Privacy Notice - Nuvei Global Services B.V.

Nuvei and privacy

Nuvei is committed to respect and protect the privacy of anybody whose personal data is processed when they accept or make a payment where the Nuvei Services are involved. This document reflects Nuvei's privacy policy and is used to inform all data subjects whose personal data may be processed by Nuvei, describing what elements of personal data Nuvei collects or obtains and how and for which purposes Nuvei uses them. Nuvei has drafted this document so that it covers the legal obligations of Nuvei acting as a Controller under the General Data Protection Regulation and Nuvei shall process the personal data only as described herein.

Information About Us

Our Site is owned and operated by Nuvei Global Services B.V., a provider of payment services  registered in  under company number 34206701.

Registered address: Amstelveenseweg 500, Unit 4.64, 1081 KL, Amsterdam.

Main trading address: Amstelveenseweg 500, Unit 4.64, 1081 KL, Amsterdam.

VAT number: NL813236460B01.

Data Protection Officer: James Lillis.

Email address: DPO@nuvei.com

Postal address: 5th Floor One Smart's Place, London, WC2B 5LW, United Kingdom.

We are regulated by Dutch Central Bank.

What Is Personal Data?

Personal data is, in simple terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

Nuvei and the personal data it processes

Nuvei processes personal information of different groups of data subjects: A Party interested in becoming a Merchant of Nuvei (an applicant Merchant) must provide information enabling Nuvei to assess and accept it as a Merchant and, when so accepted, to settle payments to, communicate with and to generally provide the Nuvei Services to it. This includes information necessary to allow Nuvei to comply with its legal obligation to identify its customers.  We seek to make this process as easy and efficient as possible, so we offer the ability to provide our identification by digital means. If you choose this option, we’ll make sure that appropriate safeguards are applied to this information too. Customers of Merchants (hereinafter “Payers”) making payments for their orders using the payment method of such Payers' choice, provide the information enabling Nuvei to process the payment to the Merchant for the order. In addition, visitors of the Nuvei website or anybody else contacting Nuvei for numerous other purposes, may provide personal data which is or may be processed by Nuvei. In some cases the information is provided directly to Nuvei, in other situations Nuvei obtains elements of personal data indirectly, for instance through a trusted partner of Nuvei or via a Merchant's integration with Nuvei's systems. After the 3 sections below, which apply to all data subjects equally, the data processing for the different groups of data subjects which can be identified is described.

Storage of the personal data

The personal data Nuvei processes as described herein is stored on Nuvei's secure servers, located in the EU/EEA.

Automated decision-making

Nuvei may use personal data for recognizing and prevention of fraud by automatic decision making systems, either operated by third parties or internal systems.

Changes, questions, comments and complaints

Any changes in Nuvei's privacy policy may affect this document. Therefore, Nuvei may make changes to it and publish new versions. Questions and comments can be shared with Nuvei through: Globalservicesbv@nuvei.com. Complaints about Nuvei's compliance with the General Data Protection Regulation can be lodged with the Dutch Autoriteit Persoonsgegevens (Data Protection Authority).

Different groups of data subjects, the processing, the purpose and the legal basis

1) Data processed by Nuvei of a Party wishing to become a Merchant

NOTE: Not all data and information provided or obtained in the process of Merchant Acceptance is actually personal data. All data provided in this process, however, is subject to confidentiality as provided for in the Nuvei Merchant Agreement, the terms of which are accepted by the (applicant) Merchant upon its entering of the acceptance process.

• Personal Data provided/ obtained and processed

Contact information of (applicant) Merchant's representatives – name, business address, business email, business phone number, for the purpose of interaction and communication with the (applicant) Merchant in the process of Merchant Acceptance.

Information about the people that own and control the business, or sole traders – name, address, identification documents and associated information contained within them, evidence of address, for the purpose of Nuvei's compliance with applicable laws, with an emphasis on financial supervision legislation and those combatting money-laundering and terrorism financing and the aim to verify the identity of the Merchant's UBOs and Directors. Some of this may be gathered electronically through the use of vendors that support electronic verification. If you choose this option, the vendor will not store your information, and Nuvei will retain control of this information

• Legal basis

The processing of the elements of personal data referred to above is necessary for Nuvei's compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating (attempted) (criminal or objectionable) conduct directed against the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers and customers and (ii) Nuvei's compliance other applicable laws such as the Dutch Money Laundering and Terrorist Financing (Prevention) Act ('Wwft').

• Recipients

Authorities – such as the financial intelligence unit, the police or other authorities if required by law, in particular the Dutch anti-money laundering and counter-terrorist financing act

Vendors – such as Trulioo that provide us with the ability to verify identities electronically.

• Storage period

As required by applicable laws, in particular the Wwft: 5 years.

• Personal data processed for Merchant Acceptance and the related data subjects' rights

NOTE: Nuvei must store the personal information obtained in the process of Merchant Acceptance and monitoring in compliance with the Wwft for a period of 5 years. Nuvei will not erase the personal data before a period of 5 years has passed since the last transaction was processed by Nuvei.

Right to access, right to rectification and right to erasure

As part of the Merchant Agreement, to the terms of which the (applicant) Merchant is bound per the moment of submitting its application, the (applicant) Merchant warrants that the data and information provided in the process of Merchant Acceptance is true, accurate and up-to-date. Therefore there are no reasons justifying and thus no options for the applicant Merchant enabling its exercise of these rights.

All data and information of applicant Merchants who were not accepted, will be deleted from Nuvei's systems, subject however to Nuvei's storage requirements under the Wwft.

