Nuvei Global Services B.V. and its affiliate companies (hereinafter: “Nuvei”) is a provider of payment services (hereinafter: the “Nuvei Services”), enabling Nuvei’s customers (hereinafter “Merchants”) to accept payments for goods and services sold online. Provision of the Nuvei Services involves the processing of personal data.
Nuvei and privacy
Information About Us
Our Site is owned and operated by Nuvei Global Services B.V., a provider of payment services registered in under company number 34206701.
Registered address: Westermarkt 2, Unit C, 1016DK Amsterdam.
Main trading address: Westermarkt 2, Unit C, 1016DK Amsterdam.
VAT number: NL813236460B01.
Data Protection Officer: James Lillis.
Email address: DPO@nuvei.com
Postal address: 5th Floor One Smart’s Place, London, WC2B 5LW, United Kingdom.
We are regulated by Dutch Central Bank.
What Is Personal Data?
Personal data is, in simple terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
Nuvei and the personal data it processes
Nuvei processes personal information of different groups of data subjects: A Party interested in becoming a Merchant of Nuvei (an applicant Merchant) must provide information enabling Nuvei to assess and accept it as a Merchant and, when so accepted, to settle payments to, communicate with and to generally provide the Nuvei Services to it. This includes information necessary to allow Nuvei to comply with its legal obligation to identify its customers. We seek to make this process as easy and efficient as possible, so we offer the ability to provide our identification by digital means. If you choose this option, we’ll make sure that appropriate safeguards are applied to this information too. Customers of Merchants (hereinafter “Payers”) making payments for their orders using the payment method of such Payers’ choice, provide the information enabling Nuvei to process the payment to the Merchant for the order. In addition, visitors of the Nuvei website or anybody else contacting Nuvei for numerous other purposes, may provide personal data which is or may be processed by Nuvei. In some cases the information is provided directly to Nuvei, in other situations Nuvei obtains elements of personal data indirectly, for instance through a trusted partner of Nuvei or via a Merchant’s integration with Nuvei’s systems. After the 3 sections below, which apply to all data subjects equally, the data processing for the different groups of data subjects which can be identified is described.
Storage of the personal data
The personal data Nuvei processes as described herein is stored on Nuvei’s secure servers, located in the EU/EEA.
Nuvei may use personal data for recognizing and prevention of fraud by automatic decision making systems, either operated by third parties or internal systems.
Changes, questions, comments and complaints
Different groups of data subjects, the processing, the purpose and the legal basis
1) Data processed by Nuvei of a Party wishing to become a Merchant
NOTE: Not all data and information provided or obtained in the process of Merchant Acceptance is actually personal data. All data provided in this process, however, is subject to confidentiality as provided for in the Nuvei Merchant Agreement, the terms of which are accepted by the (applicant) Merchant upon its entering of the acceptance process.
- Personal Data provided/ obtained and processed
- Contact information of (applicant) Merchant’s representatives – name, business address, business email, business phone number, for the purposeof interaction and communication with the (applicant) Merchant in the process of Merchant Acceptance.
- Information about the people that own and control the business, or sole traders – name, address, identification documents and associated information contained within them, evidence of address, for the purposeof Nuvei’s compliance with applicable laws, with an emphasis on financial supervision legislation and those combatting money-laundering and terrorism financing and the aim to verify the identity of the Merchant’s UBOs and Directors. Some of this may be gathered electronically through the use of vendors that support electronic verification. If you choose this option, the vendor will not store your information, and Nuvei will retain control of this information
- The processing of the elements of personal data referred to above is necessary for Nuvei’s compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating (attempted) (criminal or objectionable) conduct directed against the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers and customers and (ii) Nuvei’s compliance other applicable laws such as the Dutch Money Laundering and Terrorist Financing (Prevention) Act (‘Wwft’).
- Authorities– such as the financial intelligence unit, the police or other authorities if required by law, in particular the Dutch anti-money laundering and counter-terrorist financing act
- Vendors – such as Trulioo that provide us with the ability to verify identities electronically.
- As required by applicable laws, in particular the Wwft: 5 years
- Personal data processed for Merchant Acceptance and the related data subjects’ rights
- NOTE: Nuvei must store the personal information obtained in the process of Merchant Acceptance and monitoring in compliance with the Wwft for a period of 5 years. Nuvei will not erase the personal data before a period of 5 years has passed since the last transaction was processed by Nuvei.
- Right to access, right to rectification and right to erasure
- As part of the Merchant Agreement, to the terms of which the (applicant) Merchant is bound per the moment of submitting its application, the (applicant) Merchant warrants that the data and information provided in the process of Merchant Acceptance is true, accurate and up-to-date. Therefore there are no reasons justifying and thus no options for the applicant Merchant enabling its exercise of these rights.
- All data and information of applicant Merchants who were not accepted, will be deleted from Nuvei’s systems, subject however to Nuvei’s storage requirements under the Wwft.
2) Data processed by Nuvei of (accepted) Merchants
- The same personal data as provided during the process of Merchant Acceptance for the same purposes as described under 1) above, with the additional purpose of administrating and maintaining the customer relationship between Nuvei and the Merchant for provision, development, enhancement and marketing of the Nuvei Services.
