Privacy Notice for Brite’s services 

Welcome to our Privacy Notice for Brite´s services!

Thank you for using our website and services.

Here you will find information about:

• what personal data we process about you,
• why and how we do it,
• where it came from,
• who is involved and with whom we may share it with, and
• how it is lawful for us to do it.

Personal integrity is important to us, and we take your privacy seriously. We encourage you to read
this Privacy Notice. We hope it can help you make informed decisions. By reading this Privacy Notice
we hope you feel confident that we work hard to live up to your expectations.

We may provide this Privacy Notice in languages other than English. If there are any discrepancies
between other language versions and the English language version, the English version is authoritative.

Please contact us if you have any questions regarding this Privacy Notice or questions in general
regarding your personal data. You can always contact us by sending an email to
dataprotection@britepayments.com.

1. About us

Brite AB, corporate registration number 559116-1632, with registered address at Linnégatan 5, 114 47
Stockholm, Sweden (‘Brite’, ‘we’, ‘us’), is a payment service provider that provides payment services
including payment initiation services and account information services (the ´Services´). Brite is licensed
by and subject to the supervision of the Swedish Financial Supervisory Authority (Sw.
Finansinspektionen).

In connection with these services, Brite group companies Brite Payments Spain SL (B01593185) and
Brite AB Zweigniederlassung Berlin (HRB 244083B) also act as a data controller and process your data
in accordance with this Privacy Notice. Any reference made to ‘Brite’, ‘we’, ‘us’, ´Brite group companies´ included in this Privacy Notice shall mean the group of companies which directly or
indirectly controls, is controlled by, or is under common control with us.

2. Our role

In this Privacy Notice we describe what personal data we collect and process of you as an ´End-user´
and an individual that contacts our support via our support channels such as our website.

End-users

Brite is the data controller for the processing of your personal data when you use our payment services,
or any related services provided by us, for payments to or from our merchants (´End-user´,´you´).

Please note that your payment account provider (normally the bank where you hold the account used
for payment transactions initiated through Brite) and the merchant you are transacting with, are
separate and independent controllers for the processing of personal data in connection with the
products and/or services they provide to you and their business activities. Please contact them directly
for information on their processing of your personal data.

Website visitors

We are also the data controller for personal data processed when someone uses our website or
otherwise contacts us through our support channels.

3. Who to contact?

You are welcome to contact us at support@britepayments.com or
dataprotection@britepayments.com if you have any questions about this Privacy Notice, our use of
your personal data or if you wish to exercise your rights

4. Your rights 

You have several rights relating to the processing of your personal data.

You are entitled to receive information about what personal data we use about you and what we do
with this data and also, to a certain extent, to check your data. You are thus entitled in certain cases
to receive data or have it rectified, erased, blocked, or moved. You are also entitled to object to certain
kinds of use of your data or revoke your consent to it being used. You are always entitled to file a
complaint with the Swedish Authority for Privacy Protection or the data protection authority in your
homeland if you think that we have used your data in an unpermitted way.

You can find out more about your rights under each heading below. Please note that there are
exceptions to the rights below, so access may be denied, for example where we are legally prevented
from making a disclosure.

You can contact us at any time if you wish to exercise your rights by contacting us on
dataprotection@britepayments.com.

Our responsibility for your rights

We are obliged to respond to your request to exercise your rights within one (1) month from being
contacted by you. We are entitled to extend this period by a further two (2) months if your request is
complicated or if we have had a large number of enquiries.

If we consider that we cannot do what you want us to do, we are obliged to notify you, no later than
within one (1) month from receipt of your request, of why we cannot do what you want us to do and
inform you that you are entitled to file a complaint with the supervisory authority.

All information, communication, and all of the measures that we implement are free of charge for you.
However, we are entitled to levy an administrative charge to provide you with the information or
implement the measure requested, or to refuse to accommodate your request, if what you have asked
is manifestly unfounded or unreasonable.

Right to be informed

You have the right to be informed of how we process your personal data. We do this through this
Privacy Notice, by service-specific FAQs, and by answering your questions.

