In connection with the provision of the Open Banking Solutions, we obtain Personal Information relating to you from the various sources described below.

a. Personal Information provided by third parties

• Personal and/or Business Contact Information and Credentials: such as, name, user ID, email address and phone number.
• AIS User Account Information such as e-mail address and password and any other information that you may be able to add to your account, such as name or third-party services with whom you wish to share your Personal Information and/or PIS Account Information: information relating to the bank account(s) from which you would like to initiate a payment or to which you would like to receive a payment, such as bank account numbers or unique identifiers and bank card details.
• Authorizations that you grant us to manage your Personal Information (e.g., to access, retrieve and display your financial information or transaction information through our AIS, to update your AIS account based on recent transactions or to transfer financial information through our PIS to third party service providers of your choice).
• General Communication Information which we may receive when you contact us (e.g., via email, phone, or online web forms), such as your first and last name, telephone number, email address, physical address, as well as any other content that you provide. If you do not provide such information, we may not be able to answer your requests or queries.
• KYC/AML Information such as name, address, date of birth, account number, BIC and IBAN of account holders and beneficiaries, senior management, or authorized signatories, including copies of documents, if necessary.

b. Personal Information provided by third parties

• Financial Information: such as, information relating to a bank account (e.g., account name or reference, unique account reference ID), refund account details (account number, sort code and financial institution servicing the refund account), payment receipts, payment card details and billing address, and balance and transactions (only for our AIS solution).
• PIS Request Information: such as, payment initiation service requests, request reference number, and response status.
• Transaction Information: such as, account provider and account number, date / time of payment, payment recipient and data needed for communication with your account provider, information about disputed transactions, fraud-related information (e.g., failed logins).

c. Personal Information automatically obtained from your interaction with the Open Banking Solutions

• Device-related Information such as information which we obtain by automated means such as cookies, web beacons, and embedded scripts. This may include information from a web browser (such as browser type and browser language), an IP address, device identifier numbers, and the actions taken on a website (such as how a visitor interacts with the web pages and the links clicked, mouse location and keystroke timing). For detailed information about the use of cookies and similar technologies, please see the cookie notices and consent tools that are provided in our Open Banking Solutions.
• Logs of your use of the Open Banking Solutions, which comprise information on which user account is logged into or whether it concerns a one-time user, the IP-address used, the time and date, which action has been performed and device information, i.e., information on operating system, browser information and settings. Further, whenever a third-party service accesses the Open Banking Solutions, a similar log is created. We also monitor use of the Open Banking Solutions for fraud prevention and anomalies such as unusually high frequency of failed initiations, unusually high frequency of successful initiations, unusually high value of initiated payments or if payments are initiated from an unusual geographical location.

We may use Personal Information we obtain about you for the purposes set out below. Depending on the country in which you are located, we will only process your Personal Information when we have a legal basis for the processing as identified in the table below.

We may disclose Personal Information we collect about you to the following third parties, for the purposes described below:

a. Other permitted AIS users

When you use our AIS, you may allow other AIS users to access and view your Personal Information. If you choose to do this, you agree that we, to comply with our agreement with you, may disclose your Personal Information to the person that you have instructed us to allow access to your information concerned. You can revoke this access at any time in the Open Banking Solutions’ settings.

b. Financial institutions, business customers, partners and service providers acting on our behalf

To provide our Open Banking Solutions, we share the Personal Information we collect with financial institutions, business customers (where you instruct us to do so) and partners. For our PIS, this includes disclosing Transaction Information to a third-party provider to enable the payment transaction. For our AIS, this includes disclosing your Personal Information to your financial institution. In addition, we use service providers acting on our behalf, such as hosting and infrastructure providers, and providers of monitoring, security, and IT support services.

c. Public authorities

In some circumstances, we may share the Personal Information we collect with public authorities: (i) if we are required to do so by law or legal process, (ii) in response to a request from a court, law enforcement authorities, or government officials, or (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

d. Potential transactional partners

We may share the Personal Information we collect with potential transactional partners or other third parties in the event of a sale or transfer of our business or assets.

e. Mastercard Group

We share the Personal Information we collect with Aiia A/S in Denmark, that supports us in providing these services as well as with Mastercard’s headquarters in the U.S., and other entities within the Mastercard group of companies, for the purposes described in this Notice. Please see the “Data Transfers” section in the Global Privacy Notice [link] to understand how we comply with applicable cross-border data transfer rules.