Privacy Statement

Last updated 27/09/2024

Our privacy statement has been translated into multiple languages. You can find the languages available below. In case of a discrepancy, the English version prevails.

German
Spanish
French
⁠

1. Introduction

This privacy statement ("Privacy Statement") is designed to inform you about how Mangopay processes your Personal Data and to outline your rights as a data subject under applicable data protection laws, including Regulation (EU) 2016/679 of April 27, 2016, also known as the General Data Protection Regulation ("GDPR").

"Personal Data" refers to any information related to an identified or identifiable individual. An individual is considered identifiable if they can be directly or indirectly recognized through identifiers such as a name, identification number, location data, or one or more specific factors related to their physical, physiological, genetic, mental, economic, cultural, or social identity.

This Privacy Statement is issued on behalf of both Mangopay S.A. and Mangopay UK Limited. Mangopay S.A. and Mangopay UK Limited act as separate data controllers and are each responsible for their own processing activities carried out for the provisions of their services. Consequently, any references to "Mangopay," "we," or "our" pertain to the specific entity responsible for processing your Personal Data, as detailed in the "Country specific information" section. The information provided below applies to the processing activities of both Mangopay S.A. and Mangopay UK Limited and is further supplemented by the details outlined in the "Country specific information" section.

2. Does this Privacy Statement apply to you?

This Privacy Statement applies to you if you engage with Mangopay’s payment and electronic money services through online platforms (websites or mobile applications) (“Platforms”) operated by our partners (“Partners”). These Partners manage Platforms for various purposes, such as online sales, marketplaces, or participative funding (e.g., donation or crowdfunding). They have integrated Mangopay's payment solution to process transactions on their Platforms. Mangopay and the Partners operate as separate data controllers regarding the processing of Personal Data taking place to provide Mangopay’s payment and electronic money services.

When you register on these Platforms, you may be required to also register for Mangopay’s services, enabling you to transfer funds or receive payments related to transactions conducted on the Platforms. To deliver these payment or e-money services, Mangopay needs to process your Personal Data.

In this Privacy Statement, "you" refers to:

Natural persons who register for Mangopay’s services or enter into a service agreement with Mangopay. This includes:
- (i) Partners who are natural persons (e.g., sole traders who contract with Mangopay).
- (ii) Individuals registered on the Partners’ Platforms, for whom we create Mangopay accounts to enable the receipt of funds (e.g., Platforms’ users).
Natural persons acting as legal representatives, shareholders, beneficial owners, or contact persons employed by a Partner that is a legal entity. These individuals provide Personal Data (such as names, surnames, etc.) to facilitate the conclusion of service agreements and manage the relationship between Mangopay and the Partner.
Natural persons who make payments on a Partner’s Platform without creating a Mangopay account or registering for our services.
Natural persons who act as employees and representatives of platform operators being prospected by Mangopay (“Business contacts”).

3. What Personal Data is processed by Mangopay? How is it collected?

Depending on how you interact with Mangopay and which of our services you use, one of the following instances of Personal Data processing will apply to you.

For other instances of Personal Data processing, please refer to one of the sections below:

⁠3.1. INFORMATION FOR PERSONS WHO REGISTERED FOR MANGOPAY’S SERVICES VIA A PARTNER’S PLATFORM.

3.1.1. REGISTRATION DATA

Categories of data:

When you register for Mangopay’s services through a Partner’s Platform - such as when you subscribe to a Partner’s Platform to accept payment for the goods or services you offer - you will need to provide certain Personal Data. This Personal Data typically includes identification details such as your first and last name, date of birth, nationality, country of residence and email address. In some cases, you may also be asked to provide a copy of an official identity document or any additional documentation necessary to fulfill our legal obligations relating to Anti-Money Laundering and Counter Financing of Terrorism (“AML/CFT”). As part of our KYC due diligence, we perform a liveness check which requires you to provide a real-time selfie of yourself. To comply with strong customer authentication (“SCA”) obligations, Mangopay will collect your email address, phone number as well as some technical information about the session used for your registration (i.e., information related to your device, browser and network). Furthermore, if you are a U.S. taxpayer or have registered a U.S. bank account, you will be required to provide your Taxpayer Identification Number (TIN) to ensure compliance with U.S. tax laws and regulations.

