PRIVACY POLICY
Effective as of: 03.09.2025 Last updated: 26.08.2025
I. Why should you read this privacy policy?
"iCard" AD is a company committed to the principles of personal data protection laid down in European legislation and attaches great importance to safeguarding the information of its customers. We are constantly improving our personal data processing activities, as well as our privacy notices, in order to provide you with as much transparency as possible regarding the ways in which we process your data. This Privacy Policy explains the ways in which we collect, use, and store your personal information, as well as your rights, in case you wish to change the ways in which we use your personal information.
If you have questions about how we use your personal data, you can contact our Data Protection Officer at dpo@icard.com.
If you are unsure of the meaning of a particular term in this Privacy Policy, you can check its meaning in the other legal documents governing the use of the Cashterminal Wallet services, to which this Privacy Policy is an integral part.
1.1 Who are we?
When "we", "us", or "our" is mentioned in this Policy, this refers to iCard AD, UIC 175325806, with registered seat and management address in Varna 9009, Mladost district, Varna Business Park No. B1, which is responsible for your personal information under this Privacy Policy.
1.2 Personal information of third parties
If you have provided us with information regarding any third party, such as your representatives/proxies, we will treat this information on the presumption that you have informed those persons about this Privacy Policy and have obtained their consent for the sharing of this information.
II. How do we process your personal data?
2.1 What information do we collect about you?
When you use Cashterminal Wallet, we require and collect from you the personal data listed below:
|
Type of Personal Data |
Purpose of Processing |
Legal Basis |
With whom do we share this data? |
|
Names |
Due diligence |
Compliance with legal obligations, protection of our legal interests |
Our auditors; legal advisors or other similar consultants; debt collection agencies; accounting service providers; other outsourced service providers; regulators; Our representatives (agents) |
|
Provision of payment services |
Compliance with legal obligations and our contract with you |
Correspondent banks; financial institutions of the recipients of funds; top-up providers; auditors; legal advisors or other consultants; regulators; Our representatives (agents) |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators; Our representatives (agents) |
|
|
For card manufacturing purposes (embossing the cardholder's name on a card) |
Our contract with you |
With no one |
|
|
Creating a customer profile and maintaining our relationship |
Pre-contractual relations and/or our contract with you |
Our auditors; legal advisors or other consultants; accounting outsourcing service providers; other outsourced service providers |
|
|
Marketing |
Our legitimate interest |
Marketing service providers |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Cross-selling marketing |
Your consent |
Should there be other processors, you will be provided with information about them in the consent form |
|
|
Supporting the social features of the service |
Our legitimate interests in developing the service and encouraging users to interact with it |
Other users of the service* - Such activities occur exclusively in the context of activities carried out on social media, e.g., in situations where you have tagged us in your post or during promotional campaigns of a nature that presupposes such processing. You may always ask us to remove your personal data used in such a context, and we will take the relevant measures immediately. |
|
|
Date and place of birth |
Due diligence |
Compliance with our legal obligations |
Our auditors; legal or other similar consultants; accounting service providers; other outsourced service providers; Our representatives (agents) |
|
Ensuring your payment transactions |
Compliance with legal obligations and our contract with you |
Correspondent banks; financial institutions of the recipients of funds; top-up providers; auditors; legal advisors or other consultants; regulators; Our representatives (agents) |
|
|
Marketing |
Our legitimate interests |
Marketing service providers |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Cross-selling marketing |
Your consent |
Should there be other processors, you will be provided with information about them in the consent form |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Registered address |
Due diligence |
Compliance with legal obligations, protection of our legal interests |
Our auditors; legal advisors or other similar consultants; debt collection agencies; accounting service providers; other outsourced service providers |
|
Ensuring your payment transactions |
Compliance with legal obligations and our contract with you |
Correspondent banks; financial institutions of the recipients of funds; top-up providers; auditors; legal advisors or other consultants; regulators |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
To ensure the satisfaction of our claims arising from chargebacks, negative balances, and other similar obligations owed to us |
