GDPR Notice
General information about our data protection policy
Table of Contents
Personal data collected directly by OLKYPAY
Personal data collected indirectly by OLKYPAY
I.Data Controller
Olky Payment Service Provider SA: Société Anonyme, with a capital of €2 271 111,00, having its registered office at 7A rue de Turi, L-3378 Livange, registered in the Luxembourg Trade and Companies Register under number B 165 776 (ci-après “OLKYPAY”). OLKYPAY is a payment institution with an establishment authorisation numbered 47/13 and issued by the Ministry of Finance. OLKYPAY is authorised, subject to the prudential supervision of the Commission de Surveillance du Secteur Financier Luxembourgeois " C.S.S.F " and authorised to operate in France under the freedom of establishment by the Autorité de Contrôle et de Résolution Prudentielle "A.C.P.R" and in Belgium, the Netherlands, Germany, Poland, Romania, Italy, Ireland, Cyprus, Malta, Spain and Portugal under the freedom to provide services2. OLKYPAY is registered with the CSSF under the number Z00000006 at the following url: searchentities.apps.cssf.lu.
In the context of its payment institution activities, OLKYPAY processes personal data (hereinafter "personal data") and acts as a data controller, in accordance with the national and European regulations in force, in particular the General Data Protection Regulation of 27 April 2016 (hereinafter "GDPR").
The purpose of this general data protection notice is to inform you about the processing carried out on your personal data (purposes, legal bases, retention periods, recipients, confidentiality and security measures taken by OLKYPAY) and the rights you have over your data under the GDPR.
This notice applies to users of our iOS and Android app. The said application can only be used by persons who already have an account with us. Therefore, no data other than those already collected and processed in the context of our relationship will be collected or processed via the app.
If you already have an account within our establishment (as a natural person or as a legal representative/agent of a legal entity), we invite you to consult our General Terms and Conditions of Use of OLKY PRO account payment services which inform you about the methods of processing your personal data.
II. Persons concerned by our processing of Personal Data
OLKYPAY may collect some of your data directly from you or indirectly. In both situations, our guarantees of confidentiality and security of personal data are identical.
Personal data collected directly by OLKYPAY
OLKYPAY collects some of your personal data directly from you in the following cases:
- You apply for a position within OLKYPAY via the dedicated email address jobs@olky.eu
- You contact OLKYPAY (in particular through the Olky Support Center )
- You make a request to enter into a relationship
In those cases, this privacy policy informs you about the processing carried out on your data and your rights
If you provide us with the personal data of third parties, you act as data controller and therefore you are obliged to inform these third parties of the processing of their data by OLKYPAY and of the existence of this general information notice.
Personal data collected indirectly by OLKYPAY
As part of our anti-money laundering and countering the financing of terrorism (AML-CFT) obligations and our activity as a payment service provider, we process the personal data of individuals that is not collected directly from them.
Thus, if you are, by way of example, the manager, beneficial owner or customer of a company with an account within our establishment, we may be required to process some of your personal data.
In this case, natural persons and/or companies holding an OLKYPAY account, by transferring your data to our establishment are required to inform you in advance if this is legally required.
The same applies to applications submitted to us by recruitment agencies or employment agencies. In this case, the candidate undertakes to read this notice.
III. Categories of data processed
We only process personal data that is adequate, relevant and limited to what is strictly necessary for the purposes for which it is processed, in accordance with the principle of data minimization.
It should be remembered here that personal data is information that allows your identification, direct or indirect.
Depending on the type of purpose pursued, the categories of personal data that we may process are as follows:
- Identification data (surname, first name, address, telephone number, etc.)
- Data of personal characteristics (date and place of birth, nationality, etc.)
- Identification and electronic authentication data (e-mail address, IP addresses, cookies, password, PIN code, etc.)
- Data relating to your profession, employment, academic background
- Recording of images and sounds, only as part of KYC verifications in the process of opening an account
IV. Lawfulness and purposes of processing
We process your personal data to fulfill specific, explicit and legitimate purposes.
Each of our processing of personal data is based on at least one of the following lawfulness bases:
- Compliance with our legal and regulatory obligations, in particular with regard to the fight against money laundering and the financing of terrorism
- The processing is necessary for the performance of a contract, in particular in the context of our activity as a payment service provider
- The processing is based on our legitimate interest, in particular in the context of the management of our prospects.
The purposes of our processing include :
- Receipt, registration and processing of applications sent by email and postal mail
- Management of contact requests and prospects
- Prevention against identity theft, tax fraud, money laundering and terrorist financing
- Fulfillment of the legal obligation to respond to requisitions and communication requests sent by police and gendarmerie services, administrations and authorized public authorities
- Commercial prospecting, promotion of new products
V. Recipients of data and transfer to third parties
Your data is processed by our internal employees specifically authorized to process it and subject to strict confidentiality obligations.