Purpose of processing: Your personal data is processed to open your Mangopay account, facilitate the provision of our services and ensure compliance with our obligations as a regulated entity under AML/CFT laws and the Revised Payment Services Directive (PSD2). Additionally, we process your Personal Data to enhance security and prevent fraud.

Legal basis: We process your Personal Data on the following grounds:

Contractual necessity
The processing of your Personal Data is essential for fulfilling our contractual obligations to you. This includes actions required to initiate and provide Mangopay services, such as verifying your identity during registration and other necessary pre-contractual steps.
Legal obligation
As a regulated entity, Mangopay is legally required to process certain categories of Personal Data, including copies of your identification documents, to comply with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) obligations. These legal requirements are integral to Mangopay’s responsibilities as a licensed institution.
Legitimate interest
⁠Mangopay also processes your Personal Data based on our legitimate interest in preventing fraud and ensuring the security of our services. This is critical to maintaining the integrity and safety of our operations as we deliver services to you

Your Personal Data is collected directly through Mangopay’s API on the Partner’s Platform, which serves as the technical infrastructure for processing payments. Providing your Personal Data is mandatory for registering for our services. The specific categories of Personal Data required is clearly indicated on the registration forms available on the Partner’s Platform. If you choose not to provide the necessary Personal Data, it may result in the refusal or suspension of Mangopay’s services.

⁠3.1.2. PERSONAL DATA PROCESSED IN CONNECTION WITH THE PROVISION OF SERVICES

Categories of data: During your contractual relationship with Mangopay, we process Personal Data generated through your use of our services. This includes, but is not limited to:

Transactional data (e.g., amounts transferred, transaction descriptions, recipients);
Bank account information (e.g., details related to payments made to your external bank account through Mangopay).

Purpose of Processing: Your Personal Data is processed to deliver high-quality services, tailor offerings to your specific needs, and ensure security, including fraud prevention. Additionally, your data may be processed for statistical purposes to help improve and enhance the quality of Mangopay’s services.

Legal basis: We process your Personal Data on the following grounds:

Contractual necessity
The processing of your Personal Data is essential for fulfilling our contractual obligations to you. This includes providing Mangopay services, particularly executing payments on your behalf.
Legal obligation
As a regulated entity, Mangopay is legally required to process your Personal Data for a specified period to comply with AML/CFT obligations, as well as other applicable payment services regulations (e.g., PSD2).
Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Prevent fraud and ensure the security of the services;
- Enhance the quality of the services through statistical analysis of your Personal Data;
- Defend itself against legal claims and processing Personal Data in relation to any legal disputes, if applicable.

Your Personal Data is collected through your use of Mangopay’s services.

⁠

3.1.3. CUSTOMER SUPPORT DATA

Categories of data: When you contact Mangopay’s support team for assistance, your Personal Data is processed to address your request. Typically, this includes identification data such as your first name, last name, email address, internal technical identifiers (e.g. user ID) and phone number. Depending on the nature of your inquiry and the actions required by our support team, it may also encompass Personal Data relating to your use of our services. Additionally, we process the content of your messages and other communications sent to our support teams. Mangopay’s support team may record telephone conversations for training and quality control purposes. If you do not wish to be recorded, you may object to the recording by informing the agent you are speaking on the phone with.

Purpose of processing: Your Personal Data is processed to effectively respond to your support requests and other inquiries related to the provision of Mangopay’s services. This processing ensures that you can use our services without interruption and that the service quality remains consistently high.

