Privacy Policy

The content of this Privacy Policy is for information purposes only. In case of dispute, only the French version of this policy is legally binding.

Our Privacy Policy includes your consent to the collection, use, retention and disclosure of personal information, as well as other stated matters, which describe how and for what purposes we collect, use, store, disclose and protect the data you provide to us.

Personal data

With regard to personal data processed on your behalf in accordance with this Agreement, all parties agree you are responsible for the control of such data, while iBanFirst is responsible only for its processing. We will treat personal data in accordance with this Agreement and the instructions you reasonably give us from time to time. We will protect such personal data by employing appropriate technical and organisational measures. As the controller of data, iBanFirst may assign third parties to process personal data, provided that such third parties are subject to the same obligations as those imposed on iBanFirst with regard to data processing.

You acknowledge that iBanFirst relies on you with regard to the extent to which we are entitled to use and process the personal data you provide to us. Accordingly, we shall not be liable for any claims by any data subject arising from any action or omission by us, to the extent that such action or omission is the result of your instructions.

Purpose of the processing

Through the provision of iBanFirst services, our contact forms, exchanges and various documents, iBanFirst may collect personal data concerning you. The purpose of these activities is:

• The performance of the Client Contract in connection with the provision of iBanFirst services, or the taking of pre-contract measures
• Compliance with the Regulation
• iBanFirst's legitimate interests (preservation measures, fight against fraud, security, etc.)
• Improving iBanFirst’s services
• Commercial prospecting and marketing use.

Recipient of the data

BanFirst (including the parent company and its branches/subsidiaries) is the recipient of your personal data. Your personal data, whether in individual or aggregate form, is never transmitted to a third party, notwithstanding the cases listed above and below. Neither iBanFirst nor any of its third-party subcontractors can market the personal data of visitors and Users to the iBanFirst website/applications. iBanFirst selects its third-party subcontractors and ensures that processing methods are compatible with the application of the Regulation and its applicable transpositions.

Some of your personal data may be communicated in the following cases:

• To suppliers, third party subcontractors, partners within the framework of the execution of Client Contracts to support the provision of iBanFirst services and/or the implementation of measures to abide by the Regulation (including but not limited to fighting against fraud, fighting against money laundering and terrorist financing, etc.)
• As part of the application of our Terms and Conditions (T&C)
• For iBanFirst's legitimate interests (preservation measures, fight against fraud, security, etc.)
• In the context of requests from competent authorities
• For the purchase/sale of iBanFirst assets.

Shelf life : storing your data

Your personal data are kept by iBanFirst only for the time corresponding to the purpose of collection, excluding the application of regulatory retention periods (including in the context of the application of the EU Directive 2015/849 and its applicable transpositions).

In the event your data is collected based on your consent, we use it only for the period of time that your consent is given. As soon as your consent is withdrawn, your data are kept for the minimum period necessary for the fulfilment of the measures necessary for the implementation of your right

When your data are used to provide you with iBanFirst services, they are kept for a reasonable period limited to the fulfilment of the objective pursued, including for the minimum period necessary for the fulfilment of the measures required for the implementation of your rights.

Place of storage

Your personal data collected from iBanFirst may be stored and transferred outside the European Economic Area (“EEA”), in particular for the purpose of communicating personal data (see “Data recipients”).

iBanFirst servers are located in the European Economic Area (EEA).

Security measures

The security measures linked to your data are detailed in our Terms and Conditions (T&C)

Right of access and communication of data

You have the right to free access to the data iBanFirst has about you.

Right to portability

The data we have about you can be communicated to you in a clear, readable, and commonly used format.

Right of opposition

You may at any time object to the processing of data concerning you. The exercise of this right is only possible in one of the following two situations:

• Where the exercise of this right is based on legitimate reasons, or
• When the exercise of this right is intended to prevent the data collected from being used for commercial prospecting purposes.

Enforcing your rights

To assert your rights or for any request for additional information, please write to privacy@ibanfirst.com.

Response time

IBANFIRST undertakes to respond to your request for access, rectification or opposition or any other additional request for information within a reasonable period which shall not exceed 1 month from the date of receipt of your request.

Right to lodge a complaint with a supervisory authority

You have the right to contact the control authority in your designated country that is responsible for receiving complaints concerning the processing of your data, operated by iBanFirst.