iStock-1020058680.webp

Privacy and data protection

General

Last updated: 21 October, 2022

Anyone whose personal data Enfuce processes for the purposes described in the section “Purposes & legal bases / Why and on which legal bases we process your personal data?” below. This page describes the processing of your personal data, including why and how we process it.

Enfuce (or “we” or “us”) refers to Enfuce Financial Services Ltd. or any of our group companies, including Enfuce License Services Ltd, that is the controller for your personal data.  Enfuce is an e-money and payment institution, authorised and regulated by the Finnish Financial Supervisory Authority. Our registered office address is at Metsänneidonkuja 12, 02130 Espoo, Finland. If you have any questions about this privacy notice, how we process your personal data or you are looking to exercise your rights, please contact privacy(at)enfuce.com.

This page forms our privacy notice and covers how we use, look after, manage or otherwise process information that identifies you or could be combined with other information to identify you (referred to as personal data). Also, this notice covers your rights related to the processing of your personal data.

Enfuce is committed to protecting your privacy. We will process your personal data only in accordance with relevant data protection and privacy legislation and good data processing practices. Enfuce is the data controller of your personal data as described in this notice, which means that we define the purposes and means for processing of the personal data and are responsible for the processing.

What personal data we may process?

Personal data means any information which can (or could be used to) identify a living person. We collect personal data from you in different occasions, for example when you apply for a payments card which is issued by us, use your card to make transactions, are in touch with us as a representative of our customer, or apply for a job at Enfuce. We may also obtain information from third parties (such as identity verification or fraud prevention agencies) who may check your personal data against any information listed on population registers, sanction databases and/or other databases.
We have grouped together the types of personal data that we may process of you in the table below. The types of personal data processed depend on the purpose for which we process your personal data. This means that typically all the types of personal data listed below do not apply to you. To understand which personal data we process of you, please see “Purposes & legal basis / Why and on which legal bases we process your personal data?” section below.

Contact data: first and last name, email address, phone number, physical address

Identification data: full name, physical address, phone number, email address, personal ID number, date of birth, nationality, national identification / social security number (SSN), signature, photo, other information on ID documents, organization you represent, position or role

Payment transaction data: date, amount, currency, name of the merchant, creditor or supplier, transaction location, technical authorisation, clearing, settlement and routing data

Payment card data: card number (PAN), card name, expiry date, CVV code, card PIN block, service code

Card account information: information on account your card is linked to, such as account ID and account balance

User information: user account details on our services, such as MyEnfuce, including username or other identifier, password and other login information, content or inputs provided by you

Technical data: such as data on system logs, IP address, device information, cryptographic data

Web analytics data: data related to e.g. page visits, time spent on pages, links clicked, accessed content, device used, operating system, browser type, screen resolution, plug-ins and add-ons. As this information can be collected through use of cookies, please refer to our cookie notice and preferences at the bottom-left corner of the page.

Customer support data: information related to you included on customer support cases from your card program provider, such as account ID

Information on preferences: information related to your interests or preferences, such as interest towards one of our services

Recruitment and qualification data: information related to your education, previous work experience, certifications, training records, professional memberships, right to work documents and other information you provide during a recruitment process

Social media data: information included on your social media account (where you provide such information to us)

Information on political exposure and sanctions: data of persons constituting politically exposed persons (“PEP”) and sanction lists, such as name, date of birth, place of birth, occupation or position, country of residence, nationality and the reason why the person is on the list in question

Sensitive data: special categories of personal data as defined in data protection legislation (see below)

As a principle, we only collect your data to provide, manage and market our services or for purposes related to our business in general, such as for recruitment. Under data protection legislation, we can only process personal data for specific purposes. In addition, we always need to have a legal basis for processing personal data. The legal bases are defined in data protection legislation and include:

  • To enter into and perform our contract with you: Your personal data is necessary to enter into a contract and carry out obligations in the contract with you, e.g. in order to provide you with our services or to employ you.
  • To comply with a legal obligation that we have: We may also process your personal data to comply with our legal or regulatory obligations, such as obligations related to identifying you as set out in anti-money laundering legislation.
  • Your consent to us for processing of your personal data: We may process your personal data based on your consent where you have consented to processing for a specific purpose.
  • To pursue our legitimate interests: We may have a legitimate interest to process your personal data where the processing is necessary to fulfil certain business requirements and the processing does not conflict with your rights, freedoms or reasonable expectations.

