This privacy notice explains how your personal data -as account owner- will be processed by Worldline SA/NV (Chaussée de Haecht 1442, 1130 Brussels – VAT 0418.547.872. hereby referred to as ‘Worldline’, ‘we’, ‘us’) in the context of the Account Information Service. For the processing of personal data in the context of any other product or service of Worldline, please, consult the relevant privacy notice provided on our website or at the moment of collection of the personal data.

Worldline will store and process your personal data in accordance with applicable data privacy legislation. Such information includes:

• Identification data, such as the Name and the country of the account owner;
• Banking data, such as the bank, bank ID and IBAN number;
• Information about your device and online activity, such as your IP address and device ID to the extent that it is necessary for us to deliver our services and verify your identify in accordance with the applicable laws and our duty of care.

(hereinafter referred to as ‘Personal Data’).

We receive the Personal Data either directly by you (e.g. name of the bank) or by your bank (IBAN number, Name of the account owner).

After your authorization, Worldline will process your Personal Data to provide the IBAN number to the relevant merchant.

Worldline will share your Personal Data only if and to the extent as approved with you and as required by applicable laws.

Worldline will disclose your Personal Data to public authorities, government agencies and judicial authorities (i) if it is required to do so by law or legal process, (ii) when it believes disclosure is necessary to prevent harm or financial loss, (iii) in connection with an investigation of suspected or actual fraudulent or illegal activity, or (iv) when it is required for Worldline to defend itself against legal claims.

Worldline may transfer your Personal Data to third party providers (data processors) in order for them to process the Personal Data on Worldline’s behalf. We make sure that in these cases the provider has received specific instructions on how to process the Personal Data and is under the overview of Worldline to process the Personal Data in accordance with the agreed consent, privacy notice and the agreed security standards.

Worldline will retain the Personal Data for as long as necessary to deliver the Products and Services during and after the end of its contractual relationship with the data subject, according to the industry standards and applicable legislation (for example, transaction information may be retained for a period of up to 10 years after the date of transaction, information about the merchant may be retained for a period of up to 10 years after the termination of the contract in accordance with retention periods defined by Anti-Money Laundering and Counter Terrorism Financing legislation, tax law, contractual law, etc).

Worldline may process Personal Data in countries other than the country where the personal data was collected, including countries outside the European Economic Area (EEA) (for example, when the account owners bank is located outside the EEA). When the Personal Data is transferred to countries outside the EEA, Worldline will either rely on a derogation applicable to the specific situation or ensure that adequate safeguards have been put in place to ensure the protection of the Personal Data processed, in accordance with the applicable legislation for the transfer of Personal Data outside the EEA (e.g. Standard Data Protection Clauses under Article 46.2 of the GDPR).

You have, within the limitations of the applicable legislation, the right of information, access, rectification, erasure, restriction of processing, objection to processing and data portability. You can direct such a request to Worldline’s Merchant Services Data Protection Office at dpoms@worldline.com. For the protection of the privacy of data subjects, Worldline will be required to verify your identity before taking actions to address the request.

You also have the right to lodge a complaint with the competent supervisory authority, if according to your view one of the processing activities of Worldline is not in compliance with the applicable legislation or Worldline failed to address your data subject requests adequately. You have the right to lodge the complaint with the competent supervisory authority in the Member State of your habitual residence, your place of work or the place where the alleged infringement of the legislation took place.