General definitions
1. Personal data means any information relating to an identified or identifiable natural person (data subject), as specified in Article 4(1) of the GDPR.
2. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
3. Data processing means any operation or set of operations which is performed on personal data or on sets of personal data, as specified in Article 4(2) of the GDPR.
4. Data processor means a natural person or legal entity which processes personal data on behalf of the controller, as specified in Article 4(8) of the GDPR.
5. Data controller, the entity determining the purposes and means of processing personal data, is Paysera LT, UAB, managing the payment initiation and account information service, peer-to-peer lending platform, and other services. According to the Joint Controller Agreement No. 2018019 of 19/09/2018, your personal data controller is the Paysera network (hereinafter referred to as Paysera, Operator, Data Controller, or Company). Contact details of Paysera are published on the Paysera website. The contact details of the Data Protection Officer appointed by Paysera are: [email protected].
6. Data subject or client means a natural person who intends to or has started a business relationship (filling out a consumer credit application, registering on the Company's website, as a provider of consumer credit or otherwise as a funder seeking to finance consumer loans, entering into a service agreement with the Company, etc.) with the Data Controller, or the business relationship has ended but the Data Controller processes the data of the data subject in accordance with legal provisions.
7. Platform means a software solution on the Company's websites, developed by the Company and used to provide the Company's services.
General Provisions
8. Personal data collected by Paysera is processed in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania, the GDPR, and other legal acts. All persons, representatives, and employees of representatives acting on behalf of Paysera who have the ability to access systems with client data, access them exclusively for the performance of their work functions, having a legitimate basis for such access, and must keep personal data known during work confidential even after the termination of employment or contractual relationships.
9. The Company, in accordance with the applicable legal requirements, shall ensure the confidentiality of personal data and the implementation of appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, accidental loss, alteration, destruction, or other unlawful processing.
10. This Privacy Policy sets out the basic rules for the collection, storage, processing, and retention of your personal data, other information relating to you, the scope, purpose, sources, recipients, and other important aspects of your personal data processing when you use Paysera as a payment service provider. In this Privacy Policy, terms used in the singular form also include the plural form, and terms used in the plural form also include the singular form, unless the context clearly indicates otherwise.
11. By accessing the Paysera website and/or using the app, and/or the information contained therein, and/or services, you acknowledge and confirm that you have read, understood, and agree to this Privacy Policy. Also, after you register with the system and start using our services, this Privacy Policy becomes a Supplement to the General Payment Services Agreement.
12. Paysera reserves the right, at its sole discretion, to modify this Privacy Policy at any time by publishing an updated version of the Privacy Policy on the website and, if the changes are substantial, notifying registered users by email or in-app notification. An amended or updated version of this Privacy Policy shall take effect upon its publishing on the website.
13. If the user of the services is a business client, this Privacy Policy applies to individual clients whose data is transmitted to us by the business client. The user shall inform the data subjects (managers, recipients, agents, etc.) of the transfer of their data to Paysera in accordance with Article 14 of the GDPR.
Data processing purposes, providers, deadlines, recipients
14. The main purpose for which Paysera collects your personal data is to provide the payment services of Paysera to clients who send and receive payments. As a provider of payment and peer-to-peer lending services, Paysera is bound by law to establish and verify your identity prior to entering into financial services transactions with you, also, at the time of the provision of the services, to request further information, as well as assess and store this information for the retention period set out by legislation. Taking this into account, you must provide correct and complete information.
PURPOSE: Client identification, provision of payment services (account opening, transfers of funds, payment processing, and other), prevention of money laundering and terrorist financing, or implementation of other legal obligations of the payment service provider.
15. Personal data is processed for this purpose in compliance with legal requirements related to: establishment and verification of the client's identity; conclusion and execution of agreements with the client or in order to take steps at the request of the client; execution of transfers of funds and transmission of the necessary information together with a transfer in accordance with legislation; implementation of the "Know Your Client" requirements; continuous and periodic monitoring of the client’s activity; risk assessment; updating client data in order to ensure its accuracy; prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, determination of politically exposed persons or financial sanctions imposed on the client; ensuring proper risk and organisation management.
16. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, a face photo, citizenship, data from an identity document (including but not limited to a copy of the document), direct video transmission (direct video broadcast) recording, email address, phone number, current payment account number, IP address, current professional or work activity, current public function, data on the client's participation in political activities, inclusion in sanctions lists, other data required by applicable anti-money laundering and counter-terrorist financing laws, as well as client location data, planned service, account usage purpose (personal/business), planned investment amount, income received, main source of funds, beneficial owner, business relationship correspondence with the client, documents and data confirming the monetary operation or transaction, or other legally valid documents and data related to the execution of monetary operations or transactions, tax residence country, connection with the EEA/EU, tax identification number, devices used, SIM card issuing country, history of monetary transactions.
17. This personal data is collected and processed on the basis of a legal obligation imposed on the payment service provider, i.e. the Law on Payments, the Law on Electronic Money and Electronic Money Institutions, laws on the prevention of money laundering and terrorist financing, and other applicable legal acts, and is required in order to open an account and/or provide a payment service.
18. Data retention period: 10 (ten) years after the termination of the business relationship with the client. This personal data must be retained for 8 (eight) years according to the Law on Prevention of Money Laundering and Terrorist Financing. This data is retained for another 2 (two) years on the basis of the legal interests of Paysera according to the ordinary limitation period of the lawsuit.
19. Data providers and sources: the data subject directly, credit and other financial institutions and their branches, state and non-state registers, databases for checking the data of identity documents (databases of expired documents and other international databases), authority check registers (registers of notarised authority and other databases), the Register of Incapacitated and Disabled Persons, the Population Register, other databases, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), companies maintaining registers of international sanctions, law enforcement agencies, bailiffs, legal entities (provided you are a representative, employee, founder, shareholder, participant, contractor, or the real beneficiary of these legal entities), partners or other legal entities that engage us or are engaged by us in the provision of services, social networks where you have a profile linked to our system, and other persons. Data can be processed using artificial intelligence tools.
20. Groups of data recipients: supervisory authorities, credit, financial, payment and/or electronic money institutions, pre-trial investigation institutions, state tax agencies, payment service representatives or partners of Paysera (if the transaction is carried out using their services), recipients of transaction funds receiving the information in payment statements together with the funds of the transaction, the recipient’s payment service providers and correspondents, participants, and/or parties related to national, European, and international payment systems, debt collection and recovery agencies, companies processing consolidated debtor files, lawyers, bailiffs, auditors, other entities having a legitimate interest, other persons under an agreement with Paysera or on other lawful bases.
PURPOSE: Dispute and debt management.
21. Personal data under this purpose is processed in order to resolve disputes, manage and collect debts, submit claims, demands, lawsuits, etc.
22. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document, email address, phone number, current account number, IP address, current account statements, and all other data related to the circumstances in which the dispute or debt arose.
23. Data retention period: the due date for the debt is 10 (ten years) from the day the debt became known (if the debt consists of several elements – from the date the last element became known), and after the opening of legal proceedings – until the complete fulfilment of the parties' obligations to each other. The data retention period is based on the limitation periods for proceedings set out by the Civil Code of the Republic of Lithuania.
24. Data providers: the data subject directly, credit, financial, payment and/or electronic money institutions, state and non-state registers, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), providers of electronic communications services, other persons.
25. Groups of data recipients: companies processing consolidated debtor files, credit, financial, payment and/or electronic money institutions, lawyers, bailiffs, courts, pre-trial investigation institutions, state tax agencies, debt collection and recovery agencies, and other entities having a legitimate interest.
26. Please note that if you have a debt to Paysera and you are postponing the performance of your obligations for more than 30 (thirty) days, Paysera has the right to provide the information on your identity, contact details, and credit history, i.e. financial and property liabilities and information on their execution, and debts and their payment to companies managing debtors' databases (such as the credit institution UAB "Creditinfo Lithuania" in Lithuania*), as well as to debt collection companies. You can access your credit history by contacting the credit bureau directly.
