This website is owned by Getnet Payments, S.L. (hereinafter, "Getnet" or “We”), a company with registered office at Av. Cantabria s/n, 28660, Boadilla del Monte, Madrid and Tax Identification Number B-87694410, registered in the Madrid Mercantile Registry, Volume 37910, Book 0, Page 26, Section 8, Page M-675111.


 

1. What is the purpose of this notice?

This privacy notice aims to explain how Getnet collects, processes and protects your personal data (the “Data”) in a transparent, clear and simple way.

 

2. To whom is this notice addressed?

This notice is aimed at Data Subjects whose personal information is processed by Getnet.  Specifically, we distinguish between the following types of Data Subjects, which will be referred to throughout this document:

Users: These are the Data Subjects who browse the website.

Individuals: Data subjects who request information through any of our contact channels.

Legal representatives or representatives: Data subjects representing companies or institutions that have a legal agreement with Getnet or are in the process of establishing one.

Contact individuals: Data subjects who provide services to companies with which Getnet has commercial relations of any kind.

Merchants: customers of the Getnet entities that constitute the Getnet Group.

Candidates: Data subjects who have applied for a job at Getnet. The details of the  processing can be found at the end of this notice in epigraph 9.

 

AT A GLANCE: BASIC INFORMATION

To help you understand, we have included the most relevant information in the table below. You can find more detailed information in the second layer of information below. For any clarification or additional queries, please contact our Data Protection Officer (DPO) at privacy.merchant@pagonxt.com. 

Data Controller	Getnet Payments, S.L. Postal address: Av. Cantabria 5, Edificio Alhambra, planta 2, 28660, Boadilla del Monte, Madrid.  Contact details of the Data Protection Officer: privacy.merchant@pagonxt.com.
Purpose and legal basis	Your personal data will be processed for the following purposes: i) Managing and answering requests sent to Getnet via the available email address or by any other available channel.  ii) Maintaining commercial and legal relations with the company the Data Subject represents. iii) Internal administrative purposes. iv) Inserting accepted cookies while you browse the website.  Your data will be processed based on Getnet’s legitimate interest in answering your queries if you have sent us an email or in contracting or having any kind of commercial relation with the entity to whom you are a contact to or represent. Regarding cookies your data shall be processed based on your consent. You can object to the processing based on legitimate interest by writing to privacy.merchant@pagonxt.com.
Recipients	We may share your data with third parties that provide services to us, that act on our instructions and with whom we have signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR and with other entities that are part of the Getnet group for internal administrative purposes.
Rights	You may exercise your rights of access, rectification, erasure and restriction and objection to the processing, as well as portability of your data, by sending your request to privacy.merchant@pagonxt.com.  Also, you may claim to the Spanish Data Protection Authority (more information www.aepd.com).

 

MORE INFORMATION ON DATA PROTECTION: SECOND LAYER OF INFORMATION

1. Who is the Data Controller?

Name: Getnet Payments, S.L., NIF: B87694410.

Postal address: Avd. de Cantabria 3, Edificio Arrecife panta 2, 28660 Boadilla del Monte (Madrid).

Contact details of the data controller: privacy.merchant@pagonxt.com

 

2. What type of Data do We process, where does it come from, and what are the purposes and legal basis for processing?

 

Data Subject	Type of data and origin	Purpose	Legal basis
Users	Data such as your IP or other identifiers that, although don’t allow us to uniquely identify you without additional information, are considered personal data. More information can be found on our Cookie notice.	Depending on the type of cookies you have accepted, WE will use them to improve our website, to personalize them, etc. as described in our Cookie Notice.	Consent
Individuals	Identification and professional contact data, (name and surname, email, company, phone number, job or position).	The purpose of processing the Data is to receive your questions or queries through the different channels that We provide for this purpose, managing and responding to them.	Legitimate interest in answering Data Subjects queries and in maintaining commercial relationships with the entity you represent or contact on behalf of.
Representatives and Contact individuals	Identification and professional contact data, (name and surname, email, company, phone number, job or position).	The purpose of processing the Data is so We can maintain any kind of commercial relations with the entity you represent, or you are a contact to.	Legitimate interest in processing data is to maintain any kind of relationship with the legal entity that it represents or acts as a contact for.
Merchants (when self-employed individuals)	Pseudonymized identification data		As the parent company of the Getnet group, We have a legitimate interest in processing data for internal administrative purposes, such as producing finance and audit reports.

 

You may object to any processing based on legitimate interest, sending an email to privacy.merchant@pagonxt.com.

