Privacy Policy

Short Summary of this Policy

2. LEGAL BASIS FOR DATA PROCESSING

Walletto processes Client data on the legal basis of:

• In accordance with Article 6 (1)(b) of General Data Protection Regulation. Necessity for performance of a contract with Client and to comply with our regulatory requirements when performing pre-contractual steps after Clients request. The data is processed to open an Account for the Client and to enable Walletto to execute Client’s payments.
• In accordance with Article 6 (1)(c) of General Data Protection Regulation – Necessity for compliance with a legal obligation to which the controller (Walletto) is subject. This legal basis is used by Walletto when conducting KYC and other due-diligence procedures when opening an account for Client as also after business relationship has been established with the Client to execute the payments, conduct transaction monitoring, comply with reporting requirements and ongoing due-diligence requirements (Sanction screening and risk assessment).
• In accordance with Article 6 (1)(a) of General Data Protection Regulation – Your consent. This is applicable to Walletto’s use of Cookies as also your contact information processing for contacting you regarding new product or service offers by Walletto.

3. DEFINITIONS

'Client' The following definitions when used in this Privacy policy have the following meanings: means any natural person who uses, has used or has expressed a wish to use the Services or is in other way related to the use and/or user of any of the Services and/or has any other relationship with Walletto.

'Data Controller' means anyone who alone or jointly with others determines the purposes and means of the Processing of Personal Data. For the Processing of Personal Data described in these Principles, Walletto is the Data Controller.

'Data Processor' means anyone who Processes Personal Data on behalf of the Data Controller.

'Data Protection Legislation' means the applicable EU and national data protection legislation that Walletto is subject to, for example, Regulation (EU) 2016/679 (General Data Protection Regulation or the GDPR).

'EU/EEA' means the European Union/European Economic Area.

'Personal Data' means any information directly or indirectly related to the Client.means any operation or set of operations performed with regard to Personal Data, whether or not performed by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, use, combination, erasure or destruction.

'Processing' means any operation or set of operations performed with regard to Personal Data, whether or not performed by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, use, combination, erasure or destruction.

'Regulatory Legislation and Obligations' means the applicable legal acts that Walletto is subject to, for example, relating to anti-money laundering, banking secrecy, commercial activity, data protection, taxes, bookkeeping, e-money, payment, e-money issuing and payment services.

'Services' means Walletto provided services to Client, for example account opening application review and correspondence, e-money issuing services, payment services and payment card issuing services.

'Account' means a Walletto account which is assigned to Client in order to receive Services.

4. SCOPE OF PRIVACY POLICY

This Privacy Policy describes how Walletto collects, uses, stores, shares and protects your Personal Data whenever you use Services through the Website, using our issued payment card, sending or receiving payments or by corresponding with us (for example by email or by filling messaging form on the Website).

We assume that you have carefully read this document and understand it. This Privacy Policy is an integral part of Walletto ’s General Terms and Conditions.

Walletto can change this Privacy Policy from time to time. All Privacy Policy changes will be posted on Website additionally sending you an email informing about the update. Continued use of Walletto’s services implies you have read the revised Privacy Policy.

Processing of Client verification data

In order to receive Walletto Services you must verify your identity. We verify you by the Personal data you provide during registration. However such Personal data must be confirmed, therefore in addition, for verification purposes we also rely on verification services, managed and provided to us by our service providers.

While exercising this verification step, you will be requested to upload your ID document. You will undergo facial verification. For the mentioned purposes we receive and rely on a certain confirmation from our service providers that your identity is verified. Please note, that under the applicable laws Walletto is obligated to collect and store all data received during Client identification and verification process therefore scanned copies of ID documents, data related to facial recognition and other information will be stored by Walletto in accordance with AML laws and Regulatory legislation.

Walletto will request to provide further information that will allow Walletto to reasonably identify you and verify your identity. Walletto reserves the right to contact you and request to provide more information or approve that provided information is up-to-date and valid.

