Datenschutzrichtlinie

Obligations related to personal data processing

Last updated: May 2025

Silkpay takes the protection of personal data very seriously and takes all necessary measures to ensure compliance with Regulation (EU) 2016/679 of 27 April 2016 (the “General Data Protection Regulation” or “GDPR”) and any applicable provisions relating to personal data (collectively referred to as the “Applicable Regulation”).

This Privacy Notice (the “Notice”) describes how Silkpay, as data controller, processes your personal data and outlines the commitments made by Silkpay to protect your personal information.

1. What is the scope of this Notice?

This Notice applies to all personal data processing activities carried out by Silkpay S.A.S, located at 95 avenue Président Wilson CS 5003 – 93108 Montreuil Cedex, contact@silkpay.fr (“Silkpay” or “we”), acting as a data controller within the meaning of the Applicable Regulation, and relates to:

Merchants who use or wish to use Silkpay’s services (to accept payment solutions, etc.), or their staff, legal representatives, or beneficial owners (“Merchants”);

Banking partners (payment service providers) or other partners, or their staff (“Partners”);

Job applicants applying via the email address on our website (“Applicants”);

Any individual contacting Silkpay via any channel, including through our website’s contact form or any other user of our website.

Please note: Silkpay may also act as a data processor on behalf of its Merchants/Partners for certain processing activities. These processing operations are not covered by this Notice.

2. What data do we collect?

2.1. Information we process

Depending on the services provided and your relationship with us, we may collect different categories of personal data, including: For Merchants and Partners:

Identity data (name, surname) of you or your legal representative(s)/beneficial owner(s);

Contact details (business email, phone number);

Data required to execute our services, including login data and security information (e.g., technical logs, access traces).

  • For any individual contacting us, including via our online contact form:

Your identification data and contact details (first name, last name, email address);

Any information you voluntarily communicate to us via the contact form available on our website www.silkpay.de;

Any information you may provide to us during a phone call or a request for access to our products and services.

  • For visitors to our website and/or mobile application:

Your IP address and other data collected through the use of cookies or other trackers: we invite you to consult our Cookie Policy available at www.silkpay.de/cookies for more information.

  • For Applicants:

Your identification data and contact details (first name, last name, email address and phone number);

Any information you communicate to us when sending your application by email and in particular, your CV and cover letter.

When your personal data is submitted via a form, the mandatory or optional nature of the information you must provide is indicated at the time of collection by an asterisk. Any lack of response or any response deemed abnormal by Silkpay may result in Silkpay refusing to consider your request.

You agree that the personal data concerning you communicated to Silkpay is up-to-date, accurate, and complete.

2.2. Specific information related to legal obligations in the banking and financial sector

We may also be required to collect certain specific information (e.g.: identity cards, transaction data) concerning Merchants and Partners, in connection with our legal obligations regarding anti-money laundering and the financing of terrorism (hereinafter “AML-FT”) and know your customer (hereinafter “KYC”) requirements arising from banking regulations. This will particularly be the case when we act as a payment service provider within the meaning of banking regulations.

When we act as an agent (of payment service providers) on behalf of our banking Partners, we may be required to collect this information as a data processor, on behalf of and under the instructions of our banking Partners, who in this case are the data controllers within the meaning of the Applicable Regulation.

2.3. Cookies

For cookies and other trackers that are placed on your device during your browsing on our website or mobile application, we invite you to consult our Cookie Policy available at www.silkpay.de/cookies.

3. For what purposes do we use your personal data and on what legal basis do we rely?

Silkpay undertakes to collect and process your personal data in a fair and lawful manner. The processing operations carried out by Silkpay serve specific, explicit, and legitimate purposes. Your personal data may therefore be processed for the following purposes:

  • The performance of our service and the management of our contractual relationship.

=> In this context, the legal basis for the processing is the performance of the contract between Silkpay and you (or pre-contractual measures).

  • To respond to your questions or requests and to manage any complaints you may have: Silkpay may use the data collected to respond to your requests relating to Silkpay’s services, for example.

=> In this context, the legal basis for the processing is either the performance of the contract if the request is related to the contractual relationship between Silkpay and you, or Silkpay’s legitimate interest, and more specifically its interest in addressing your inquiries and ensuring quality customer service.

  • To carry out statistical analyses, develop our website, optimize your browsing, and provide you with a personalized experience: Cookies or other trackers may be placed on our website for these purposes – for more information, please refer to the Cookie Policy available at www.silkpay.de/cookies.

=> In this context, the legal basis for the processing is Silkpay’s legitimate interest, and more specifically its interest in improving its website and services and in offering you tailored content and an optimal browsing experience.

  • To follow up on your application if you contact us for this purpose.

=>In this context, the legal basis for the processing is Silkpay’s legitimate interest, and more specifically its interest in responding to your application and in identifying profiles suited to the positions available within Silkpay.

  • To send you marketing and advertising information (B2B):

Silkpay may send commercial documentation to Merchants and, where applicable, to its Partners, including by email, to provide them with information about its activities and services (unless opposed by the Merchants/Partners, in accordance with the Applicable Regulation).

=>In this context, the processing is based on Silkpay’s legitimate interest, and more specifically its interest in promoting its services, offering personalized deals, better understanding the needs of Partners and Merchants, and offering them tailored services to foster loyalty.

  • To investigate any violation or suspected violation of our rights or property

=>In this context, the processing is based on Silkpay’s legitimate interest, and more specifically on its interest in defending its rights.

