Table of contents

Table of contents

1. Introduction

At bunq, we really care about your privacy. This means we will never sell or rent your personal data to third parties without your permission. In this Privacy & Cookie Statement (“Statement”) you can read what personal data we collect and how we use it. 

The data controller for the processing of your personal data is bunq B.V., registered at the Dutch Chamber of Commerce with registration number 54992060. Our address is Naritaweg 131-133, 1043 BS Amsterdam, the Netherlands.

To make sure bunq only processes personal data in line with the relevant laws and regulations, bunq has appointed a Data Protection Officer (DPO). If you still have any questions about the processing of personal data after reading this Privacy & Cookie Statement, you can contact our DPO via privacy@bunq.com. If you want to cancel your bunq account or have any other questions about your bunq account, please contact our support via the bunq app or support@bunq.com.

2. What data does bunq collect

Personal data means any information that can be linked to a natural person. We collect your personal data in a number of ways, including:

  • You share it with us when you open a bunq account; use our products and services; contact us via one of our channels or visit our website.

  • From public registers; or third parties such as other financial institutions, or public authorities.

  • To execute your payments, we may also collect personal data of non-bunq users.

Opening a bunq account

To open bunq accounts, we can collect and process the following personal data:

  • Identity information: First and last name; date, country and place of birth; nationality; gender; 

  • Contact and address details: Residential address; telephone number; email address;

  • Social security numbers and/or other tax identification numbers including the type of identification document, the issuing date and the issuing institution;

  • Counter IBAN;

  • Device data (such as type of device, operating system, IP-addresses and advertising ID’s);

  • Cookies and usage data on how you use our products and services;

  • Correspondence with bunq and support data (telephone, chat conversations and email);

  • Additional documentation related to opening an account;

  • Picture of an identification document made in the bunq app;

  • Video identification data.

Use of the bunq app, websites and other services

While using our app, websites and other services, we can collect and use the following personal data:

  • First and last names, phone numbers and email addresses of the contacts in your phone’s address book; 

  • Location data via GPS;

  • Uploaded images/content;

  • Device data of added devices and API-keys;

  • Added aliases (bunq.me pages, telephone numbers and email addresses);

  • Financial and banking data, product subscriptions and transaction history;

  • Cookies and usage data on how you use our products and services;

  • Marketing data (statistics related to our marketing campaigns and data to measure this);

  • Correspondence with bunq and support data (telephone, chat conversations, email, voice and screen recordings);

  • Activity on bunq Together;

  • Background location data, if you choose to use our Card Protection feature or Travel Assistant

Background location data is collected only with your active consent, for the purpose of enabling the Card Protection feature (feature that determines whether your card is within a 100km radius of you, allowing you to determine if your card has been stolen) or for enabling a Travel assistant (Localized tips, assisting you in your travel destination).

Authentication methods based on biometrical data, such as fingerprint scans, are not stored, used or shared in a format that allows us to reproduce the biometrical data.

Minors

We collect and process personal data from minors only with parental consent when they become a bunq user and use our services.

Finn

bunq’s AI bot, Finn,  is involved in processing customer support queries: it can respond directly to questions submitted by users, as well as provide prompts that bunq support can review and use as a basis for response to the user.  Finn will also answer the bunq user’s questions on their spending, accounts, group expenses, and app activity.

3. What is the lawful basis for the processing of my personal data? 

bunq processes your personal data in accordance with the relevant laws and regulations based on several legal grounds.

Legal obligations

We process your personal data to comply with our legal obligations, for example to verify your identity and to share certain data with governmental institutions.

Contract performance

To keep our agreement with you and to provide our services in a well and secure manner, we process your personal data. For example, we need your contact information to keep you informed about relevant developments, and we store correspondence data to improve our customer service.

Consent

Because we value your privacy and we want you to have a choice, we will ask your explicit consent for various features. For example, while using the app you can choose to provide access to your contact list, to upload images/content or to create a public bunq.me link. If you have given consent for a specific feature, you have the right to withdraw consent at any time in the app.

Legitimate interests

We can also process certain data when we have a legitimate interest to do so, for example, to prevent and combat misuse, fraud and crimes, to analyse the use of our products and services for the purpose of improving them, for information and system security purposes or for offering you a better user experience.