Walletto processes data gathered during Client’s verification in order to comply with regulatory and legal obligations as well as to ensure that Clients are not attempting to create additional Accounts or to commit fraudulent actions. Refusal to undergo ID and facial verification will terminate your Account opening process.

All Personal data you provide for verification process shall be provided directly by you to our service provider performing your verification and therefore processing of such data shall be covered by the policies of such service provider. You should carefully review privacy policies of such Service provider before starting the verification process.

While you are using our Services and Account we are collecting the following information:

• History of transactions (date, information of payer and payee, amount of transaction) is processed in order to: (i) to provide further updates and improvements, (ii) ensure compliance with a legal obligations;
• Messaging history, including, but not limited to, claims and complaints made by you is processed due to the performance of obligations regarding provision of Services. Please note that we identify you by email, which you have submitted during registration process. When you submit your request always provide your email. In other case we will not be able to identify you properly and submit the information requested by you or to fulfill your request;
• Your behavior while using Account (your clicks, visited sections) in order to ensure the improvements of functionality of Website;
• Your payment card information: date of issue and expiry date in order to provide you Services;
• Message content: if you include a message with your payments, the content of that massage is stored by Walletto;
• Cookies: like most of Websites and mobile applications we use cookies. Please see information on cookies we use in our cookie policy.

Walletto processes Personal Data collected while using Services and Account on the following legal basis:

• Conclusion and performance of contractual arrangements and obligations between Walletto and the Client; and
• Pursuance of legitimate interests of Walletto, as controller and manager of Webpage platform;
• for compliance with a legal obligation to which Walletto is subject.

In providing personal data of any individual other than yourself to us during the use of our Services, you agree that you have obtained a consent from such individual to disclose their personal data for collection and use. By providing such Personal data to us you bear all the responsibility towards such individual if you have not received proper consents for such provision and you undertake to indemnify us for any liability which may appear due to unlawful provision and/or disclosure of personal data.

6. OTHER PURPOSES FOR USE OF PERSONAL DATA

Developing the Website

We use Personal data to conduct research and development of our Website and Services in order to provide you and others with a better, more intuitive and personalized experience, drive membership growth.

7. PERSONAL DATA RECEIVED FROM THIRD PARTIES

We collect and receive your Personal data from yourself, as well as from the following sources:

• We work closely with third parties in order to help us deliver our Service to you. These third parties are business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, fraud prevention agencies, customer service providers and developers. Information we collect about you from such parties can include credit search information, information which helps us to verify your identity or information relating to your payment transactions.
• Other legal sources, such as public registers, internet search engines, public sources such as social media.

If you are a beneficial owner, shareholder, representative or employee of our corporate client we are collecting your Personal data in order to fulfill legal and regulatory obligations. Your Personal data is provided to us by the representatives of the company where you hold a certain position. Personal data received under this clause is processed in accordance to the provisions of this Privacy policy and you have all the rights of the Data subject listed herein in this Privacy policy and in the applicable laws.

Our Legal Obligation to Use or Disclose Personal Data

As a regulated financial institution, we can be asked to share your Personal Data to state and public authorities.

We will only do so when we are legally required to provide information or when we need to take legal action to defend our rights, as well as the cases, where we have a belief in good faith that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable law, regulation, legal process or enforceable governmental request, enforce applicable General Terms and Conditions, including investigation of potential violations, detect, prevent or otherwise address fraud, security or technical issues.

Other

Walletto may partner with other financial institutions, such as Banking, credit and financial services partners, including banking partners, banking intermediaries, credit companies and international payments services providers. With their help we are able to provide you with a larger scope of Services or better quality ones. When we will offer such service to you, you will be asked to consent for data processing.