OLKYPAY may still be required to communicate your data to public authorities (tax, judicial, police, supervisory authority and regulators) and, where applicable, to lawyers, notaries, liquidators or other empowered persons legally authorized to receive your data.
OLKYPAY has not identified any transfer of personal data outside the European Union carried out in the course of its activities.
VI. Data retention period
Your personal data will be kept for as long as necessary for the fulfillment by the company of its legal and regulatory obligations and the exercise of the prerogatives recognized by law and jurisprudence.
If you are applying for a position within OLKYPAY and we have not followed up on it within 2 months of receiving it, please consider that your candidature has not been retained and that the data transmitted has been deleted. If you have obtained an interview and your application has not been selected, we delete your data 1 month after our last exchange.
Data obtained in the context of an unsuccessful business relationship are deleted after 2 years.
VII. Confidentiality and security of your data
OLKYPAY undertakes to pay particular attention to the security of your personal data.
OLKYPAY takes, to do this, the appropriate physical, technical and organizational measures to prevent as far as possible any alteration or loss of data or any unauthorized access to them.
VIII. Cookies and trackers
We invite you to consult our cookie policy available via this link: www.olky.eu/en/universe/cookies which informs you about the use of cookies on our website.
IX. Your rights
As a natural person subject to one of our processing of personal data, and subject to the limitations provided for by the GDPR, you have certain rights and in particular :
- A right of access - you have the right to obtain confirmation from OLKYPAY as to whether or not your Personal Information is being processed by OLKYPAY, as well as certain other information about how it is being used. You also have the right to access your Personal Information by requesting a copy of your Personal Information. OLKYPAY may refuse to provide information where it would reveal Personal Information about another person or adversely affect the rights of another person.
- A right to rectification - you may ask OLKYPAY to take steps to correct your Personal Information if it is inaccurate or incomplete (for example, if your name has been mistyped or if you change your address).
- A right to erasure - also known as the "right to be forgotten", this right allows you, in simple terms, to request the erasure or deletion of your Personal Information where there is no compelling reason for OLKYPAY to continue to use it, or if its use is unlawful. However, this is not a general right to erasure and there are some exceptions, for example where OLKYPAY needs to retain information to defend a legal claim or to comply with a legal obligation.
- A right to restriction of processing - you have the right to "block" or prevent further use of your Personal Data where OLKYPAY is assessing a request for rectification or as an alternative to erasure. Where processing is restricted, OLKYPAY may still retain your Personal Data, but may not use it further.
- A right to data portability - where processing is based on your consent or on the basis of the performance of a contract and the processing is carried out using automated processes, you may request that we provide you with your Personal Data in a structured, commonly used and machine-readable format, in particular for the purpose of transmission to a third party. Where technically feasible, you also have the right to have your Personal Data transmitted directly to that third party.
- A right to object - you have the right to object to certain types of processing, on grounds relating to your particular situation, at any time, provided that such processing is carried out for the purposes of OLKYPAY's legitimate interests. OLKYPAY will be permitted to continue processing Personal Data if OLKYPAY can demonstrate that the processing is justified on compelling legitimate grounds which override your interests, rights and freedoms or if OLKYPAY needs it for the establishment, exercise or defence of legal claims. If you object to the processing of your Personal Data for direct marketing purposes, OLKYPAY will no longer process your Personal Data for such purposes.
- A right to withdraw your consent - where OLKYPAY processes your Personal Data on the basis of your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that took place prior to such withdrawal.
X. Exercising your rights
If you wish to assert one of your rights, you can send a complaint through our Support center by choosing the category "protection of personal data" or by post to OLKY PAYMENT SERVICE PROVIDER SA, 7A rue de Turi, L-3378 Livange Luxembourg.
Our services are obliged to respond to your requests within a maximum of one month from receipt of the request.
However, this one-month period may be extended by two additional months due to the complexity and number of requests received by our services. In this case, you will be informed within one month of receiving your request. In case of any difficulty in connection with the management of your personal data, you can lodge a complaint with the CNPD - National Commission for Data Protection (more information on www.cnpd.public.lu ).
The refusal to communicate personal data required by our services is a choice left to your sole discretion. However, you are hereby informed that such a refusal may in particular hinder the subscription to some of our services and the continuation of our relationship
XI. Update of this general information notice
We update this General Data Protection Information Notice regularly and as regulations evolve or as the range of our services is enhanced.
Luxembourg, 1st November 2022.