PURPOSE: To support and administer relations with clients, inform clients about existing and new services, provide services, prevent disputes, and collect evidence (recording phone conversations), correspondence of business relations with the client.
27. Personal data is processed for this purpose in order to: maintain the business relationship and communication with the client; provide services to the client; protect the interests of the client and/or Paysera; prevent disputes, provide evidence of business communication with the client (recordings of conversations, correspondence); perform quality assessment and ensure the quality of services provided by Paysera; where it is necessary for the execution of the agreement, in order to take steps at the request of the client, or in implementing a legal obligation; inform the client about the services provided by Paysera, their prices, specifics, changes in the contracts concluded with the client, etc.; send Paysera systemic and other notifications related to the services provided.
28. For this purpose, the following personal data may be processed: name, surname, address, date of birth, email address, phone number, IP address, client location data, current account statements, phone conversation recordings, correspondence with the client, and any other data necessary for the purpose.
29. Data retention period: 5 (five) years after the termination of the business relationship with the client. The retention period may be extended for a period not exceeding 2 (two) years, provided there is a reasoned request from a competent authority. Such data retention period is required under the laws on the prevention of money laundering and terrorist financing.
30. Data providers: the data subject directly, providers of electronic communications services.
31. Data recipients: supervisory authorities, companies processing consolidated debtor files, lawyers, bailiffs, courts, pre-trial investigation institutions, debt collection and recovery agencies, other entities having a legitimate interest, other entities under an agreement with Paysera.
32. The data subject confirms that they understand that such information notifications are necessary for the performance of the General Payment Services Agreement and/or its annexes concluded with the client, and do not constitute direct marketing messages.
PURPOSE: Credit rating assessment, credit risk management, and automated decision making.
33. The personal data for this purpose is processed to assess the creditworthiness of clients, to manage the credit risk, and to meet the requirements related to operational risk management and capital adequacy, so that Paysera can offer to offer/provide funding.
34. The following personal data may be processed for this purpose: name, surname, address, date of birth, email address, telephone number, payment account number, IP address, payment account statements, client's balance on the account, financial liabilities, credit and payment history, income, education, workplace, current work position, work experience, available assets, and data on relatives, credit rating, former debts, and other information.
35. Data retention period: 1 (one) year after the termination of the business relationship with the client, when the end date is not earlier than the date of full fulfilment of obligations by both parties to each other. In the event of a refusal to grant credit, the moment of informing the client about the refusal to grant credit shall be considered the moment of termination of the relationship with the client.
36. Data providers: the data subject directly, credit and other financial institutions and their branches, law enforcement agencies, other registers and state institutions, companies processing consolidated debtor files (e.g. in Lithuania, UAB "Creditinfo Lithuania" or other), individual persons who provide data about spouses, children, and other persons related by kinship or affinity, co-debtors, guarantors, collateral providers, etc., legal entities when the client is a representative, employee, contractor, shareholder, participant, owner, etc. of these legal entities, and partners or other legal entities who Paysera employs for service provision.
37. Data recipients: credit, financial, payment and/or electronic money institutions or service providers assisting in the assessment of creditworthiness, and companies processing consolidated debtor files.
38. In order to conclude or offer to enter into a funding agreement with you and to provide you with services, Paysera will, in certain cases, apply decision-making based on the automated processing of your personal data. In this case, the system checks your creditworthiness with a set algorithm and assesses whether the service can be provided. If the automated decision is negative, it may be changed by the client providing more data. Paysera takes all the necessary measures to protect your rights, freedoms, and legitimate interests. You have the right to demand human intervention, express your opinion, and challenge an automated decision. You have the right to oppose an automated decision by contacting Paysera directly.
39. Personal data for this purpose is processed in order to ensure the widest possible range of services received by Paysera clients, with certain services being provided by third parties.
40. For this purpose, the following personal data may be processed: name, surname, citizenship, personal identification number, address, contact information.
41. The client is clearly informed about any data processing for the purpose of providing services through third parties, and the data is processed only with the client's expressed consent.
