Privacy Policy for the Services of Iris Solutions AD.

 

Introduction

This Privacy Policy is applied by “Iris Solutions” AD. (“Iris”, “we”) as a personal data controller in the collection and processing of personal data collected when using the website www.irispay.bg (“Site”/“Our Site”), as well as the mobile application “Iris Multibank Wallet” and the application “IRISPay for Merchants” (together referred to as the “Applications”/“our Applications”). The protection of your personal data is important to us and therefore we have taken the necessary organizational and technical measures to process your personal data in a lawful, appropriate and transparent manner and to guarantee your rights. With this policy, we wish to provide you with information about the type of your personal data that we process, the purposes for which we process them, for how long we store them, to whom we provide them and what your rights are in relation to the processing. We recommend that you familiarize yourself with this policy as a current or potential user of our Site or our Applications, as by providing your personal data, you agree to its terms. If you have any questions, you may contact us at the contact details provided below.

Definitions:

“Personal data” means any information relating to an identified or identifiable natural person. This may be information relating to your name, address, email address, as well as other personal data, or a combination thereof.

 

“Functionality” means all services provided through the Site and the Applications, which are described in detail in our Terms and Conditions;

Administrator information

The administrator of personal data under this privacy policy is Iris Solutions Ltd., UIC 204997709. You can contact us at:

• address: Sofia, 111B Tsarigradsko Shosse Blvd., Sofia Tech Park, Incubator Building, 1st floor. • e-mail address: bdo@irisbgsf.com.
• contact phone number: +359889209055

Types of personal data we process

Data provided during registration

When you use our Website www.irispay.bg, as well as the mobile application “Iris Multibank Wallet”, we collect the following Personal Data provided by you:

• Name, surname, family name;
• Date and place of birth (including indication of place of residence and country);
• Personal Identification Number (PIN)/Personal Identification Number (PIN) or other unique identification number for foreigners, contained in an official document, the validity period of which has not expired;
• Citizenship;
• Permanent address and country;
• Correspondence address in Bulgaria;
• Type, number and validity of identity document, date and place of issue, authority that issued the document;
• Bank/payment account identifiers (IBAN, BIC, etc.);
• Telephone;
• Email;
• Information on whether you are or are associated with Politically Exposed Person within the meaning of Art. 36 of the Anti-Money Laundering Act (AMLA).

The "IRISPay for Merchants" application does not perform direct registration and does not collect data directly. The registration process is carried out through the web portal https://paybyclick.irispay.bg , which is opened via a button in the application. When you click the "Registration" button, the application automatically redirects to a web browser, where you have the opportunity to fill out a registration form in which you provide the following Personal Data

• First name, last name and family name;
• Email address;
• Phone number.

Biometric data

If the device from which you access the IRISPay for Merchants application supports biometric authentication (e.g. fingerprint), you can enable this option in the application. Biometric data is not transmitted to servers, is not stored by Iris Solutions Ltd. and is not shared with third parties. The user can enable or disable biometric login at any time from the “Menu” tab in the IRISPay for Merchants application.

Technical data

When using our services, the following technical data is automatically collected:

• Device type (e.g. smartphone, tablet);
• Operating system and version (e.g. Android 12, iOS 16);
• App version (e.g. 1.2.3);
• IP address;

Error logs, which may include

• Time and date of the error;
• Description of the error that occurred;
• Steps that led to the error (e.g., failed to load an interface element).

Cookies

Website

Our Site as well as our application “Iris Multibank Wallet” use “cookies”. They are placed by software running on our servers and by software managed by third parties whose services we use.

Cookies are small text files that are created when you visit a website. They allow information collected on a web page to be stored, allowing the website to provide you with a personalized experience and the website owner with statistical data on how you use the website so that it can be improved. Some cookies can be stored for a certain period of time, such as one day, or until you close your browser. Others last indefinitely.

When you first visit our site or our “Iris Multibank Wallet” application, we ask you if you want us to use cookies. If you choose not to accept them, we will not use them for your visit, except to record that you have not agreed to their use for another purpose. If you choose not to use cookies or to prevent their use through your browser settings, you will not be able to use all the functionalities of our website.

Most browsers allow you to refuse to accept cookies, as well as to delete them, or to prevent or limit their use at any time. The methods for doing this vary depending on the browser. If you block cookies, you will not be able to use all the functionalities of our Site.

„IRISPay for Merchants”

The "IRISPay for Merchants" application does not use cookies.

Purposes of data processing

Your personal data is processed only to the extent necessary to fulfill the following purposes:

Providing access to our functionalities

• To authenticate users when logging into the Applications and the Site;
• To provide personalized access to the features of the Applications and the Site.

