Privacy

Personal data

1. Introduction

At bunq, we really care about your privacy. This means we will never sell or rent your personal data to third parties without your permission. In this Privacy & Cookie Statement you can read what data we collect and how we use it.

The data controller for the processing of your personal data is bunq B.V., registered at the Dutch Chamber of Commerce with registration number 54992060. Our address is Naritaweg 131-133, 1043 BS Amsterdam, the Netherlands.

To make sure bunq only processes personal data in line with the relevant laws and regulations, bunq has appointed a Data Protection Officer (DPO). If you have any questions about the processing of personal data after reading our Privacy & Cookie Statement, you can contact our DPO via privacy@bunq.com. If you want to cancel your bunq account or have any other questions about your bunq account, please contact our support via the bunq app or support@bunq.com. 

2. What data does bunq collect

Opening a bunq account

To assess and open bunq accounts, we can collect and process the following personal data:

• Personal information: First- and last name; date, country and place of birth; nationality; gender
• Contact and address details: Residential address; telephone number; email address
• Social security numbers and/or other tax identification numbers including the type of identification document, the issuing date and the issuing institution;
• Counter IBAN;
• Device data (such as type of device, operating system, IP-addresses and advertising ID’s);
• Cookies and usage data on how you use our products and services;
• Correspondence with bunq and support data (telephone, chat conversations and email);
• Additional documentation related to opening an account;
• Picture of an identification document made in the bunq app;
• Video identification data.

Use of the app, websites and other services

While using our app, websites and other services, we can collect and use the following personal data:

• First and last names, phone numbers and email addresses of the contacts in your phone’s address book
• Location data via GPS;
• Uploaded images/content;
• Device data of added devices and API-keys;
• Added aliases (bunq.me pages, telephone numbers and email addresses);
• Financial and banking data, product subscriptions and transaction history;
• Cookies and usage data on how you use our products and services;
• Marketing data (statistics related to our marketing campaigns and data to measure this);
• Correspondence with bunq and support data (telephone, chat conversations and email);
• Activity on bunq Together.

Authentication methods based on biometrical data, such as fingerprint scans, are not stored, used or shared in a format that allows us to reproduce the biometrical data. 

3. What is the lawful basis for the processing of my personal data?

bunq processes your personal data in accordance with the relevant laws and regulations based on several legal grounds.

Legal obligations

We process your personal data to comply with our legal obligations, for example to verify your identity and to be able to share certain data with governmental institutions.

Contract performance

To keep our agreement with you and to provide our services in a well and secure manner, we process your personal data. For example, we need your contact information to keep you informed about relevant developments, and we store correspondence data to improve our customer service.

Consent

Because we value your privacy and we want you to have a choice, we will ask your explicit consent for various features. For example, while using the app you can choose to provide access to your contact list, to upload images/content or to create a public bunq.me link.

Legitimate interests

We can also process certain data when we have a legitimate interest to do so, for example, to prevent and combat misuse, fraud and crimes, to analyse the use of our products and services for the purpose of improving them, for information and system security purposes or for offering you a better user experience.

4. For what purposes does bunq use my personal data?

We use your personal data to:

• Comply with our legal obligations that follow from any relevant applicable legislation and any provisions issued by the supervisory authorities or judicial institutions;
• Execute agreements with our users, for example for processing payments, production of bunq cards, securing bunq accounts, identification purposes and customer support;
• Learn more about the use of our products and services so we can improve them;
• Carry out and personalise (targeted) marketing activities through different channels and measure their effectiveness, based on your personal circumstances and use of our products and services;
• Conduct analyses for statistical, strategic and scientific purposes;
• Prevent and combat misuse, fraud and crimes;
• Ensure the safety and integrity of the financial sector, bunq and our users;
• Training and coaching purposes;     
• Improve our current and future products.

5. Does bunq share my personal data with third parties?

To be able to provide our services, we share certain personal data with third parties. We keep the sharing to a minimum and ensure that these third parties will handle your personal data with the same care as we do. In particular, third parties are required to take appropriate technical and organizational measures to protect your data This means, among other things, that we sign Data Processing Agreements and that we use the standard contract clauses adopted by the European Commission for personal data protection.

An overview of the third parties or categories of third parties with whom we share data can be found below. Next to this privacy statement, additional privacy statements or policies from these third parties may apply.

Onfido Limited

To verify your identification document and identity, we use the services of third-party supplier Onfido Limited (Finsbury Avenue 3, EC2M 2PA London, United Kingdom).

Wise

If you wish to use the services of Wise in the bunq app, we share your personal data with Wise (56 Shoreditch High St, E1 6JJ London, United Kingdom). This may include a copy of your identification document for opening the account.