42. Data retention period: 1 (one) year.
43. Data providers: the data subject directly, Paysera, third parties providing services.
44. Data recipients: third parties providing services, Paysera, data subject.
PURPOSE: Protection of interests of Paysera and the client (video surveillance on the premises of Paysera).
45. Personal data for this purpose is processed in order to ensure the security of Paysera and/or the client, to protect the life and health of the client and/or their representative, and other rights of Paysera and the client (video surveillance and recording in the premises of Paysera) in pursuit of the legitimate interest to protect clients, employees, and visitors of Paysera and their property, as well as the property of Paysera.
46. For this purpose, the following personal data may be processed: video recordings on the premises managed by Paysera.
47. Before entering the premises of Paysera where video surveillance is conducted, you are informed about the surveillance by special markings.
48. Data retention period: 1 (one) year.
49. Data providers: the data subject directly who visits the premises of Paysera where video surveillance is conducted and is captured by the surveillance camera.
50. Data recipients: courts, pre-trial investigation institutions, lawyers, responsible employees of Paysera.
PURPOSE: Direct marketing.
51. For this purpose, personal data is processed in order to provide clients with offers on the services provided by Paysera and find out the clients' opinions on the above-mentioned services.
52. The following personal data may be processed for this purpose: name, surname, email address, and phone number.
53. For this purpose, Paysera sends newsletters and direct marketing messages after obtaining the client's consent. Paysera may use a newsletter service provider while ensuring that said provider complies with the personal data protection requirements set out in the Joint Controller Agreement. The client may revoke their consent upon receiving newsletters or direct marketing messages by clicking on the Revoke your consent link as well as informing Paysera at any time about their refusal to process personal data for direct marketing purposes by e-mail [email protected].
54. Data retention period: until the termination of the business relationship with the client or until the day the client objects to the data processing for this purpose.
55. Data providers: the data subject directly.
56. Data recipients: The data for this purpose may be transmitted to search or social networking systems (the possibility to object data processing is ensured by the websites of these systems), newsletter service providers.
PURPOSE: Statistical analysis, service improvement.
57. Your personal data collected and anonymised for the aforementioned purposes may be processed according to Article 6.1(f) of the GDPR for the purpose of statistical analysis and for improving technical and organisational measures, information technology infrastructure, ensuring the adaptation of the provided service to the devices used, creating new Paysera services, increasing satisfaction with existing services, testing and improving technical measures and IT infrastructure. For this purpose, personal data shall be processed in such a way that, by including it in the scope of statistical analysis, it is not possible to identify the data subjects concerned. The collection of your personal data for the purpose of statistical analysis is based on the legitimate interest to analyse, improve, and develop the conducted activity.
58. You have the right to disagree and object to your personal data processing for such purpose at any time and in any form by informing Paysera thereof. However, Paysera may continue to process the data for statistical purposes if it proves that the data is processed for compelling legitimate reasons beyond the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.
PURPOSE: Prevention of service misuse and criminal offences, and ensuring proper delivery of services.
59. The data collected for all of the above purposes may be used to prevent unauthorised access and use, i.e. to ensure privacy and information security.
60. For the processing of personal data, Paysera may engage data processors and/or, at its own discretion, hire other persons to perform certain ancillary functions on behalf of Paysera (e.g. data centres, hosting, cloud hosting, system administration, system development, software development, provision, support services such as improvement and development; services of client service centres; marketing, communication, consulting, temporary staffing, or similar services). In such cases, Paysera shall take the necessary measures to ensure that such data processors process personal data in accordance with Paysera's instructions and applicable laws, and shall require compliance with the appropriate personal data security measures. Paysera shall also ensure that such persons are bound by confidentiality obligations and cannot use such information for any purpose other than the performance of their functions.
61. Personal data collected for the purposes specified in this Privacy Policy shall not be processed in any ways incompatible with these legitimate purposes or legal requirements.
62. The data referred to above will be provided and received through a software tool used by Paysera or its authorised agent, also by other means and third persons with whom Paysera has entered into personal data processing agreements in accordance with laws and regulations.
