing, and that you have the right to disagree and to object the use of your personal data for this purpose at any time by informing Paysera thereof in writing via email to: support@paysera.com. The message must contain the full name and email address of the personal data subject.

15.3. Data retention period: until the termination of the business relationship with the client or until the day the client objects the data processing for this purpose.

15.4. Data providers: the data subject.

15.5. Data recipients: The data for this purpose may be transmitted to search or social networking systems (the possibility to object data processing is ensured by the websites of these systems). The data shall not be provided to other persons.

16. Statistical analysis. Your personal data collected for the aforementioned purposes, except for the national identification number, identity documents and their details, also the exact place of residence, may be processed for the purpose of statistical analysis. For this purpose, personal data shall be processed in such a way that, by including it in the scope of statistical analysis, it is not possible to identify the data subjects concerned. The collection of your personal data for the purpose of statistical analysis is based on the legitimate interest to analyse, improve, and develop the conducted activity. I am aware that I have the right to disagree and object my personal data processing for such purpose at any time and in any form by informing Paysera thereof. However, Paysera may continue to process the data for statistical purposes if it proves that the data is processed for compelling legitimate reasons beyond the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.

17. Service improvement. The data collected for all of the above purposes can be used to improve technical and organisational tools, IT infrastructure, adapt services to the devices used, develop new Paysera services, enhance satisfaction with existing services, as well as test and improve technical tools and IT infrastructure.

18. Service misuse prevention and proper service delivery. The data collected for all of the above purposes may be used to prevent unauthorised access and use, i.e. to ensure privacy and information security.

19. For the processing of personal data, Paysera may engage data processors and / or, at its own discretion, hire other persons to perform certain ancillary functions on behalf of Paysera (e.g. data centres, hosting, cloud hosting, system administration, system development, software development, provision, support services such as improvement and development; services of customer service centres; marketing, communication, consulting, temporary staffing, or similar services). In such cases, Paysera shall take the necessary measures to ensure that such data processors process personal data in accordance with Paysera's instructions and applicable laws, and shall require compliance with the appropriate personal data security measures. Paysera shall also ensure that such persons are bound by confidentiality obligations and cannot use such information for any purpose other than the performance of their functions.

20. Personal data collected for the purposes specified in this Privacy Policy shall not be processed in any way incompatible with these legitimate purposes or legal requirements.

21. I agree that my data referred to above will be provided and received through a software tool used by Paysera or its authorised agent, also by other means and third persons with whom Paysera has entered into personal data processing agreements in accordance with laws and regulations.

Geographical area of processing

22. Generally, personal data is processed within the European Union / European Economic Area (EU / EEA), but may in certain cases be transmitted and processed outside the EU / EEA.

23. Personal data may be transferred and processed outside the EU / EEA where the transfer is necessary for the conclusion or execution of a contract (for example, when a payment is carried out to a third party or through a third party partner (correspondent)) or with the consent of the client. In all of these cases, we seek to ensure that appropriate technical and organisational measures are in place.

Profiling

24. Profiling carried out by Paysera involves the processing of personal data by automated means for the purposes of legislation relating to risk management and continuous and periodic monitoring of transactions in order to prevent fraud; such ongoing profiling is based on the legal obligations of Paysera.

25. For the purpose of direct marketing and statistical analysis, profiling may be carried out using Matomo, Google, Facebook, and other analytics tools.

Processing the personal data of minors

26. A minor under 14 (fourteen) years of age, seeking to use the payment services of Paysera, shall provide written consent from their representative (parent or legal guardian) with regard to their personal data processing.

Cookie policy

27. Paysera may use cookies on this website. Cookies are small files sent to a person's Internet browser and stored on their device. Cookies are transferred to a personal computer upon first visiting the website. Paysera uses only necessary cookies, which on personal devices are used to identify the person, improve the functionality and use of the website, and to streamline the person’s access to the website and information contained therein.

28. Most web browsers accept cookies, but the person can change the browser settings so that cookies would not be accepted. However, in this case, some functions may not work.