4. For what purposes does bunq use my personal data?

We use your personal data to:

  • Comply with our legal obligations that follow from any relevant applicable legislation and any provisions issued by the supervisory authorities or judicial institutions;

  • Execute agreements with our users, for example for processing payments, production of bunq cards, securing bunq accounts, identification purposes and customer support;

  • Learn more about the use of our products and services by conducting analyses for statistical and strategic purposes so we can improve them;

  • Carry out and personalize (targeted) marketing activities through different channels and measure their effectiveness, based on your personal circumstances and use of our products and services;

  • Prevent and combat misuse, fraud and crimes;

  • Ensure the safety and integrity of the financial sector, bunq and our users;

  • Training and coaching purposes; 

  • Improve our current and future products.

5. Does bunq make automatic decisions based on my personal data?

When you use bunq’s services, automated decisions can be made about you, which will include profiling.

You have the right to request a manual review of automatic decisions. For more information, please take a look at the ‘What are my rights?’ section of this statement.

Automated decisions are made in the following processes:

  • Opening an account

Our 5-minute rule is enabled by your application being reviewed and approved/rejected by bunq’s automated system. 

  • Fraud detection

Monitoring how our services are used to detect fraud, money laundering, and other crimes and prevent the continuation of misuse of bunq’s services.

6. Does bunq share my personal data with third parties?

To be able to provide our services, we share certain personal data with third parties. We keep the sharing to a minimum and ensure that these third parties will handle your personal data with the same care as we do. In particular, third parties are required to take appropriate technical and organizational measures to protect your data. This means, among other things, that we sign Data Processing Agreements and that we use the standard contract clauses adopted by the European Commission for personal data protection.

Business Partners

We may share your personal data with our business partners who act on our behalf, or which jointly offer products and services with us. An overview of the third parties or categories of third parties with whom we share data can be found below. Next to this privacy statement, additional privacy statements or policies from these third parties may apply.

  • Onfido Limited

To verify your identification document and identity, we use the services of third-party supplier Onfido Limited (Finsbury Avenue 3, EC2M 2PA London, United Kingdom).

  • Wise

If you wish to use the services of Wise in the bunq app, we share your personal data with Wise (56 Shoreditch High St, E1 6JJ London, United Kingdom). This may include a copy of your identification document for opening the account.

  • TeleSign

In order to verify your identity, we use the services of third-party supplier TeleSign (13274 Fiji Way Suite 600, Marina del Rey, CA 90292, United States). 

  • adjust GmbH

To analyze the use of our websites, products and services, and to measure the effectiveness of our (personalized) marketing campaigns, we use technology from adjust GmbH (Saarbrücker Strasse, 10405 Berlin, Germany).

  • Mixpanel Inc., Braze Inc. and Looker Data Sciences Inc.

For bringing together and analyzing the personal usage data from various sources, including your use of our websites, products and services and to carry out and measure the effectiveness of our (personalized) marketing campaigns, we use technology from Mixpanel Inc. (405 Howard Street, San Francisco, CA 94105, USA), Braze Inc. (330 W 34th Street, NY 10001, New York, USA) and Looker Data Sciences Inc. (1600 Amphitheatre Parkway, CA 94043, Mountain View, USA).

  • AskNicely

In order to receive your feedback and to analyze and improve the usage of our services, we use the technology and services of AskNicely (63 Ponsonby Road, Ponsonby 1011, Auckland, New Zealand). For these purposes, personal data is shared to provide AskNicely’s services.

  • Google LLC

To offer you smooth translations (on your request) and OCR related features (such as invoice and attachment scanning), we use the Cloud Translation and Cloud Vision API's from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). We also use Google’s G Suite services, in order to improve the services we offer to you, by enhancing our information security and efficiency. Content will only be stored by Google temporarily (before being deleted) to provide the services, and Google does not claim any ownership of the content nor do they use it for any other purposes except for providing the requested services.

To verify your address, assure your bunq cards arrive at the correct address and for fraud prevention, we also use the services of Google Places API from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). For these purposes, location and usage data is shared to provide and help improve the services. Further information regarding Google’s data privacy policy can be found at https://policies.google.com/privacy.

  • Mobile payments

To offer you Apple Pay and Google Pay services, we use the technology from Apple Inc (One Apple Park Way, Cupertino, CA 95014, USA) and Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). When you decide to use these services, please take notice of the separate terms and conditions with regard to data sharing.

  • MaxMind

To verify your location, assure your bunq cards arrive at the correct address and for fraud prevention, we use the technology of MaxMind (14 Spring Street, MA 02451, Waltham, USA). For these purposes, location, usage data and your e-mail address is shared to provide and help improve the services.