Legal basis: We process your Personal Data on the following grounds:

Contractual necessity
The processing of your Personal Data is essential for fulfilling our contractual obligations to you, particularly in ensuring that you receive high-quality services.
Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Address your customer support requests and other inquiries
- Improve the quality of Mangopay’s services and enhance your customer service experience
- Defend against legal claims and manage any related legal disputes, if applicable

Your Personal Data is collected directly from you when you contact us for support or other queries, or through our Partners. Providing this data is mandatory to allow us to respond to your requests and communicate with you effectively. Failure to provide the necessary Personal Data may prevent Mangopay from addressing your queries and assisting with troubleshooting.
⁠

3.2. INFORMATION FOR INDIVIDUALS MAKING PAYMENTS ON A PARTNER'S PLATFORM WITHOUT REGISTERING FOR MANGOPAY'S SERVICES

⁠Categories of data: When you make a payment using a card or other payment method on a Partner’s Platform, you are required to provide certain Personal Data, such as your first and last name, card number, Card Validation Value (“CVV”) and expiration date. The specific categories of Personal Data processed may vary depending on the payment method available on the Platform.

Additionally, we collect transactional data as part of executing the payment order. We also gather certain technical data related to your device, electronic identifiers, IP address, and information about your interactions with the Partner’s Platform for security and fraud prevention purposes.

Purpose of processing: Your Personal Data is processed for the purpose of executing your payment and preventing fraudulent transactions.

Legal basis: We process your Personal Data on the following grounds:

Legal obligation
As a regulated entity, Mangopay is required to process your Personal Data for a specified period to comply with AML/CFT obligations.

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Execute your payment
- Resolve any issues that may arise with your payment
- Enhance the quality of Mangopay’s services
- Prevent fraud and ensure the security of our services
- Defend itself against legal claims and managing related legal disputes, if applicable

Your Personal Data is collected directly from you. Providing this data is necessary, if you fail to provide the required information, we will be unable to process your payment.

3.3. INFORMATION FOR PERSONS ACTING AS PARTNER’S LEGAL REPRESENTATIVES, BUSINESS CONTACTS OR BENEFICIAL OWNERS

3.3.1. PERSONAL DATA COLLECTED FOR CONCLUSION OF CONTRACT WITH MANGOPAY

Categories of Data: To facilitate the execution of contracts with Mangopay, our Partners, acting as legal entities, must provide specific categories of Personal Data pertaining to their legal representatives and beneficial owners. This data typically includes, but is not limited to, names, surnames, tax identification details, addresses, countries of residence, copies of identification documents, and contact information. The exact list of required documents and Personal Data may vary depending on individual circumstances.

Purpose of Processing: Your Personal Data is processed to facilitate the conclusion of a contract for Mangopay’s services with the Partner. This process necessitates the verification of the identities of the Partner's legal representatives and ultimate beneficial owners.

Legal Basis: We process your Personal Data on the following grounds:

Legal obligation
As a regulated entity, Mangopay is legally required to process your Personal Data in order to verify your identity, in compliance with our Know-Your-Business (KYB) due diligence obligations.
Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Enable the conclusion of the contract,
- Prevent fraud,
- Defend itself against legal claims and manage any related legal disputes, if applicable.

The provision of Personal Data is mandatory to enable the delivery of our services. Failure to provide the required Personal Data may prevent us from concluding a contract with you and, consequently, from providing Mangopay’s services to the Partner.

⁠3.3.2. PERSONAL DATA COLLECTED THROUGH MANGOPAY'S TECHNICAL INTERFACES

Categories of Data: To oversee payment operations conducted through their platforms, Mangopay’s Partners are granted access to our HUB and Dashboard interfaces. These tools provide Partners with supervision and control over payment flows on their platforms. To grant you access to our HUB and Dashboard, it is necessary to process your Personal Data. This data is limited to identification details, such as your first and last name, email address, and may also include information about your job position. Additionally, Personal Data may be generated based on your use of Mangopay’s interfaces (e.g., logs, pages viewed, etc.).

Purpose of Processing: Your Personal Data is processed to ensure only authorized individuals have access to the HUB and Dashboard. It is also processed to enhance the user experience for Dashboard and HUB users by displaying contextual information, and to ensure the security of these interfaces.

Legal basis: We process your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Ensure the delivery of high-quality services to the Partner and monitor transactions on the Platform;
- Prevent fraud and safeguard the security of our interfaces and services;
- Defend itself against legal claims and any related legal disputes, if applicable.

Provision of Personal Data is mandatory in order to access our HUB and Dashboard. Refusal to provide the required Personal Data will prevent access to the interfaces.

