Introduction

The payment method iDEAL in3 is a service of in3 NL B.V., hereafter referred to as: iDEAL in3. We consider the protection of your privacy and your personal data very important. In this privacy statement, we therefore describe which personal data we collect from you and how we handle it. In addition, this privacy statement explains what rights you have and how you can exercise your rights.

This privacy statement applies as soon as you visit our website or download our app. Additionally, this privacy statement naturally applies when you use our iDEAL in3 payment method and contact us. This Customer Privacy Statement applies to you either because you (i) have chosen as a consumer to check out with our iDEAL in3 payment method, or (ii) as a consumer visit our website, or (iii) have contacted us in connection with our services.

Data Controller

We, iDEAL in3, are responsible for processing your personal data.

The contact details of iDEAL in3:

Name: in3 NL B.V.

Address: Meerenakkerweg 1a

5652 AR Eindhoven

Email address: support@in3.ideal.nl

Chamber of Commerce number: 59234784

Which data do we process and for what purpose?

We process your data when you visit our website, contact us, and/or when you use our iDEAL in3 payment method.

Data you provide to us

We process personal data that you provide to us. For instance, when you:

- make a purchase at a (web) store and pay via our iDEAL in3 payment method;
- create an account with us;
- contact our customer service.

The data we process from you includes:

- basic information, such as your name, email address, postal address, date of birth, telephone number;
- order information, such as data related to your orders;
- payment information, such as your bank account number and data related to payments to us;
- communication information, such as data related to your communication with our customer service.

We need this information to provide our services, deliver good customer service, and for marketing purposes. We also use the email address you provided to send newsletters if you have subscribed to them.

Data we collect when you want to use our iDEAL in3 payment method

When you choose to use our iDEAL in3 payment method, we will also process your credit score and the criteria on which it is based. This is further explained in paragraph 4 below. We need this information to assess whether it is responsible for you to use the iDEAL in3 payment method for the purchase you want to make. In this way, we aim to prevent over-crediting and thereby protect both you and us.

Automated Credit Assessment

When does an automated credit assessment take place?

If you opt for payment with the iDEAL in3 payment method, we assess whether this can be done responsibly. We test this based on a credit score that we request from a trade information agency (Experian). If you are a known customer of ours, we also take into account your payment history with us during this assessment.

Credit assessment for a consumer purchase and its implications

For the credit assessment as a consumer, we provide your name, address, date of birth, email address, and phone number to the trade information bureau Experian. We then receive a credit score from Experian associated with you. Based on this credit score from Experian, as well as any historical payment data we already have about you, we automatically decide whether or not you can (again) use the iDEAL in3 payment method.

In addition to the credit assessment via Experian, we also check your name and address. Furthermore, we check if your details appear in the insolvency register and the curatorship and administration register to determine if payment via iDEAL in3 is responsible. To prevent over-crediting and fraud, we also check if there are still outstanding debts at the address you provided. If possible, we also check if you have any other negative registrations in your name. You can, for example, get a negative registration if you have payment arrears with other services, such as your phone subscription or energy company. Finally, we check if you have made more than two credit applications with iDEAL in3 in the past 30 days to try to protect you against over-crediting.

How long is the credit assessment retained?

We keep the data underlying the credit score to explain it when you ask. Furthermore, we store data to check and improve our policy in the field of credit assessment and fraud prevention. See paragraph 6 for specific retention periods. Experian retains your credit score application for 30 days so that they can take it into account with new credit applications during that period.

Why is the credit assessment necessary?

We use automated credit assessments to be able to enter into and execute the agreement for the use of our iDEAL in3 payment method with you. We also have a significant and legitimate interest in the credit check. Without this check, after all, we cannot assess whether we can collect the payments and whether you can meet the payment obligations. We also find it important to prevent over-crediting and, in that context, to know whether staggered payment is responsible in your case. Since we receive many requests for payment via iDEAL in3, we have to conduct the credit assessment automatically. The methods we use for this are regularly tested to ensure that they remain fair, purposeful, and unbiased. However, you can always ask us for a human review of your specific situation.

Insight, objection, and human assessment

If we reject your request to use iDEAL in3, you can do the following. First, you can ask for insight into the (personal) data on which we based this and the logic of the decision. If the data is incorrect, you can request correction or deletion. If you believe the rejection is unjustified given the data, you can object. You can also ask us to manually assess your creditworthiness. You can make these requests by sending an email to support@in3.ideal.nl. We will ask you questions to verify your identity when handling your request.

Who do we share your data with?

