LAST UPDATED: April 5, 2022

TABLE OF CONTENTS

• 1. PURPOSE
• 2. CONTROLLER OF YOUR DATA PROCESSING 
• 3. PURPOSE OF THE PROCESSING
• 4. PERSONAL DATA SUBJECT TO PROCESSING
• 5. RETENTION PERIOD OF YOUR DATA
• 6. DATA TRANSFERS OR COMMUNICATIONS
• 7. EXERCISE OF RIGHTS
• 8. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
• 9. DATA PROVIDED

1. PURPOSE

This Privacy Policy details all the information that will allow you to understand how your personal data is processed within the Rewards Program.

The processing of your personal data by PayLead and Bit2Me is the result of your willingness to participate in the Rewards Program. With the intention of being transparent, when you register for the Rewards Program, we will provide you with as much information as possible about how we use your personal data and the scope of your rights (including the right to object to processing that is not strictly necessary for the provision of the Rewards Program).

2. CONTROLLER OF YOUR DATA PROCESSING 

To offer the Rewards Program, the following two entities act as Data Controllers:

• PAYLEAD, a simplified joint-stock company, with its registered office at 9, rue de Condé 33064 Bordeaux (France), registered in the Trade and Companies Register (RCS) of Bordeaux under number B 821 725 579.

• BITCOINFORME, S.L. (Bit2Me), with registered address at Calle Germán Bernacer, 69, 03203, Elche, Alicante, SPAIN, and with Tax ID (CIF): B-54835301.

3. PURPOSE OF THE PROCESSING

PayLead also analyzes your bank transaction data to offer you personalized deals based on your transaction history and spending habits. Therefore, the essence of the Rewards Program is to allow you to enhance your bank transactions to benefit from personalized and relevant offers from our partner merchants.

PayLead uses your personal data for the subsequent processing described below. You have more information on how PayLead processes your data in its privacy policy: https://www.paylead.fr/privacy/

4. PERSONAL DATA SUBJECT TO PROCESSING

Bit2Me will communicate the following data to Paylead for the provision of this service:

• A client identifier, consisting of a series of numbers and letters, specific to each user; 

• Anonymized IBAN (International Bank Account Number) (i.e., only some digits of the IBAN number); 

• The nature/type of account; 

• Name of the entity; 

• Payment account references; 

• The location, date, label, and associated anonymized PAN (last 4 digits) of the payment transactions, (including up to 6 months of transaction history);

By analyzing your transactions, PayLead also identifies and processes your consumption habits (your preferred brands, your favorite stores, the geographical areas where you usually shop, your average basket), your average salary, your exceptional income, or other life events that can be inferred from your purchases (such as weddings, births, etc.).

As part of the user support process, we may process additional personal data of any kind that you provide to us. In doing so, we will limit the information used to that which is necessary to respond to your request, and we suggest that you only provide us with the information we request for this purpose.

Regarding the six-month transaction history, PayLead needs to obtain this information as a necessary condition to provide the service, as it is essential to perform the analysis of transaction data to determine the possibility of benefiting from the different offers of the Rewards Program. If you do not wish to share your transaction history, you will not be able to participate in the Rewards Program.

5. RETENTION PERIOD OF YOUR DATA

Your personal data is used for a specific period of time, strictly limited to the purposes for which it is collected:

• Your bank transaction data is deleted after two years (from the date of the transaction) if they have not generated a reward payment. 

• Your transaction data is deleted after five years (from the date of the transaction) if they have generated a reward payment. 

When you decide to unsubscribe from the Rewards Program, PayLead will delete all your personal data, except for that related to the payment of rewards, which will be kept, duly blocked, for the aforementioned five-year period.

In addition, Bit2Me may keep certain personal data, duly blocked, for a period of ten years, if necessary to comply with regulations on money laundering and the financing of terrorism, as established in its Privacy Policy.

You have more information about the retention of your personal data by both companies in their respective Privacy Policies.

6. DATA TRANSFERS OR COMMUNICATIONS

There may be communications of data to third parties or competent authorities, for the fulfillment of legal obligations, as well as for the provision of third-party services, which will be considered as data processors with whom Bit2Me and PayLead have signed the corresponding data access agreements on behalf of third parties, having previously verified that they offer sufficient guarantees to apply appropriate technical and organizational measures, so that the processing is carried out in accordance with the requirements of the GDPR, guaranteeing the security and protection of the rights of the data subject.

7. EXERCISE OF RIGHTS

You have recognized rights of access, rectification, erasure, restriction of processing, objection, and data portability. Likewise, you are protected by the right to withdraw your consent for the processing of your data. You also have the right to lodge a complaint with the supervisory authority.

At any time, the Data Subject may exercise their rights by sending a communication, attaching a document that proves their identity and expressly indicating the right they wish to exercise, to both PayLead and Bit2Me at the addresses indicated above or by sending an email to the address dpo@paylead.fr or rgpd@bit2me.com, respectively.

8. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Both PayLead and Bit2Me have adopted the necessary technical and organizational measures to guarantee the security and integrity of the data, as well as to prevent its alteration, loss, unauthorized processing, or access.

9. DATA PROVIDED

The data collected through the different enabled channels are strictly necessary to attend to your request, which the Data Subject voluntarily communicates. The refusal to provide the data classified as mandatory will result in the non-provision or impossibility of accessing the service for which they were requested. Likewise, data may be provided voluntarily in order for services to be provided optimally. Similarly, in those cases where third-party data is provided, the Data Subject undertakes to inform them of the content of this privacy policy.

The Data Subject undertakes to communicate as soon as possible any modification and rectification of their personal data so that the information is always up-to-date.