⁠3.3.3. CUSTOMER SUPPORT DATA

Categories of data: When you contact Mangopay’s support, the Partner’s Customer Success Manager (“CSM”) or any other team for assistance, your Personal Data is processed to address your request. The Personal Data processed includes identification details such as your first and last name, email address and phone number. Depending on the nature of your inquiry and the required actions by Mangopay’s teams, additional Personal Data may be processed. Additionally, we process the content of your messages and other communications sent to our teams. Mangopay’s support team may record telephone conversations for training and quality control purposes. If you do not wish to be recorded, you may object to the recording by informing the agent you are speaking on the phone with. If you provide your consent, the Partner’s CSM also has the possibility of recording your meetings (i.e., voice and/or image).

When addressing your request, you may be interacting with an Artificial Intelligence (“AI”) technology which may provide you with an output to help answer your request. The reliance on an AI will be clearly indicated in the chatbot and you will always have the possibility of choosing to interact with one of Mangopay agents instead.

Purpose of processing: Your Personal Data is processed to effectively respond to the Partner’s support requests and other inquiries related to the provision of Mangopay’s services. This processing ensures that you can use our services without interruption and that the service quality remains consistently high.

Legal basis: We process your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Address your customer support requests and other inquiries
- Improve the quality of Mangopay’s services and enhance your customer service experience
- Defend itself against legal claims and manage any related legal disputes, if applicable

Consent
We rely on your consent for the recording of your meetings with the Partner’s CSM.

Your Personal Data is collected directly from you, when you contact us with customer support and other queries. Except for the recording of your meeting with your CSM which requires your consent, providing your Personal Data is mandatory in order to enable responding to your queries and contacting you. Refusal to provide the required Personal Data may result in Mangopay’s inability to respond to your queries and help with troubleshooting.

⁠3.3.4. MARKETING DATA

Categories of data: We may reach out to business contacts acting on behalf of the Partner, in order to inform them about the new services we offer and about improvements in our services. For that purpose we can process, among others, your contact details, such as your first and last name, job position, email address and/or phone number. If you provide your consent, the Partner’s CSM also has the possibility of recording your meetings (i.e., voice and/or image).

Purpose of the processing: Provide you with information about our services.

Legal basis: Mangopay processes your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Upsell its services, if relevant to the Partner’s scope of business;
- enhance the quality of its services and of the customer service experience.

Consent
⁠We rely on your consent for the recording of your meetings with the Partner’s CSM.

Your Personal Data is collected directly from you, on a voluntary basis. In case you refuse to provide the required Personal Data, we will not contact you for marketing purposes.

3.4. INFORMATION FOR INDIVIDUALS ACTING AS MANGOPAY'S BUSINESS CONTACTS.

We conduct multiple marketing activities concurrently and jointly manage our website to effectively address your inquiries and provide information about our services. Due to this centralized approach, Mangopay SA and Mangopay UK Limited act as joint controllers regarding the processing of your personal data for marketing purposes. Consequently, the responsibilities of both companies for complying with data protection obligations have been mutually established as follows:

Mangopay SA is responsible for:

A. collecting consent for processing of personal data for future marketing and for communication with business contacts on behalf of both joint controllers;
B. fulfilling information obligation on behalf of both joint controllers;
C. ensuring the legality of any data transfer outside the EEA, should the joint controllers decide to entrust the processing to an entity based in a third country;
D. concluding data processing agreements when the personal data is entrusted to processors for hosting purposes;
E. acting as a common point of contact for you.

All the other obligations remain with each individual company as a data controller.

⁠3.4.1. DIRECT MARKETING DATA

Categories of data: In order to carry out direct marketing campaigns, we collect your Personal Data, such as your first and last name, the company you work for, your corporate email address and/or phone number, your job position, any information visible on your LinkedIn profile and CV. Your Personal Data is either obtained via databases provided by our service providers for this effect or following your participation at an event for which Mangopay participates, either as a sponsor or as a visitor.

Purpose of processing: Your Personal Data is processed in order for our Sales agent to contact you by email and present you with our services.

Legal basis: Mangopay processes your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in conducting direct marketing activities of its own services.

