1. INTRODUCTION AND SCOPE

This Privacy Statement (the “Statement”) applies to the website www.Paynovate.com (the “Website”), owned, operated and/or used by:

PAYNOVATE
Cantersteen, 47
1000 Brussels BELGIUM

Business Number: BE 0506.763.929
Hereinafter “Paynovate”, “we” or “us”

Paynovate considers the protection of privacy as being of fundamental importance and would like to enable you - as a visitor to its website - to retain full control over what happens to your personal data and privacy and to keep you informed.

All capitalized terms not defined in this Statement shall have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”).

Your Personal Data and your privacy are protected by Paynovate in accordance with Belgian and European regulations on the protection of privacy. Please read this Statement very carefully.

The following describes not only your rights, but also the way in which you can exercise these rights.

By visiting our Website, disclosing your Personal Data, or accepting this Statement, you expressly consent to the way Paynovate collects and Processes your Personal Data as described in this Statement.

2. WHO PROCESSES YOUR PERSONAL DATA AND HOW CAN YOU CONTACT PAYNOVATE?

Paynovate is responsible for the Processing of your Personal Data that you provide through the Website.

Paynovate has appointed a privacy officer, whom you can always contact for questions about your privacy and the Processing of your Personal Data. The privacy officer can be reached at:

PAYNOVATE
Cantersteen, 47
1000 Brussels BELGIUM

Privacy officer
Email: privacy@paynovate.com

3. TYPES OF INFORMATION PAYNOVATE MAY COLLECT FROM YOU

Paynovate may collect, store and use the following kinds of personal information about individuals who visit and use our website.

Mostly data retention periods are agreed upon with the Data Controller. Depending on the service versions that are used and it might vary:

• 1 day
• 30 days
• 60 days
• 5 years
• 8 years
• 10 years

Types of data that we are processing:

• the person’s name;
• surname;
• gender;
• identity document number;
• personal code (if it is issued);
• identity number (i.e. national identification number) (if it is issued);
• birth date;
• identity document expiry date;
• identity document issued date (if it is issued);
• identity document photograph(s);
• face photograph(s);
• citizenship/nationality;
• client id;
• identification date and method;
• IP address;
• device fingerprint (“user-agent”).

The processed information is needed to:
(1) deliver the content of our application correctly,
(2) optimize the content of our application as well as its advertisement,
(3) ensure the long-term viability of our information technology systems and app technology,
(4) provide the law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack,
(5) provide products and services for our clients and fulfill the agreement conditions between the Parties

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner).

Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.

Before personal data is provided by the data subject, the data subject must contact any employee. The employee clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and the consequences of non-provision of the personal data.

We may collect and process face data, such as photographs, in order to provide you with certain services or improve our offerings. Face data may be collected through our mobile application or website, or through other means such as social media or publicly available sources.

We use face data for the following purposes:

• To provide facial recognition or verification services
• To personalize your experience
• To improve our services

We take the privacy and security of your face data seriously and protect it in accordance with applicable laws.

We may share your face data:

• With your consent
• For legal or regulatory reasons
• With service providers

We may also use third-party analytics and tracking tools to collect and analyze data related to your use of our platform.

3.1 Information you supply to Paynovate

You may provide us with information about yourself by filling out forms, subscribing, or using MyPaynovate.

This may include:

• name
• business name
• address
• email
• telephone number
• business number
• MVC details
• IBANs
• financial details

3.2 Information automatically collected

• Technical information (IP, browser, OS)
• Website usage (pages, duration, clicks, downloads)

Cookies
For more information, reference is made to Paynovate’s Cookie Policy.

4. PURPOSES AND PRINCIPLES OF PROCESSING

4.1 Information you supply

4.1.1 Contact information

Collected when you:

• send emails
• fill forms
• subscribe
• update profiles

Used to:

• provide services
• answer questions
• improve experience

Grounds:

• Performance of agreement
• Consent

4.1.2 Application information

Collected via Breezy HR for recruitment.

Grounds:

• Legitimate interest

4.2 Automatically collected information

Used to:

• improve website
• troubleshoot
• analyze usage

Grounds:

• Legitimate interest

5. RECEIVING AND SHARING PERSONAL DATA

5.1 When data is received

• Website visits
• Emails
• Calls
• Forms
• Subsidiaries
• Cookies
• Newsletter

5.2 Sharing data

• Shared minimally
• With processors and subsidiaries
• Not sold or rented

6. TRANSFER OUTSIDE EEA

Data is generally not transferred outside the EEA unless safeguards are in place.

7. DIRECT MARKETING

• Requires consent
• You can withdraw anytime
• Includes profiling

Contact: privacy@paynovate.com

8. DATA RETENTION

8.1 User-provided data

• Contact info: 1 year
• Applications: 1 year

8.2 Automatically collected

• Technical: 2 years
• Visits: 2 years

9. DATA SECURITY

Paynovate uses appropriate safeguards but cannot guarantee full internet security.

10. YOUR RIGHTS

You have the right to:

• access
• correct
• delete
• transfer
• restrict
• object

You may file complaints with the Belgian Data Protection Authority.

11. AMENDMENTS

Changes will be posted and may be notified by email.

12. CONSENT FOR DISCLOSURE

Data may be disclosed:

• for legal reasons
• for compliance
• to protect rights and safety

13. LIABILITY

Paynovate is not liable for misuse by third parties unless required by GDPR.

14. APPLICABLE LAW

This Statement is governed by Belgian law.
Courts of Brussels have jurisdiction.