 

3. How long do We store your Data?

 

Data subject	Conservation period
User	We process the information We collect using cookies for the periods indicated in the cookie notice.
Individuals	The Data provided will be stored for as long as is necessary to manage the request. Thereafter, it will be kept and blocked for as long as is necessary to formulate, exercise and defend possible claims arising from the processing of the data.
Representatives and Contact individuals	The Data will be stored for as long as the Data Subject is representing the company and there is an ongoing commercial relationship. If a commercial agreement is reached, we will process your data for the duration of the agreement. Once the agreement has expired, we will keep the Data blocked for the time necessary for the formulation, exercise and defense of possible claims arising from it processing.
Merchants (when self-employed individuals)	The Data will be stored for as long as the data subject is a Getnet Group customer. Once they are no longer a customer, the data will be kept blocked for 10 years to comply with anti-money laundering and financial crime regulations.

 

4. Will your data be shared with third parties?

Getnet may communicate your data to the following entities, always in relation to the purposes described:

Service providers, that act on Getnet’s instructions and with whom it has signed a data processor agreement in accordance with the provisions of Article 28 of the GDPR.

Affiliates (entities that are part of the Getnet group) for internal administrative purposes.

• To the competent bodies of the Public Administrations, if the Data are required.

Unless you or the company you represent asks us to do so in the context of a business relationship, Getnet will not share your data with other data controllers, and we will ensure that you have been informed and there is a legitimate interest in sharing it.

 

5. International Data Transfers

Getnet may transfer some of the Data to service providers and affiliates located outside the EEA, including those in the United States, Argentina, Brazil, Mexico, Chile, Colombia and Uruguay.

Non-EEA countries do not have the same data protection laws as the EEA.  These countries may not provide the same degree of protection for your personal data or give you the same rights in relation to it. For these reasons, and to comply with applicable regulations, when transferring data to territories outside the EEA, Getnet will only transfer data to countries that have been deemed by the European Commission to provide an adequate level of protection for personal data (as is the case for Argentina, the United States and Uruguay), or will sign the 'Standard Contractual Clauses' (SSCs) approved by the European Commission, which provide personal data with the same level of protection it has in the EU.

 

6. What are your rights when you provide us with your Data?

You have the following rights:

 

Access: you have the right to ask us to inform you about what data we hold about you and provide you with a copy of it.

Rectification: you have the right to ask us to correct the information we hold about you if it is incorrect.

Cancellation or deletion: you have the right to ask us to delete your data when it is no longer necessary or when we are processing it because you have given us your consent.

Objection: you have the right to ask us to stop processing your data when we are processing it based on our legitimate interest.

Limitation of processing: you have the right to ask us to limit the processing of your data when, for example, you have contested the accuracy of the data.

Portability: you have the right to ask us to communicate your data to a third party in a structured, commonly used and machine-readable format, wherever possible, or to yourself.

Right not to be subject to automated decisions: you have the right to ask us not to base a decision that has legal effect for you or significantly affects you on automated processing, with some exceptions.

 

You can also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es

If you want more information about rights in the framework of data protection you can access the infographic about the AEPD here.

 

7. What security measures do we apply?

At Getnet we are committed to security, and we apply technical and organizational measures aimed at guaranteeing the integrity, unavailability and confidentiality of your Data.

At Getnet, we are committed to security. We have implemented technical and organisational measures to ensure the integrity, availability and confidentiality of your data. These measures include encryption, data loss prevention, secure passwords and access controls. Likewise, Getnet guarantees the fulfilment of the duty of secrecy and confidentiality with respect to the Data.

 

8. Other important information 

8.1 Communication of Data by a third party

As we have already explained, in some cases, the data we collect is not received directly from you, the data subject, but rather from a third party, such as an affiliate, partner, representative, or contact individual from your company.

If you are such a third party, you guarantee that you will comply with the applicable regulations for sharing data, and that you have informed the data subject of this, indicating that they can review this privacy notice.

8.2. Changes to this notice and inquiries

We may update this privacy notice and will inform you of the changes and their effective date. Any updates will also be posted on this website.

 

9. EMPLOYMENT CANDIDATES’ PRIVACY NOTICE

9.1. Purpose of the processing and legal basis 

 

Management of the selection process
Purpose	We will process your personal data to evaluate your suitability for the job you have requested and to manage the selection process. Linked to this processing and if you turn out to be the candidate selected, we may carry out a series of pre-hiring checks that may include: - We request information related to your working life issued by official bodies to carry out the necessary checks before hiring.         - We carry out an analysis to verify the reliability, integrity and honesty of the candidate and to be able to comply with the legal requirements that may apply to us and with the internal policies of the Getnet Group.
Lawfulness	The legal basis for this processing is the execution of the contract or the application of pre-contractual measures. If we ask you for the working life issued by official bodies, the processing will be based on our legitimate interest in verifying the truthfulness and experience that you reflect in your request. The legal basis for integrity analysis, reliability and honesty of the candidate will be the legitimate interest of Getnet that is specified in that Getnet for the type of activity it carries out and for the fact of being part of a financial group must guarantee that the people who occupy certain positions and perform certain functions are the ones suitable considering the risks associated with these functions, this being expected by the candidates, without unbalancing their rights.
Types of data  processed	Contact and identification data (name, surname, address, telephone numbers); date of birth, gender, work and educational history, and any other information contained in your CV. Data derived from participation in tests during the selection process (group dynamics, interviews, language tests, etc.). Working life. Data publicly communicated by you in your social media profiles.

 

 

Resolution and management of consultations
Purpose	Answer the queries you can make during the selection process and after it.
Lawfulness	Our legitimate interest in answering any questions that may arise during the selection process or subsequently.
Types of data processed	Identification and contact data (name, surname, email, telephone). Any data that may be included in the consultation.

 

Candidate Examination
Purpose	To confirm the suitability of the candidate, the data of the candidate selected for checking that do not appear on the official sanctions lists (in particular in accordance with EU Regulations 2580/2001, 881/2002, 753/2011) are processed. This verification is done through the "Worldcheck" tool before making a firm offer to the selected candidate.
Lawfulness	The fulfillment of legal obligations or the legitimate interest in fulfilling the obligations of due diligence and avoiding the possible damages (including possible fines) that may arise from the hiring of sanctioned persons.
Types of data processed	Name and surname Date of birth Nationality

1.  

9.2. Additional information on the use of AI tools to assess whether the candidate meets the requirements of the offer for which he or she is applying

1- How does the automated tool used by Getnet work?

During the initial selection of candidates, Getnet can use an analysis tool based on artificial intelligence to assess whether the characteristics of the candidates contained in the information provided by them (mostly CVs) meet the requirements of the job offer.

The system analyses this information and generates different scores showing the percentage of matching between the candidates and the job offer based on the information they have provided. The result generated by the tool does not in itself determine a final decision. Candidate selection decisions are made exclusively by human beings, who may or may not consider the results generated by the tool. In any case, there is always human supervision during the evaluation process.

 

2- What type of information is processed by the automated tool and what is the legal basis for the processing?

The tool only processes the information provided by the candidate at the time of applying for the vacancy, in particular the information contained in the CV.

Candidates participate in the recruitment process on a voluntary basis and the processing of their data is based on the adoption of pre-contractual measures. However, the automated processing of personal data through the tool is legally based on the legitimate interest of Getnet.

This legitimate interest is specified in the need to use technological tools to improve efficiency, objectivity and traceability, to optimise the management of the recruitment process and to ensure an initial technical evaluation based on previously defined criteria.

Candidates may, at any time, object to their application being evaluated by the automated tool and request that their profile be reviewed manually by the person responsible for the selection process. To do so, the candidate should contact Getnet by e-mail at privacy.merchant@pagonxt.com.

 

9.3. Who do we share your data with?

1-With service providers

We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.

 

2- International transfers of Data

In exceptional cases, as we may use service providers located outside the EEA, or our EEA-based providers may sub-contract to providers outside the EEA, your data may be transferred outside the EEA to countries such as Brazil, Chile, Mexico or others which do not provide a similar or adequate level of protection to that provided in the EEA, we will provide adequate safeguards in accordance with data protection legislation. If you wish to request a copy of these guarantees or additional information, you may do so by contacting the DPO at privacy.merchant@pagonxt.com.

 

9.4 How long do we keep your Data?

We will process your personal data for as long as the selection process lasts and, where appropriate, as necessary to manage queries. Once the process is complete, we will retain your information in case of future opportunities in which you may be interested in a maximum period of 18 months. After that period, we will proceed to block the information and delete it after the period of exercise of actions.

9.5. Exercise of rights

You can exercise your rights of access, rectification, erasure, limitation of processing, portability, opposition and the right not to be subject to automated individual decisions including profiling, sending an email to mailbox privacy.merchant@pagonxt.com as well as filing a claim with the Spanish Data Protection Agency at www.aepd.es