You can find out to which purposes and under which legal basis we process your personal data by clicking the sections that are relevant for you below. You can also find out if the data is collected directly from you or from other sources.

Purpose for processingTypes of personal dataLegal basisCollected from
Providing you with requested material and information on our products or servicesContact data  ConsentYou (when you sign up e.g. to our newsletter or other material)
Manage, operate and improve the performance of our websites and services by understanding their effectiveness and optimizing our digital assetsWeb analytics dataConsentYou (through technical means)
Analyse and advertise our services Web analytics dataConsentYou (through technical means)
Ensure network and information securityTechnical dataLegitimate interestYou (through technical means)

Purpose for processingTypes of personal dataLegal basisCollected from
Marketing and sales of our services– Contact data
– Web analytics data  
Legitimate interest, consent (where required e.g. for analytics)– You (submitting or through technical means)
– Other sources, such as marketing partners
Delivery of our servicesContact dataLegitimate interest– You
– Other sources, such as your employer (our customer)
Customer relationships managementContact dataLegitimate interest– You
– Other sources, such as your employer (our customer)
Invoicing for our servicesContact dataLegitimate interest– You
– Other sources, such as your employer (our customer)
Purchase of services and related vendor assessmentsContact dataLegitimate interest– You
– Other sources, such as your employer (our vendor)
Vendor relationships managementContact dataLegitimate interest– You
– Other sources, such as your employer (our vendor)
Assessments and auditingContact dataLegitimate interestYou, your employer

Purpose for processingTypes of personal dataLegal basisCollected from
Recruitment, including screening, evaluating, interviewing and selecting potential employee candidates– Contact data
– Recruitment and qualification data
– Social media data
Performance of contract (necessary steps to enter into a contract), consent (where required), legitimate interest– You, when you apply for a job and submit information via recruitment tools, email, phone or in an interview
– Other sources (with your consent where required), such as referees, recruitment companies, LinkedIn, screening agencies or publicly available registers (as allowed by law)
Identity verification and background checks– Contact data
– Identification data
– Recruitment and qualification data  
Performance of contract, consent (where required)– You
– Other sources (with your consent where required), such as credit check agencies

Purpose for processingTypes of personal dataLegal basisCollected from
Provide login to MyEnfuce service– Contact data
– User information
– Technical data
Legitimate interestYou (through your input and technical means)
Provide MyEnfuce service– Contact data
– User information
– Technical data
Legitimate interest, consentYou (through your input and technical means)
Ensure network and information securityTechnical dataLegitimate interestYou (through technical means)
Promote, analyse, modify and improve our systems, and tools, and develop new servicesTechnical data  Legitimate interestYou (through technical means)
Manage, operate and improve the performance of our servicesWeb analytics dataConsentYou (through technical means)

