How do we protect your personal data

Bilderlings takes the security of your data seriously. We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Where Bilderlings engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and Company measures to ensure the security of data. We continuously educate and train our employees about the importance of confidentiality and privacy of customer information. We maintain physical, electronic and procedural safeguards that comply with the relevant laws and regulations to protect your personal information from unauthorised access.

Personal data sharing

We may disclose your personal data to third parties:

• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation
• to protect the rights, property, or safety of Bilderlings, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction
• to assist us in conducting or co-operating in investigations of fraud or other illegal activity where we believe it is reasonable and appropriate to do so
• to develop customer relationships, services and systems
• to our suppliers:
  • to card manufacturing, personalisation and delivery companies, to create and deliver your personalised payment card
  • to our banking and financial services partners and payments networks, such as Mastercard. To help us provide our services to you
  • to analytics providers and search information providers. To help us improve our website or app
  • to communications services providers. To distribute commercial offers and marketing materials and providing multi-factor authorisation and signature.
  • to professional advisors and European based certified partners providing AML KYC and risk management systems, for maintaining compliance with the law and the regulatory requirements
  • to suppliers who provide us with IT, outsource and other services, to help us provide our services to you.
  • In general, personal data is processed within the United Kingdom, European Union/European Economic Area (UK/EU/EEA). However, there may be certain cases where personal data is transmitted and processed outside the UK/EU/EEA. 
  • Personal data may be transferred and processed outside the UK/EU/EEA in situations where it is necessary for the conclusion or execution of a contract. For example, this may occur when a payment is carried out to a third party or through a third-party partner (correspondent). Additionally, if a client engages in commerce activities using an online platform as a registered user, the payment service providers of registered users may be subject to specific customer information requirements that necessitate the transfer of personal data. Moreover, data transfers may occur when the client has given their consent. In all of these cases, we strive to ensure that appropriate technical and organizational measures are in place, as outlined in the Joint Controller Agreement. These measures are implemented to safeguard the security and confidentiality of personal data, regardless of its location.

    Please note that when personal data is transferred outside the UK/EU/EEA, we adhere to relevant data protection laws and regulations, and we take steps to ensure an adequate level of protection for the data being transferred.

Automated decision-making, profiling

Bilderlings conducts profiling activities that involve the automated processing of personal data. This profiling is carried out to comply with legislation related to risk management and to ensure the continuous and periodic monitoring of transactions in order to prevent fraud. The ongoing profiling is based on Bilderlings’ legal obligations.

We don’t use special category data in our automated decision-making systems unless we have a lawful basis to do so.

Data retention

We will retain your personal data only for as long as is necessary to fulfill the purposes for which we collected it. We’ll generally keep your personal data for five years after our business relationship with you ends, or such period as may be required by applicable UK laws. We will always delete data that is no longer required by a UK law.

Your rights

• You have the right to request access to the personal data we hold about you.
  • If you ask, we’ll provide the information about the personal data we hold about you. We can’t give you any personal data about other people, personal data which is linked to an ongoing criminal or fraud investigation, or personal data which is linked to settlement negotiations with you. We also won’t provide you with any communication we’ve had with our legal advisers.
• You have the right to request that we correct any inaccurate personal data we hold about you.
• You have the right to request that we delete your personal data, subject to certain exceptions.
• You have the right to request that we restrict the processing of your personal data, subject to certain exceptions.
• You have the right to object to the processing of your personal data on grounds relating to your particular situation.
• You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another controller, where technically feasible. We will assess the technical feasibility of such a transfer on a case-by-case basis, taking into account factors such as the format of the personal data, the cost and complexity of the transfer, and the availability of relevant technology. If we determine that a transfer is not technically feasible, we will explain the reasons for this to you in writing. In some cases, we may also be required to deny your request to transfer personal data under applicable law or professional obligations.
• You have the right to lodge a complaint with the Commissioner https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/).

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk