1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

We collect and process the following categories of personal data:

Data Category	Examples	Purpose
Identity Data	Name, date of birth, nationality, ID number	Customer identification, KYC compliance
Contact Data	Email, phone number, postal address	Communication, service delivery
Financial Data	Bank account details, payment history, transaction data	Payment processing, fraud prevention
Technical Data	IP address, browser type, device information	Security, fraud detection, service improvement
Usage Data	Login times, pages visited, features used	Service optimization, customer support
Business Data	Company details, VAT number, business type	Business account setup, compliance

3. How We Use Your Data

We process your personal data for the following purposes:

• Payment Processing: To execute and manage payment transactions
• Account Management: To create and maintain your SoPayment account
• Security & Fraud Prevention: To protect against unauthorized access and fraudulent activities
• Compliance: To meet legal obligations including KYC, AML, and tax reporting
• Customer Support: To respond to inquiries and provide technical assistance
• Service Improvement: To analyze usage patterns and enhance our services
• Marketing: To send relevant updates and promotional materials (with your consent)

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our payment services contract
• Legal Obligation: Compliance with EU and Dutch financial regulations (PSD2, AML, GDPR)
• Legitimate Interest: Fraud prevention, security monitoring, and service improvement
• Consent: Marketing communications and optional features (you can withdraw anytime)

5. Data Sharing

We may share your personal data with:

Authorized Third Parties:

• Banking Partners: For payment processing and settlement
• Regulatory Authorities: When required by law (DNB, tax authorities, law enforcement)
• Service Providers: Cloud hosting, security services, customer support (under strict data processing agreements)
• Professional Advisors: Lawyers, auditors, and consultants
• Fraud Prevention Services: To verify identity and prevent fraudulent transactions

International Transfers:

Your data is primarily processed within the EU/EEA. Any transfers to third countries are protected by:

• EU Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Certification schemes and codes of conduct

6. Data Security

We implement comprehensive security measures to protect your data:

• Encryption: End-to-end encryption for data transmission and storage
• Access Controls: Role-based access with multi-factor authentication
• Network Security: Firewalls, intrusion detection, and monitoring systems
• Data Centers: ISO 27001 certified facilities with 24/7 physical security
• Regular Audits: Annual security assessments and penetration testing
• Staff Training: Regular privacy and security training for all employees

7. Data Retention

We retain your personal data only as long as necessary:

• Active Accounts: Throughout the duration of our business relationship
• Transaction Records: 7 years (Dutch financial regulations)
• KYC/AML Data: 5 years after account closure (regulatory requirement)
• Marketing Data: Until you withdraw consent or 3 years of inactivity
• Technical Logs: 12 months for security and fraud prevention

8. Your Rights Under GDPR

As a data subject, you have the following rights:

9. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Enable core website functionality and security
• Performance Cookies: Analyze website usage and improve performance
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Deliver relevant advertisements (with your consent)

You can manage cookie preferences through your browser settings or our cookie banner.

10. Automated Decision Making

We use automated systems for:

• Fraud Detection: AI-powered systems to identify suspicious transactions
• Risk Assessment: Automated scoring for payment authorization
• Identity Verification: Automated checks against sanctions lists

You have the right to request human review of any automated decision that significantly affects you.

11. Children's Privacy

SoPayment services are not intended for individuals under 18 years old. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will:

• Notify you of significant changes via email or website banner
• Provide 30 days' notice for material changes
• Maintain previous versions for reference

13. Contact Information