Purpose for processingTypes of personal dataLegal basisCollected from
Identification of you and verifying your identity as required in applicable legislation.– Contact data
– Identification data  
Legal obligation, performance of contract– You, when you apply for a card
– Other sources, such as Identity verification services and your card program provider
Setting up your account, including processing your application for a card and creating your account– Contact data
– Identification data
– Payment card data
– Card account information
Performance of contract (consumer cards), legitimate interest (commercial cards)– You, when you apply for a card
– Other sources, such as Identity verification services and your card program provider
Maintaining and administering your account and the customer relationship– Contact data
– Identification data
– Payment card data
– Card account information
– Payment transaction data
Performance of contract (consumer cards), legitimate interest (commercial cards)– You
– Other sources, such as payment service providers, where applicable and your card program provider
Authentication for payment transactions– Payment card data
– Payment transaction data
Performance of contract (consumer cards), legitimate interest (commercial cards)– You, through technical means, when you make a transaction
– Other sources, such as technical service providers and your card program provider
Processing your payment transactions, including authorization, clearing and settlement– Payment transaction data
– Sensitive data (see more information on section “Types of data”)
Performance of contract (consumer cards), legitimate interest (commercial cards)– You, through technical means, when you make a transaction
– Other sources, such as payment service providers and your card program provider
Physical and virtual card management– Contact data
– Identification data
– Payment card data
Performance of contract (consumer cards), legitimate interest (commercial cards)– You
– Other sources, such as identity verification services and your card program provider
Monitoring your account for fraud– Payment transaction data
– Card account information
– Payment card data
Performance of contract (consumer cards), legitimate interest (commercial cards)You, through technical means when you make a transaction and your card program provider
Prevent, reveal and/or resolve issues related to money laundering and terrorism financing, including providing data to public authorities for investigation of such crimes in accordance with anti-money laundering and terrorism financing legislation.– Contact data
– Identification data
– Information on political exposure and sanctions
– Payment transaction data
Legal obligation– You
– Other sources, such as our business partners, government-maintained lists or sources, financial service providers, identity verification and fraud prevention services, sanction list providers, public sources and payment service providers and your card program provider
Providing a secure environment for the transmission of our servicesTechnical dataPerformance of contract (consumer cards), legitimate interest (commercial cards)You (through technical means)
Providing customer support related to your card, account or transactions– Payment card data
– Payment transaction data
– Card account information
Legitimate interest– You (through technical means)
– Other sources, such as your card program provider
Auditing and reporting– Payment transaction data (in aggregated form)
– Card account information (in aggregated form)
– Contact and identification data
– Technical data (in aggregated form)
Legitimate interest– You (through technical means)
– Other sources, such as payment service provider, where applicable and your card program provider
Ensuring and developing security of our systems with technical means, such as with data encryption, access controls, log management and auditingTechnical dataLegitimate interestYou (through technical means)
Promote, analyse, modify and improve our systems, and tools, and develop new servicesTechnical data  Legitimate interestYou (through technical means)
Conduct aggregate analysis and develop business intelligence that enable us to operate, protect, make informed decisions, and report on the performance of, our business;– Payment transaction data (in aggregated form)
– Card account information (in aggregated form)
– Technical data (in aggregated form)
– Customer support data (in aggregated form)
Legitimate interest– You (through technical means)
– Other sources, such as payment service providers (where applicable)

Purpose for processingTypes of personal dataLegal basisCollected from
Maintain a shareholder register– Contact data
– Identification data
– Recruitment and qualification data
– Information on political exposure and sanctions
Legitimate interest– You
– Other sources, such as our business partners, government-maintained lists or sources, financial service providers, identity verification and fraud prevention services, sanction list providers, public sources,
Manage PR and media relationsContact dataLegitimate interest– You
– Other sources, such as your employer, public sources
Visitor management and securing our premisesContact dataLegitimate interest– You
– Other sources, such as your employer

Who can process your personal data?

Your personal data is processed only by personnel who are authorized to do so based on their role. Enfuce does not sell your personal data.

Your personal data can only be transferred or disclosed to the following categories of third parties, in the following situations:

  • Our group companies: Enfuce group companies can be involved in processing of your personal data, including processing of your payment card transactions.
  • Our service providers: We use service providers in order to manage and operate our business. Service providers are needed for a variety of purposes, such as for operation of our IT systems, or for providing physical payment cards. These service providers can only process your personal data based on our instructions and use it only for purposes defined by us. Such processing is always regulated by data processing agreements in order to ensure that all our service providers keep your personal data safe and process it only in accordance with applicable legislation.
  • Regulatory and law enforcement authorities where the law requires us to do so.
  • Anyone to whom we lawfully transfer or may transfer our rights and duties under the agreement;
  • Any third party as a result of any restructure, sale or acquisition of Enfuce or any associated entity, provided that any recipient uses your information for the same purposes as it was originally supplied to us and/or used by us.

  • Your card program provider: your card program provider is our customer and supports certain activities relating to your card, such as verifying your identity.
  • Parties involved in the payment transaction process: to enable payment transactions, we disclose your personal data to other parties involved in the payment transaction process, such as banks and card scheme companies
  • Identity verification and sanction list providers to undertake required verification, regulatory and fraud prevention checks.

Our business partners: we may disclose your personal data to our business partners, where relevant for the services provided or for your interests.

Where is your personal data located or transferred to?

We may transfer your personal data within Enfuce group companies in countries where we have operations. 