2) Data processed by Nuvei of (accepted) Merchants

• Personal Data processed

The same personal data as provided during the process of Merchant Acceptance for the same purposes as described under 1) above, with the additional purpose of administrating and maintaining the customer relationship between Nuvei and the Merchant for provision, development, enhancement and marketing of the Nuvei Services.

Any updates of the personal data provided by the Merchant or obtained by Nuvei in accordance with the terms of the Merchant Agreement for the purpose of Nuvei's obligations under applicable laws to keep the records of the Merchant, its UBOs and Directors up-to-date.

• Legal basis

The processing of the elements of personal data referred to above is necessary for (i) the performance of the Merchant Agreement, i.e. provision of the Nuvei Services to the Merchant, (ii) Nuvei's compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating attempted, criminal or objectionable conduct directed against the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers or customers, to a certain extent, (iii) the purposes of the legitimate interests pursued by the sector of which Nuvei forms part Nuvei itself, its Merchants and their Payers or customers and (iv) Nuvei's compliance with (other) applicable laws such as the Wwft.

• Recipients

Authorities.

• Storage period

As required by applicable laws, generally as a business having bookkeeping and fiscal obligations and, in particular, the Wwft: 5 years.

• Personal data of data subjects related to the Merchant and their rights

Right to access

An overview of the personal data Nuvei holds about the data subjects related to the Merchant can be requested by the relevant data subject by sending a request to Nuvei via Globalservicesbv@nuvei.com  or by accessing the online boarding tool for the Merchants that provided the identification data online by including a legible copy of its ID. Nuvei may have to contact the relevant data subject in order to establish and verify the authenticity of any such request.

Right and obligation to rectification

NOTE: As part of the Merchant Agreement, the Merchant warrants that the data and information provided in the process of Merchant Acceptance is true, accurate and up-to-date. Therefore, the data subject not only has the right to rectify the personal data Nuvei, the Merchant is also under the obligation to correct, or complete any inaccurate or incomplete information.

Right to erasure

Nuvei will not erase the personal data before a period of 5 years has passed since the last transaction between Nuvei and such Merchant was processed in order to comply with the Wwft and other applicable laws.

3) Payers making payments for orders placed at websites of Merchants of Nuvei

• Personal Data processed

NOTE: Dependent on the payment method a Payer chooses to pay with, the following elements of personal data of such Payer may be collected/ obtained and processed by Nuvei either directly or via the systems of Nuvei partners or Merchants:

Payment information – data identifying the payment instrument used by the Payer (such as the IBAN, a credit or debit card number).

Contact information – as indicated above, dependent on the payment method - name, email address, phone number, residence/shipping/billing address, personal identification number of the Payer, IP address.

• Purpose

To comply with applicable laws - with an emphasis on financial supervision legislation and those combatting money-laundering and terrorism financing with the aim to monitor for fraud or other unusual or suspect activity and, if required, verify the identity of Payers in order to enable compliance with reporting obligations of Nuvei.

And for the legitimate interest of Nuvei to conduct aggregate analysis and develop business intelligence enabling Nuvei to operate, protect and report on the performance of its business and to make informed decisions.

• Legal basis

The processing of the elements of personal data referred to above is necessary for (i) Nuvei's compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating (attempted) (criminal or objectionable) conduct directed against the sector of which Nuvei forms part Nuvei itself, its Merchants and their Payers or customers, to a certain extent, (ii) Nuvei's compliance with (other) applicable laws such as the Wwft, and (iii) the purposes of the legitimate interests pursued by the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers or customers, with an aim to improve the Nuvei Services and for the purpose of business development focusing on but not limited to improving or implementing new risk models and other services and products for fraud mitigation.

• Recipients

Third parties or internal systems used for recognizing and prevention of fraud

Third parties or internal systems used for performance and SLA monitoring

Authorities - such as the financial intelligence unit, the police or other authorities if required by law, in particular the Dutch Money Laundering and Terrorist Financing (Prevention) Act ('Wwft').

• Purpose

As provided for in the Wwft: 5 years.

• Exercising rights as a data subject

NOTE: Identification of a Payer is only required in the case a transaction is recognised as unusual or suspect and if Nuvei shall report the transaction to the relevant authorities. The majority of payments processed does not require the identification of the Payer by Nuvei. Payers who wish to be enabled to exercise their rights to access, rectification or erasure shall provide all additional information substantially enabling Nuvei to identify the data subject – which may include that the data subject shall provide additional information which is only available at and shall be obtained by the data subject from the related Merchant, so specifying the information or processing activities to which the request relates. In respect of a Payer’s right to erasure, the following applies: Nuvei must store the personal data of payers as described above in compliance with the Wwft for a period of 5 years. Nuvei will not erase any personal data of a Payer before a period of 5 years has passed since the last transaction between Nuvei and the related Merchant was processed. Payers can send their queries in respect of the personal data to Globalservicesbv@nuvei.com and Nuvei may have to contact the relevant data subject in order to establish and verify the authenticity of any such request.

Use of cookies: for the correct routing of all requests related to a transaction a cookie based mechanism is used. Cookie lifetime is limited to 30 minutes.

4) People visiting Nuvei’s website or otherwise contacting Nuvei

People who visit the Nuvei website may leave their name and email address, which we will only use for the purpose of responding to the queries so received. People who contact Nuvei by phone, will be asked to provide their name and phone number if they require – and consent to – Nuvei to contacting them later.

Changes to this Privacy Policy

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be immediately posted on our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of our Site following the alterations. We recommend that you check this page regularly to keep up-to-date. This Privacy Policy was last updated 01.04.2022.