TeleSign

In order to verify your identity, we use the services of third-party supplier TeleSign (13274 Fiji Way Suite 600, Marina del Rey, CA  90292, United States).

adjust GmbH

To analyse the use of our websites, products and services, and to measure the effectiveness of our (personalised) marketing campaigns, we use technology from adjust GmbH (Saarbrücker Strasse, 10405 Berlin, Germany).

Segment.io Inc., Mixpanel Inc., Braze Inc. and Looker Data Sciences Inc.

For bringing together and analysing the personal usage data from various sources, including your use of our websites, products and services and to carry out and measure the effectiveness of our (personalised) marketing campaigns, we use technology from Segment.io Inc. (100 California Street, San Francisco, CA 94111, USA), Mixpanel Inc. (405 Howard Street, San Francisco, CA 94105, USA), Braze Inc. (330 W 34th Street, NY 10001, New York, USA) and Looker Data Sciences Inc. (1600 Amphitheatre Parkway, CA 94043, Mountain View, USA).

AskNicely

In order to receive your feedback and to analyze and improve the usage of our services, we use the technology and services of AskNicely (63 Ponsonby Road, Ponsonby 1011, Auckland, New Zealand). For these purposes, personal data is shared to provide AskNicely’s services.

Google LLC

To offer you smooth translations (on your request) and OCR related features (such as invoice and attachment scanning), we use the Cloud Translation and Cloud Vision API's from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). We also use Google’s G Suite services, in order to improve the services we offer to you, by enhancing our information security and efficiency. Content will only be stored by Google temporarily (before being deleted) to provide the services, and Google does not claim any ownership of the content nor do they use it for any other purposes except for providing the requested services.

To verify your address, assure your bunq cards arrive at the correct address and for fraud prevention, we also use the services of Google Places API from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). For these purposes, location and usage data is shared to provide and help improve the services. Further information regarding Google’s data privacy policy can be found on Google's Privacy page.

Mobile payments

To offer you Apple Pay and Google Pay services, we use the technology from Apple Inc (One Apple Park Way, Cupertino, CA 95014, USA) and Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). When you decide to use these services, please take notice of the separate terms and conditions with regard to data sharing.

MaxMind

To verify your location, assure your bunq cards arrive at the correct address and for fraud prevention, we use the technology of MaxMind (14 Spring Street, MA 02451, Waltham, USA). For these purposes, location, usage data and your e-mail address is shared to provide and help improve the services.

Cash Payment Solutions

To offer you the services of Cash Payment Solutions to be able to deposit and withdraw cash at various locations where available, we use the services of Cash Payment Solutions GmbH (Wallstr. 14a 10179 Berlin, Germany). For these purposes, data is shared such as location data in order to show you their nearest locations.

Currence

For the use of the online identification tool 'iDIN' we use the services of Currence (Gustav Mahlerplein 33-35, 1082MS Amsterdam, The Netherlands). Certain personal information is shared for the purpose of verifying your identity.

TapiX

In order to offer you the bunq features Insights and Subscriptions, we make use of the services of Tapix (Dateio s.r.o., Impact Hub Praha, Drtinova 10, Praha 5 – Smichov, Czech Republic). For these purposes, anonymized payment information is shared, for TapiX to enrich your transactions with details about your payment and to offer you with an overview of all your subscriptions.

Vonage 

In order to offer you the ‘SOS’ feature, which can be found on our Help Desk page, we need to record and transcribe your conversation with us. To help us with this, we use the services of Vonage (Nexmo Inc., 23 Main Street, Holmdel, NJ 07733 USA). Your personal data is only processed if you make use of this service.

Birdee

When you make use of Easy Investments, you are making use of the services of Birdee (Birdee S.A., 59 Boulevard Royal, L-2449 Luxembourg, www.birdee.co). In order to offer you our and their services, we are required to share certain data with Birdee. 

Other parties

• Parties for producing and delivering bunq cards;
• Email, marketing and ad services and social media platforms for managing and executing service emails, direct marketing emails     ,      setting up marketing campaigns and helping us track usage of our website;
• SMS providers for sending SMS messages;
• (Outsourced) customer support services;
• Payment institutions for processing transactions and safeguarding the safety and integrity of the financial sector;     
• In order to provide you with ‘bunq Deals’, we may share certain information with the counterparty that provides the Deal. We will only share strictly necessary information and will only share data when you make use of the Deal;
• Notaries for helping you set up your company;
• Legal consultants or auditors for complying with our own legal obligations and for any legal claims.

The third parties listed under ‘Other parties’ are located mainly in the EU. A data processing agreement has been signed with each of them. If they are located outside the EU, the standard contractual clauses provided by the European Commission have been signed.

Governmental institutions and agencies

To comply with laws and regulations we can share data with the concerned institutions. For example, we may have to submit anti-money laundering reports to the FIU and the Tax Authorities can request financial data and we can share data with the Dutch Central Bank for participating in the Deposit Guarantee Scheme. Next to this, bunq can have a statutory or legal obligation to share personal data with investigating authorities to prevent and combat misuse, fraud and crimes.