⁠3.4.2. RESPONDING TO YOUR CONTACT REQUEST

Categories of data: In case you contact Mangopay directly through the dedicated form on our website or by reaching out to one of our Sales agent through another means of communication, we will process your Personal Data, such as your first name and last ,ame, the company you work for, your corporate email address and/or phone number, as well as any personal data you might include in the form or message.

Purpose of the processing: We process your Personal Data in order to respond to your query. Provided you consent to the recording, meetings with our Sales agents may be recorded for training and operational efficiency purposes.

Legal basis: We process your Personal Data on the following grounds:

Legitimate interest
We rely on our legitimate interest in direct marketing of our own services by responding to your contact request.
Consent
The recording of meetings between you and our Sales agents is based on your consent.

Provision of your Personal Data is voluntary, but if you don’t provide us with your basic contact details (name, surname and either phone number or email address), we will not be able to respond to your query.

⁠3.4.3. CONTACT THROUGH A MARKETPLACE SOLUTION PROVIDER

Our services may be promoted by marketplace software solutions providers with whom Mangopay has partnered. If you are in contact with one of these marketplace software solutions, the latter may communicate your Personal Data to Mangopay, whether you have expressed interest in our services or not.

Categories of data: The following categories of personal data may be shared between Mangopay and the marketplace solution provider: your first name and last name, the company you work for, your corporate email address and/or phone number, your job position.

Purpose of the processing: We process your personal data in order to contact you to evaluate whether our services are suitable to your needs in light of the integration you are pursuing with the marketplace software solution provider with whom Mangopay has partnered.

Legal basis:

We process your personal data based on our legitimate interest to promote our services which may be tailored for your integration with a marketplace solution provider Mangopay has partnered with.

⁠3.5. INFORMATION FOR PARTNERS WHO ARE SOLE TRADERS (NATURAL PERSONS).

⁠3.5.1. PERSONAL DATA COLLECTED FOR CONCLUSION OF CONTRACT WITH MANGOPAY

Categories of data: To conclude a contract with Mangopay, our Partners who are natural persons must provide certain identification data. This includes, but is not limited to, first and last name, tax identification information, residence information, copies of identification documents and contact details. The categories of Personal Data requested may vary depending on circumstances.

Purpose of processing: Your Personal Data is processed for the purpose of concluding the contract for provision of Mangopay’s services with you which requires the verification of your identity.

Legal basis: We process your Personal Data on the following grounds:

Legal obligation
As a regulated entity, Mangopay is legally required to process your Personal Data in order to verify your identity, in compliance with Know-Your-Customer (KYC) due diligence obligations.
Contractual necessity
⁠The processing is necessary for us to start the provision of Mangopay’s services to you, as well as registering for Mangopay’s services which requires verification of your identity etc.
Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Enable the conclusion of the contract;
- Prevent fraud;
- Defend itself against legal claims and manage any related legal disputes, if applicable.

3.5.2. PERSONAL DATA COLLECTED THROUGH MANGOPAY'S TECHNICAL INTERFACES

Legal basis: We process your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Ensure the delivery of high-quality services to the Partner and monitor transactions on the Platform.
- Prevent fraud and safeguard the security of our interfaces and services.
- Defend itself against legal claims and any related legal disputes, if applicable.

Provision of Personal Data is mandatory in order to access our HUB and Dashboard. Refusal to provide the required Personal Data will prevent access to the interfaces.

⁠3.5.3. CUSTOMER SUPPORT DATA

Categories of data: When you contact Mangopay’s support or any other team for assistance, your Personal Data is processed to address your request. The Personal Data processed includes identification details such as your first and last name, email address and phone number. Depending on the nature of your inquiry and the required actions by Mangopay’s teams, additional Personal Data may be processed. Additionally, we process the content of your messages and other communications sent to our teams. Mangopay’s support team may record telephone conversations for training and quality control purposes. If you do not wish to be recorded, you may object to the recording by informing the agent you are speaking on the phone with.

Legal basis: We process your Personal Data on the following grounds:

Legitimate interest
Mangopay has a legitimate interest in processing your Personal Data to:
- Address your customer support requests and other inquiries
- Improve the quality of Mangopay’s services and enhance your customer service experience
- Defend itself against legal claims and manage any related legal disputes, if applicable

Consent
We rely on your consent for the recording of your meetings with the Partner’s CSM.

