Privacy Policy

PDF

Scope of this Privacy Notice

1.1. This Privacy Notice applies to each web page that starts with the url www.ibanfirst.com (“Site”), which is the property of and is managed by iBanFirst Group. When we say “we”, “our”, “us” or “iBanFirst” in this policy, we are referring to the companies that make up the iBanFirst Group. The companies that currently make up the iBanFirst Group are:

• iBanFirst SA, a payment institution established in Belgium and under the prudential supervision of the National Bank of Belgium, with registered office at 350 Avenue Louise, 1050 Brussels, Belgium and with company number 0849.872.824.
• iBanFirst Ltd, an authorised electronic money institution supervised by the Financial Conduct Authority with registered office at 6th Floor Dashwood House, 69 Old Broad Street, London, EC2M 1QS, United Kingdom and registered with Companies House under number 06260585.

1.2. iBanFirst acts as the controller for the processing of the personal data that we collect from you or that you provide to iBanFirst when you visit our Site (“Site User”), when you or your organisation uses our products and services, when you contact us to obtain information or to request a quote (by phone or on our Site), when you visit our premises, when we perform our business activities, when we contact you in relation to our products or services, or when you or your organisation provides a product or service to us.

1.3. We do our utmost to protect and process the personal data that are entrusted to us in a correct and transparent way, more particularly in accordance with the applicable law and especially with the General Data Protection Regulation 2016/679 of 27 April 2016 (the "EU GDPR") and the EU GDPR as incorporated into national law in the United Kingdom ("UK GPDR"), where applicable, (together referred to as the “GDPR”). We will protect such personal data by maintaining appropriate technical and organisational measures.

1.4. This Site may contain links to other websites. Although we try to only insert links to websites that share our own standards regarding data protection, we are neither responsible for the contents nor for the policy regarding data protection of those websites. This Privacy Notice only applies to data processed by iBanFirst. When you click on links on this Site, we strongly advise to read the privacy notice on the relevant websites first, before sharing any personal data.

1.5. If you provide us with the personal data of other individuals, you guarantee that the other individual was informed of this Privacy Notice, and that insofar as a certain processing requires the consent of the data subject, you have obtained the relevant consent from the data subject for this processing by us.

1.6. This Site may use cookies and/or other similar technologies. More information can be found in our Cookie Notice.

1. Personal data processed by iBanFirst

2.1. The personal data that we collect and process, can include the following elements:

2.2. We can obtain such personal data directly because you have given it to us (e.g. via a form on the Site, by contacting us), or indirectly because others have given them to us (for Site Users: through our use of cookies and similar technologies on the Site; for Suppliers, Customers and Prospects: from your organization or from third party service providers (e.g. through introducing brokers, sanctions screening tools, credit agencies,… ); through the purchase of a business or a business' assets; or for Customers: from certain information from social media) or because they are publicly available. We can also obtain your personal data through the way in which you interact with us.

3. Purpose of processing
3.1. The purposes of these processing activities and the corresponding legal bases are:

3.2. Insofar as we record phone calls with Customers, it should be noted that we record those phone calls for various purposes and based on different legal bases, as specified hereunder:

3.2.1 Europe

• Phone calls from our account managers and dealers will always be recorded. We record those phone calls for evidentiary purposes in the framework of a commercial transaction, as specified at the beginning of our commercial relationship. This processing is necessary for our legitimate interest to collect evidence regarding commercial transactions. These recordings are stored for 10 years as from the end of the contractual relationship.
• Phone calls between Customers and other iBanFirst personnel (e.g. sales or customer services) will only be recorded after you have been informed thereof prior to the start of the recording and upon obtaining your consent for the recording. The purpose of recording these phone calls is to enable us to provide internal trainings which help us to improve our services and customer experience, as well as any other specific purpose of which you might be informed prior to the start of the recording. These recordings are stored for a maximum period of 130 days as from the date of recording.

3.2.2 UK

• Phone calls from our account managers and dealers will always be recorded. We record those phone calls for evidentiary purposes in the framework of a commercial transaction, as specified at the beginning of our commercial relationship. This processing is necessary for our legitimate interest to collect evidence regarding commercial transactions. These recordings are stored for 6 years as from the end of the contractual relationship.
• Phone calls between Customers and other iBanFirst personnel (e.g. sales or customer services) will only be recorded after you have been informed thereof prior to the start of the recording and upon obtaining your consent for the recording. The purpose of recording these phone calls is to enable us to provide internal trainings which help us to improve our services and customer experience, as well as any other specific purpose of which you might be informed prior to the start of the recording. These recordings are stored for a maximum period of 130 days as from the date of recording.

3.3. In addition, if we use your information for purposes other than those mentioned above we will notify you of these purposes before using your information and obtain your consent (where necessary).

3.4. Unless otherwise indicated, the provision of personal data to iBanFirst is not a statutory or contractual requirement and you are not obliged to provide your personal data to us. If you decide not to provide your personal data, we might, in some instances, not be able to provide you with all features of the Site or a product or service. Completion of any forms or surveys is entirely voluntary, although you may be required to submit certain personal data to iBanFirst to allow us to adequately handle your inquiries or requests.