Exercise or protection of our rights |
Lawyers; debt collection agencies; courts, arbitration tribunals, and similar |
|
|
Nationality |
Creating a customer profile and maintaining our relationship |
Pre-contractual relations and/or our contract with you |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers |
|
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers; regulators; Our representatives (agents) |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators; Our representatives (agents) |
|
|
Official identity document and all data contained therein |
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers; Our representatives (agents) |
|
Ensuring your payment transactions |
Compliance with legal obligations and our contract with you |
Correspondent banks; financial institutions of the recipients of funds; top-up providers; auditors; legal advisors or other consultants; regulators; Our representatives (agents) |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators; Our representatives (agents) |
|
|
Recordings of your video call for identification purposes or verification selfie (if applicable to you) |
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers |
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Information about your tax status |
Due diligence |
Compliance with legal obligations |
Our auditors; legal or other similar consultants; accounting service providers; other outsourced service providers |
|
Providing the ability to review and verify your tax obligations |
Our contract with you |
Government or municipal tax liability databases; legal or other similar consultants; regulators |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Source of funds and/or wealth |
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers; regulators |
|
Marketing |
Legitimate interests |
Marketing service providers; marketing consultants; SEO and other similar software or consultancy providers; other similar providers |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Expected turnover, professional activity, purpose and nature of the relationship for use of the service |
Due diligence |
Compliance with our legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers |
|
Marketing |
Legitimate interests |
Marketing service providers; marketing consultants; SEO and other similar software or consultancy providers; other similar providers |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Proof of address or other verification data that we may request depending on the specific situation |
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers; regulators |
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Telephone number |
Identity verification |
Compliance with legal obligations, protection of our legal interests |
Communication service providers; debt collection agencies; legal advisors or other similar consultants; outsourced service providers; Our representatives (agents) |
|
Creating a customer profile and maintaining our relationship |
Pre-contractual relations and/or our contract with you |
Legal advisors or other similar consultants; accounting service providers; other outsourced service providers; Our representatives (agents) |
|
|
Marketing |
Our legitimate interest |
Marketing service providers |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries; Our representatives (agents) |
|
|
Cross-selling marketing |
Your consent |
Should there be other processors, you will be provided with information about them in the consent form |
|
|
Facilitating access to our platform |
Our contract with you |
With no one |
|
|
Communicating important messages about the service |
Compliance with legal obligations |
Communication service providers; legal or other similar consultants; outsourced service providers |
|
|
To ensure the satisfaction of our claims arising from chargebacks, negative balances, and other similar obligations owed to us |
Exercise or protection of our rights |
Lawyers; debt collection agencies; courts, arbitration tribunals, and similar |
|
|
Email address |
Creating a customer profile and maintaining our relationship |
Pre-contractual relations and/or our contract with you |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers |
|
Marketing |
Our legitimate interest |
Marketing service providers |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Cross-selling marketing |
Your consent |
Should there be other processors, you will be provided with information about them in the consent form |
|
|
Facilitating access to our platform |
Our contract with you |
With no one |
|
|
Communicating important messages about the service |
Compliance with legal obligations |
Communication service providers; debt collection agencies; legal advisors or other similar consultants; outsourced service providers; regulators |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
To ensure the satisfaction of our claims arising from chargebacks, negative balances, and other similar obligations owed to us |
Exercise or protection of our rights |
Lawyers; debt collection agencies; courts, arbitration tribunals, and similar |
|
|
Device identification number and data from it (incl. IP address) |
Due diligence |
Compliance with legal obligations |
Our auditors; legal advisors or other similar consultants; regulators |
|
Identity verification |