We store your personal data in servers located in the European Economic Area (EEA), but we may use service providers that are based elsewhere in limited occasions. In cases where your personal data may be transferred outside of the European Union (EU), the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, we ensure the lawfulness of the transfer using a valid legal mechanism. These mechanisms include adequacy decisions adopted by the European Commission concerning a specific country and European Commission’s Standard Contractual Clauses for international transfers of personal data. In addition, we use additional security safeguards such as encryption to ensure the security of the personal data transferred.

For how long do we store your personal data?

The storage period for your personal data depends on the purpose it is processed for. We only retain your personal data for as long as is required for the purpose. Legislation applicable to us, such as anti-money laundering legislation, sets out mandatory retention periods that define for how long we must store your personal data. Where there is no legal obligation to store certain personal data, the retention times are defined based on our legitimate business needs. The following table illustrates examples of retention periods and criteria for defining retention periods for key categories of personal data.

Categories of personal dataRetention period and/or criteria for defining it
Information used for cardholder identification and identity verificationSix years after the end of the customer relationship, based on anti-money laundering legislation
Payment transaction-related dataSix years after the end of the customer relationship or after an occasional transaction, based on anti-money laundering legislation
User data on our services, such as MyEnfuceBased on the usage of the service: Inactive user accounts are deleted after a period of inactivity, depending on the service.
Data used for recruitment purposes18 months, unless you request a deletion or to store it for longer
Data used for customer or vendor relationship managementDepending on the length of the customer or vendor relationship
Data used for electronic direct marketing purposesDepending on the subscription; data is deleted in case you withdraw your consent for receiving electronic direct marketing.
Data related to the use of our websiteDepending on the purpose (e.g. analytics or marketing). Please see cookie settings and notice at the bottom-left corner of the page for more information.

How do we ensure the security of your personal data?

Enfuce is committed to maintaining the security of your personal data with robust, state-of-the art technical and organisational security measures. We secure the confidentiality, integrity and availability of your personal data, and protect it against loss, misuse, unauthorized access, disclosure, alteration and destruction. These security measures include, inter alia:

  • advanced encryption of data both in transit and at rest;
  • pseudonymisation of personal data;
  • role-based access controls and user authentication;
  • technical IT and network security measures;
  • comprehensive information security policies and staff training in accordance with them;
  • incident and breach management processes;
  • business continuity and disaster recovery processes;
  • regular testing and review of our security measures;
  • agreements covering data protection and security measures with our partners.

What are your rights?

You have specific legal rights in relation to your personal data. If you would like to exercise any of your legal rights, please contact privacy(at)enfuce.com.

Right of access: You have the right to know whether we process your personal data and to know what personal data about you we process. You may request for a copy of such data.

Right to rectification: You have the right to correct and update your personal data or ask us to update it if it is inaccurate or incomplete. We encourage you to keep all your personal information up to date.

Right to erasure (“Right to be forgotten”): You have the right to request us to delete your personal data. We will delete your personal data unless we have a legal obligation or other overriding reason to retain your data. In such case, we will let you know and explain our decision.

Right to restriction of processing: You can, under certain limited circumstances, ask us to restrict how we use your personal data and temporarily limit the way we use it (e.g. whilst we check that the personal data we hold of you is correct).

Right to objection: You can object to us processing your personal data if you want us to stop using it, provided that our legal basis for processing that personal data is legitimate interest or in relation to marketing communications.

Right to data portability: You can ask us to send you or another organisation an electronic copy of your personal data, provided that the processing is based on performance of a contract with you or on your consent.


Complaints: If you are unhappy with the way we collect and use your personal data, we hope we can resolve it. Please contact privacy(at)enfuce.com in the first instance. However, if you consider that our processing infringes your rights as a data subject, you always have the right to complain to a data protection supervisory authority, in the country where you work, normally live or where any alleged infringement of data protection laws has occurred. The supervisory authority in Finland is the Office of the Data Protection Ombudsman, www.tietosuoja.fi.

Can this information be changed?

Our services and applicable laws are continuously developing. There will be updates to this privacy notice page whenever changes or developments require so. The up-to-date version of can always be found on this website. The date of this notice can be found at the top of the page. We recommend that you revisit this page from time to time to review any possible changes. If any substantial changes in the way we process your personal data occur, we will post a notice of such change on this website.

Search