To help protect the banking system and to assist you in filing your tax returns, we also share your tax information number and the description of your sub accounts with the Tax Authorities.

6. How long does bunq store my data?

We only keep your data for the time necessary to fulfil the purpose of collection. We are legally obliged to retain certain data for a minimum of 5 to 7 years after ending the customer relationship and in other cases up to 10 years, as in the case of accounting obligations.. 

We are able to store personal data for longer periods with a valid legal ground, or when the data is sufficiently (for example) pseudonymised or anonymised.

7. What are my rights?

Below we have outlined the rights the GDPR grants you and what this means for you in the context of your activities with bunq.

Your right: You have the right to be informed (article 13 GDPR).

What it means: We provide you with the necessary information regarding the collection and usage of your personal data. We do this by means of this Privacy Statement.

Your right: You have the right to access the personal data we hold about you (article 15(1) GDPR).

What it means: If you file a data access request, we will provide you with a copy of all the personal data we have collected about you. You also have the right to receive this information in a way that is structured, commonly used and machine-readable.

Your right: You may request that we delete your personal data (article 17(1) GDPR).

What it means: We will delete the personal data we have collected about you. We will only delete your data if you are no longer an active user with us. Furthermore, Dutch law requires us to keep certain information for up to 10 years.

Your right: You may request that we rectify incorrect or incomplete information about you (article 16(1) GDPR).

What it means: If you spot anything in your personal information that is either incorrect or incomplete, let us know! We will change it as soon as possible.

Your right: You may object to the processing of your personal data by us (article 21(1) GDPR).

What it means: We process certain data on the basis of legitimate interest. In this case, you can object to the processing.

We will consider your request and determine whether we have an overriding reason to process the data you’re objecting to. If this is the case, we will refuse your request.

Your right: You may ask us to restrict the processing of your personal data (article 18 GDPR).

What it means: Restriction of processing means that we will temporarily suspend processing of your personal data. You can ask us to do so if:

• you contest the accuracy of the information;
• our processing is unlawful but you don’t want us to delete the data;
• our processing is unlawful, but you need us to maintain the information in connection to a legal claim; or
• you have objected to the processing and we’re evaluating your request.

You also have the right not to be subject to a decision that was made solely on the base of automated processing, including profiling, which produces legal effects that concern you or that similarly significantly affect you (Article 22 GDPR).

Furthermore, you may lodge a complaint with the data protection supervisory authority responsible for you (in the member state where you commonly reside, where your place of work is located or where the alleged infringement took place) in accordance with Article 77 of the GDPR if you are of the opinion that the processing of your personal data violates the GDPR.          

8. Revoking consent & limiting access

Direct marketing

If you do not want your data to be used for direct marketing activities, you can let us know via the bunq app anytime. Our communication via email also contains the possibility to unsubscribe from these messages.

GPS and access to your contact list

While using the bunq app, you can provide permission to your contact list and to process location data. If you no longer want us to use location data, or if you no longer want to provide access to your contact list in the bunq app, you can easily revoke these permissions. You will find the settings for the bunq app at the settings for installed apps on your device. You can revoke provided permissions at any given moment.

Uploaded images/content

Images and content that you use to personalise your bunq account or improve your app experience can be easily changed in the bunq app.

Public bunq.me profile

When you create a public bunq.me profile, your nickname and IBAN are visible for anyone that visits your public bunq.me profile for making payments. You can deactivate your bunq.me page with the accompanying data at any given time via the bunq app.

Phone number, email aliases and Easy Green Plan

At signup we connect your phone number and email address to your bunq account as aliases. This allows other bunq users to easily transfer money to your bank account(s), as your bunq account (and IBAN) will show up in their contact list. You can easily disconnect aliases from your bank account(s) via the settings of the selected bank account.

We will also show other bunq users on Together that you are on an Easy Green Plan. You can turn this feature off in the settings section of your account.

Cookies

For more information on how to delete cookies, please see our Cookie Statement. 

Places

To offer you bunq Places, we will share certain information with your Inner Circle. Users in your Inner Circle will see where you’ve made a card payment. They will not see when you paid or how much you paid.

Users who have your alias (see above) in their contact list will see that a bunq user has paid at a particular store, but they will not see who exactly made the payment.

Sharing these data under Places will only take place after you’ve given us your consent to do so. You can revoke your consent at any moment via the bunq app.

9. Changes to the Privacy & Cookie Statement

We are always improving and expanding our products and services. This might cause our data processing to change. When we change something, we will adjust our Privacy & Cookie Statement accordingly. You can always find the latest version on our website and in the app.

10. Complaints

When you have a complaint about the data processing by bunq, you can contact our Data Protection Officer via privacy@bunq.com.

In case you disagree with the handling of your complaint, you are able to file a complaint at the Autoriteit Persoonsgegevens.