MongoPay Terms and Conditions

Last update: August 23, 2022

Introduction

The purpose of this privacy policy (“Privacy Policy”) is to inform You about the processing activities performed on your Personal Data by MANGOPAY, as well as Your rights as a data subject under applicable national law, including the Data Protection Regulation (EU) 2016/679 of 27 April 2016, referred to as the “General Data Protection Regulation” or “GDPR”.

“Personal Data” means any information relating to an identified or identifiable individual. An identified or identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, an identification number, location data, etc.) or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social condition.

The entity processing your data, acting as data controller, is MANGOPAY S. A. (“MANGOPAY”), a public limited company incorporated under the laws of Luxembourg, having its registered office at 2 Avenue Amélie, L-1125 Luxembourg and registered with the Luxembourg Trade and Companies Register under number B173459, authorized to carry out payment and electronic money services, as an electronic money institution. MANGOPAY is licensed by the Commission de Surveillance du Secteur Financier du Luxembourg, 283 route d’Arlon L-1150 Luxembourg, www.cssf.lu.

MANGOPAY has appointed a data protection officer, a “DPO”. You can contact the DPO at the following email address: dpo.mangopay@mangopay.com.

Does this privacy policy affect you?

MANGOPAY provides payment and electronic money services through online platforms (websites or mobile applications) operated by its partners (“Partners”). These Partners operate platforms through which they conduct business, for example, online sales, marketplaces, crowdfunding intermediation (donations, crowdfunding) and have decided to integrate the MANGOPAY payment solution to process payments on their platforms. When you register with these Partners, you may also be asked to register for services provided by MANGOPAY, which will allow you to transfer funds or receive payments for transactions made on the Partner’s platform. To provide these payment services, MANGOPAY is required to process your Personal Data.

By “You” we mean:

Persons who have registered for MANGOPAY services in their capacity as a natural person;
Natural persons related to a legal entity that has registered for MANGOPAY services (e.g. legal representative, beneficial owner, etc.);
Natural persons linked to a Partner;
Individuals who have made a payment on a Partner’s platform using a MANGOPAY payment page;
Users of the MANGOPAY website (https://www.mangopay.com/fr/) and blog (https://blog.mangopay.com/fr).

What Personal Data is processed by MANGOPAY? How is it collected?

If You have registered for MANGOPAY services through a Partner

When You register for MANGOPAY services through a Partner, You agree that the Personal Data strictly necessary for the provision of the services will be processed by MANGOPAY. The categories of Personal Data processed mainly concern identification data, for example, your first and last name, date of birth, nationality, country of residence, e-mail address. You may also be asked to provide, if necessary, an official identification document or any additional document that we deem necessary to comply with our legal obligations regarding the fight against money laundering and terrorist financing (“AML/CFT”).

Your Personal Data is collected directly from your personal online space on the Partner’s platform through MANGOPAY’s API (technical infrastructure processing payments). Because MANGOPAY, as a regulated entity, is subject to strict legal obligations, it is mandatory that You provide Your Personal Data in order to register for MANGOPAY services. The required Personal Data is prominently displayed on the collection forms posted on the Partner’s platform. Refusal to provide the required Personal Data may result in the refusal or suspension of MANGOPAY services. Throughout the course of the contractual relationship between You and MANGOPAY, MANGOPAY will process additional Personal Data generated by Your use of MANGOPAY’s services. This additional Personal Data includes, but is not limited to, transactional data, bank account data (when payments to your external bank account are executed by MANGOPAY), or any correspondence with MANGOPAY’s support team.

Your Personal Data may also be processed for statistical purposes to improve the quality of MANGOPAY’s services.

If You make a payment on a MANGOPAY payment page

When You make a payment by card or using a payment method (“CDM”) on a Partner’s platform, it is necessary for You to provide certain Personal Data, namely your first and last name, card number, as well as the card’s cryptogram and expiration date. Additional Personal Data, such as transactional data, is generated when the payment order is executed.

If You are a user of the MANGOPAY website or blog

If You browse the MANGOPAY website or blog, your Personal Information is collected through the use of cookies. This Personal Information may include your web browser preferences and settings, the type of device you are using and the interaction you have with the content displayed. For more information on the purposes for which cookies are used on the MANGOPAY site, please click here.