Compliance with legal obligations |
Communication service providers; legal advisors or other similar consultants; outsourced service providers |
|
|
Creating a customer profile and maintaining our relationship |
Pre-contractual relations and/or our contract with you |
Our auditors; legal advisors or other similar consultants; accounting service providers; other outsourced service providers |
|
|
Detection and prevention of fraud, spam, abuse, security incidents, and other harmful activities |
Legitimate interest |
Outsourced service providers; outsourced software service providers; legal or other similar consultants; regulators |
|
|
Facilitating the use of our platform |
Our contract with you |
With no one |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Payment transactions, use of our e-money service |
Initiating a payment, sending or requesting money, accepting a card payment, a transaction to fund your account, topping up an account via Cashterminal |
Our contract with you |
The other parties to your transactions and their financial institutions; correspondent banks; payment system operators; outsourced service providers; legal advisors; our auditors; regulators; Our representatives (agents) |
|
Managing our loyalty programs, where applicable |
Our contract with you |
The other parties to your transactions and their financial institutions; outsourced service providers; legal advisors; our auditors |
|
|
Detection and prevention of fraud, abuse, security incidents, and other harmful activities through blocking services or applying other fraud prevention measures |
Legal obligations |
Outsourced software service providers; outsourced compliance, PEN testing, and other similar audit service providers; PCI DSS auditors; legal and other similar consultants |
|
|
To ensure the satisfaction of our claims arising from chargebacks, negative balances, and other similar obligations owed to us |
Exercise or protection of our rights |
Lawyers; debt collection agencies; courts, arbitration tribunals, and similar |
|
|
Specific customer identifiers and, where applicable, other data, such as a registered address for a certain service, and similar |
Initiating a payment, sending or requesting money, accepting card payments, top-ups, payments to specific merchants or businesses |
Our contract with you |
The other parties to your transactions and their financial institutions; correspondent banks; payment system operators; outsourced service providers; legal advisors; our auditors; specific merchants or businesses; regulators; Our representatives (agents) |
|
Orders, use, and other data related to cards issued by us |
We provide you with the ability to order and use our payment cards, as described in the general terms and conditions for the service |
Our contract with you |
Compliance and risk fulfillment providers; legal advisors or other similar consultants; regulators |
|
Facilitating your payment transactions |
Compliance with legal obligations and our contract with you |
The other parties to your transactions and their financial institutions; correspondent banks; payment system operators; outsourced service providers; legal or other similar consultants; our auditors; regulators |
|
|
Marketing |
Our legitimate interest |
Marketing service providers; marketing consultants; SEO and other similar software or consultancy providers; other similar providers |
|
|
Automatic card data update. In order not to disrupt any services or products you may have ordered through recurring (subscription) transactions initiated by you with a merchant enrolled in a corresponding card scheme program, that merchant would automatically receive the updated card data. |
Our contract with you |
Card schemes [1] (VISA, Mastercard); merchants with whom you have carried out a "recurring" transaction |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Login data |
Identity verification |
Compliance with legal obligations |
With no one |
|
Facilitating the use of our platform |
Our contract with you |
With no one |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Delivery address |
Delivery of cards and other packages offered through the service |
Our contract with you |
Courier companies, outsourced service providers, legal advisors, and regulators |
|
Geolocation |
Identity verification |
Compliance with legal obligations |
Communication service providers; legal advisors or other similar consultants; outsourced service providers; regulators |
|
Provision of location-based services |
Your consent |
Outsourced service providers |
|
|
Detection and prevention of fraud, abuse, security incidents, and other harmful activities through blocking services or applying other fraud prevention measures |
Legal obligations |
Outsourced software service providers; outsourced compliance, PEN testing, and other similar audit service providers; PCI DSS auditors; legal and other similar consultants |
|
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Profile picture |
Supporting the social features of the service |
Your consent |
Other users of the service |
|
Application-related preferences |
Facilitating the use of our platform |
Our contract with you |
With no one |
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Contact list |
Provides you with an easy way to interact with other users of the platform |