4. Disclosure of personal data to third parties
4.1. We may disclose some of your personal data to the following third parties who reasonably need access to those data in view of achieving one or several of the above-mentioned purposes to:

• external service suppliers, third party subcontractors or partners, to conduct verification of your identity as required under applicable law, within the framework of the execution of customer contracts to support the provision of iBanFirst products and services and/or the implementation of measures to abide by the GDPR (including but not limited to fighting against fraud, fighting against money laundering and terrorist financing), IT service providers, translation agencies, security companies, marketing agencies, etc.;
• law enforcement and public authorities, in the context of requests from law enforcement and competent authorities in accordance with the applicable legislation;
• potential or future buyers of iBanFirst (or any iBanFirst assets);
• external professional advisors (e.g. auditors, lawyers or consultants of iBanFirst
• any company of the iBanFirst group, i.e. our affiliates, our representative offices, our subsidiaries, our ultimate holding company and its subsidiaries.

4.2. Your personal data collected by iBanFirst may be stored and transferred outside the EEA/UK. Some third parties who receive your personal data may be located in a country outside the EEA/UK in which the legislation does not offer the same degree of data protection. We will ensure that your personal data is only transferred to parties that apply an appropriate level of data protection (e.g. for the EU GDPR where the European Commission has issued an adequacy decision or by including the so-called EU standard contractual clauses in the agreement with the recipient and subject to an appropriate data transfer impact assessment; for the UK GDPR where the UK Secretary of State has issued an adequacy regulation or by including the UK supervisory authority's international data transfer agreement or international data transfer addendum to the EU Standard contractual clauses in the agreement with the recipient and subject to an appropriate data transfer impact assessment). You can contact us to receive a copy of, or request information about, the appropriate safeguards or transfer mechanism that apply to the transfer of your personal data using the contact details in section 7.

5. Duration of processing

5.1. Your personal data is stored by iBanFirst only for the time necessary to achieve the above-mentioned purpose, taking into account the application of legal obligations, statutory limitation or retention periods (including in the context of the application of the EU Directive 2015/849 and or MLR 2019 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, as may be amended and/or repealed from time to time and its applicable transpositions, as well as any personal data required for iBanFirst to establish, exercise or defend legal claims).

5.2. In the event your personal data is collected based on your consent, we use it only for the period of time that your consent is given. As soon as your consent is withdrawn, your personal data are kept for the minimum period necessary for the fulfilment of the measures necessary for the implementation of your right.

5.3. For the retention periods applicable to phone call recordings with Customers, please refer to section 3.2 above.

5.4. The applicable storage period for personal data collected through cookies or similar technologies on this Site can be found in our Cookie Notice.

5.5. Camera footage is kept for maximum one month, unless we need to retain the footage for longer for example where it is required as evidence to prove a crime, damage or nuisance or to identify an offender, public disorder, witness or victim.

6.Your rights as a data subject
6.1. You have several rights regarding the personal data that we process. If the relevant conditions of the GDPR are met, you have the right::

1. 1. to withdraw your consent
      Insofar the processing activity is based on your consent, you have the right to withdraw your consent for such processing activity at any time. This withdrawal will however not affect the lawfulness of the processing of your personal data for the period prior to the time of this withdrawal and processing activities based on another legal basis
   2. to access your personal data
      You have the right to access to the personal data iBanFirst has about you, information on the processing of these personal data and to receive a copy thereof. You have the right to request all information we hold on you, this is known as a subject access request. If you wish to make a subject access request please contact us in writing, by telephone or by email using the contact details at the end of this privacy policy and we will supply you with our subject access form. Upon receipt of a completed form and one piece of ID (required to ensure we do not disclose your information to unauthorised access) we will deal with your request without undue delay or within one month, subject to an extension of up to a further two months, where required and permitted by applicable laws. This information will be free of charge unless your request is manifestly unfounded or excessive whereby a fee may be required prior to release of your information or we may refuse to comply with the request.
   3. to ask us to rectify, erase or restrict your personal data
      You are entitled to request us to rectify if you think it is incorrect or incomplete or to erase your personal data, in principle free of charge. You acknowledge that, in case of a request to erase your personal data, this is subject to certain exemptions and in the event of erasure certain services and products might not be available to you anymore. You may also request us to restrict the processing of your personal data, for example, when we check the accuracy of your personal data.
   4. to data portability
      The personal data that you provided to iBanFirst can be provided to you in a clear, structured, readable, and commonly used machine-readable format and can be transferred to a third party (insofar the processing is based on consent or the performance of an agreement).
   5. to of object to the processing of your personal data
      You may at any time object to the processing of your personal data by iBanFirst for direct marketing purposes. In other cases, you have a right to object on grounds relating to your particular situation (insofar the processing is based on legitimate or public interest).
   6. to lodge a complaint with a supervisory authority
      If you believe that iBanFirst did not act in accordance with the legislation concerning the processing of your personal data, you have the right to file a complaint with the competent supervisory authority of your place of habitual residence or work or where an alleged infringement took place

6.2. If you have questions about your data protection rights, or to exercise your rights or for any request for additional information, please write to privacy@ibanfirst.com

7. iBanFirst Contact details
If you have any questions regarding this Privacy Notice or this Site or you wish to exercise your data protection rights, you can contact us in the following ways:

• By e-mail: dpo@ibanfirst.com
• By post in EEA: IBANFIRST SA, att. Privacy and Legal department 1050 Brussels, 350 Avenue Louise.
• By post in the UK: iBanFirst Limited, att. Privacy and Legal department, 6th Floor Dashwood House, 69 Old Broad Street, London, EC2M 1QS .

8. Modifications to this Privacy Notice
We can modify this Privacy Notice at any time. In order to keep you informed of the latest modification of the Privacy Notice, we shall adapt the revision date on top of this page each time it is modified. The modified Privacy Notice shall enter into force as of that date.
Please consult this page regularly to keep informed of any modifications and/or additions.