Right of access

You are entitled to ask for a register extract relating to our use of your personal data. You are also
entitled to receive a copy of the personal data that we use free of charge. We are entitled to levy an
administration charge for any additional copies. If you make a request in an electronic format (e.g. by
email), we will give you the information in a commonly used electronic format.

Right to rectification

We will, at your request or on our own initiative, rectify, de-identify, erase or supplement data that
we discover to be inaccurate, incomplete or misleading. You are also entitled to supplement it with
additional data if anything of relevance is missing.

Right to erasure

You are entitled to ask us to remove your personal data if there are no longer any acceptable reasons
for us to use it. The data shall therefore be erased if:

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,
• we are using your data on the basis of your consent and you revoke this and there is no other legal ground for the processing,
• you object to our use of your data which has been used following a balance of interests and we do not have important interests that override your interests or rights,
• you object to our use of your personal data for the purposes of direct marketing,
• we have used the personal data in an unpermitted way,
• we have a legal obligation to erase the personal data, or
• you are a child and we have collected the personal data in conjunction with an offer of information society services.

However, there may be a statutory requirement or other substantially compelling reason that means
that we cannot immediately erase your personal data. We will then stop using your personal data for
purposes other than to comply with legislation or that are not necessary for any other substantially
compelling reason.

Right to restriction of processing

You are entitled to request restriction of our processing when:

• you consider that your data is inaccurate and you have requested rectification, during the period when we are investigating the accuracy of the data,
• the use is unlawful and you do not wish to have the data erased,
• we, as controllers, no longer need the personal data for our purposes of use, but you need it to be able to establish, exercise or defend a legal claim, or
• you have objected to its use, pending a check about whether our important interests outweigh your interests.

Right to object

You are entitled to object to such use of your personal data that we do on the basis of a balance of
interests or a general interest. If you object to such use, we will only continue to use the data if we
have important reasons to continue to use it that outweigh your interests.

Right to data portability

You have a right to data portability. This means a right to receive some of your personal data in a
structured, commonly used and machine-readable format and be able to transfer this data to another
controller. You only have a right to data portability when the use of your personal data is automated
and we base our use on your consent or on a contract between you and us. This means that you, for
example, are entitled to receive and transfer all of the personal data input by you to create your user
account with us.

Right to object to automated decision making

You have the right to object to an automated decision made by us, if the automated decision produces
legal effects or similarly significantly affects you. Please read more under section 12 in this Privacy
Notice.

Your right to complain to a supervisory authority

You are entitled to lodge a complaint about our processing of your personal data to the Swedish
Authority for Privacy Protection, which is the supervisory authority for Brite. You can also file a
complaint with the data protection authority in your homeland within the EU.

5. What personal data do we collect and process about you?

• Identifying information: name (first and last name), personal identity (ID) number, date of birth, postal address, gender, email address, phone number.
• Financial information and other identifying information: sending and/or receiving bank, IBAN, bank account number, name of account, bank account ownership, source of funds and amounts related thereto, proof of funds, account balance at the time of payment, account information such as account history, information about credits, information about purchases (such as amount, time, type of transaction and in some cases type of goods and/or place of purchase), and other financial information derived from your accounts, information identifying an end-user´s payment such as order id, message id, payment reference id, transaction id and the time when the transaction was made, and customer id identifying you as a user in our system. The IDs that identify you and your payment are generated in our systems when you use our service.
• Behaviour information: how you use our payment service and/or how website visitors interact with our websites.
• Work related data: such as employer and title.
• Geographical information: County, country.
• Transaction and correspondence history.
• Device data: such as IP-number, type of device, operating system and browser information.
• Information related to your contacts with our customer service: information provided by you through our contact form on our website, and email correspondence.
• Information from external sanction lists and PEP/RCA lists: sanction lists and lists of persons constituting politically exposed persons (“PEP”) or relatives and close associates of PEP (“RCA”) include information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the list in question.

6. Why do we process your personal data?

We process your personal data so that we can, in the best possible way, provide you with the services
we offer for the following overall purposes. More information is provided under each purpose that you
can read to find about, among other things, what personal data we use to achieve the purpose, the
way in which we use the personal data and how long we will process the personal data for the purpose
in question.