3.5.4. MARKETING DATA

Purpose of the processing: Provide you with information about our services.

Legal basis: Mangopay processes your Personal Data on the following grounds:

Legitimate interest
⁠Mangopay has a legitimate interest in processing your Personal Data to:
- Upsell its services, if relevant to the Partner’s scope of business;
- enhance the quality of its services and of the customer service experience.

Consent
We rely on your consent for the recording of your meetings with the Partner’s CSM.

Your Personal Data is collected directly from you, on a voluntary basis. In case you refuse to provide the required Personal Data, we will not contact you for marketing purposes.

4. Profiling and automated decision-making

To prevent fraud, money laundering and terrorist financing, Mangopay uses profiling, which means we automatically process your Personal Data to assess certain aspects related to you. This includes technical information about your device, system preferences, and how you interact with our services.

In some cases, this automated processing may lead to decisions made without human involvement, such as temporarily blocking a payment, delaying a payout, or limiting access to your account if we detect suspicious activity.

These decisions are usually temporary and are not intended to have a significant impact on your legal rights or produce serious consequences for you. However, decisions to block a transaction can produce legal effects or similarly significantly affect you, depending on individual circumstances, but are necessary to ensure transaction security, and prevent fraud, money laundering and terrorist financing, in accordance with Mangopay’s legal obligations. It’s a critical part of the services we provide to keep your payments secure.

The legal grounds for profiling are:

The performance and execution of our agreement with you
Mangopay’s legitimate interest in ensuring security and preventing fraud

If you are not satisfied with an automated decision or want more information, you can contact us at the email addresses specified in the “Country Specific Information” section to request a human intervention or to contest the decision.

5. How long is your Personal Data kept?

Mangopay will only keep your Personal Data as long as necessary to fulfill the purpose for which it is processed. The applicable retention periods are generally determined by legal obligations.

AML/CFT compliance: Personal Data provided for AML/CFT purposes, including identification documents and transaction details, are retained from five (5) to ten (10) years, starting from the end of the contractual relationship with Mangopay.
Disputes and support communications: Personal Data needed to manage disputes and communications with our support team will be retained for five (5) years.
Phone calls and meetings recordings: Phone calls recordings made for training and quality control purposes are kept for six (6) months. Recording of meetings with our CSM or Sales agents are kept for one (1) year.
Marketing purposes: Personal Data used for marketing purposes, based on our legitimate interest, will be processed throughout our relationship with the Partner and fro up to three (3) years after the last contact with the Partner
Log data: Personal Data stored in logs will be kept for six (6) months
Accounting data: Personal Data necessary for accounting will be retained for ten (10 ) years from the end of the relevant accounting period.

6. Where is your Personal Data stored?

We store your Personal Data on cloud servers located in Ireland (Dublin) and Germany (Frankfurt).

Sometimes, we may need to transfer your Personal Data to companies outside the EU/EEA that help us provide our services. When we do this, we make sure your Personal Data is protected by using valid safeguards such as the European Commission’s adequacy decisions or Standard Contractual Clauses..

7. Who receives your Personal Data? Is it shared with third parties?

As part of our services, your Personal Data may be shared with:

⁠⁠⁠7.1. Affiliates

We share your Personal Data with Mangopay’s affiliated companies to fulfill the purposes outlined in this Privacy Statement.

⁠7.2 Competent authorities

We may need to disclose your Personal Data to legal authorities, such as courts and financial regulators. Before sharing, our legal team reviews each request to ensure it is legitimate.

⁠7.3 Processors

We work with selected service providers to deliver part of our services. These providers are bound by strict contractual obligations to only process your Personal Data as instructed by Mangopay. For instance, Mangopay uses service providers specialized in AML/CFT and KYC verifications, such as Onfido LTD.

⁠7.4 Payment partners

We collaborate with payment partners to process transactions and protect your funds. These partners act independently and only receive the data necessary to complete the transaction. The legal basis for sharing your Personal Data with these partners is either the performance of our contract with you or our legitimate interest in ensuring proper payment processing.