If You contact the MANGOPAY support team

Whenever You contact MANGOPAY’s support team for assistance, Your Personal Data will be processed to handle Your requests. The Personal Information processed is generally limited to identifying information such as your first and last name, e-mail address and telephone number, but may also include Personal Information related to the use of MANGOPAY’s services, depending on the purpose of your request and the actions taken by MANGOPAY’s support team to respond to it. The MANGOPAY support team may also record your telephone conversations in order to ensure and improve the quality of the services. These recordings are subject to a strict retention period of six months.

If You are acting as a representative of a Partner

MANGOPAY HUB and Dashboard Interface

In order to track payment transactions made through their platforms, MANGOPAY Partners have access to the Dashboard interface. This infrastructure is designed to provide Partners with a degree of oversight and control over the payment flow on their platforms. When a Partner encounters a problem that requires MANGOPAY’s intervention, they can send a request to the MANGOPAY support team directly through the MANGOPAY HUB. In order to provide You with access to MANGOPAY’s internal HUB and Dashboard interfaces, MANGOPAY must process your Personal Data. The Personal Data required is limited to identifying information (such as your first and last name and email address). Personal Data is also generated from your use of MANGOPAY’s interfaces (e.g., logs, page views, etc.) in order to provide you with a seamless experience by displaying contextual information and to troubleshoot any technical problems.

Training \mathrm{LBC / \mathrm{FT

In order to provide You with a thorough understanding of our business, You may be required to complete a short online AML/CFT training course provided by one of MANGOPAY’s service providers. In order to give You access to the learning module, Your identification data will be processed, as well as some additional data in order to be able to follow Your progress throughout the training.

If You subscribe to the MANGOPAY newsletter

If You decide to subscribe to the MANGOPAY newsletter, your Personal Data will be processed in order to provide you with the latest news about MANGOPAY. For the purpose of managing your subscription, the Personal Data processed is limited to your email address. You have the right to revoke your consent and subscription at any time, either by submitting a request to dpo.mangopay@mangopay.com or by clicking on the “unsubscribe” link displayed in each newsletter.

On what legal basis and for what purposes are your Personal Data processed?

Your Personal Data is processed by MANGOPAY:

To fulfill contractual obligations: the processing of your Personal Data is necessary for the performance of contractual obligations that MANGOPAY has towards You, as well as to take action, at Your request, before entering into a contract. This legal basis is used for certain processing activities, including:
Enrollment in services (payment or electronic money services)
Execution of payment transactions;
Customer relationship management (such as providing transaction records);
Handling your questions or possible complaints;
Processing card payments (when You make a card payment on a Partner’s platform).
On the basis of MANGOPAY’s legitimate interests: the processing of your Personal Data may be based on MANGOPAY’s legitimate interests necessary for its activities as a payment service provider. This is true for certain processing activities, including:
Fighting fraud;
Improving the quality of MANGOPAY’s services;
Maintaining the security of the MANGOPAY API and services in general.
Based on its legal obligations: as a regulated entity, MANGOPAY is subject to strict legal obligations that require it to carry out specific data processing for the following purposes:
To comply with the legal and regulatory obligations imposed on it in its capacity as a payment service provider, and in particular for the fight against money laundering and the financing of terrorism;
To cooperate with the competent authorities in charge of law enforcement or prudential supervision, in case of control or investigation.
On the basis of your consent: the processing of your Personal Data may be subject to your consent. Your consent is required for certain processing activities, including:
quad$ The use of certain cookies;

How long will your Personal Information be retained?

MANGOPAY will retain your Personal Data for no longer than is necessary to fulfill the purpose of the processing.

If You have registered for MANGOPAY’s services through one of its Partners, your Personal Data will be retained for the duration of the contractual relationship. When You stop using the services, all of Your Personal Data will be permanently deleted, except for Personal Data that must be retained by MANGOPAY for legal reasons. The following data retention periods apply:

In accordance with MANGOPAY’s legal obligations to combat money laundering and terrorist financing, any transaction information and documentation and information provided as part of MANGOPAY’s “Know-Your-Customer” (“KYC”) procedure will be retained for up to ten (10) years, starting from the end of the contractual relationship.
In accordance with applicable law, data necessary for the processing of any disputes or litigation and communications with the MANGOPAY support team will be retained for five (5) years. Audio recordings for quality control purposes will only be kept for a period of six (6) months.

Personal Data generated through the use of cookies by MANGOPAY is subject to specific retention periods which are specified here.

Where is Personal Information stored?

The servers used by MANGOPAY to store your Personal Data are located in Luxembourg.

