Privacy

Last update: 28/10/2022

To download the Confidentiality Policy in PDF format, click here.


1. Introduction

This privacy policy (“Privacy Policy”) is intended to inform You about the processing activities carried out on your Personal Data by MANGOPAY, as well as your rights as data subject under applicable national legislation, including under Regulation (EU) 2016/679 of 27 April 2016 regarding the protection of data, referred to as the “General Data Protection Regulation” or “GDPR”.

Personal Data” means any information that relates to an identified or identifiable individual. An identified or identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier (e.g. name, identification number, location data…) or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.

The entity processing your data, acting as data controller, is MANGOPAY S.A (“MANGOPAY”), a société anonyme (limited liability company) governed by Luxembourg law, the registered office of which is located at 2 Avenue Amélie, L-1125 Luxembourg and registered in the Luxembourg Business and Companies Registry under number B173459, authorised to exercise payment and electronic money services, in the capacity of an electronic money institution. MANGOPAY is authorised by the Luxembourg Commission de Surveillance du Secteur Financier, 283 route d’Arlon L-1150 Luxembourg, www.cssf.lu.

MANGOPAY has designated a data protection officer, a “DPO”. You may contact the latter at the following email address: dpo.mangopay@mangopay.com.

2. Does this Privacy Policy affect You?

You are affected by this Privacy Policy if your personal data is processed by MANGOPAY in order to carry out its commercial prospecting operations.

By “You”, we refer to:
• Physical persons being contacted by MANGOPAY as part of its prospecting activities.

3. What Personal Data is processed by MANGOPAY? How is it collected?

3.1. If You have submitted a contact form via MANGOPAY’s website

In order to explore MANGOPAY’s services and product, You have the possibility to fill-in and submit a contact form which will be processed by our Sales department. Upon receipt, an expert will proceed with establishing a first contact in order to assist you and provide you all necessary information. 
By submitting the form, you consent that certain categories of personal data be processed by MANGOPAY in order to establish contact and evaluate the opportunity. The categories of Personal Data processed mainly pertain to identification data, for example, your first and last name, email address, phone number (optional), company’s name, country of establishment. You are also required to provide information about your project and your availability by way of a free-text field.

3.2. If You are contacted directly by MANGOPAY’s Sales Department

You might also be directly contacted by MANGOPAY’s Sales department as part of their usual prospecting activities. As part of these prospecting operations, your personal data is collected and processed usually through online networking softwares. It may also be the case that your personal data has been collected during or following a commercial event to which You and MANGOPAY participated. The personal data collected and processed will generally be limited to identification data such as your first and last name, email address, phone number, as well as professional data such as your job position and your company’s name.

3.3. If You are in contact with one of MANGOPAY’s Partners

MANGOPAY’s services may be promoted by marketplace software solutions providers with whom MANGOPAY has partnered (“Partners”). If You are in contact with one of MANGOPAY’s Partners to make use of their software solution and You are interested in MANGOPAY’s services, the Partner may communicate your Personal Data to MANGOPAY. In such cases, one of MANGOPAY Sales’ agents will contact You to evaluate whether MANGOPAY’s services are suitable to your needs.

4. On which legal basis and for which purposes is your Personal Data processed?

Your Personal Data is processed by MANGOPAY:

On the basis of your consent: The processing of your Personal Data might be subject to your consent. Your consent is required for certain processing activities, including:

• To collect your personal data required in the contact form displayed on MANGOPAY’s commercial website.

On the basis of MANGOPAY’s legitimate interests: The processing of your Personal Data might be based on MANGOPAY’s legitimate interests. This is especially true when MANGOPAY’s services are directly related to your profession.

5. How long is your Personal Data kept?

MANGOPAY will retain your Personal Data for no longer than is necessary to achieve the purpose of the processing activity.

For processing activities based on your consent, your personal data will be effectively deleted as soon as You withdraw your consent or oppose the processing of your personal data. In order to withdraw your consent or express your opposition, please follow the instructions under section “9. How to exercise your rights?”. If the processing activity is based on MANGOPAY’s legitimate interest, your personal data will be retained for up to three years following MANGOPAY’s last contact with You.

6. Where is Personal Data stored?

The servers used by MANGOPAY to store your Personal Data are located in Luxembourg.

Furthermore, MANGOPAY might transfer your Personal Data to its processors whose services are necessary for carrying out MANGOPAY’s services. Some of these processors process your Personal Data outside of the territory of the European Union/European Economic Area. In this case, MANGOPAY ensures that the country in which your Personal Data is processed is covered by a European Commission adequacy decision. Otherwise, MANGOPAY ensures the implementation of appropriate safeguards such as Standard Contractual Clauses (“SCC”) adopted by the European Commission and any supplementary measures, if necessary.

7. Who are the recipients of Personal Data? Is it transferred to third parties?

7.1 Authorised MANGOPAY personnel

Only MANGOPAY personnel that are specifically authorised and have a need-to-know may access your Personal Data, for the purpose of carrying out their missions. MANGOPAY employees having access to your Personal Data are subject to strict confidentiality obligations, as well as professional secrecy, and have been trained on data protection.

7.2 Competent authorities

MANGOPAY may be required to transfer Personal Data to the competent authorities, such as public authorities, organisations for the fight against money laundering and the financing of terrorism, or the authorities for MANGOPAY’s oversight. Before any disclosure of Personal Data, each request from an authority involving your Personal Data will be analysed by MANGOPAY’s legal department to assess whether the authority qualifies as an authorised recipient.