Geographical area of processing
63. Generally, personal data is processed within the European Union/European Economic Area (EU/EEA) but may in certain cases be transmitted and processed outside the EU/EEA.
64. Personal data may be transferred and processed outside the EU/EEA where the transfer is necessary for the conclusion or execution of a contract (for example, when a payment is carried out to a third party or through a third party partner (correspondent)) or for example, when the client carries out commerce activities using an online platform (is a registered user) where payment service providers of registered users are subject to specific customer information requirements when law provisions stipulate the need for the transfer, or when the client gave their consent. We seek to ensure that appropriate technical and organisational measures are in place in all of these cases as indicated in the Joint Controller Agreement.
65. Profiling carried out by Paysera involves the processing of personal data by automated means for the purposes of legislation relating to risk management and continuous and periodic monitoring of transactions in order to prevent fraud; such ongoing profiling is based on the legal obligations of Paysera.
66. For the purpose of direct marketing and statistical analysis, profiling may be carried out using Matomo, Google, Meta, OpenAI, and other analytics tools.
Processing the personal data of minors
67. A minor under 14 (fourteen) years of age, seeking to use the payment services of Paysera, shall provide written consent from their representative (parent or legal guardian) with regard to their personal data processing.
Cookie policy
68. Paysera may use cookies on this website. Cookies are small files sent to a person's Internet browser and stored on their device. Cookies are transferred to a personal computer upon first visiting the website.
69. Usually, Paysera uses only the necessary cookies on the person's device for identification, enhancement of the website functionality and use, and facilitating a person's access to the website and the information it contains. Paysera may use other cookies upon receiving the client's consent. You will find a brief description of different types of cookies here:
69.1. Strictly necessary cookies. These cookies are necessary in order for you to be able to use different features on the Paysera website. They are essential for the website to work and cannot be switched off. They are stored on your computer, mobile phone or tablet while you are using the website and are only valid for a limited amount of time. They are usually set in response to actions made by you while browsing such as changing your privacy settings, logging in and filling out various forms.
69.2. Statistics cookies. These cookies are used to collect and report on anonymous information in order to find out how our visitors use the website. A registered IN number is used to gather statistical data on how users navigate the website.
69.3. Analytics cookies. These cookies are used to monitor the number and traffic of website users. Analytics cookies help us find out which websites are visited the most and how visitors use them to improve the quality of our services. If you do not consent to the use of these cookies, we will not include your visit to our statistics.
69.4. Marketing cookies. These cookies are used to provide relevant information about our services based on your browsing habits to improve content selection and offer more options while using our website. In addition, these cookies may be used in our third-party partners' websites for reporting purposes. In that way, we would also receive information about your browsing history from our official partners' websites where we place our ads. If you do not consent to the use of these cookies, you will only see non-personalised advertising.
70. Most web browsers accept cookies, but the person can change the browser settings so that cookies would not be accepted. It should be noted that unlike other types of cookies, rejecting necessary cookies may affect the website functionality, and some features may not work properly. Upon first visiting the Paysera website, you will see a pop-up message with a list of specific types of cookies you may choose to accept or decline. If you decide to accept the necessary and the other types of cookies, you can change your selection and revoke your consent by clicking on Cookies Settings at the bottom of the page.
The right of access, rectification, erasure of your personal data, and to restrict data processing
71. You have the following rights:
71.1. THE RIGHT OF ACCESS TO DATA: to obtain information as to whether or not Paysera processes your personal data, and, where that is the case, access to the personal data processed by Paysera and to receive information on what personal data and from which sources are collected, the purposes of the processing, the recipients to whom the personal data have been or may be provided; to obtain from Paysera a copy of the personal data undergoing processing in accordance with the applicable law. Upon the receipt of your written request, Paysera, within the time limit laid down in the legislation, shall provide the requested data in writing, or specify the reason of refusal. Once in a calendar year, data may be provided free of charge, but in other cases, remuneration may be set at a level not exceeding the cost of the data provision. More information on the right of access to data and its processing can be found here.