  • Cash Payment Solutions

To offer you the services of Cash Payment Solutions to be able to deposit and withdraw cash at various locations where available, we use the services of Cash Payment Solutions GmbH (Wallstr. 14a 10179 Berlin, Germany). For these purposes, data is shared such as location data in order to show you their nearest locations.

  • Currence

For the use of the online identification tool 'iDIN' we use the services of Currence (Gustav Mahlerplein 33-35, 1082 MS Amsterdam, The Netherlands). Certain personal information is shared for the purpose of verifying your identity.

  • TapiX

In order to offer you the bunq features Insights and Subscriptions, we make use of the services of Tapix (Dateio s.r.o., Impact Hub Praha, Drtinova 10, Praha 5 – Smichov, Czech Republic). For these purposes, anonymized payment information is shared, for TapiX to enrich your transactions with details about your payment and to offer you with an overview of all your subscriptions.

  • Vonage

In order to offer you the ‘SOS’ feature, which can be found on bunq.com/help,  we need to record and transcribe your conversation with us. To help us with this, we use the services of Vonage (Nexmo Inc., 23 Main Street, Holmdel, NJ 07733 USA). Your personal data is only processed if you make use of this service.

  • Birdee

When you make use of Easy Investments, you are making use of the services of Birdee (Birdee S.A., 59 Boulevard Royal, L-2449 Luxembourg, www.birdee.co). In order to offer you our and their services, we are required to share certain data with Birdee.

  • OpenAI

We use the technology of OpenAI (OpenAI OpCo, LLC at 3180 18th Street, San Francisco, CA, United States. https://openai.com). To offer you smooth customer support services, we may process your data via the OpenAI APIs if you share these in support chat in the bunq app. 

  • Externe Verwijzingsregister (EVR)

When you want to open a bunq account, we check your details against the EVR. We may also include your details in this register in case we have a reasonable ground to believe that your bunq account is being used for fraudulent activities. More information about the EVR can be found here: https://together.bunq.com/d/55920-whats-evr-and-how-does-bunq-use-it/2 

  • Incode

To verify your identification document and identity, we use the services of third-party supplier Incode (221 Main St Ste 520 San Francisco, CA, 94105-1983 United States). Their privacy policy can be found here: https://incode.com/privacy-policy/

  • CHEQ

To ensure that bots and other forms of fake traffic do not affect your experience of using our website, we use the services of CHEQ AI Technologies Ltd (23 Yehuda HaLevi Street, Tel Aviv 65136) to block such traffic. The Privacy Policy of CHEQ can be found here: https://cheq.ai/privacy-policy/

  • IDnow

To verify your identification document and identity, we may use the services of third-party supplier IDNow GmbH (Auenstrasse 100, 80469 Munich, Germany). Currently, this partner is used for identification of bunq users that reside in Spain. You can find the privacy policy of IDNow here: https://www.idnow.io/privacy/

  • Sardine

To counter fraud and money laundering, as well as to conduct risk checks, we use the services of Sardine (382 North East 191st Street, Miami, https://www.sardine.ai/). By sharing your data with Sardine, we strengthen our efforts to counter money laundering and fraud. 

  • Microsoft Azure

To make certain processes more efficient, bunq uses the services of Microsoft Azure OpenAI (Redmond, One Microsoft Way, United States, https://azure.microsoft.com/en-us/). The vendor’s API is used for: document review, transaction monitoring, onboarding, customer support, and allows Finn to be accessible to our users.

  • Checkout.com

To allow you to top up your bunq account using debit and credit cards, bunq has partnered with Checkout.com (London, N1, 1 Shepherdess Walk, United Kingdom). You can access the privacy policy of Checkout.com here: https://enterprise.craft.co/privacy. 

  • Barzahlen

Users residing in Austria or Germany have an option in the bunq app called “Withdraw & Deposit” provided through bunq’s partnership with Barzahlen. You can find Barzahlen’s privacy policy here: https://www.barzahlen.de/privacy-notice/?lang=en-bz

  • Adyen

Adyen (Simon Carmiggeltstraat 6-50, Amsterdam, Noord-Holland, 1011DJ) is a Payment Service Provider that processes payment transactions of bunq users. Adyen’s privacy policy can be accessed here: https://www.adyen.com/policies-and-disclaimer/privacy-policy.