Your consent |
With no one |
|
Interactions with our application |
Facilitating the use of our platform |
Our contract with you |
With no one |
|
Personalizing, measuring, and improving our advertising and marketing |
Our legitimate interests |
Marketing service providers |
|
|
Developing and optimizing the service and your customer experience, through your participation in surveys and analyses |
Our legitimate interests |
Marketing service providers |
|
|
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
|
Interaction with our support team |
Providing assistance in relation to the use of the service |
Our contract with you |
Providers of software for processing customer inquiries |
|
Analysis and taking action in relation to the application of compliance and risk management policies |
Compliance with legal obligations |
Providers of blacklist and/or sanctions list information; outsourced compliance and risk assessment service providers; legal or other similar consultants; regulators |
|
|
Interaction with our social media channels (additional information will be provided in our social media privacy notices) |
Personalizing, measuring, and improving our advertising and marketing |
Our legitimate interests |
Marketing service providers; marketing consultants; SEO and other similar software or consultancy providers; other similar providers |
|
Participation in games, quizzes, and completing a questionnaire or entry form for a promotional campaign contest |
We provide you with the opportunity to participate in the relevant event |
Fulfillment of our general terms and conditions for the relevant event |
Marketing service providers |
|
Personalizing, measuring, and improving our advertising and marketing |
Our legitimate interests |
Marketing service providers |
|
|
Cookies and other tracking technologies |
The use of cookies and other tracking technologies is described in our Cookies Policy |
2.2 Specific cases of data sharing
In all cases, we may share information about you in connection with the specific reasons described below:
With other members of the iCard group, as well as members of the group of our representative (agent) registered with the BNB register under Article 19 of the PSPSA - "Intercapital Group" AD, for the purposes of our due group consolidation: we may share your personal data with members of the iCard group of companies or of our wider group of companies that are related to each other by a common owner or controlling persons.
Aggregated Information. We may share aggregated information (information about our customers that we combine so that the individual customer cannot be identified) and other anonymized information on the basis of compliance with legal requirements, industry and market analysis, demographic or other profiling, marketing and advertising, as well as for other business purposes, on the basis of our legitimate interest. This type of activity will not be considered processing of personal data because the information is anonymized.
With our lawyers, legal consultants, auditors, and other similar parties for the purpose of protecting our legal interests. We may share any information with our legal advisors and other similar persons that would be necessary for the purposes of protecting our legal interests.
Transfer of business activity. If any of the companies providing iCard's services engages in a merger, consolidation, acquisition, reorganization, sale of assets, portfolio transfer, or insolvency, then we may sell, transfer, or divide all or part of our assets, including your personal data, in the performance of or in connection with such a transfer (e.g., due diligence/preliminary review procedure). In such a case, you will be notified before your personal data is transferred to another legal entity and/or becomes subject to a different Privacy Policy.
2.3 Decisions based entirely on automated processing
In certain cases, our systems may make decisions based entirely on automated processing. This does not mean that we will always use automated decision-making for these types of processing. If you believe that you have been treated unfairly by our automated decision-making systems, you may request human intervention in reviewing the decision at any time by contacting us in the ways described in the "How to complain?" section. Such decisions may be made for processing such as:
|
Processing Activity |
Logic of the Automated Processing |
|
Detection and prevention of fraud, abuse, security incidents, and other harmful activities through blocking services or applying other fraud prevention measures |
Our fraud prevention and monitoring systems may sometimes make automated decisions in connection with suspicious behavior. For example, we may block a certain transaction that was made in a remote part of the world just a few minutes after your last login from your country of residence. |
2.4 Information we collect about you from third parties
We may request information about you from certain persons when you register for our services.
Such persons are generally agencies that help prevent fraud, as well as providers of services related to "Know Your Customer" rules and the application of anti-money laundering measures. These providers help us fulfill our legal obligations for due diligence of our customers.
