Who is responsible for processing your data and how to contact us

This notice (“Notice”) describes the steps AllSecure Global (“we” or “us”) takes to protect the personal data that we process about merchants (our customers) and other business related personal data. AllSecure Global is committed to the protection of the personal data that we process about you in line with the data protection principles set out in the European Union’s (“EU”) General Data Protection Regulation 2016/679 (“GDPR”). The controller in respect of your personal data is AllSecure Global d.o.o., Dunajska cesta 136, 1000 Ljubljana, Slovenia. You can contact us using the following email address: [email protected].

What personal data we collect and why

We may source, use and otherwise process your personal data in different ways. In all cases we are committed to protecting the personal data that we process. In each of the sections listed below, we describe how we obtain your personal data and how we will treat it.

Representatives of our Existing or Prospective Merchants and Vendors

Sources of personal data

We may obtain your personal data from the following sources:

1. from you directly,
2. from a company that employs you, if you are an employee of our merchants,
3. from affiliates of AllSecure Global;
4. during networking events that we have either hosted, or sponsored, or attended; and/or
5. from publicly available sources (for example, your company website or social media sites and company registrars)

Personal data that we collect and process

We may collect the following categories of personal data relating to employees, officers, authorised signatories and other associated individuals of our merchants and vendors. This may include:

• name;
• business address;
• business email address;
• business telephone
• number;
• job title

For the purposes of anti-money laundering requirements, we may also collect the following:

• name;
• date of birth;
• address;
• information from utility bills;
• copies of passports;
• copies of driving licences;
• nationality;
• bank details (account numbers, sort codes);
• police contact certificate (occasionally).

Why do we collect your personal data and what are our lawful bases for it?

We may use your personal data to:

• Provide you with our products or services or receive products or services from you
• Establish and manage our relationship
• Learn about how our products and services are or may be used
• Manage security
• Let you know about our products, services and events that may be of interest to you by letter, telephone, email or other forms of electronic communication
• Anti-money laundering and sanctions lists

Our legitimate interests in doing so are:

• Efficiently fulfil our contractual and legal obligations
• Management reporting (including at an intra-group level)
• Efficiently fulfil our contractual and legal obligations
• Account Management Exercise or defend legal claims
• Understand the market in which we operate
• Management reporting (including at an intra-group level)
• Understand the market in which we operate
• Management reporting (including at an intra-group level)
• Managing security, risk and crime prevention, including anti-money laundering
• Management reporting (including at an intra-group level)
• Promote our products and services
• Management reporting (including at an intra-group level)
• Managing risk, prevention of crime and anti- money laundering

If you object to us using your contact details for these purposes, including direct marketing, please send an email to us using the following email address: [email protected].

Website Visitors

Sources of personal data

We may obtain your personal data from the following sources:

1. from you directly (for example, by filling in forms on the website)
2. when you register to use the website;
3. subscribe to any of our services;
4. request further information via the website
5. when you report a problem with the website;
6. from your device or browser; and/or
7. if you contact us, we may keep a record of that

Personal data that we collect and process 

1. name;
2. username;
3. email address;
4. phone number;
5. postal address;
6. bank details;
7. job title;
8. operating system;
9. browser type;
10. login information;
11. full Uniform Resource Locators (URL);
12. products or services you viewed or searched for;
13. other website data, including page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page;
14. cookie data (for more information please see our Cookie Notice
15. preferences regarding online marketing; and/or
16. IP

Why do we collect your personal data and what are our lawful bases for it? 

We may use your personal data to:

• Provide our website services to you
• Establish and manage our relationship
• Learn about our websites(s) users’ browsing patterns and the performance of our website(s)
• Manage security
• Let you know about our products, services and events that may be of interest to you by letter, telephone, email or other forms of electronic communication
• Learn about how our products or services may be used

Our legitimate interests in doing so are:

• Website management
• Promote our products and services Account management
• Notifying you of any changes to our products and services
• Provide you with password reminders
• Notify you that a particular service has been suspended for maintenance
• Understand the market in which we operate
• Management reporting (including at an intra-group level)
• Account management
• Make suggestions and recommendations to you about products or services that may interest you
• Website management, including troubleshooting, data analysis, testing, research, statistical and survey purposes
• Managing security, risk and crime prevention
• Management reporting (including at an intra-group level)
• Promote our products and services
• Management reporting (including at an intra-group level)
• Make suggestions and recommendations to you about products or services that may interest you
• Understand the market in which we operate
• Management reporting (including at an intra-group level)

If you object to us using your personal data for these purposes, including direct marketing, please send an email to us using the following email address: [email protected]

Who do we share your personal data with

We do not sell your personal data to third parties.

Affiliates

We may share your personal data with our affiliates, by which we mean a person or entity that directly or indirectly controls, is controlled by, or is under common control with AllSecure Global. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

Our Service Providers

We may disclose information about you to organisations that provide a service to us, on the understanding that they will keep the information confidential and will comply with the GDPR and other relevant data protection laws.

We may share your information with the following types of service providers:

1. technical support providers who assist with our website and IT infrastructure;
2. third party software providers, including ‘software as a service’ solution providers, where the provider hosts the relevant personal data on our behalf;
3. professional advisers such as solicitors, accountants, tax advisors, auditors and insurance brokers;
4. providers that help us generate and collate reviews in relation to our products and services;
5. our advertising and promotional agencies and consultants and those organisations selected by us to carry out marketing campaigns on our behalf; and/or
6. providers that help us store, collate and organise information effectively and securely, both electronically and in hard copy format, and for marketing

Company Mergers and Takeovers

We may transfer your personal data to potential purchasers and their advisors, subject to appropriate confidentiality obligations, in the event we decide to dispose of all or parts of our business.

