Bankwards
Register
Legal

Privacy Policy

Bankwards Operations GmbH · Körösistraße 29c/Top 86, 8010 Graz, Austria · FN 631086 v

1. Preamble

In this Privacy Policy, Bankwards transparently informs its customers on what personal data is collected, the reasons behind it and who would be the recipient of such data. With regards to the terms used in this Privacy Policy the definitions of the GDPR apply accordingly.

2. Applicability

Bankwards Operations GmbH with its corporate seat in Körösistraße 29c/Top 86, 8010 Graz, Austria, registered with the Austrian commercial register under registration number FN 631086 v together with its affiliates ("Bankwards Group") offer via its website ("Bankwards Platform") services and products related to invoice approval, cross-border payments, card utilization and accounting services.

This Privacy Policy applies to all services and products regarding the Bankwards Platform, this website and our helpdesk.

3. Controller

Bankwards will solely use the Customer's personal data in compliance with applicable data protection laws and this Privacy Policy. Each company of the Bankwards Group is a Controller pursuant to Art 4 para 7 GDPR and therefore responsible for the processing of personal data in connection with the services provided by the specific company.

Bankwards will only share the Customer's personal data with other third parties if a legal basis applies - this may be due to the business relationship, legitimate interests, a legal obligation or prior consent (withdrawable at any time).

4. Payment Services

When the Customer uses the payment services, Bankwards will only process personal data with the Customer's consent or due to a contractual obligation, and will not request any data other than those necessary to provide the service. Bankwards won't use, access or store any data for purposes other than the performance of payment services as explicitly requested by the Customer.

5. Data Categories and Sources

Bankwards may process the following categories of personal data:

  • -Contact & account data: name, address, telephone number, email address, date of birth, photo
  • -Verification data: identity documents, utility bills, PEP data, proof of funds
  • -Financial data: bank details (IBAN, BIC), payment service provider information, transaction IDs
  • -Log data: IP address, device information, operating system, browser type, cookies
  • -Company details: commercial register reports, UBO data, structure and ownership information
  • -Support data: data provided in requests to the support team
  • -Marketing data: statistical and marketing data, cookies, behaviour, interests and preferences

6. Purpose and Legal Basis for Using Personal Data

Bankwards processes personal data in accordance with applicable data protection legislation, including the GDPR, the E-Privacy Directive and national implementing acts. Bankwards processes personal data based on one of the following legal bases:

6.1. Performance of contractual obligations (Art 6(1)(b) GDPR)

General performance of Bankwards services, account management, execution of Customer orders, Customer service and support, and analysis and improvement of the platform.

6.2. Compliance with legal obligations (Art 6(1)(c) GDPR)

Contract management, accounting and invoicing, compliance and risk management, KYC measures, monitoring for fraud prevention, money laundering and terrorist financing.

6.3. Legitimate interests (Art 6(1)(f) GDPR)

Fraud prevention, processing authority inquiries, risk management, internal administrative purposes, process and quality management, market research, and Customer support communications.

6.4. Based on consent (Art 6(1)(a) GDPR)

Direct marketing and advertising, website analysis and tracking for advertising purposes. Given consent may be withdrawn at any time.

7. Recipients of Personal Data

Bankwards transfers personal data only within the following four groups:

7.1. Within the Bankwards Group - for internal administrative purposes, on a need-to-know basis.

7.2. To Processors - service providers for video authentication, IT services, Customer support, application management.

7.3. To public bodies - if required by law, to prevent damages, or in connection with investigations.

7.4. To other third parties - bank identification verification providers, payment gateway providers, and others where a legal basis applies.

8. International Data Transfer

Bankwards will process personal data in general within the European Economic Area. Where processing occurs outside the EEA, Bankwards relies on appropriate data transfer mechanisms pursuant to Art 44 et seq GDPR, including adequacy decisions by the European Commission, standard contractual clauses, or binding corporate rules.

9. Newsletter

The Customer may subscribe to the Bankwards newsletter to receive information on Bankwards services. The newsletter may contain trackers to better understand Customer interactions with the newsletter.

10. Retention and Deletion Periods

Bankwards retains personal data only as long as absolutely necessary - for the duration of the business relationship and as long as applicable legal retention periods stipulate. Statutory retention periods include:

  • -7 years under the Austrian Enterprise Code and Federal Tax Code
  • -10 years under the Austrian Financial Market Money Laundering Act
  • -3 to 30 years under the Austrian General Civil Code where required for legal disputes

11. Data Subject Rights

11.1. Right of access (Art 15 GDPR) - request confirmation of processing and receive a copy of personal data.

11.2. Right to rectification (Art 16 GDPR) - request rectification of incorrect or incomplete data.

11.3. Right to erasure (Art 17 GDPR) - request deletion of personal data, unless an overriding exception applies.

11.4. Right to restriction of processing (Art 18 GDPR) - request restriction in certain circumstances.

11.5. Right to data portability (Art 20 GDPR) - receive personal data in a structured, machine-readable format.

11.6. Right to object (Art 21 GDPR) - object to processing based on legitimate interests.

11.7. Right to withdraw consent (Art 7(3) GDPR) - withdraw consent at any time with future effect.

11.8. Right to not be subject to automated decision-making (Art 22 GDPR) - Bankwards does not use automated decision-making including profiling.

To exercise any of the above rights, contact us at support@bankwards.com or write to Bankwards GmbH, Körösistraße 29c/Top 86, 8010 Graz, Austria.

12. Supervisory Authority

If you have concerns about how Bankwards processes your personal data, you have the right to lodge a complaint with the competent data protection supervisory authority in Austria.

13. Declaration of Consent

Bankwards Customers have the right to withdraw consent at any time by emailing support@bankwards.com. Please note that withdrawal of consent may affect Bankwards' ability to provide certain services.

14. Updates of this Privacy Policy

Bankwards regularly reviews and updates this Privacy Policy. If significant changes are made, Bankwards will notify you accordingly and provide the updated version.

15. Contact

If you have any further questions about this Privacy Policy or the processing of your personal data, contact the Data Protection Officer of Bankwards at support@bankwards.com.

We reply with a time that suits you.