We may collect information about you from public sources for the purposes of applying anti-money laundering measures or market research. This may include:
Checks in official public registers, such as your local Commercial Register;
Information published in the press or on social media.
2.5 Processing based on a legal obligation or contractual requirement, or a requirement necessary for entering into a contract
In all cases where any of the above-described data is processed on the basis of "Our contract with you", "Fulfillment of our general terms and conditions", "Compliance with legal obligations", or other similar grounds - this data is necessary in order for us to continue providing you with the specific services, and in case you do not provide us with this data, we may need to terminate the specific services you are using.
2.6 Retention periods
a) We will continue to store your personal information for as long as we have a contractual relationship.
We will store your data for a period not exceeding 5 (five) years after the year of our last interaction, or for a longer/shorter period, if required by the relevant national legislation in the field.
However, we may retain some of this data in exceptional cases, such as when this is necessary for the protection of our legal interests, or in the event of any pending proceedings related in any way to you.
b) Since we maintain our archives in a manner that protects them from accidental or malicious destruction and loss, residual copies of your personal data may not be removable from our backup systems for a limited period of time.
c) We reserve the right to store your identification data for an indefinite period of time, in case you have been included in our company's internal blacklist due to suspicion of malicious, fraudulent, or other similar behavior. This retention is based on our legitimate interest in preventing such persons from using our services in the future.
III. Your Rights
You may exercise any of the rights described in this section before the Controller by sending a message from your registered email for the services to iCard. Please note that upon receipt of your email, we will attempt to provide you with the requested information within a reasonable time, in accordance with any obligations that we or our affiliated companies may have under applicable law.
3.1 Managing your information
You have the right to obtain the following:
Confirmation of whether and where we process your personal data;
Information about the purposes of the processing;
Information regarding the categories of personal data being processed;
Information regarding the categories of recipients with whom the personal data may be shared;
Information about the period for which the personal data will be stored (or the criteria used to determine that period);
Information about the existence of the right to erasure, rectification, restriction of processing, and objection;
Information about the existence of the right to lodge a complaint with any regulator;
In case your personal data was not collected from you, information about its sources;
Information about the existence and an explanation of the logic used in any automated processing;
Additionally, you have the right to obtain a copy of the personal data being processed.
3.2 Rectification of inaccurate or incomplete personal data
You have the right to request that we correct inaccurate or incomplete personal data about you (which you cannot update yourself).
3.3 Access to Personal Data and Portability
You have the right to:
receive a copy of your personal data in a structured, commonly used, and machine-readable format that allows for reuse;
transfer your personal data from one controller to another;
store your personal data for further personal use on a personal device; and
have your personal data transmitted directly between controllers without hindrance.
Applicable law may allow you to request copies of your personal data held by us.
3.4 Withdrawal of consent and cessation of processing
If you have provided consent for us to process your information, you may withdraw it at any time by notifying us specifically what you wish to withdraw. Please note that the withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal. In addition, in certain jurisdictions, applicable law may give you the right to restrict the ways in which we use your personal data, in particular (i) in case you have contested the accuracy of your information; (ii) in case you have objected that the processing is unlawful and that you wish the erasure of your personal data; (iii) in case we no longer need your information for the purposes of processing, but you wish to obtain the information for the establishment, exercise, or defense of legal claims; or (iv) in case you have objected to the processing pending verification of whether our legitimate interests override yours.
3.5 Objection to processing
In certain jurisdictions, applicable law may allow you to require us to stop processing your personal data for certain specific purposes, in case such processing is based on a legitimate interest. If you object to such processing, we will cease processing your information unless we can demonstrate compelling legitimate grounds for such processing, or in case the processing is necessary for the establishment, exercise, or defense of our rights. If you wish us to stop processing your personal data for specific activities that constitute legitimate interests for us, we may be forced to suspend the provision of some or all of the service's functionalities.
Where your personal data is processed for direct marketing purposes, you may at any time request that we stop this by sending us an email to the addresses listed below.