Social Media

Facebook (Meta Platforms)

We operate an AllSecure Facebook page. The controller for the processing is AllSecure Global d.o.o. There, we process information about your activities, such as likes, posts or comments. In addition, we receive aggregate (anonymous) statistics generated by Facebook and logged on Facebook servers when people interact with pages and their associated content.

When processing personal data on our Facebook Pages as part of Facebook Page Insights, we are joint controllers with Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This means that Facebook and we jointly determine the purposes and means of this processing. 

We receive anonymous statistics from Facebook about how people interact with our pages and the content associated with them. We have no influence on how Facebook processes your data. The creation of page insights by Facebook may be based on the processing of personal data. According to its own information, Facebook processes, among other things, information about what content you view or how you interact with that content. The information actually collected by Facebook depends on whether and how you use Facebook products. 

Facebook assumes all obligations under the GDPR for the processing of Insights data, including fulfilling the right of access to data processing and the right to erasure. If you exercise your data subject rights regarding Insights data with us, we are contractually obligated to forward all relevant information regarding such requests to Facebook within 7 days.

For more information about Facebook Page Insights and our shared responsibility for data processing with Facebook, please click here.

You can find out more information about data use by Facebook (Meta Platforms) as well as setting and objection options on the Facebook (Meta Platforms) websites here.

LinkedIn

We operate an AllSecure LinkedIn page. The controller for the processing is AllSecure Global d.o.o. There, we process information about your activities, such as likes, posts or comments. In addition, we receive aggregate (anonymous) statistics generated by LinkedIn and logged on LinkedIn servers when people interact with pages and their associated content. We also use the marketing offer “LinkedIn Ads” to address specific target groups.

When processing personal data on our LinkedIn pages as part of LinkedIn Page Insights, we are joint controllers with LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). This means that LinkedIn and we jointly determine the purposes and means of this processing. 

LinkedIn assumes all obligations under the GDPR for the processing of Insights data, including the fulfillment of the right of access to data processing and the right to erasure. If you exercise your data subject rights regarding Insights data with us, we are contractually obligated to forward all relevant information regarding such requests to LinkedIn within 3 days.

For more information about LinkedIn Page Insights and our joint responsibility for data processing with LinkedIn, please click here: 

You can find out more information about data use by LinkedIn, as well as setting and objection options, on LinkedIn’s websites here.

Twitter

We operate an AllSecureTwitter page. The controller of the processing is AllSecure Global d.o.o. There, we process information about your activities, such as likes, posts or comments. In addition, we receive aggregate (anonymous) statistics generated by Twitter (Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Irland) and logged on Twitter servers when people interact with pages and their associated content.

For more information about Twitter Insights and our joint responsibility for data processing with LinkedIn, please click here.

Transfer of personal data outside the EU/EEA

If and when transferring your personal data outside the EU or European Economic Area (“EEA”), we will only do so using one of the following safeguards:

1. the transfer is to a non-EEA country that has been the subject of an adequacy decision by the EU Commission;
2. the transfer is covered by a contractual agreement, which covers the GDPR requirements relating to transfers to countries outside the EEA;
3. the transfer is to an organisation which has binding corporate rules approved by an EU data protection authority; or
4. the transfer is to an organisation in the US that is EU-US Privacy Shield

International transfers to our affiliates are governed by EU Commission-approved Standard Contractual Clauses for Controllers and, where relevant, for Processors.

We may also transfer your data to third-party vendors outside the EU, such as our customer relationship management system and due diligence providers. Where we do so, the Standard Contractual Clauses or other safeguards approved by the EU Commission are in place to safeguard that personal data.

Copies of these agreements may be obtained by contacting us using the following email address: [email protected]

Your Rights

The GDPR provides you with certain rights in relation to the processing of your personal data, including to:

• Request access to personal data about you (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing
• Request rectification, correction, or updating to any of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request personal data provided by you to be transferred in machine-readable format (“data portability”).

• Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below).
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it).
• Object to the processing of your personal data in certain This right may apply where the processing of your personal data is based on the legitimate interests of AllSecure, as explained above, or where decisions about you are based solely on automated processing, including profiling.
• Right to lodge a complaint. You also have the right to lodge a complaint with the data protection supervisory authority, if you are not happy with how we Process your Personal Data.

These rights are not absolute and are subject to various conditions under:

• applicable data protection and privacy legislation; and
• the laws and regulations to which we are

If at any time you decide that you do not want to be contacted for any purpose or if you would like to exercise any of your rights as set out above, you can contact us by emailing the following email address: [email protected]

Retention Period

We store your personal data just as long as necessary for the purposes for which they are processed. Beyond that, we are potentially obligated to store your data for longer in accordance to legal retention periods.

• Specifically, we store your data in connection with the establishment of contact with us in accordance with legal retention periods for a time period of usually seven years.
• Server log files are stored for a maximum time period of 15 days and are erased subsequently.
• We store your usage data for the time period stated in Cookie Settings, “Report Cookies”, but at the latest until you withdraw your consent (eg. by disabling cookies).
• If you are no client of us and have registered for our newsletter only, we store your data until you withdraw your consent.
• We store data in connection with your registration and your user account until the end of your client relationship with us, or respectively beyond that until the expiry of the respective legal retention periods (usually for a time period of seven years, see above).

Apart from that, we store your personal data for a time period beyond the above-mentioned, as long as legal claims out of the relationship between you and us are enforceable and only if such litigation becomes apparent, or respectively until the definitive settlement of an incident or court proceedings. Such processing is based on legitimate interests for the establishment, exercise or defence of legal claims.

Amendments of our Privacy Policy

Within the course of the development of our services and internet, we will amend our Privacy Policy regularly. We will publish amendments on our Website. Therefore, you should visit this Privacy Policy regularly to be informed about the current status.

Version: 07. March 2024