Service provision

We use third parties, such as suppliers, who provide services to us to enable the iDEAL in3 payment method. These parties help, among other things, in sending payment overviews, collection services, fraud prevention, and creditworthiness assessment. You can ask us questions about these parties and their data processing method via privacy@in3.ideal.nl. We can also share data with authorities if legally required.

Financing

We can share data with third parties to finance our service. In that context, for example, we transfer our claims on consumers like you (the Claims) to Aion Bank SA/NV (Aion). Aion can then dispose of the Claims and, for instance, pledge them to third parties. Aion can also transfer the Claims for collection to third parties or transfer them back to the store where you, as a consumer, made your purchase. The parties involved then receive your data to manage the Claims, manage payment obligations, and handle payments. You can find Aion's privacy statement here: https://aion.eu/en/privacy-policy.

Miscellaneous

Lastly, we may provide your data to third parties in other cases when we have a valid reason for doing so. For instance, in the context of an acquisition of our company, like to a potential buyer or their advisors, or to establish, exercise, or defend our legal position or rights.

When we share your personal data as mentioned here, we take all legal, technical, and organizational measures to ensure that your data is carefully secured. We do not send your data to third parties for remote sales or market research unless you have given permission for this.

We process your data as much as possible within the European Union. For certain activities, data may be processed outside the European Union. This might be the case with Marketing parties, for instance. These are global organizations, which means that data can be processed beyond the borders of the European Union. When this happens, appropriate measures are taken to comply with applicable privacy laws. For example, by closing the necessary standard contractual provisions (so-called Standard Contractual Clauses) which have been approved by the European Commission. If you have any questions about data transfer or the safeguards taken, you can contact privacy@in3.ideal.nl.

Purposes, bases, and retention periods

We process your personal data for the purposes and on the grounds specified below. Furthermore, you can read below how long we keep certain data.

6.1. Purpose: Confirming your identity

Data: Name, address, email address, and date of birth.

Basis: The establishment and execution of our agreement with you (Article 6(1)(b) of the General Data Protection Regulation, GDPR).

Retention Period: We retain this data for 2 years after your customer relationship with us has ended, unless we are legally required to keep certain data longer.

6.2. Purpose: Checking your creditworthiness and preventing fraud

Data: Name, address, date of birth, email address, phone number, negative registrations in registers such as the guardianship and administration register, number of credit applications in the past month, payment history with iDEAL in3, and any debts at the same address.

Basis: The legitimate interest of iDEAL in3 (Article 6(1)(f) of the GDPR). We have a legitimate interest in protecting ourselves from fraud and from granting credit that cannot be repaid. We also have an interest, as do consumers themselves, in protecting consumers from over-crediting.

Retention Period: We retain this data for 1 year from the moment you applied to use our iDEAL in3 payment method.

6.3. Purpose: Customer service

Data: Name, address, email address, phone number, order and payment history with iDEAL in3.

Basis: This depends on your request, but customer service may be necessary for the establishment and execution of our agreement with you (Article 6(1)(b) of the GDPR). Customer service may also be necessary to pursue legitimate interests in assisting you with questions about our services (Article 6(1)(f) of the GDPR).

Retention Period: We retain this data for 2 years after your customer relationship with us has ended unless we are legally required to keep certain data longer.

6.4. Purpose: Administration

Data: Name, address, email address, phone number, account number, amounts payable, details of your transactions via iDEAL in3.

Basis: Our legal administrative obligations (Article 6(1)(c) of the GDPR).

Retention Period: We retain this data for 7 years after your transaction via iDEAL in3, unless there is a longer legal retention obligation.

6.5. Purpose: To manage accounts and deliver our service

Data: Name, address, date of birth, email address, phone number, account number, amounts payable, order and payment history with iDEAL in3.

Basis: To provide our service and/or the account you created (Article 6(1)(b) of the GDPR).

Retention Period: We retain this data for 2 years after your customer relationship with us has ended unless we are legally required to keep certain data longer.

6.6. Purpose: Financing our services

Data: Name, address, email address, phone number, account number, amounts payable, transactions with iDEAL in3.

Basis: Our legitimate interest in obtaining and undertaking financing at our discretion (Article 6(1)(f) of the GDPR).

Retention Period: We retain this data for 2 years after your customer relationship with us has ended, unless we are legally required to keep certain data longer.

6.7. Purpose: Providing a well-functioning website

Data: Your IP address and other technical data of your device.

Basis: Our legitimate interest in providing a well-functioning website (Article 6(1)(f) of the GDPR).

Retention Period: 30 days after visiting our website.

6.8. Purpose: Marketing

Data: Email address and phone number.

Basis: Our legitimate interest in advertising our services (Article 6(1)(f) of the GDPR).