We will provide you with an opt-out option when we use your personal data for direct marketing purposes.
3.6 How to complain?
a) Initially, you can try to resolve the dispute by sending an email to the relevant Controller under this Policy, from your email registered for the service:
Data Protection Officer: dpo@icard.com Business Park Varna, No. B1, Varna 9023, Bulgaria
b) If you are not satisfied with the response of the personal data Controller, you have the right to lodge complaints regarding the processing of your personal data carried out by us with the competent personal data protection authorities:
You have the right to file a complaint with the Controller's lead supervisory authority - the Commission for Personal Data Protection:
Address: Sofia 1592 2 "Prof. Tsvetan Lazarov" Blvd. e-mail: kzld@cpdp.bg
IV. Global Operations
In order to facilitate our operations on a global scale, we may be required to transfer, store, and process information relating to you within our group of companies or service providers established in Europe, India, Asia, and North and South America. The applicable legislation in those countries may differ from the legislation applicable to your location. For example, information collected within the EEA may be transferred, stored, and processed outside the EEA for the purposes of this Privacy Policy. In cases where we transfer, store, and process your personal data outside the EEA, we first ensure that appropriate safeguards are in place to provide an adequate level of protection.
V. International Transfers
5.1 Adequacy decisions for the protection of personal data
If we have disclosed any part of your information outside the EEA, we will comply with adequacy decisions regarding the protection of personal data, where this is possible.
5.2 Other means of ensuring an adequate level of protection for personal data
If personal information is shared with our affiliated companies or service providers outside the EEA, and in the absence of an adequacy decision regarding the protection of personal data, we will ensure, prior to sharing your information with such affiliated companies or service providers, the availability of the necessary measures for an adequate level of protection of personal data, as well as a valid legal basis in accordance with the applicable rules on personal data transfers. We will provide you with additional information regarding the measures taken to ensure an adequate level of protection of personal data upon request.
VI. Security
It is our responsibility to ensure the protection of your personal data, kept in encrypted form on servers located in special premises in Class A European jurisdictions. In order to prevent unauthorized access to or disclosure of information, we maintain physical, electronic, and procedural safeguards that comply with applicable legislation for the protection of non-public personal data. Once you have accessed your account, all internet communication is protected by SSL technology with a high degree of security (AES-256, 256 bit keys, certified by StartCom Ltd). We restrict access to your identifiable information solely to employees who require it in order to provide you with the service.
If you know or have reason to believe that your account access data has been lost, stolen, misappropriated, or otherwise compromised, or in case of actual or suspected unauthorized use of your profile and account, please contact us following the instructions in the "Contact Us" section below. We are obligated to ensure the security of our systems and services, but you are responsible for maintaining the security of your password and registration information for access to your profile, as well as for verifying the currency and accuracy of the personal data we maintain about you.
VII. Can children use our services?
The services are not intended for individuals under 18 years of age. We do not knowingly collect information, including personal data, from children or other legally incapacitated individuals who are not permitted to use the services. If we receive information that we have collected the personal data of a person under 18 years of age, we will promptly delete it, unless we are legally obligated to retain such information. Please contact us if you believe that we are mistakenly or negligently collecting information from individuals under the age of 18.
VIII. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy at any time, in accordance with this provision. If we make changes to this Privacy Policy, the updated version of the document will be made available in the mobile application. If you do not agree with the amended Privacy Policy, you may terminate your contracts with us. If you do not exercise your right to terminate your contracts with us before the effective date of the amended Privacy Policy, your use of iCard will be subject to the amended Privacy Policy.
IX. Contact Us
If you have any questions or complaints regarding this Privacy Policy or our information processing practices, you can send us an email from your registered email to the email address specified in Section 3.6.
[1] Please note that the Card Scheme is a separate personal data controller for the purposes of the issued card. You can read more about the personal data processing practices of the relevant Card Scheme on its official website.