Security maintenance and improvement

• To protect the Applications and the Site from unauthorized access and cyberattacks;
• To detect and prevent abuse or security breaches;

Technical support and fraud protection

• To analyze and troubleshoot technical errors and malfunctions;
• To provide support to users if they encounter difficulties using the application;
• To investigate and prevent potential fraud, including unauthorized use of accounts or unauthorized transactions.

Compliance with regulatory requirements:

• providing payment services for which we have a license/permission from the Bulgarian National Bank;
• carrying out checks and collecting information in accordance with the requirements of the Anti-Money Laundering Measures Act;
• fulfilling our obligations under applicable legislation, including personal data protection regulations (GDPR);
• providing information to regulatory authorities or other competent institutions when required by law.

User experience analysis and improvement

• To collect data on the use of the Site and Applications for the purpose of optimizing and improving their functionalities;
• To understand the behavior and needs of users in order to offer better and more intuitive services.

Your personal data will not be processed for purposes other than those listed above unless your explicit consent is obtained, including for marketing purposes.

Legal grounds for processing personal data

 

We process your personal data on different grounds depending on the specific type of data and the purposes for which it is processed. Please note that in certain cases your consent to the processing of personal data may not be necessary if Iris has another legal basis (for example, compliance with statutory obligations) for the processing of your personal data. We process your data on the following grounds:

• on the basis of the contract concluded between us and our legitimate interest, we process your profile data that you provided to us when registering on our application or website, as well as when you access your profile;
• on the basis of fulfilling our legal obligation and fulfilling the contract concluded between us, we may process so-called transactional data (for example, card data, bank account data and details of transaction history);
• on the basis of our legitimate interest and for the purposes of our communication with you, we may process so-called correspondence data, which may include the content of our communication with you and the metadata related to the communication;

 Data sharing

Your personal data is not shared with third parties, except as expressly listed in this section. Sometimes the Site and/or Applications may contain links/references (hyperlinks) to other websites. We do not operate the linked sites and do not endorse the content, services and products of these sites. We advise you to use the linked sites carefully and with due attention to their content and terms of use. Iris is not responsible for the privacy policy or content of such sites and we advise you to review their privacy policies. However, as soon as we receive information about illegal activities or illegal information on such websites, we will take immediate measures to remove the electronic references (links) to them.

Please note that the protection provided by the GDPR follows the data you provide, which means that the data protection rules continue to apply regardless of where the data is located and who processes it. This also applies when the data is transferred to a non-EU country ("third country").

Possible cases of sharing personal data:

• When fulfilling legal obligations or regulatory requirements, including for the purpose of preventing fraud;
• When it is necessary to provide information to government authorities or judicial institutions in accordance with the law, including for the purpose of confirming your identity, conducting judicial, administrative or extrajudicial proceedings, etc.;
• We may need to transfer your personal information to business partners and service providers located in or outside the European Economic Area ("EEA"). For example, we may process payments through other organizations such as banks/payment institutions, card networks and payment schemes located in or outside the EEA;
• When necessary to ensure the functioning of the application, including for the purpose of preventing fraud, we may provide limited access to personal data to third parties for the purpose of support;
• If necessary, we may disclose your data and data about received inquiries to one or more of our partners listed on the Site and/or the Applications, in order to perform the services we offer;
• The Site contains references/hyperlinks to applications that may collect personal data for the use of third parties, such as Google, Facebook, LinkedIn, Instagram, Youtube, Pinterest and others (such as the social network sharing and liking buttons that are placed on the Site);
• Outside of the above hypotheses, personal data may be shared with third parties if you have given explicit consent to this.

Using analytical tools (Google Analytics)

The Site and the Applications use Google Analytics to collect data about user behavior and how the Applications are used. The data collected through Google Analytics is used only to improve the application and does not allow for the identification of specific users. This data may include information about:

• Device type and operating system;
• IP address (anonymized if applicable);
• Session duration and navigation within the application.

Data security

We implement modern organizational, technical and physical measures to ensure the security of your personal data. Our goal is to protect the data from loss, unauthorized access, disclosure or misuse.

The measures we are implementing include:

Data encryption

• All data transmitted from our Site and our applications to our servers is protected by SSL/TLS encryption.
• Biometric data used for login (where applicable) is processed and stored locally on the device and is not sent to our servers.

Limited access

• Access to the servers on which data is stored is strictly limited to authorized employees and subcontractors.
• All persons with access to the data undergo regular information protection training and are bound by contractual confidentiality obligations.

