Personal Data

Information on personal data processing for Bambora merchants

When you become a Bambora merchant, personal data (personal identifiable information) about you will be processed by Bambora. The processing will be conducted for the purpose of providing you or your company with Bambora’s solutions (the “Purpose”). Bambora AB, reg. no. 556233-9423 (“Bambora”) will process your or the representatives’ of the company you represent personal data (the “Data”) as data controller. Bambora is a payment institution with a license to provide payment services and is under the supervision of the Swedish Financial Supervisory Authority. The processing of the Data is required in order for you or your company to become a Bambora merchant.

What type of Data Bambora collects depends on what type of legal structure you conduct your business in. If your business is conducted under a separate legal entity, such as a limited liability company (Sw. aktiebolag), a trading partnership (Sw. handelsbolag) or any other independent legal entity, the only personal data we collect from you relates to the board members and/or owners of the company and contact details of your representatives. The Data mainly includes name, social security number, address, percentage of ownership, address, identification card and whether the individual or someone connected to the individual is a politically exposed person. If you provide personal data regarding someone else, we encourage you to and rely on you to advise those individuals about this information. However, if you conduct business as a sole trader (Sw. enskild näringsidkare), your company registration number may be your social security number depending on in which country you are based. In such case any information relating to your business that we receive access to will be considered personal data. We may also, irrespective of the legal structure of your business, collect personal data from third parties within the payment transaction industry and publicly accessible sources.

Bambora’s legal basis for the processing of the Data varies. If you do not conduct business as a sole trader, we will mainly process the Data in order to fulfil legal obligations. Certain processing activities are however based on requirements within the payment transaction industry without being obligations originating from law, while certain processing activities are necessary in order for us to fulfil our obligations towards your company. In such case, Bambora processes the Data based on its legitimate interest to be able to conduct its business and provide you with the payment services. Where you act as a sole trader, Bambora’s legal basis for the processing of the Data will be the same as above, but also to be able to enter into and perform our merchant agreement with you.

Bambora may share the Data with other companies within the Bambora Group in order to achieve the Purpose. The Data may also be shared with government authorities and Bambora’s trusted partners to achieve the Purpose. Such partner’s may for example be other actors within the payment transaction industry that require information from us or the data processors that Bambora has engaged. These other companies may reside in countries outside the EU/EEA. In case such country is not regarded by the European Commission as a country with adequate level of protection of personal data, such transfer will normally be based on the standard data protection clauses for transfer of personal data to countries outside of the EU/EEA adopted by the European Commission, see articles 45-46 of the GDPR. A copy of these standard data protection clauses can be found here.

Bambora will process the Data for as long as you or your company remains a Bambora merchant, unless laws or regulations to which Bambora is subject obligates or entitles Bambora to continue the processing. In some cases, where the Data is no longer necessary to fulfil the Purpose, the processing might cease earlier. The Data will in such case be removed from all databases within the Bambora Group.

In case you have any questions regarding Bambora’s processing of the Data, please contact us at support@bambora.com or call +46(0) 10 10 66 000.
You may also contact Bambora’s Data Protection Officer who can be contacted by e-mail at dpo@bambora.com. You can also use these contact details if you would like to exercise any of your rights as a data subject under the GDPR. Please note that the rights under the GDPR are not unconditional. Therefore, an attempt to invoke any of the rights might not lead to an action. Further, in some cases, the requirement by you to invoke a right may lead to that we cannot enter into, or provide our services under, a merchant agreement. Your rights under the GDPR include the following

- Right to access – According to article 15 of the GDPR, you are entitled to access the Data and receive certain information about the processing. That information is provided in this document.

- Right to rectification – According to article 16 of the GDPR, you are entitled to obtain rectification of inaccurate Data concerning you and to have incomplete personal data completed.

- Right to erasure – Under certain circumstances, you are according to article 17 of the GDPR entitled to have the Data erased (the so-called “right to be forgotten”).

- Right to restriction of processing – Under certain circumstances, you are according to article 18 of the GDPR entitled to restrict the processing of the Data that Bambora carries out.

- Right to data portability – You are according to article 20 of the GDPR entitled to receive the Data (or have the Data directly transmitted to another data controller) in a structured, commonly used and machine-readable format from Bambora.

- Right to object – According to article 21 of the GDPR, you are entitled to object to certain processing activities conducted by Bambora on the Data, such as all Bambora’s processing of the Data based on Bambora’s legitimate interest. Please note that in relation to processing based on Bambora’s legitimate interest, we might still have a compelling legitimate interest to continue to process the Data.

Finally, you also have the right to lodge a complaint with the supervisory authority, which in Sweden (the seat of Bambora) is Datainspektionen/Integritetsskyddsmyndigheten.