BPAY Privacy Policy – blog.bpay.md

BPAY Privacy Policy

A. General information

BPAY LLC (Limited Liability Company) (personal data controller number 0000665-001 of April 8, 2016) gives top priority to maintaining the confidentiality of Your personal data.

This document is intended to inform You about the processing of Your personal data in the context of Your use of the www.bpay.md website or the BPay mobile application (individually or together – the „Site”).

B. Categories of personal data processed

B.1. If you are a user of BPAY services (use www.bpay.md and / or the BPAY mobile app), BPAY will process your personal data, such as: your surname and given name; gender; date and place of birth; nationality; Identification Number (IDNP); image; bank details; signature; mobile phone number; address and email address; ID card details; identification / video recording, as well as data relating to how You use the Site, for example Your behavior / preferences / habits within BPAY, and any other categories of data that You provide directly in the context of creating Your user account, in the context of placing an order through the Site or in any other way resulting from Your use of the Site.

B.2. Additionally other data can be processed: phone contact list; camera; geolocation; phone data storage; push notification settings.

B.3. If You are a visitor to the Site, BPAY will process Your personal data that You provide directly in the context of Your use of the Site, such as the data You provide in the contact / questions / complaints section, to the extent that You contact us in this way.

C. Purposes and grounds for processing

C.1. If You are a user of BPAY services, BPAY processes Your personal data as follows:

to carry out the contractual relationship between You and BPAY, i.e. to take over, validate, execute the transaction initiated by You.

Basis: The processing of Your data for this purpose is based on the contract concluded between You and BPAY. The provision of Your personal data is necessary for the performance of this contract. Refusal to provide data may result in the impossibility of the contractual relationship between you and BPAY being fulfilled.

for the fulfilment of BPAY’s legal obligations in the context of the services provided through the Site, including tax obligations, compliance with legislation on preventing and combating money laundering and terrorist financing and the implementation of international sanctions.

Basis: The processing of Your data for this purpose is necessary on the basis of legal obligations that BPAY must fulfil. Providing Your data for this purpose is necessary. Refusal to provide your data may result in BPAY being unable to comply with its legal obligations and therefore unable to provide You with services through the Site.

for marketing activities, i.e. for the transmission, by means of remote communication (e-mail, SMS) of commercial communications on products and services offered by BPAY through the Site.

Basis: The processing of Your data for this purpose is based on Your consent, if You choose to provide it.

You can consent to the processing of Your data for this purpose by ticking the appropriate box when creating Your BPAY account, or after creating Your account, in the My Account Information section. To unsubscribe from receiving such commercial communications You can use the option at the end of each email / SMS containing commercial communications. In addition, You can unsubscribe by going to My Account Information.

Providing Your data for this purpose is voluntary. Refusal to provide consent to the processing of our data for marketing purposes will have no negative consequences for You.

for the purpose of carrying out various analyses, reporting on the functioning of the Site, making payment preference profiles, mainly in order to improve the experience offered on the Site.

Basis: The processing of Your data for this purpose is based on BPAY’s legitimate interest in continuously improving the customer experience on the Site. Providing Your data for this purpose is voluntary. Refusal to provide data for this purpose will not have any negative consequences for You.

C.2. If You are a user of the BPAY mobile application, BPAY may process Your personal data as follows:

to ensure p2p functionality within the BPAY mobile application, when accessing the p2p transfer option, access to the phone’s Contacts is requested to link to the BPAY Existing Customers Database and add them to the list of recipients for this type of payment transaction.

Basis: The processing of Your data for this purpose can only be carried out with Your consent. Refusal to grant the requested permission may result in the impossibility of automatic matching of recipients for the p2p option.

to provide extended functionalities, access to the video camera, necessary for Your identification, is required.

Basis: The processing of Your data for this purpose is based on BPAY’s legitimate interest in ensuring BPAY’s legal obligation for KYC („Know Your Customer” procedures) / AML („Anti-Money Laundering and Prevention of Terrorist Financing” procedures).

