This notice explains how your personal data are processed when you use the Apple Pay application to pay for goods and services instead of using your physical card. It covers only the processing of personal data carried out by Addiko Bank d.d.
For information on how APPLE DISTRIBUTION INTERNATIONAL LIMITED, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, company registration number 470672 (hereinafter: “Apple”) processes personal data in connection with the use of Apple Pay, please refer to the information published on Apple’s website or within the Apple Wallet application.
I. WHO IS THE DATA CONTROLLER AND WHERE CAN YOU OBTAIN ADDITIONAL INFORMATION?
Addiko Bank d.d. (“Addiko Bank”, “Addiko” or the “Bank”), with its registered office at Dunajska 117, 1000 Ljubljana, Slovenia, company registration number 1319175, acts as the data controller and is therefore responsible for ensuring that personal data are processed in accordance with the GDPR and other applicable legislation (the “Controller”).
If you would like additional information on the processing of personal data, you may contact the Data Protection Officer at: dpo.si@addiko.com.
II. WHICH PERSONAL DATA DOES THE BANK PROCESS?
The Bank will transmit the following data to the digital wallet service provider:
- First and last name of the cardholder, card name and card type, device hardware ID, card expiration month and year, card number and other security data required solely for the card provisioning process in the digital wallet (e.g. CVV). These data are used on a one‑time basis only and are not stored;
- contact address and telephone number of your mobile device from the Bank’s systems;
- transaction data (transaction amount, timestamp, type, currency, transaction category, authorization status, number of transactions performed, transaction reference number, discount information or other merchant messages).
III. WHAT IS THE PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL DATA?
Apple, as the provider of the digital wallet service, processes the data listed in Section II of this Notice for the following purposes:
- enabling card provisioning and payment execution via the digital wallet;
- verifying the user’s identity and determining the card provisioning process;
- displaying and transmitting transaction data and transaction history to the user;
- detecting, preventing and managing fraud;
- managing the lifecycle of the digitized card;
- complying with legal obligations and responding to requests from competent authorities;
- performing administrative, technical and security activities and improving the service;
- preparing statistical and aggregated reports on service usage and performance;
- linking transactions made with the digitized card to the corresponding physical card.
Apple receives the data listed in Section II via the legal entity providing card digitization services to the Bank: Mastercard Europe SA, 198/A, Chaussée de Tervuren, 1410 Waterloo, Belgium (hereinafter: “Mastercard”), based on your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation (“GDPR”).
The use of the digital wallet is entirely voluntary and is not covered by any existing agreement you may have with Addiko Bank.
Since your consent forms the legal basis for the transfer of data to Apple, you may withdraw your consent at any time with effect for the future by removing your card from the digital wallet. In such case, Addiko Bank will no longer transmit data to Apple. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. If you wish to use the digital wallet again, you must add your card to the Apple Wallet application.
Regardless of consent withdrawal, the Bank continues to process certain data where required by law (Article 6(1)(c) GDPR) or for the establishment, exercise or defense of legal claims (Article 6(1)(f) GDPR), within the scope and retention periods prescribed by applicable legislation.
IV. SOURCES OF PERSONAL DATA
All data transmitted to Apple are obtained from you, from the device on which you store the digitized card, and from data already held by the Bank. For details on the categories of data transmitted to Apple, please refer to Section II of this Notice.
V. WHO ARE THE RECIPIENTS OF PERSONAL DATA?
Unlike payments made with a physical card, where Addiko transmits data to the merchant via Mastercard, the use of Apple Pay involves the transmission of data to Apple, as described in previous sections of this Notice.
Other potential recipients, where a legal basis exists, include:
- public authorities (e.g. police, public prosecutors, investigators and courts in cases of fraud; tax authorities in tax matters; courts for the protection of the Bank’s legal rights),
- legal entities vested with public authority (the Bank always verifies the legality of requests received),
- other banks that are members of the Addiko Group and have an appropriate contractual relationship with the Bank,
- legal entities providing services or goods to the Bank based on a contractual business relationship.
In relation to the processing of personal data required for the use of Apple Pay, Apple acts as an independent data controller.
VI. DOES THE BANK USE AUTOMATED DECISION‑MAKING?
In accordance with Articles 3 and 22 of the GDPR, we inform you that the Bank may use automated decision‑making where a likelihood of fraud is detected. This process is identical to that applied to payments made with a physical card, whereby the Bank protects your funds by interrupting the transaction.
VII. HOW LONG DOES THE BANK RETAIN PERSONAL DATA?
All data related to your current account are retained for 10 years after termination of your current account agreement, unless deletion is prevented by another factor, such as ongoing court proceedings or a criminal investigation.
VIII. WHAT RIGHTS DO I HAVE REGARDING MY PERSONAL DATA?
The GDPR grants individuals several rights regarding the processing of personal data, as set out in Articles 15 to 22, including:
- the right of access to personal data processed by the Bank (subject to the conditions of Article 15 GDPR),
- the right to rectification (e.g. correction of inaccurate data or completion of incomplete data),
- the right to erasure of personal data (where data are linked to a contract, the Bank must retain them for 10 years after termination in accordance with anti‑money laundering and counter‑terrorist financing legislation),
- the right to restriction of processing,
- the right to data portability,
- the right to object, and
- rights related to automated individual decision‑making,
all subject to the conditions laid down in the GDPR.
You may exercise these rights by submitting a request to the Bank by any means or directly via email to dpo.si@addiko.com. Unless exceptional circumstances apply, your request will be processed within 30 days of receipt of a complete request.
You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.
IX. ARE PERSONAL DATA TRANSFERRED TO THIRD COUNTRIES (OUTSIDE THE EU)?
In connection with the use of Apple Pay, data are transmitted to Apple. The way Apple processes these data is governed by the agreement between you and Apple, which you accepted when adding your Addiko card to the Apple Wallet application. The Bank has no influence over Apple’s further processing of personal data once they have been transmitted.
In addition, certain personal data may be transferred to third countries, for example to banks that are members of the Addiko Group outside the EU. Such transfers are carried out only where and to the extent permitted by law and subject to the safeguards set out in Article 46 of the GDPR.