Your personal data is used for the following overall purposes, which are further explained below:

• For the provision of our services to you.
• For the administration and provision of support and customer services to you.
• To enable us to perform Customer Due Diligence (CDD), Enhanced Due Diligence (EDD) checks and Ongoing Due Diligence (ODD) and to fulfil our legal obligations.
• Administration in conjunction with corporate acquisitions, restructuring, etc.
• To defend and attend to legal claims.
• To market and sell our services to you.

We do not use your personal data for any other incompatible purpose.

Providing us with your personal data is voluntary, but necessary to enable you to use our service. It will not be possible to execute payments if you do not provide personal data.

Administration and provision of our services to you

What we do

We process the following personal data about you to enable us to execute payments initiated by
you, and also to be able to provide and administer our services in accordance with our conditions
of use. This includes, for example, verifying that you are over such age that is allowed for the
access to the Services and identifying you before a transaction is executed. We obtain the
following information to enable us to determine the identity of our users, contact them if
required, and also the financial information required to be able to provide the services.

Personal data

• Identifying information: name (first and last name), e-mail, phone number, personal identity (ID) number, date of birth, postal address.
• Financial information and other identifying information: sending and/or receiving bank, IBAN, bank account number, name of account, bank account ownership, account balance at the time of payment, account information such as account history, information about credits, information about purchases (such as amount, time, type of transaction and in some cases type of goods and/or place of purchase), and other financial information derived from your accounts, information identifying an end-user´s payment such as order id, message id, payment reference id, transaction id and the time when the transaction was made, and customer id identifying you as a user in our system. The IDs that identify you and your payment are generated in our systems when you use our service.
• Transaction and correspondence history.
• Behaviour information: how you use our payment service.
• Geographical information: County, country.
• Device data: such as IP-number, type of device, operating system and browser information.
• Any other information provided to us by you.

Legal basis

We are entitled to use your data to perform our contract with you.

Storage period

Two (2) years from when Brite’s service was last used. The data may be saved for longer if it is
required to establish, defend, or exercise a legal claim or for the duration of the contractual
relationship and thereafter for a maximum of ten (10) years based on statutes of limitations. Data
that Brite has a legal obligation to retain under bookkeeping laws is generally retained for 7 years.

Administration and provision of support and customer services to you

What we do

We process your personal data in order to provide administrative support if you for example
contact us with any questions regarding our services through any channel. Such contact may occur
through e.g. e-mail to one of our specified e-mail addresses (dataprotection@britepayments.com
and support@britepayments.com), through our chatbox or through the contact forms on our
website.

You have the right to object to processing of your personal data based upon a legitimate interest
as legal basis. Please see section 4 for more information about your rights.

Personal data

• Identifying information: name, e-mail, phone number.
• Work related data, such as employer and title.
• Geographical information: County, country.
• Transaction and correspondence history.
• Financial information and other identifying information: IDs that identify you and your
• payment in our systems such as customer ID, payment reference ID, proof of payment
• documentation, and IBAN.
• Device data, such as IP-number.
• Any other information provided to us by you.

Legal basis

After a balancing of interests, we have assessed that Brite’s interest of processing your personal
data in order to administer the provision of our support and customer services overrides your
interest of protection of your privacy. Hence, the legal basis is legitimate interest.

Storage period

Two (2) years from the date when Brite collected your data or the date when you last contacted
us, whichever is later. The data may be saved for longer if it is required to establish, defend or
exercise a legal claim.

To market and sell our services to you

What we do

We process your personal data to market Brite and our services. We may use your data to e.g.
send our newsletter or directly contact you after the completion of one of our forms on our
website (www.britepayments.com). The purpose of our marketing measures is to send you direct
advertisements as well as to contact you with information about our services.

You have the right to object to processing of your personal data based upon a legitimate interest
as legal basis. When our processing of your personal data is based on your consent, you have the
right to withdraw your consent at any time. Moreover, you can easily opt-out from any direct
marketing performed by Brite, e.g. if we send our newsletter to you. Information on how to optout will be provided in each communication to you and is further explained in section 4 below,
together with more information regarding your rights.