Providing Your data for this purpose is voluntary. Refusal to provide data for this purpose will limit the functionalities available to You for BPAY services (payment transactions / ATM cash withdrawal etc.).

to provide some functionality for payment provider identification, access to the video camera is required, necessary to scan invoices for payment of provider services to correlate with the BPAY database of existing providers and automatically add them to the list of recipients for this type of payment transaction.

Basis: The processing of Your data for this purpose can only be carried out with Your consent. Refusal to grant the requested permission may result in the impossibility of automatic matching of recipients for the option pay suppliers.

For the provision of extended functionalities, the image of the identity document and face for your identification is required.

Basis: The legal basis for processing your data is based on the legitimate interest of BPAY in complying with legal requirements associated with the KYC (Know Your Customer) procedures/AML (Anti-Money Laundering and Counter-Terrorism Financing/anti-fraud procedures). BPAY captures the facial image of the client for the purpose of establishing the client’s identity and preventing the fraudulent use of an identity document belonging to another person.
Providing your data for this purpose is voluntary. Refusal to provide data for this purpose will limit the functionality available for BPAY services (payment operations/cash withdrawals at ATMs, etc.).

For the functionality of using and storing discount cards in the BPAY application, the image/photo of the discount card and its integration into the BPAY functionality is requested.

Basis: Processing your data for this purpose can be done without the additional request for permission, as this is just an additional tool of the services provided by BPAY in which you choose to use this instrument or not.
Providing your data for this purpose is voluntary. Refusal to provide data for this purpose will limit the functionality available for BPAY services (use of discount cards).

to provide navigation assistance functionality within the BPAY mobile app, access to Your phone’s Geolocation is requested when accessing the payment point or ATM identification option to assist You in moving to the required location.

Basis: The processing of Your data for this purpose can only be carried out with Your and BPAY’s consent. Refusal to grant the requested permission may result in the impossibility of identifying the location of Your telephone and the impossibility of assisting You to the required location.

access to Your phone’s storage space is required to provide storage functionality for payment documents, bank statements, etc.

Basis: The processing of Your data for this purpose can only be carried out with Your consent. Refusal to grant the requested permission may result in the impossibility of storing the requested information on Your phone.

access to Your phone’s storage space is required to provide storage functionality for payment documents, bank statements, etc.

to provide some push notification functionality You may be asked for consent to enable the option on Your phone.

Basis: The processing of Your data for this purpose can be carried out: with Your consent request (default setting for iOS phones) or without Your consent request (default setting for Android OS phones).

Refusal to grant the requested permission may result in push notifications not being received on Your phone.

C.3. If You are a visitor to the Site, BPAY processes Your personal data as follows:

for marketing activities, i.e. for the transmission, by means of remote communication (e-mail, SMS), of commercial communications concerning the products and services offered by BPAY through the Site.

Basis: The processing of Your data for this purpose is based on Your consent, if You choose to provide it.

You can express Your consent to the processing of data for this purpose by completing and ticking the appropriate box in the newsletter subscription form available on the Site. To unsubscribe from receiving such commercial communications, You can use the option at the end of each e-mail / SMS containing commercial communications.

Providing Your data for this purpose is voluntary. Refusal to provide consent to the processing of Your data for this purpose will not have negative consequences for You.

to resolve complaints, grievances and to monitor traffic and improve Your experience on the Site.

Basis: The processing of Your data for this purpose is based on BPAY’s legitimate interest in ensuring the proper functioning of the Site, as well as to continuously improve the experience of visitors to the Site, including by addressing various comments, questions or complaints.

Providing Your data for this purpose is voluntary. Refusal to provide data for this purpose will have no negative consequences for You.

D. Duration for which we process Your data

As a matter of principle, BPAY will process Your personal data only to the extent necessary to achieve the processing purposes mentioned above.

If You are a customer, we will process Your data for the duration of the contractual relationship and thereafter in accordance with BPAY’s legal obligations (e.g. in the case of financial-accounting supporting documents for which the statutory retention period is 10 years from the end of the financial year in which they were drawn up).