Retention Period: We retain this data for 2 years after your customer relationship with us has ended, unless we are legally required to keep certain data longer.

6.9. Purpose: Sending newsletters

Data: Email address.

Basis: Consent (Article 6(1)(a) of the GDPR).

Retention Period: As long as you have given consent and have not withdrawn it.

6.10. Purpose: Defending or establishing our rights

Data: Name, address, email address, phone number, account number, amounts payable, transactions with iDEAL in3.

Basis: We have a legitimate interest in being able to establish, exercise, and defend our legal position and rights (Article 6(1)(f) of the GDPR).

Retention Period: During the dispute and for 5 years thereafter.

What rights do you have?

Requests to exercise the rights below can be sent to privacy@in3.ideal.nl. We may ask questions to verify your identity when handling your request.

Access: You have the right to access the personal data we have about you.

Correction: We strive to ensure that the personal data we hold about you is accurate and up-to-date. You can ask us to modify or delete your information when something in your data is no longer correct.

Deletion: You have the right to request the deletion of your data if the personal data is incorrect or no longer relevant. You can also request to delete your account at any time. We do not always have the ability to immediately delete all data due to legal retention periods or the execution of the credit agreement.

Objection and Human Assessment: You have the right to object to the processing of your personal data and to request a human assessment insofar as it concerns the automated credit assessment. See also the section above under paragraph 4.

Objection: You can object to any processing of your personal data based on iDEAL in3's legitimate interest as described in paragraph 6.

Data Portability: If your personal data is processed automatically for the execution of a contract, you have the right to request a machine-readable format of your data for transfer to another party.

Withdraw Consent: When we process your personal data based on your consent, such as for the newsletter, you have the right to withdraw your consent at any time. You can do this through our website, via the link at the bottom of the newsletter, or by sending an email to support@in3.ideal.nl.

Complaints: We place great importance on customer service. If you have requests or complaints about the processing of your personal data, please contact us at privacy@in3.ideal.nl. We will do our best to help you. If you disagree with our approach, you always have the right to file a complaint with the personal data authority at https://autoriteitpersoonsgegevens.nl/.

How do we protect your data?

We take appropriate technical and organizational measures to protect your personal data from unauthorized access, transfer, destruction, or other unauthorized processing. Security measures include firewalls, encryption, the use of secure IT environments, access control, training for staff working with your data, and careful selection of third parties who will process personal data for us. Additionally, access to your information is limited to iDEAL in3 staff who need your data to perform their duties.

Other Websites

Our website may refer to other websites. We are not responsible for the privacy statements or content of such other websites. We recommend that you read the privacy statements and terms and conditions of those websites carefully before using them.

Use of Cookies and Similar Technology

When you visit one of our websites, we automatically register certain information. This includes the date and time of your visit to our website, as well as how you arrived at our website (for example, through a search engine like Google). This information is recorded using cookies and similar techniques. The information we can record therefore partly depends on your browser settings and which cookies you have accepted.

Cookies are small files temporarily stored in the user's browser cache when a website is visited. Our website uses cookies necessary for the site to function and to interact with you. We also use analytical cookies from Google Analytics and Hotjar to collect statistical data about the use of our website and to make our website more user-friendly. We have set up Google Analytics in a privacy-friendly manner according to the guidelines of the Dutch Data Protection Authority. We also process your IP address, device ID, and other information about the device you use to visit our website, such as the type of browser and operating system. We use this information for analyses in the area of fraud prevention to align our policies accordingly.

An overview of the cookies we use, what the cookies do, their duration, and who has access to them can be found [here]. If you object to certain cookies or data collection, you can adjust your settings [link to cookiebot] here.

If you don't want cookies on your computer, you can block their use through your browser settings. Please note that some features on the website only work if you allow cookies. You can also delete cookies from your browsing history. Regularly deleting cookies can alter the user profile built with them. However, deleting cookies does not stop data collection; it only deletes the profile based on previous browsing history.

Changes to this Customer Privacy Statement

We constantly make improvements to our website and our payment method iDEAL in3. For this reason, we reserve the right to change this Customer Privacy Statement by posting a revised version on our website. Changes can also be made due to changes in the General Data Protection Regulation, other privacy regulations, or related case law. We advise regularly checking the content of the latest version of our Customer Privacy Statement on this page.

Questions about Data Protection

iDEAL in3 has a data protection officer who deals with the protection of your personal data. If you have questions about this Customer Privacy Statement or the protection of personal data within iDEAL in3, please contact privacy@in3.ideal.nl.

Last Update: 24 September 2023