71.2. THE RIGHT OF RECTIFICATION: if your data processed by Paysera is incorrect, incomplete, or inaccurate, you can address Paysera in writing for the rectification of the incorrect or inaccurate data or to have the incomplete personal data completed by providing a relevant request;
71.3. THE RIGHT TO BE FORGOTTEN: to request the termination of the data processing (erase the data), when that the data subject withdraws the consent on which the processing is based, or the personal data is no longer necessary in relation to the purposes for which it was collected, or the personal data has been unlawfully processed, or the personal data has to be erased for compliance with a legal obligation. A written notice of objection to personal data processing shall be submitted to Paysera personally, by post, or via electronic means of communication. If your objection has legal grounds, Paysera, after examining the request, shall terminate any actions of processing of your personal data, with the exception of cases provided for by law. It should be noted that the right to require the immediate erasure of your personal data may be limited due to the obligation of Paysera as a payment service provider to store data about the clients' identification, payment transactions, concluded agreements, etc. for the period laid down in legislation;
71.4. THE RIGHT TO RESTRICT THE PROCESSING OF DATA: to request to restrict the processing of personal data, when the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise, or defence of legal claims. A data subject who has obtained restriction of processing shall be informed by the Data controller before the restriction of processing is lifted;
71.5. THE RIGHT TO OBJECT: the right to object to the processing of your personal data for direct marketing purposes;
71.6. RIGHT TO MAKE A COMPLAINT: to address the supervisory authority with a claim regarding the processing of your personal data, if you believe that the personal data is processed in violation of your rights and legitimate interests stipulated by applicable legislation;
71.7. RIGHT TO CONTACT the Data controller and/or the data protection officer for the purpose of exercising your rights;
71.8. Other statutory rights.
72. You can send your request for access, rectification, or objection to data processing via email to: [email protected]. The person submitting the request must clearly indicate their full name and sign the request with a qualified electronic signature.
Third-party websites
73. Paysera is not responsible for protecting the client's privacy on websites of third parties, even if the client accesses such websites through links provided on this website. Paysera recommends learning the privacy policies of each website that does not belong to Paysera.
The use of logos
74. The client, using the services of Paysera for business objectives and professional interests, agrees that Paysera may use their name and/or logo for direct marketing purposes (e.g. by indicating that the client is using the services provided by Paysera).
Ensuring Information Security
75. Paysera aims to ensure the highest level of security for all information obtained from the client and public data files. In order to protect this information from unauthorised access, use, copying, accidental or unlawful erasure, alteration, or disclosure, as well as from any other unauthorised form of processing, Paysera uses appropriate legal, administrative, technical, and physical security measures.
Final Provisions
76. Additional information on how Paysera processes personal data may be provided in contracts, other documents, the website, mobile application or remote client service channels (by phone, email, etc.).
77. Paysera has the right to unilaterally amend and/or supplement this Privacy Policy. Information about changes to the Privacy Policy is announced by publishing it on the Company's website. In certain cases, the Company may also inform individuals about the changes by mail, email, mobile application or in another manner.
78. These Privacy policy provisions are subject to the law of the Republic of Lithuania. All disputes regarding the provisions of the Privacy Policy shall be settled by negotiation and, in case of failure to resolve an issue by negotiation, the dispute shall be taken to courts of the Republic of Lithuania.
* – UAB "Creditinfo Lithuania" (company code: 111689163, address: Lvivo st. 21A, LT-09309 Vilnius, Lithuania, www.creditinfo.lt, phone: (8 5) 2394131, which manages and provides your information to third parties (financial institutions, telecommunication agencies, insurance, electricity and utility service providers, trading companies, etc.) for legitimate interests and objectives: to assess your creditworthiness and manage debts. Credit history data is usually stored for 10 years after the fulfilment of obligations).
Using services provided solely by "Paysera Bank of Georgia", JSC, personal data collected through "Paysera Bank of Georgia", JSC is processed under this Privacy Policy.
Agreement History
Privacy Policy (valid until 17/06/2024)
Privacy Policy (valid until 28/09/2021)
Privacy Policy (valid until 20/07/2020)
Privacy Policy (valid until 17/04/2020)
Privacy Policy (valid until 16/09/2019)