9. YOUR RIGHTS

You are entitled to the following rights regarding the protection of your Personal Data:

• The right to request access information we process about you: this right enables you to receive a copy of the personal data we hold about you;
• The right to request to correct incorrect / inaccurate information about you: this right enables you to have any incomplete or inaccurate Personal data we hold about you to be corrected. Please note that we need to verify the accuracy of the new data you provide to us.
• The right to request to transfer all or part of the Personal data: This right enables you to ask us to provide you with your Personal data in a structured, commonly used, machine-readable format, which you can then transfer to other appropriate data controller. Note that this right only applies to automated information which you initially provided for us to use and consented for it use or where we used the information to perform a contract with you.
• The right to request erasure of Personal data: This right enables you to ask us to delete or remove personal data where there is no legitimate reason for us to process it, or if you have successfully exercised your right to object to processing (as described in paragraph 9 herein below). Please note that Walletto as a regulated financial institution is obligated under the applicable laws regarding prevention of money laundering and terrorist financing as well as of Law on Electronic Money and Electronic Money Institutions of the Republic of Lithuania to retain certain information you have provided for a number of years, therefore we are not always able to comply with your request of erasure for the mentioned reasons. We will notify you at the time of your request if it the situation is as described.
• The right to request restriction of data processing: This right enables you to ask us to suspend the processing of your personal data in the following cases:
• if you want us to establish the data accuracy;
• where our use of the data is unlawful but you do not want us to erase it;
• where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims;
• you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Please note that such requests can lead to a situation that we are unable to perform our contractual obligations towards you or enter into a contract with you. If this would be the case we will notify you about it.

• The right to object to processing of Personal Data when processing is carried out on the basis of legitimate interest: This right can be exercised in a situation where we are relying on our legitimate interest (or those of a third party) but in your particular situation such processing impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. Please note that Walletto as a regulated financial institution is obligated under the applicable laws regarding prevention of money laundering and terrorist financing as well as of Law on Electronic Money and Electronic Money Institutions of the Republic of Lithuania to process your certain Personal data for compliance purposes, therefore in some cases, we can demonstrate that we have compelling legitimate grounds to process your Personal data which override your rights. Please note that requirements of the mentioned laws supersede any right to objection under applicable data protection laws. If you object to the processing of certain data then we may not be able to provide you Services and it is likely we will have to terminate your account.
• To exercise any of the rights mentioned above, please reach out to our client support team via email of by filling request form on our Website or contact our Data Protection Officer as indicated below. We will ask you to verify your identity and for more information regarding your request.

10. HOW LONG DO WE KEEP YOU DATA

Walletto as a regulated financial institution is obligated under the applicable laws regarding prevention of money laundering and terrorist financing as well as of Law on Electronic Money and Electronic Money Institutions of the Republic of Lithuania to retain your Personal data for a number of years:

• Client identification data and verification data – 8 (eight) years after termination of the contract relations;
• Business correspondence with the Client – 5 (five) years after termination of the contract relations;
• History of transactions and related documents confirming the transaction – 8 (eight) years after the execution or completion of the transaction.

Provided data retention timeline can be extended for up to 2 (two) years upon reasoned instruction of a competent authority.

We therefore use this retention requirement as a benchmark for all personal data that we receive from you. In order to not hold your information for longer than is strictly necessary we will not hold any of your personal data for more than 8 years after the termination of our business relationship.

11. COMPLAINTS

If you feel that Walletto has breached this policy or processed your data incorrectly, you should send a request or complaint directly to Walletto by sending an e-mail to dpo@walletto.eu or a letter to our office at Žalgirio str. 92-222, LT-09303, Vilnius, Lithuania.

Please note that Walletto identify you by personal data and e-mail, which you have provided to Walletto when you signed up for the services. When you submit your request always provide your personal details and sent your request via e-mail you have submitted when you signed up for the services. In other case we are unable to identify you properly and submit the information requested by you or to fulfill your request.

Walletto will review the complaint and send you response within 15 working days, or inform you that we need more time to provide you with an extensive response.

If for any reasons Walletto’s answer does not satisfy you, have the right to lodge a complaint to the national Data Protection Agency (DPA) in the country of your residence or to Lithuania State Data Protection Inspectorate (https://vdai.lrv.lt/en/) at ada@ada.lt

We would, however, appreciate the chance to deal with your concerns before you approach the DPA and find a solution at your satisfaction. So please contact us in the first instance.