Personal data

• Identifying information: name, e-mail and phone number.
• Work related data, such as employer and title.
• Financial information: Account information.
• Device data, such as IP-number.
• Any other information provided to us by you.

Legal basis

After a balancing of interests, we have assessed that Brite’s interest of offering its product and
services that meet the needs and desires of its customers overrides your interest of protection
of your privacy. Hence, the legal basis is legitimate interest.

In relation to direct marketing, we base our processing on your consent.

Storage period

Two (2) years from the date when Brite collected your data or the date when you last contacted
us, whichever is later. You may at any time object to our processing of your personal data for
the purpose of direct marketing. If you object, you will no longer receive direct marketing. For
more information about your rights, see section 4.

To enable us to perform Customer Due Diligence (‘CDD’), Enhanced Customer Due Diligence (‘EDD’) checks and Ongoing Due Diligence (‘ODD’) checks and to fulfil our legal obligations

What we do

We process the following personal data about you to enable us to perform CDD and EDD and
ODD checks as applicable, including anti-money-laundering checks and checks against sanctions
and PEP/RCA lists.

We may also be required to report statistics to authorities on inter alia fraudulent transactions
and report suspicious payments to the police or similar authorities.

Personal data

• Identifying information: Name, personal identity (ID) number, date of birth, postal address,
  gender.
• Financial information and other identifying information: Account information, source of
  funds and amounts related thereto and customer-ID.
• Information from external sanction lists and PEP/RCA lists: sanction lists and lists of persons
  constituting politically exposed persons (“PEP”) and relatives and close associates to PEP
  (“RCA”) include information such as name, date of birth, place of birth, occupation or
  position, and the reason why the person is on the list in question.

Legal basis

We have a legal obligation in accordance with the Measures against Money Laundering and
Terrorism Financing Act (2017:630) to perform these checks. To the extent the information
constitutes sensitive information, the legal basis is necessary for reasons of public interest (article
9(2)(g) GDPR). The sensitive information may contain e.g., information about political opinion in
PEP/RCA lists.

Storage period

Your personal data will be processed for this purpose as a minimum for five (5) years and for up
to ten (10) years following the date of termination of the relationship for the purpose of
preventing, detecting, and investigating money laundering, terrorist financing and fraud, in
accordance with legal requirements.

Administration in conjunction with acquisitions, restructuring, etc.

What we do

If Brite were to be restructured, for example split into several different operations, or if an
external party were to acquire Brite or parts of our operation, Brite will transfer your personal data together with the personal data of other users to the acquiring company. This company will,
in such cases, continue to use your personal data for the same purposes as specified by us in this
Privacy Notice unless you receive other information in conjunction with the transfer.

Personal data

All of the personal data we process about you in accordance with this Privacy Notice, with the
exception of sensitive personal data that will not be transferred, might be processed for this
purpose depending on the circumstances.

Legal basis

We are entitled to use your data on the basis of a balance of interests as we consider that our
interest in facilitating an acquisition or restructuring process outweighs your interest in protecting
your personal data. However, a precondition for this is that the acquiring company conducts an
operation similar to Brite.

Storage period

If Brite ceases to exist (e.g., owing to a merger, liquidation or bankruptcy), we will erase your
personal data unless we need to save it in order to fulfil statutory requirements.

If Brite is bought by an acquiring company or is split up in conjunction with restructuring, we will
continue to save and use your personal data in accordance with the provisions of this
Privacy Notice, unless you receive other information in conjunction with the transfer.

Defend and deal with legal claims

What we do

If a dispute arises, we are entitled to use your data for the purpose of establishing, defending, or
exercising the legal claim.

Personal data

• All of the personal data we process about you in accordance with this Privacy Notice might
• be processed for this purpose depending on the circumstances.

Legal basis

We are entitled to use your data on the basis of a balance of interests.

Storage period

The data is saved for the entire contractual relationship and for up to twelve (12) months following
termination of the contract. The data may be saved for longer if it is required to establish, defend,
or exercise a legal claim or for the duration of the contractual relationship and thereafter for a
maximum of ten (10) years based on statutes of limitations.