  • To respond to and comply with any judicial request as well as with our regulatory obligations.

related to “AML-FT” and “KYC”, where applicable (only when Silkpay acts as the data controller for such processing, which will notably be the case when Silkpay is a payment service provider within the meaning of banking regulations), or any other legal or regulatory obligation.

=> In this context, the processing is based on compliance with a legal obligation to which Silkpay is subject and/or on Silkpay’s legitimate interest.

  • To respect your choice when we have requested your prior consent.

 For certain specific processing activities, we will provide you with detailed information about such processing and request your prior consent when required by the Applicable Regulation.

=> In this context, the processing is based on your consent.

4. How long do we retain your personal data?

Silkpay retains your personal data, in active storage, for a period that does not exceed the time necessary for the purposes for which the data is collected and processed.
However, Silkpay may then retain your personal data in the form of archives to comply with its legal and regulatory obligations or to take into account applicable limitation periods in order to assert, exercise, or defend legal claims before the courts (for example, in commercial matters, the statutory limitation period is generally 5 years).

For instance, among the most common personal data processing operations, we apply the following retention periods:

  • Personal data relating to Merchants and Partners is retained for a period not exceeding the time strictly necessary for the management of the contractual relationship. Certain data used to establish proof of a right, a contract, or retained under a legal obligation will then be archived for the period necessary to fulfill the purposes for which it is retained and in accordance with regulations. For example, we retain in archives for 10 years all invoicing data required for accounting purposes, even if we are no longer in a business relationship with the individual concerned, in accordance with applicable regulations.

  • In addition, we retain data of Merchants and Partners used for commercial prospecting purposes for a period of 3 years from the end of the business relationship (for example, upon termination of a service agreement or the last contact from the client). We may then archive the data for the duration of the applicable statutory limitation period;

  • We retain data relating to any non-client/Partner prospect (used for commercial prospecting purposes) for 3 years following the last contact with that prospect (or until the exercise of their right to object), and then we archive the data until the end of the applicable statutory limitation period;

  • We retain the data necessary to handle your request until the end of the processing of your request (and then in archives in accordance with the applicable limitation periods);

  • Regarding data of unsuccessful candidates, we retain it in active storage for 2 years from the last contact with said candidates (unless they object), then 4 years in archives. In case of objection by the candidate to the retention of their data in active storage, we retain their data for 6 years in archives.

5. Who do we share your data with? Who can access your data?

Your personal data may be shared with third parties acting as data processors, bound by a data processing agreement, to perform services such as hosting, data analysis and marketing campaigns, contact management (CRM), communications, database management, website management, and IT maintenance. These processors act only on Silkpay’s instructions and have access to your personal data solely to perform their services. They are subject to the same security and confidentiality obligations as Silkpay.

We may also share your data with any third party providing advisory services on our behalf (e.g., lawyer, accountant, auditor, etc.).

Furthermore, to the extent permitted by law, your personal data may be shared with third parties (e.g., competent authority, Partner) for the following reasons:

  • In response to judicial or administrative proceedings of any kind, or to any request from competent authorities;

  • To comply with legal obligations (or to allow our banking Partners to comply with their legal obligations), to prevent, detect, investigate, and take action against any prohibited or illegal activities, any situation threatening security or any of your rights and interests, those of Silkpay, or any individual, and any violation of the Website Terms of Use;

  • When such disclosure is necessary to provide you with the service or to fulfill our contractual obligations.

Finally, Silkpay may disclose your personal data to its successors and/or potential acquirers in order to facilitate or enable mergers, consolidations, changes of control, or other restructurings in which Silkpay may participate.

6. Is your Personal Data transferred outside the European Union?

The personal data collected by Silkpay is hosted within the European Union.

7. What are your rights?

In accordance with the Applicable Regulation, you have the following rights regarding the personal data that we process as data controller:

  • The right of access: you have the right to obtain (i) confirmation as to whether or not personal data concerning you is being processed and, where it is, to obtain (ii) access to such data and a copy of it.

  • The right to rectification: you have the right to obtain the rectification of personal data concerning you that is inaccurate. You also have the right to have incomplete personal data completed, including by providing a supplementary statement.

  • The right to erasure: in certain cases, you have the right to obtain the erasure of your personal data. However, this right is not absolute and Silkpay may have legal or legitimate grounds to retain such data.

  • The right to restriction of processing: in certain cases, you have the right to obtain restriction of the processing of your personal data.

  • The right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you when such processing is based on Silkpay’s legitimate interest. However, Silkpay may invoke compelling legitimate grounds for continuing the processing, in which case Silkpay may continue to process your personal data in accordance with the Applicable Regulation. When your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of such data. You may object to receiving newsletters or communications by sending an email or letter to the address indicated below. Furthermore, our direct marketing messages include an "unsubscribe" option should you no longer wish to receive such messages from us.

  • The right to transmit instructions regarding the use of data after death: you have the right to give Silkpay instructions regarding the use of your personal data after your death.

To exercise these rights, you may submit a request:

  • By email to: contact@silkpay.fr

  • By mail to: 95 AV U PRESIDENT WILSON, 93100 MONTREUIL, FRANCE

If you experience any difficulty related to the processing of your personal data, you may file a complaint with the CNIL (3 Place de Fontenoy, 75007 Paris). However, we encourage you to contact us first before submitting a complaint to the CNIL.