In addition, MANGOPAY may transfer your Personal Data to its subcontractors whose services are necessary to perform MANGOPAY’s services. Some of these subcontractors process your Personal Data outside the territory of the European Union or the European Economic Area. In this case, MANGOPAY ensures that the country in which your Personal Data is processed is covered by an adequacy decision of the European Commission. Failing that, MANGOPAY ensures that appropriate safeguards are in place such as the Standard Contractual Clauses (“SCC”) adopted by the European Commission and any additional appropriate measures, if any.

Who are the recipients of the Personal Data? Is it transferred to third parties?

Authorized MANGOPAY personnel

Only MANGOPAY employees who are specifically authorized and have a need to know may access your Personal Information in order to perform their duties. MANGOPAY employees who have access to your Personal Information are subject to strict confidentiality obligations and professional secrecy and have been trained in the protection of personal information.

Competent Authorities

MANGOPAY may transfer Personal Data to competent authorities, such as public authorities, anti-money laundering and anti-terrorist financing agencies, or banking supervisory authorities. Prior to any disclosure of Personal Data, each request from an authority involving your Personal Data will be analyzed by MANGOPAY’s legal department to assess whether the authority qualifies as an authorized recipient.

MANGOPAY’s subcontractors

MANGOPAY uses certain service providers to carry out its activities as a payment service provider and to provide the services You have requested (e.g., hosting a computer system, credit institutions for the protection of funds or the performance of payment transactions, etc.). In order to carry out their services, certain service providers may process your Personal Information on behalf of MANGOPAY. These processors process your Personal Data only on the instructions of MANGOPAY and exclusively for the purpose of providing their services to MANGOPAY. Unless you expressly agree, subcontractors are not permitted to use your Personal Data for their own purposes.

MANGOPAY’s third-party service providers are carefully selected and are subject to strict contractual obligations, which include obligations to ensure an appropriate level of security, confidentiality obligations and obligations to implement appropriate technical and organizational measures, etc. By sending a request to MANGOPAY (dpo.mangopay@mangopay.com), you can obtain a detailed list of the subcontractors involved in the processing of your Personal Data.

What are your rights regarding your Personal Data?

Right of access

You have the right to access your Personal Data. If You exercise this right, MANGOPAY will send You a copy of the characteristics of the processing of your Personal Data (the purposes of the processing, the categories of data concerned, etc.). This information will be provided to You in a commonly used electronic format. However, You may request that this information be provided to You in another format, provided that MANGOPAY is technically able to provide You with the information in the format requested based on the means available or the particulars of the request in question.

You are advised that MANGOPAY may require payment of a fee based on the administrative costs incurred, if You request additional copies.

Right of Correction

If your Personal Data is inaccurate or incomplete, You have the right to request that such Personal Data be corrected or updated.

Right to erasure (“Right to be forgotten”)

In accordance with applicable regulations, You may request the erasure of Your Personal Data if any of the following conditions apply:

Your Personal Data is no longer necessary for the purposes for which it was collected or processed;
Your Personal Data has been processed unlawfully;
Your Personal Data has been collected solely on the basis of your consent and you wish to withdraw it;
Due to your particular circumstances, you object to the processing of your Personal Data based on MANGOPAY’s legitimate interests, including profiling, and there are no overriding legitimate grounds for the processing ;
You object to the processing of your Personal Data for direct marketing purposes;
Your Personal Data must be deleted to comply with a legal obligation under applicable law.

Please note that your request for deletion of your Personal Data will be denied if the processing is necessary to exercise the right to freedom of expression and information, to exercise or defend legal claims, or to comply with a legal obligation to which MANGOPAY is subject.

Right to limit data processing

You have the right to request the restriction of the processing of your Personal Data in one of the following cases: - If You dispute the accuracy of Your Personal Data. If the processing of your Personal Data is restricted on this ground, it will only be processed with your consent;

If the processing is unlawful and You wish to have the processing of Your Personal Data restricted in lieu of erasure of Your Personal Data;
If MANGOPAY no longer needs your Personal Data but it is still necessary for the establishment or defense of legal claims;
If You have objected to the processing of Your Personal Data based on MANGOPAY’s legitimate interests in Your particular circumstances, the processing of Your Personal Data will be restricted until it has been established whether or not MANGOPAY’s legitimate reasons override Yours.

If the processing of your Personal Data has been restricted, MANGOPAY will inform you before the restriction is lifted.

