Privacy Notice

This privacy notice informs you, the payer (hereinafter the “Payer”), about how personal data (hereinafter “Personal Data”) is processed in connection with the current payment initiation service (hereinafter referred to as the “Service”).

DIMOCO Payments GmbH (hereinafter “DIMOCO”), Europaring F15/302, 2345 Brunn am Gebirge, Austria, a payment institution licensed by the Austrian Financial Market Authority (FMA), operates the Service on behalf of the service provider, to whom you intend to direct the payment using the Service, as identified on the payment page (hereinafter the “Merchant”).

In providing the Service, DIMOCO acts on behalf of the Merchant as a processor. The Merchant is controller under data protection laws for the processing of Personal Data in the provision of the Service.

Categories of Personal Data and source

Personal Data will be processed and stored in accordance with applicable data privacy legislation. Such Personal Data may include:

identification and contact data, such as first name, last name, email, physical address and country of the Payer and shipping address;
banking and financial data, such as the Payer’s bank, bank sort code and IBAN, as well as transaction data (such as date, time, amount, currency of the transaction or type of payment method etc.) as well as consent data regarding the execution of a payment transaction;
Information about Payer’s device and online activity when using the Service, such as Payer’s IP address, device ID and language to the extent that it is necessary to provide the Service.

If the Payer choses the option to “Pay faster next time”, certain data such as the bank, bank sort code and IBAN of the Payer, as well as information about the Payer’s device and online activity, such as the IP address and device ID, and consent status of the storage of such data is stored on the Payer’s device in an encrypted file.

Personal Data is provided either by the Payer directly when using the Service (e.g. IBAN, IP address, device ID) or transmitted by the Merchant (e.g. transaction information).

Purposes and legal basis of processing

Personal Data will be processed for the following purposes:

as necessary for the performance of the contract between the Payer and the Merchant, including the initiation of the payment order, submitting it to Payer’s financial institution for its execution in the context of providing the Service, and (as applicable) carrying out any refunds.
for the purposes necessary for protecting the Merchant’s and DIMOCO’s (as Merchant’s payment service provider) legitimate interests except where these interests are overridden by the Payer’s interest, rights and freedoms. This includes the processing of Payer’s data to combat and prevent abuse and fraud as well as promoting safety and security in the context of the Service.
as required for compliance with Merchant’s or DIMOCO’s legal and regulatory obligations under applicable laws and regulations (e.g. PSD2, AML & KYC legislation, tax law), or when requested by any competent judicial or governmental authority.

The purpose for storing the payment data when choosing the option to “Pay faster next time” is to improve the performance and end-user experience of Service and prevent the necessity to enter the payment data again for future payments based on the Payer’s consent.

Recipients of Personal Data

Personal Data will only be shared if and to the extent required for providing the Service, as described in the Payment Terms, and as required by applicable laws and regulations. This includes sharing the data with and between the Merchant, DIMOCO and Payer’s bank to provide the Service (i.e. initiation, processing and execution of the Payer’s payment order).

Personal Data may be disclosed to public authorities, government agencies and judicial authorities (i) if it is required to do so by law or in an administrative or legal process, (ii) when disclosure is necessary to prevent harm or financial loss to the Merchant or DIMOCO, (iii) in connection with an investigation of suspected or actual fraudulent or illegal activities, or (iv) to defend Merchant or DIMOCO against legal claims.

The data may also be transferred to third-party providers (data processors and sub-processors) on Merchant’s or DIMOCO’s behalf. In these cases, the third-party provider shall receive specific instructions on how to process the Personal Data and be bound by respective safeguards and processes in order to ensure processing in compliance with all applicable data processing laws and regulations and adequate security standards.

Location of processing

Personal Data may be processed in countries other than the country where it was collected, including countries outside the European Economic Area (for example, when the Payer’s bank or the Merchant are located outside the EEA). When Personal Data is transferred to countries outside the EAA that do not have an adequate level of protection, appropriate adequate safeguards will be put in place to ensure the protection of the Personal Data processed in accordance with the applicable legal provisions for the transfer of Personal Data outside the European Economic Area (e.g. Standard Data Protection Contractual Clauses under Article 46.2 GDPR).

The data stored when choosing the option to “Pay faster next time” is stored on the Payer’s device in an encrypted file.

Retention period

Personal Data will be retained for as long as necessary to deliver the Service according to the industry standards, applicable laws and obligatory retention periods (for example, transaction information is retained for a period up to 10 years according to the applicable standards and regulations, such as anti-money laundering legislation, tax law, etc.).

Rights

Payer has, within the limitations of the applicable laws and regulations, the right of information, access, rectification, erasure, restriction of processing, objection to processing and data portability. Such a request shall be directed to the Merchant acting as data controller in the context of the provision of the Service for a specific payment transaction using the Merchant’s contact information (as depicted on the Merchant website and any order documents sent to Payer).

The Payer’s consent, which is legal basis for the “Pay faster next time” option, can be withdrawn at any time by using the “Delete saved preferences” functionality right under the saved “favorite bank” information, or by deleting the browser’s cookie cache. Such withdrawal will be valid for the future processing only and may result in the unavailability of the function and bank data may have to be entered again.

Additionally, complaints can be lodged with the competent supervisory authority, if certain processing activities should be deemed not in compliance with applicable laws or regulations.

Cookie notice

In providing the Service, DIMOCO and/or its (sub-)processors may utilize the following cookies or cookie-like technologies on the payment webpages.

Functional cookies allow the website to provide further and enhanced functionalities when used and are necessary to provide the Service and its full functionalities, such as the “Pay faster next time” function. To remove this cookie stored on the Payer’s device, the “Delete saved preferences” functionality right under the saved “favorite bank” information may be used, or the browser’s cookie cache can be deleted.

Performance cookies are a type of cookie that collect information about how the Payer interacts with a payment website to monitor user behaviour, page stay times, abandonment rates and device information. Such information is stored in an anonymized way and cannot be used to identify individuals. The provided cookie management tool can be used to generally accept or decline the use of such cookies, and the choice will be stored on the Payer’s device. This data can be deleted using browser’s cache clearing mechanism.

The following cookies may be utilized when providing the Service:

Cookie: providerPreferences
Description: Stores bank selection and additional information provided in the initial payment process.
Lifespan: Persistent

Cookie: cookiePreference
Description: Stores the user’s Performance Cookie choice
Lifespan: Persistent – 6 months

Cookie: User Behavior Tracking
Description: Collects specific user interactions with the Service, such as clicks on buttons and navigation paths.
Lifespan: Session

Cookie: Page Stay Time Tracking
Description: Collects and monitors stay times on the different user facing pages part of the Service.
Lifespan: Session

Cookie: Abandonment Rate Tracking
Description: Used to identify potential drop-off points where users might leave a process.
Lifespan: Session

Cookie: User Device Information Tracking
Description: Collects information about a user’s device such as device type (e.g. Desktop Computers / Tablets / Mobile Phones), operating system information (e.g. Windows / macOS / iOS / Android / etc.) and browser type and version information (e.g. Chrome, Firefox, Safari) to ensure that the Service functions well across different platforms and to improve the accessibility and user experience of the Service.
Lifespan: Session