7.3 MANGOPAY’s processors

MANGOPAY makes use of certain service providers to carry out its prospecting activities. To carry out their services, some providers are required to process your Personal Data on behalf of MANGOPAY. These processors process your Personal Data only on MANGOPAY’s instructions and exclusively for the purpose of providing the services to MANGOPAY. Barring express agreement on your part, the subcontractors are not authorised to use your Personal Data for their own behalf.
MANGOPAY’s third party service providers are carefully selected and are subject to strict contractual obligations, including obligations to ensure an appropriate level of security, confidentiality obligations and obligations to implement appropriate technical and organizational measures, etc.. By sending a request to MANGOPAY (dpo.mangopay@mangopay.com), you may obtain a detailed list of the processors involved in the processing of your Personal Data.

7.4 MANGOPAY’s Partners

If You are interested in one of MANGOPAY’s Partners’ marketplace software solutions and would like to know more about the offer, MANGOPAY may transfer your Personal Data to the Partner in question.

8. What are your rights concerning your Personal Data?

8.1 Right of access

You have the right to access your Personal Data. If You exercise this right, MANGOPAY will send You a copy of the characteristics of the processing of your Personal Data (the purposes of data processing, the categories of Data in question, etc.). This information will be provided to You in a currently used electronic format. However, You have the possibility of requesting that this information be provided to You in another format, provided that MANGOPAY is technically capable of providing You the information in the format requested based on available means and/or on the particularities of the request at hand.
You are informed that MANGOPAY may require the payment of fees based on the administrative costs incurred, should You request additional copies.

8.2 Right of rectification

If your Personal Data is inaccurate or incomplete, You have the right to request this Personal Data to be rectified or updated.

8.3 Right to erasure (“Right to be forgotten”)

In compliance with applicable regulations, You may request erasure of your Personal Data if one of the following conditions applies:

• Your Personal Data is no longer necessary for the purposes for which it has been collected or processed;
• Your Personal Data has been subject to illegal processing;
• Your Personal Data has been collected solely on the basis of your consent and You would like to withdraw it;
• Based on your particular situation, You object to the processing of your Personal Data that is based on MANGOPAY’s legitimate interests, including profiling, and there are no overriding legitimate grounds for the processing;
• You object to the processing of your Personal Data for direct marketing purposes;
• Your Personal Data must be erased to comply with a legal obligation under applicable law.
Please do note that your request for deletion of your Personal Data will be refused when processing is necessary to exercise the right of the freedom of expression and information, for the exercise or defense of legal claims, or for complying with a legal obligation to which MANGOPAY is subject.

8.4 Right to restrict data processing

Provided certain conditions apply, You have the right to request the processing of your Personal Data to be restricted. In such cases, the processing of your personal data will be restricted. You will be informed before the restriction is lifted.

8.5 Right to object to data processing

You have the right to oppose any commercial prospection by post, telephone or electronic means, including profiling in so far as it is linked to such prospecting. You do not have a need to demonstrate grounds for objecting.
In the specific case of prospecting by electronic means, it is possible at any time for You to oppose such prospection by clicking on the link in the e-mail received. It is also possible to oppose any prospection by responding “stop” to the e-mail received. If You object to the processing of your personal data, You will be effectively removed from MANGOPAY’s prospecting database.

9. How to exercise your rights?

You may exercise your rights by contacting MANGOPAY at the following email address: dpo.mangopay@mangopay.com. You may also send your request via post to the following address: MANGOPAY S.A., 2 Avenue Amélie, L-1125 Luxembourg.

For any exercise of rights requests demonstrating a reasonable doubt on your identity, MANGOPAY may request that You verify your identity before addressing your request.

Responses to your requests will be communicated to You electronically, unless You request they be otherwise communicated. In this case, You must specify the preferred format in your request.

MANGOPAY undertakes to respond to all requests immediately. In any case, You will receive a response in a maximum time frame of one month (30 days) from the receipt of your request. However, we inform You that this time frame may be extended to two (2) months if your request is particularly complex or if the number of requests to be handled is particularly important. In this case, You will be informed of such an extension and the reasons thereof within one month (30 days) from the receipt of your request.

If MANGOPAY is not able to execute your request, You will be informed at the latest in a time frame of one month (30 days) from the receipt of your request. The reasons for MANGOPAY’s refusal will be provided.

You are informed that in the event of manifestly unfounded or excessive requests, specifically in terms of their repetitive nature, MANGOPAY may refuse to respond to your requests or require that fees be paid that take into account the administrative costs borne by responding to your requests.

10. How is your Personal Data secured?

MANGOPAY implements appropriate technical and organizational measures in order to ensure the confidentiality and integrity of your Personal Data, and specifically, to prevent its destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These security measures include encryption, pseudonymisation, as well as implementing measures that ensure the availability and constant resiliency of MANGOPAY’s IT infrastructure.

If applicable, any breach of security qualifying as a breach of Personal Data carrying high risks to your rights and freedoms will be notified to You as soon as possible by MANGOPAY.

11. Contacting MANGOPAY’s supervisory authority

If you consider that your rights have been infringed as a result of the processing of your Personal Data, you have the right to lodge a complaint with or directly contact the Commission nationale pour la protection des données at any time.

12. Modification of the Privacy Policy

Please note that this Privacy Policy may be updated or modified at any time. The last version will be the one available on MANGOPAY’s website. You will find an indication of the last update on the first page.