Right to object to the processing of Personal Data

If You have a special situation, You may object to the processing of Your Personal Data based on MANGOPAY’s legitimate interests. Unless MANGOPAY demonstrates compelling legitimate grounds for the processing that override your rights, freedoms and interests, or if the processing is necessary for the establishment, exercise or defense of legal claims, your Personal Data will no longer be processed.

You also have the right to object to the processing of your Personal Data for direct marketing purposes without providing any grounds for objection.

If your Personal Data is processed by MANGOPAY for statistical purposes, You have the right to object to the processing on grounds relating to your particular situation. If You object on this basis, Your Personal Data will no longer be processed for this purpose, unless the processing is necessary for the performance of a task performed for reasons of public interest.

Right to Data Portability

You have the right to receive the Personal Data that you have transmitted to MANGOPAY if the processing of your Personal Data is based on your consent or on a contract between You and MANGOPAY, and is carried out by automated means. Your Personal Data will be transferred in a structured, currently used and computer-readable format. You also have the right to request that your Personal Data be transferred directly to another controller, where technically possible. In the event that the processing of your Personal Data is necessary for the performance of a task carried out in the public interest, your request will be refused.

How to exercise your rights?

You may exercise your rights by contacting either the MANGOPAY Partner or MANGOPAY directly at dpo.mangopay@mangopay.com… You can also send your request by mail to the following address MANGOPAY S. A., 2 Avenue Amélie, L-1125 Luxembourg.

For any request to exercise your rights where there is reasonable doubt as to your identity, MANGOPAY may request that your identity be verified before processing your request.

Responses to your requests will be communicated to you electronically, unless You request that they be communicated otherwise. In this case, you must specify the preferred format in your request.

MANGOPAY will respond to any request immediately. In all cases, You will receive a response within a maximum of one month (30 days) from the receipt of your request. However, we inform You that this period may be extended to two (2) months if your request is particularly complex, or if the number of requests to be processed is particularly large. In this case, You will be informed of such an extension and the reasons for it within one month (30 days) of receipt of your request.

If MANGOPAY is unable to fulfill your request, You will be informed within one month (30 days) of receipt of your request. You will be informed of the reasons for MANGOPAY’s refusal.

In the event of manifestly unfounded or excessive requests, in particular because of their repetitive nature, MANGOPAY may refuse to respond to your requests or require payment of a fee taking into account the administrative costs incurred in responding to your requests.

How is your Personal Information secured?

MANGOPAY implements appropriate technical and organizational measures to ensure the confidentiality and integrity of your Personal Data, and in particular to prevent its destruction, loss, alteration, unauthorized disclosure or unauthorized access. These security measures include encryption, pseudonymization, and the implementation of measures to ensure the constant availability and resilience of MANGOPAY’s IT infrastructure.

MANGOPAY

If applicable, any security breach qualified as a breach of Personal Data involving high risks to your rights and freedoms will be notified to You as soon as possible by MANGOPAY or by the MANGOPAY Partner with whom You have a business relationship.

What is the relationship between MANGOPAY and its Partners for the processing of your Personal Data?

If You have registered for MANGOPAY services or make a payment on a MANGOPAY payment page, MANGOPAY and the relevant Partner act as joint processors of your Personal Data. It is therefore the responsibility of the Partner and MANGOPAY to process your Personal Data for the following activities in compliance with applicable regulations:

The registration and use of services (payment services or electronic money services);
Management of customer relations (such as the provision of transaction records);
Handling your questions and possible complaints;
In order to comply with legal and regulatory obligations regarding the fight against money laundering and the financing of terrorism.

This joint responsibility is contractually established between each Partner and MANGOPAY through a joint responsibility agreement. If You wish to exercise any of Your rights as a data subject, You may first contact the Partner with whom You are dealing directly by following the procedure on the Partner’s platform. MANGOPAY cooperates with each Partner to ensure the protection of your Personal Data. In addition, MANGOPAY cooperates with each Partner to ensure the highest level of security of your Personal Data and to respond as efficiently as possible to all your requests.

Contacting MANGOPAY’s supervisory authority

If you consider that your rights regarding the processing of your Personal Data have been violated, you have the right to file a complaint with the National Commission for Data Protection or to contact it directly at any time.

Modification de la Politique de confidentialité

Veuillez noter que cette Politique de confidentialité peut être mise à jour ou modifiée à tout moment. La dernière version sera celle disponible sur le site de MANGOPAY. Vous trouverez une indication de la date de la dernière mise à jour sur la première page.