If You are a customer and You have decided to terminate Your business relationship with BPAY, Your user account will be closed in accordance with the Contract concluded with You, which will also have the effect of unsubscribing from receiving commercial communications by which we keep You informed about the products and services offered through the site. However, we would like to inform You that closing Your payment account will not automatically result in the deletion of Your personal data. If You do not want Your personal data to be processed or if You want Your data to be deleted, You can exercise your rights as detailed in point G below.

If You withdraw Your consent to the processing of Your data for marketing purposes, BPAY will cease processing Your personal data for this purpose, without however affecting the processing carried out by BPAY on the basis of the consent given by You prior to the withdrawal of Your consent.

E. Disclosure of personal data

In order to fulfil the processing purposes, BPAY may disclose Your data to partners, third parties or entities that support BPAY in carrying out business through the Site (e.g. commercial banks, other payment service providers, payment agents, IT service providers, etc.), or to central / local public authorities, in the following cases listed as examples:

for Site administration;
where such communication would be necessary to award prizes or cash back or other incentives to data subjects obtained as a result of their participation in various promotional campaigns organized by BPAY through the Site;
for maintaining, customizing and improving the Site and the services provided through it;
for conducting data analysis, testing and research, monitoring usage trends and activity, developing security features and user authentication;
for the transmission of commercial marketing communications, under the conditions and within the limits laid down by law;
where disclosure of personal data is required by law, etc.

F. Transfer of personal data

Personal data provided to BPAY may be transferred outside the Republic of Moldova, but only to European Union countries.

G. Your rights

Under the conditions laid down in the legislation on the processing of personal data, as data subjects, You have the following rights:

the right to information, i.e. the right to receive details of the processing activities carried out by BPAY as described in this document;
the right of access to data, i.e. the right to obtain confirmation from BPAY about the processing of personal data, as well as details of the processing activities such as the way in which the data are processed, the purpose of the processing, the recipients or categories of recipients of the data, etc.;
the right to rectification, i.e. the right to have inaccurate / unjustified personal data corrected by BPAY without undue delay and to have incomplete data completed; rectification / completion will be communicated to each recipient to whom the data was transmitted, unless this proves impossible or involves disproportionate effort.
the right to erasure without undue delay („right to be forgotten”) if one of the following applies:
they are no longer necessary for the purposes for which they were collected or processed;
where consent is withdrawn and there is no other legal basis for processing;
where the data subject objects to the processing and there are no compelling legitimate grounds;
where personal data have been unlawfully processed;
where personal data must be deleted to comply with a legal obligation;
personal data have been collected in connection with the provision of information society services in accordance with the legislation of the Republic of Moldova or the national law under which the controller operates.
It is possible that, following the request for deletion of the data, BPAY will anonymize these data (thus depriving them of their personal nature) and continue processing for statistical purposes under these conditions;
the right to restrict processing insofar as:
- the person disputes the accuracy of the data for a period that allows us to verify the accuracy of the data;
- the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use;
- the controller no longer needs the personal data for processing purposes, but the data subject requests them for establishing, exercising or defending a legal claim; or
- the data subject has objected to the processing (other than direct marketing), for the period of time during which it is verified whether the legitimate rights of the controller prevail over those of the data subject.
the right to data portability, i.e. (i) the right to receive personal data in a structured, commonly used and readable format, and (ii) the right to have such data transferred by BPAY to another data controller, to the extent that the conditions laid down by law are met;
the right to object – in relation to processing activities may be exercised by submitting a request as indicated below;
- at any time, for reasons relating to the data subject’s particular situation, that data relating to him or her are processed on the basis of the legitimate interest of BPAY or on the basis of the public interest, except where BPAY can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims;
- at any time, free of charge and without any justification, that data concerning him or her be processed for direct marketing purposes.
the right not to be subject to an automated individual decision, i.e. the right not to be subject to a decision taken solely on the basis of automated processing activities, including profiling, which produces legal effects concerning or significantly affecting the data subject;
the right to apply to the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP) or to the competent courts, if You consider it necessary.

For any further questions on how personal data are processed and to exercise Your rights mentioned above, please contact: support@bpay.md