29. All information about the cookies used by the website, their purpose, validity, and the data used are given in the table below:

The right of access, rectification, erasure of your personal data and to restrict data processing

30. You have the following rights:

30.1. THE RIGHT OF ACCESS TO DATA: to obtain information as to whether or not Paysera processes your personal data, and, where that is the case, access to the personal data processed by Paysera and to receive information on what personal data and from which sources are collected, the purposes of the processing, the recipients to whom the personal data have been or may be provided; to obtain from Paysera a copy of the personal data undergoing processing in accordance with the applicable law. Upon the receipt of your written request, Paysera, within the time limit laid down in the legislation, shall provide the requested data in writing, or specify the reason of refusal. Once in a calendar year, data may be provided free of charge, but in other cases a remuneration may be set at a level not exceeding the cost of the data provision. More information on the right of access to data and its processing can be found here;

30.2. THE RIGHT OF RECTIFICATION: if your data processed by Paysera is incorrect, incomplete, or inaccurate, you can address Paysera in writing for the rectification of the incorrect or inaccurate data or to have the incomplete personal data completed by providing a relevant request;

30.3. THE RIGHT TO BE FORGOTTEN: to request the termination of the data processing (erase the data), in the case that the data subject withdraws the consent on which the processing is based, or the personal data is no longer necessary in relation to the purposes for which it was collected, or the personal data has been unlawfully processed, or the personal data has to be erased for compliance with a legal obligation. A written notice of objection to personal data processing shall be submitted to Paysera personally, by post, or via electronic means of communication. If your objection has legal grounds, Paysera, after examining the request, shall terminate any actions of processing of your personal data, with the exception of cases provided for by law. It should be noted that the right to require the immediate erasure of your personal data may be limited or not possible due to the obligation of Paysera as a payment service provider to store data about the clients' identification, payment transactions, concluded agreements, etc. for the period laid down in legislation;

30.4. THE RIGHT TO RESTRICTION OF PROCESSING: to request to restrict the processing of personal data, when the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise, or defence of legal claims. A data subject who has obtained restriction of processing shall be informed by the data controller before the restriction of processing is lifted;

30.5. THE RIGHT TO OBJECT: the right to object to the processing of your personal data for direct marketing purposes;

30.6. to address the supervisory authority with a claim regarding the processing of your personal data, if you believe that the personal data is processed in violation of your rights and legitimate interests stipulated by applicable legislation;

30.7. to contact the data controller and / or the data protection officer for the purpose of exercising your rights;

30.8. other statutory rights.

31. You can send your request for access, rectification, or objection to data processing via email to: support@paysera.com. The person submitting the request must clearly indicate their full name and sign the request with a qualified electronic signature.

Third-party websites

32. Paysera is not responsible for the protection of the Client's privacy on websites of third parties, even if such websites are accessed by the client through links provided on this website. Paysera recommends to learn the privacy policies of each website that does not belong to Paysera.

The use of logos

33. The client, using the services of Paysera for business objectives and professional interests, agrees that their name and / or logo may be used by Paysera for direct marketing purposes (e.g. by indicating that the client is using the services provided by Paysera).

Ensuring information security

34. Paysera aims to ensure the highest level of security for all information obtained from the Client and public data files. In order to protect this information from unauthorised access, use, copying, accidental or unlawful erasure, alternation, or disclosure, as well as from any other unauthorised form of processing, Paysera uses appropriate legal, administrative, technical, and physical security measures.

Final provisions

35. These Privacy policy provisions are subject to the law of the Republic of Lithuania. All disputes regarding the provisions of the Privacy Policy shall be settled by negotiation and, in case of failure to resolve an issue by negotiation, the dispute shall be taken to courts of the Republic of Lithuania.

* – UAB "Creditinfo Lithuania" (company code: 111689163, address: A. Goštauto st. 40, LT 01112 Vilnius, Lithuania, www.manocreditinfo.lt, phone: (8 5) 2394131, which manages and provides your information to third parties (financial institutions, telecommunication agencies, insurance, electricity and utility service providers, trading companies, etc.) for legitimate interests and objectives: to assess your creditworthiness and manage debts. Credit history data is usually stored for 10 years after the fulfilment of obligations).