- Any updates of the personal data provided by the Merchant or obtained by Nuvei in accordance with the terms of the Merchant Agreement for the purpose of Nuvei’s obligations under applicable laws to keep the records of the Merchant, its UBOs and Directors up-to-date.
- The processing of the elements of personal data referred to above is necessary for (i) the performance of the Merchant Agreement, i.e. provision of the Nuvei Services to the Merchant, (ii) Nuvei’s compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating attempted, criminal or objectionable conduct directed against the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers or customers, to a certain extent, (iii) the purposes of the legitimate interests pursued by the sector of which Nuvei forms part Nuvei itself, its Merchants and their Payers or customers and (iv) Nuvei’s compliance with (other) applicable laws such as the Wwft.
- As required by applicable laws, generally as a business having bookkeeping and fiscal obligations and, in particular, the Wwft: 5 years
- Personal data of data subjects related to the Merchant and their rights
- Right to access
- An overview of the personal data Nuvei holds about the data subjects related to the Merchant can be requested by the relevant data subject by sending a request to Nuvei via Globalservicesbv@nuvei.com or by accessing the online boarding tool for the Merchants that provided the identification data online by including a legible copy of its ID. Nuvei may have to contact the relevant data subject in order to establish and verify the authenticity of any such request.
- Right and obligation to rectification
- NOTE: As part of the Merchant Agreement, the Merchant warrants that the data and information provided in the process of Merchant Acceptance is true, accurate and up-to-date. Therefore, the data subject not only has the right to rectify the personal data Nuvei, the Merchant is also under the obligation to correct, or complete any inaccurate or incomplete information.
- Right to erasure
- Nuvei will not erase the personal data before a period of 5 years has passed since the last transaction between Nuvei and such Merchant was processed in order to comply with the Wwft and other applicable laws.
3) Payers making payments for orders placed at websites of Merchants of Nuvei
- NOTE: Dependent on the payment method a Payer chooses to pay with, the following elements of personal data of such Payer may be collected/ obtained and processed by Nuvei either directly or via the systems of Nuvei partners or Merchants:
- Payment information– data identifying the payment instrument used by the Payer (such as the IBAN, a credit or debit card number)
- Contact information– as indicated above, dependent on the payment method – name, email address, phone number, residence/shipping/billing address, personal identification number of the Payer, IP address.
- To comply with applicable laws – with an emphasis on financial supervision legislation and those combatting money-laundering and terrorism financing with the aim to monitor for fraud or other unusual or suspect activity and, if required, verify the identity of Payers in order to enable compliance with reporting obligations of Nuvei.
- And for the legitimate interest of Nuvei to conduct aggregate analysis and develop business intelligence enabling Nuvei to operate, protect and report on the performance of its business and to make informed decisions.
- The processing of the elements of personal data referred to above is necessary for (i) Nuvei’s compliance with the legal obligation to safeguard the security and integrity of the financial sector, including detecting, preventing, investigating and combating (attempted) (criminal or objectionable) conduct directed against the sector of which Nuvei forms part Nuvei itself, its Merchants and their Payers or customers, to a certain extent, (ii) Nuvei’s compliance with (other) applicable laws such as the Wwft, and (iii) the purposes of the legitimate interests pursued by the sector of which Nuvei forms part, Nuvei itself, its Merchants and their Payers or customers, with an aim to improve the Nuvei Services and for the purpose of business development focussing on but not limited to improving or implementing new risk models and other services and products for fraud mitigation.
- Third parties or internal systems used for recognizing and prevention of fraud
- Third parties or internal systems used for performance and SLA monitoring
- Authorities– such as the financial intelligence unit, the police or other authorities if required by law, in particular the Dutch Money Laundering and Terrorist Financing (Prevention) Act (‘Wwft’).
- As provided for in the Wwft: 5 years
- Exercising rights as a data subject
- NOTE: Identification of a Payer is only required in the case a transaction is recognised as unusual or suspect and if Nuvei shall report the transaction to the relevant authorities. The majority of payments processed does not require the identification of the Payer by Nuvei. Payers who wish to be enabled to exercise their rights to access, rectification or erasure shall provide all additional information substantially enabling Nuvei to identify the data subject – which may include that the data subject shall provide additional information which is only available at and shall be obtained by the data subject from the related Merchant, so specifying the information or processing activities to which the request relates. In respect of a Payer’s right to erasure, the following applies: Nuvei must store the personal data of payers as described above in compliance with the Wwft for a period of 5 years. Nuvei will not erase any personal data of a Payer before a period of 5 years has passed since the last transaction between Nuvei and the related Merchant was processed. Payers can send their queries in respect of the personal data to Globalservicesbv@nuvei.com and Nuvei may have to contact the relevant data subject in order to establish and verify the authenticity of any such request.
4) People visiting Nuvei’s website or otherwise contacting Nuvei
People who visit the Nuvei website may leave their name and email address, which we will only use for the purpose of responding to the queries so received. People who contact Nuvei by phone, will be asked to provide their name and phone number if they require – and consent to – Nuvei to contacting them later.
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.