8. What are your rights regarding your Personal Data?

8.1 Right of access

You have the right to know what Personal Data we hold about you and how it is being processed. We’ll provide this information electronically unless you request a different format, which we’ll try to accommodate.

⁠8.2 Right of rectification

If your Personal Data is incorrect or incomplete, you can ask us to correct or update it.

⁠8.3 Right to erasure (“Right to be forgotten”)

You can ask us to delete your Personal Data if:⁠

It is no longer needed for the purposes for which it was collected;
It was processed illegally;
You withdraw your consent (if consent was the legal basis for the processing);
You object to the processing based on your specific situation, and there are no overriding interest for Mangopay to continue the processing;
You object to its use for direct marketing;
We are legally required to erase it.

However, your request may be denied if we need to keep your Personal Data to exercise our right to freedom of expression and information, defend legal claims, or comply with legal obligations, such as for AML/CFT purposes.

⁠

⁠8.4 Right to restrict processing

You can ask us to limit how your Personal Data is processed if:

You contest its accuracy;
The processing is unlawful but you prefer restriction over deletion;
We no longer need your Personal Data but you need it to establish or defend legal claims;
You objected to our processing based on our legitimate interest and we are still reviewing your request.

In case restriction is implemented, we’ll inform you before it is lifted.
⁠

8.5 Right to object to processing

You can object to our processing of your Personal Data if it is based on our legitimate interests, unless we can demonstrate compelling reasons to continue the processing. You can also object to the use of your Personal Data for direct marketing at any time.

⁠8.6 Right to data portability

If our processing is based on your consent or a contract, and is done via automated means, you have the right to receive your Personal Data in a machine-readable format and request its transfer to another controller, if technically possible.

8.7 Right to withdraw your consent

If our processing is carried out on the basis of your consent, you have the right to withdraw it at any time. Withdrawal will not affect the legality of prior processing.

⁠8.8 How to exercise your rights?

Please consult the “Country specific information” section of this Privacy Statement to learn how to exercise your rights with Mangopay.

9. How is your Personal Data secured?

We use various security measures, including encryption and pseudonymization, to protect your Personal Data from unauthorized access, loss or alteration.

10. Country specific information

European Union/European Economic Area (EU/EEA)

If you are using the services of one of our EU/EEA-based Partners, the following additional information applies:

Mangopay S.A. is the data controller responsible for processing your Personal Data in connection with its payment or e-money services. Mangopay S.A. is a company registered in Luxembourg, with its registered office at 2 Avenue Amélie, L-1125 Luxembourg.

Personal Data collected and processed under Mangopay S.A.'s AML/CFT obligations will be retained for ten (10) years, starting from the end of your contractual relationship with Mangopay S.A.

To exercise your data rights, you can contact either Mangopay's Partner or Mangopay S.A. directly at: dpo.mangopay@mangopay.com.

If you believe your rights have been violated in relation to the processing of your Personal Data, you have the right to file a complaint with the Commission Nationale pour la Protection des Données (CNPD) at any time. You can submit a complaint form here.

United Kingdom (UK)

If you are using the services of one of our UK-based Partners, the following additional information applies:

Mangopay UK Limited is the data controller responsible for processing your Personal Data in connection with its payment or e-money services. Mangopay UK Limited is registered in the UK, with its registered office at The Smiths Building, 179 Great Portland St, London W1W 5PL, UK. It is also registered with the Information Commissioner’s Office (ICO) under registration number ZB710243.

Personal Data collected and processed under Mangopay UK Limited’s AML/CFT obligations will be retained for five (5) years, starting from the end of your contractual relationship with Mangopay UK Limited.

To exercise your data rights, you can contact either Mangopay's Partner or Mangopay UK Limited directly at: uk.dpo.mangopay@mangopay.com.

If you believe your rights have been violated in relation to the processing of your Personal Data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). You can submit a complaint form here.

11. Changes to this Privacy Statement

This Privacy Statement may be updated to reflect changes in our practices, business model or legal requirements. The latest version will always be available on our website, with the date of the last update clearly indicated.