Regular testing and updates

• We perform regular vulnerability and security tests on our Site and our applications, as well as on the server infrastructure.
• Our software systems are updated regularly to meet the latest security standards.

Biometric data protection

• Biometric data, such as Face ID or fingerprint, that can be used to access the IRISPay for Merchants application, are processed through secure technologies built into the device's operating system. The application, or IRIS, does not have access to this data, which is stored only locally on the device.

Backups

• Data is backed up regularly to ensure recovery in the event of loss or technical failure. The back-ups are stored in a secure environment.

Despite the measures taken, it is important to note that no security system can guarantee absolute security. We recommend that users keep their devices updated and use strong passwords for maximum protection.

Iris Solutions Ltd. is committed to continuing to improve security measures in accordance with the latest technological advances and regulatory requirements. However, you are responsible for the confidentiality of your personal identification data by keeping your access passwords safe. If you suspect that someone has gained unauthorized access to your user password or account, you must change your password immediately. If you lose control of your account, you must immediately notify Iris using the contact details provided in this policy.

Data retention period

Your personal data is stored until the expiration of the legally prescribed period for their storage or until the expiration of the legally prescribed limitation period for filing lawsuits, but no more than 5 (five) years from the lapse of the grounds for processing.

 

You may at any time before the expiration of the period described here request the deletion of your Personal Data (if the data is not processed on the basis of our legitimate interest), and if their complete deletion is impossible due to a regulatory requirement for their storage – request their anonymization.

Your rights

At any time during the processing of your Personal Data, you have the following rights:

 

1. Right of access: Right to access your personal data and to be provided with information on the purposes of the processing, the categories of personal data, recipients to whom Personal Data are disclosed, storage periods, etc.
2. Right to rectification: You have the right to request Iris to rectify inaccurate personal data concerning you without undue delay;
3. Right to erasure (the “right to be forgotten”): Right to have your Personal Data erased on the following grounds: the personal data are no longer necessary for the purposes for which they were collected/processed; when you deregister and delete the Application; when you withdraw your consent, in cases where the data processing is based on consent; the personal data must be erased for the purpose of compliance with a legal obligation under European Union or national law; when the data have been processed unlawfully; when you have objected to their processing and there is no other basis for their processing.
4. Right to restriction: Right to request restriction of the processing of your personal data in the following cases:

 – the accuracy of the personal data is contested by you – we will restrict their processing for a period that allows us to verify the accuracy of the personal data;

– unlawful processing has been established, but you only want the processing of your data to be restricted, instead of being deleted;

– you want your personal data to be stored, although Iris no longer needs them for the purposes of the processing, as you will use them to establish, exercise or defend your legal claims;

– if you object to the processing of your personal data, we will restrict their processing for the period of verification of its validity

1. Right to object: Right to object to receiving commercial communications; right to object to your personal data being provided to third parties;
2. Right to data portability: Right to receive the Personal Data that you have provided to the Administrator in a structured, commonly used and machine-readable format, and you have the right to transfer these data to another administrator without hindrance from the Administrator, when the processing is based on our legitimate interest or a contractual obligation.
3. Right to lodge a complaint: In case you believe that your rights in relation to the processing of your personal data have been violated, you have the right to lodge a complaint with the Personal Data Protection Commission. The current contact details and the conditions for filing a complaint with the Personal Data Protection Commission can be found on the Commission’s website www.cpdp.bg. As of the date of the last update of this notice, the contact details are: Address of the Personal Data Protection Commission: Sofia 1592, 2, “Prof. Tsvetan Lazarov” Blvd.; E-mail: kzld@cpdp.bg

 

 

As an End User, you may exercise the rights described above, in case they are not available as a functionality through the Application, by submitting a written application to the Administrator’s address and/or e-mail address specified above. Your request should contain sufficient data to be able to be unequivocally identified, and contact details – address, telephone number and/or e-mail address for feedback. The Personal Data Administrator prepares a response to the submitted request within 14 (fourteen) days of its receipt.

 

Any information regarding your rights or other issues related to the protection of personal data can be obtained from the Administrator via the communication channels specified below.

 

Privacy Policy Updates

• For all other issues related to the processing of personal data that are not regulated in this document, the provisions of the Personal Data Protection Act and Regulation (EU) 2016/679 shall apply.
• The Personal Data Administrator reserves the right to make changes to this Policy at any time, ensuring similar protection of your Personal Data in all cases. The changes shall enter into force upon their publication, unless otherwise stated therein.
• If you have any questions about the way in which we process your personal data, or if you wish to exercise your rights, please contact us using our contact details provided above.

 

 

This privacy policy was last updated on 16.12.2024.