  • Other parties

  • Parties for producing and delivering bunq cards;

  • Email, marketing and ad services and social media platforms for managing and executing service emails, direct marketing emails, setting up marketing campaigns and helping us track usage of our website;

  • SMS providers for sending SMS messages;

  • (Outsourced) customer support services;

  • Financial institutions for processing transactions and safeguarding the safety and integrity of the financial sector;

  • Notaries for helping you set up your company;

  • Legal consultants or auditors for complying with our own legal obligations and for any legal claims;

  • We may share your personal data with other bunq entities and branches. We may do so to provide and improve our services to you and to enable us to comply more efficiently with the applicable laws.

A data processing agreement has been signed with each of the ‘Other parties’ listed above. If they are located outside the EU, the standard contractual clauses provided by the European Commission have been signed.

Governmental, supervisory and judicial institutions and authorities 

To comply with laws and regulations or based on legitimate interest we can share data with public authorities, regulators, tax authorities and judicial or investigative authorities. For example, we may have to submit anti-money laundering reports to the FIU and the Tax Authorities can request financial data and we can share data with the Dutch Central Bank for participating in the Deposit Guarantee Scheme. Next to this, bunq can have a statutory or legal

obligation to share personal data with investigating authorities to prevent and combat misuse, fraud and crimes. 

To help protect the banking system and to assist you in filing your tax returns, we also share your tax information number and the description of your sub accounts with the Tax Authorities.

7. How long does bunq store my data?

We process and store your data as long as you remain a bunq user. ​​We only keep your data for the time necessary to fulfill the purpose of collection. You may request us to close your account at any time and delete your data after account closure. We may retain certain data after account closure due to legal or regulatory requirements. We are legally obliged to retain certain data for a minimum of 5 to 7 years after ending the customer relationship and in other cases up to 10 years, as in the case of accounting obligations.

We are able to store personal data for longer periods with a valid legal ground, or when the data is sufficiently pseudonymised or anonymised.

8. What are my rights?  

Below we have outlined the rights the GDPR grants you and what this means for you in the context of your activities with bunq.

1. Right to be informed (Article 13 GDPR)

What it means: We provide you with the necessary information regarding the collection and usage of your personal data through this Privacy Statement.

2. Right to access personal data (Article 15(1) GDPR)

What it means: If you file a data access request, we will provide you with a copy of all the personal data we have collected about you. You also have the right to receive this information in a way that is structured, commonly used, and machine-readable.

3. Right to request deletion of personal data (Article 17(1) GDPR)

What it means: We will delete the personal data we have collected about you upon request, provided you are no longer an active user with us and we are not legally required to keep the data. Certain information may be retained due to Dutch law requirements.

4. Right to rectification of incorrect or incomplete information (Article 16(1) GDPR)

What it means: If you spot anything incorrect or incomplete in your personal information, let us know, and we will rectify it as soon as possible.

5. Right to object to processing of personal data (Article 21(1) GDPR)

What it means: You can object to the processing of your personal data based on legitimate interest. We will assess your request and consider whether there's an overriding reason to continue processing the data. Objections may not apply if there's a legal obligation or contractual necessity.

6. Right to request restriction of processing of personal data (Article 18 GDPR)

What it means: You can request the temporary suspension of processing your personal data if:

  • you contest the accuracy of the information,

  • processing is unlawful but you want us to retain the data,

  • processing is unlawful, but you need us to maintain the information for legal reasons, or

  • you have objected to the processing, and we're evaluating your request.

7. Right not to be subject to automated decisions (Article 22 GDPR)

What it means: We will manually review any personal data subject to automated decisions in the past.

8. Right to lodge a complaint with data protection supervisory authority (Article 77 GDPR)

What it means: You have the right to lodge a complaint with the Dutch Supervisory Authority if you believe the processing of your personal data violates the GDPR.

9. Revoking consent & limiting access  

Direct marketing

If you do not want your data to be used for direct marketing activities, you can let us know via the bunq app anytime. Our communication via email also contains the possibility to unsubscribe from these messages.

GPS and access to your contact list

While using the bunq app, you can provide permission to your contact list and to process location data. If you no longer want us to use location data, or if you no longer want to provide access to your contact list in the bunq app, you can easily revoke these permissions. You will find the settings for the bunq app at the settings for installed apps on your device. You can revoke provided permissions at any given moment.

Uploaded images/content

Images and content that you use to personalize your bunq account or improve your app experience can be easily changed in the bunq app.

Public bunq.me profile

When you create a public bunq.me profile, your nickname and IBAN are visible for anyone that visits your public bunq.me profile for making payments. You can deactivate your bunq.me page with the accompanying data at any given time via the bunq app.

