RAKUTEN EUROPE BANK, S.A. PRIVACY NOTICE (FACTORING)

This privacy notice describes how Rakuten Europe Bank, S.A., 2 rue du Fossé, L-1536 Luxembourg ('we', 'us') processes and collects personal information about you, how we use and protect this information, and your rights in relation to this information.

This notice serves to inform you in case we have received your personal data from a business partner in the course of a factoring relationship. Factoring is a financial transaction in which our business partner sells to us the right to receive payment from you for certain invoices. As we entrust the same firms as our business partner with the ongoing collection of those invoices, this transaction between us and our business partner does not put any new obligations on you and generally does not affect the way you have to pay your invoices.

However, in the course of the factoring relationship, we receive certain personal data about you, mainly in order to evaluate the receivables against you. Therefore, we would like to explain herein, how we use this data. This privacy notice applies to all personal information we collect or process about you. Personal information is information, or a combination of pieces of information that could reasonably allow you to be identified.

1. PERSONAL INFORMATION WE USE

We receive personal information about you from our business partner. The categories of information that we receive about you are:

  • (a) identification data, such as your name, date of birth, contact details (e.g. telephone number, email address, postal address)
  • (b) information relating to the invoice we purchased from our business partner (invoice date, sale type, currency, gross value, instalment) credit score and information related to the payments you make to settle certain invoices through our business partner.

2. SPECIAL CATEGORIES OF PERSONAL DATA

We do not collect/process any special categories of personal data (such as personal information that relates to your religious beliefs, political opinions, health).

3. HOW WE USE YOUR PERSONAL INFORMATION AND THE BASIS ON WHICH WE USE IT

We use your personal information for:

  • (a) risk mitigation (we evaluate the probability of repayment of the invoice to evaluate the price at which we purchase the invoice from our business partner)
  • (b) business planning (to assess the success of our factoring activities regarding certain categories of debtors, for instance according to their country of residence, and determine our commercial objectives and actions)
  • (c) regulatory requirements (our regulator requires that we store proper records on all beneficiaries of our services)
  • (d) the recording in our accounts of settlement of certain invoices.

We must have a legal basis to process your personal information. Where we process your data under c) above, the legal basis for processing is compliance with a legal obligation we are subject to. Otherwise, the legal basis will be to meet our legitimate interests. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

4. YOUR RIGHTS OVER YOUR PERSONAL INFORMATION

Depending on the circumstances, you have certain rights regarding your personal information, subject to local law. These include the following rights to:

  • access your personal information
  • rectify the information we hold about you
  • erase your personal information
  • restrict our use of your personal information
  • object to our use of your personal information
  • receive your personal information in a usable electronic format and transmit it to a third party (right to data portability)
  • lodge a complaint with a data protection authority.

We must have a legal basis to process your personal information. Where we process your data under c above, the legal basis for processing is compliance with a legal obligation we are subject to. Otherwise, the legal basis will be to meet our legitimate interests. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

5. AUTOMATED DECISIONS ABOUT YOU

We may automatically process your personal information to make decisions or conduct 'profiling' about you. This involves using software that is able to evaluate your personal aspects and predict risks or outcomes. We carry out this automatic processing, for example, for the purposes of deciding whether to purchase the invoice from our business partner or not. These types of decisions are solely relevant for the relationship between us and our business partner and will not have legal or similar effects for you.

6. INFORMATION SHARING

We may share your personal information with third parties under the following circumstances:

  • Service providers and business partners. We may share your personal information with our service providers and business partners that perform business operations for us. For example, Arvato or other collection agencies from time to time.
  • Rakuten Group companies. Rakuten Group, Inc. is our parent company. We work closely with Rakuten Group, Inc. and other businesses and companies that fall under the Rakuten Group family. A list of companies within the Rakuten Group can be found here: https://global.rakuten.com/corp/about/company/.
  • Law enforcement agencies, courts, regulators and government authorities. We may share your personal information with these parties where this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
  • Asset purchasers. We may share your personal information with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this privacy notice.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on "International Data Transfers" below for more information.

7. INFORMATION SECURITY AND STORAGE

We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.

8. RETENTION

We will keep your personal information at least 10 years from the business transaction with our business partner, which corresponds to the prescription period for commercial claims.

We will only retain your personal information after this time if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require your personal information to be retained.

9. INTERNATIONAL DATA TRANSFERS

For the purposes of our factoring transactions, your personal information will not be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information

10. CONTACT US

Rakuten Europe Bank S.A. is the controller responsible for the personal information we collect and process. If you have questions or concerns regarding the way in which your personal information has been used, please contact customerinquiry@bank.rakuten.eu.

Our Data Protection Officer can be contacted at: eudpo@rakuten.com.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your data protection authority or to the data protection authority of Luxembourg, using their website https://cnpd.public.lu/en/particuliers/faire-valoir/formulaire-plainte.html.

11. CHANGES TO THE NOTICE

We may modify or update this privacy notice from time to time.

If we change this privacy notice, we will notify you of the changes. Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).