Phone number, email aliases and Easy Green Plan

At signup we connect your phone number and email address to your bunq account as aliases. This allows other bunq users to easily and safely transfer money to your bank account(s), as your bunq account (and IBAN) will show up in their contact list if they have added you to their phone contact list with your phone number and/or email address. The processing of your aliases for these purposes is based upon bunq’s legitimate interest since this feature makes banking easier and helps to prevent fraud and misuse. Furthermore, it gives bunq users certainty that money is transferred into the correct account. You can easily disconnect aliases from your bank account(s) and thereby opt-out from the processing of your aliases for these purposes via the settings of the selected bank account.

We will also show other bunq users on Together and in the app that you are on an Easy Green Plan. You can turn this feature off in the settings section of your account.

Cookies

For more information on how to delete cookies, please see our Cookie Statement.

Recommendations and Activities

To offer you bunq Recommendations, we will share certain information with other bunq users who have you in their contact list.

Users who have your alias (see above) in their contact list will be able to see your recommended places, public nicknames and public avatars.

Sharing these data under Places will only take place after you’ve given us your consent to do so. You can revoke your consent at any moment via the bunq app.

10. Changes to the Privacy & Cookie Statement

We are always improving and expanding our products and services. This might cause our data processing to change. When we change something, we will adjust our Privacy & Cookie Statement accordingly. You can always find the latest version on our website and in the app.

11. Complaints 

If you have a complaint about the data processing by bunq, you can contact our Data Protection Officer via privacy@bunq.com

In case you disagree with the handling of your complaint, you can file a complaint at the Autoriteit Persoonsgegevens. 

Cookies Statement

1. What are cookies?

Cookies are small (text)files we send to your device when you use or visit our products, services, ads and websites. The files are stored on your device. Some of the cookies we use are essential for our services to work. We also collect some non-essential cookies to collect information for making reports and to help us improve our services.

2. Why does bunq use cookies?

We use cookies to:

  • provide basic functionalities of our products and services;

  • improve the usability of our products and services;

  • show you personalized ads across the web and analyse their effectiveness;

  • learn more about the use of our products and services by conducting analyses for statistical, strategic and scientific purposes; and

  • manage customer relationships.

We can combine the data gathered from cookies with other data we have about you, to learn more about your personal customer journey, your use of our products and services and to improve our (personalised) marketing as described in this Privacy & Cookie Statement. 

3. Google Analytics

For bunq.me, bunq.to and together.bunq.com, we have configured Google Analytics in accordance with the guidelines for privacy friendly use from the Dutch Data Protection Authority (‘Handleiding privacyvriendelijk instellen van Google Analytics’). This means we’ve signed a data processing agreement with Google, anonymize IP-addresses and have disabled data sharing where possible. Additionally, Google allows you to opt-out for their analytics cookies via https://tools.google.com/dlpage/gaoptout.

4. Hotjar Limited analytics

We use Hotjar (St Julian’s Business Centre 3, Elia Zammit Street 1000, Malta, Europe) for gathering analytics and analyzing the use of our products and services. We have configured Hotjar for privacy friendly use, meaning we’ve signed a data processing agreement with Hotjar, anonymize IP-addresses and have disabled data sharing where possible. Hotjar honours ‘Do Not Track’ browser settings and additionally allows you to opt-out for their cookies via https://www.hotjar.com/legal/compliance/opt-out

5. Hubspot

In order to gather analytics to analyse the use of our products and services, we use Hubspot (Hubspot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin, D01R8H7). We have signed a data processing agreement with Hubspot in order to guarantee it to be privacy friendly, and we have disabled data sharing where possible. In addition, check out Hubspot’s cookie policy for more information on how their cookies work and how to opt-out for their cookies https://legal.hubspot.com/cookie-policy.

6. How can I block and delete cookies?

In addition to the measures as described in this statement, if you can easily block and remove all cookies on your device via the privacy settings of your web browser.

If you want to prevent new cookies from being placed on your device, you can block the use of cookies via the privacy settings of your web browser. You can choose to block all cookies or only cookies from specific websites. Please note that blocking cookies will not automatically remove cookies that are already stored on your device.

Please be aware that by blocking and/or deleting cookies, our websites (and possibly other websites) might not function properly. With every new session, new cookies will be placed unless you have blocked the use of cookies.

We’re here to help

If you have any questions or need assistance with anything, we're always available to offer a helping hand.

We’re here to help

If you have any questions or need assistance with anything, we're always available to offer a helping hand.

We’re here to help

If you have any questions or need assistance with anything, we're always available to offer a helping hand.