Partner Privacy Notice
Last updated:
1. Who we are and whom this notice covers
PaySaxas Oy (Business ID 3387454-8, Lapinlahdenkatu 16, 00180 Helsinki, Finland), an electronic money institution authorised by the Finnish Financial Supervisory Authority, is the controller of the personal data described in this notice.
This notice covers individuals who apply to join or take part in the PaySaxas Partner Programme (the “Programme”), and the directors, representatives, beneficial owners and Partner Portal users of companies that apply to join or take part in it. If you register a company, please make this notice available to these people. It does not cover clients of PaySaxas companies, whose data is described in the privacy policy of the PaySaxas company that provides their account and in the Platform Privacy Policy.
Our Data Protection Officer can be reached at dpo_privacy@paysaxas.com.
2. What data we process
- Identification and contact data: first and last name, date of birth, email address, mobile phone number, postal address, country of residence and your Partner Portal username.
- Company data (company partners): company name, registration number, country of incorporation and VAT number, and data on directors, beneficial owners and representatives, including evidence of a representative's authority.
- Programme data: the clients attributed to you (shown to you only by reference number), Rewards accrued, reduced, held and paid, statements and payout documents, and records of your acceptance of the Partner Agreement and of payout documents (the version accepted, time, IP address and browser).
- Payout data: the IBAN and account holder name of your payout account and the result of its verification.
- Tax data: tax residence, whether you carry on business, whether you perform your activities in Finland, partly in Finland or outside Finland, tax identification number (for individuals whose payments are reported to the Finnish Incomes Register, the Finnish personal identity code or a foreign tax identification number and its issuing country), VAT status, prepayment register status, tax card details, evidence you give us of these facts, the tax treatment we apply and tax withheld.
- Screening data: results of sanctions, politically exposed person and adverse-media screening, including, where permitted by law, information about criminal offences or alleged offences (GDPR Art. 10), how a possible match was resolved and, if you are a politically exposed person, our approval decision; an identity document only where we ask for it under section 6.
- Communications with us, including what you tell our partner team about your business.
- Partner Portal log data: log-in times, IP address and device information, and the sign-in methods you have set up.
We do not collect biometric data about partners.
3. Where the data comes from
- From you, including the evidence of your tax status that you give us.
- For company partners, from the company and the people acting for it.
- From clients you introduce, if they tell us that you referred them.
- From PaySaxas Financial Solutions Corporation, if you took part in its affiliate programme before you accepted the Partner Agreement: your registration data and the history of your referrals and rewards.
- From public registers, such as trade registers.
- From sanctions lists, lists of politically exposed persons and adverse-media sources, directly or through our screening provider.
- From our own systems (Programme data and log data).
4. Why we process the data and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Registering you and running the Programme: attributing referrals, calculating and paying Rewards, issuing statements and payout documents, recording your acceptances | Identification, contact, company, Programme and payout data | Performance of our agreement with you (GDPR Art. 6(1)(b)); for representatives and users of company partners, our legitimate interest in performing the agreement with the company (Art. 6(1)(f)) |
| Verifying company partners | Company data; data on directors, beneficial owners and representatives | Our legitimate interest in knowing whom we contract with and pay (Art. 6(1)(f)) |
| Sanctions screening before each payout and clearing a possible match | Name, date of birth, country, screening results; an identity document where requested | Compliance with our legal obligations under EU sanctions regulations and Finnish freezing decisions (Art. 6(1)(c)) |
| Screening against other sanctions lists that we apply under our risk policy, and for politically exposed persons and adverse media; preventing fraud and abuse of the Programme | Name, date of birth and country of residence; for company partners, company data and data on directors and beneficial owners; screening results, how a possible match was resolved and, for a politically exposed person, our approval decision; for preventing fraud and abuse, Programme data and payout data | Our legitimate interest in preventing financial crime and protecting the Programme (Art. 6(1)(f)); information about criminal offences only where Article 10 GDPR and applicable Finnish law, including the Data Protection Act (1050/2018), permit it |
| Monitoring the clients introduced through the Programme, as part of our anti-money-laundering controls | Programme data and statistics on the clients you introduced | Compliance with our legal obligations under the Act on Preventing Money Laundering and Terrorist Financing (Art. 6(1)(c)) and our legitimate interest in preventing money laundering and terrorist financing (Art. 6(1)(f)) |
| Tax withholding, Incomes Register reporting and bookkeeping | Tax data, payout documents | Compliance with legal obligations under the Prepayment Act (1118/1996), the Act on the Incomes Information System (53/2018) and the Accounting Act (1336/1997) (Art. 6(1)(c)); for the Finnish personal identity code, section 29 of the Data Protection Act (1050/2018) |
| Keeping the Partner Portal secure, including log-in codes sent by SMS | Mobile phone number, log data | Our legitimate interest in IT security (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Our legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can ask us how we balanced them against your interests.
5. Whether you must provide the data
Data marked as required in the Partner Portal is needed to conclude and perform our agreement with you. Tax identifiers are required by law for payments reported to the Incomes Register; give them to us only in the Partner Portal, never by email or chat. Without them we cannot pay Rewards, or we must withhold tax at the rate the law prescribes when information is missing.
6. Screening and identity documents
We do not check identity documents of individual partners at registration, and we do not use liveness checks or facial recognition. Before each payout we screen partners and, for company partners, their directors and beneficial owners, against sanctions lists, lists of politically exposed persons and adverse-media sources, using our own lists and our provider Sumsub, which acts as our processor.
Identity document. If our checks before a payout find a possible match that we cannot clear with the information we already hold, we may ask you to upload an identity document. If the match is cleared, we keep the document while you remain a partner and delete it once the partnership has ended and nothing more is payable to you. If the match is confirmed, we keep it for 5 years from that decision. Legal basis: compliance with our legal obligations under sanctions law (GDPR Art. 6(1)(c)).
We ask for the document in the Partner Portal and you upload it there; please do not send it by email. A copy we cannot read is deleted straight away and we ask again.
7. Automated processing
Screening runs automatically. A possible match puts the payout on hold until our compliance staff review it, and a person takes every decision on a match. Rewards and payout conditions are calculated automatically under the Partner Agreement; you can object to a statement and we explain the calculation, and our finance staff review each payout before it is made. We do not take decisions that have legal or similarly significant effects for you based solely on automated processing.
8. Who receives the data
Within PaySaxas, only staff who need the data for their tasks can see it. Your full tax identifier is visible only to the person who files the Incomes Register report, and every view is logged.
We share data only as needed with:
- Sumsub, for screening and business verification, as our processor;
- our banks and payment service providers, to make payouts;
- our external accountant, for bookkeeping and tax reporting, as our processor;
- the Finnish Tax Administration, for Incomes Register reporting and other tax purposes;
- other PaySaxas group companies that pay you Rewards on fees their clients paid them, under their own partner agreements, as separate controllers;
- IT, hosting, SMS and email service providers and other PaySaxas group companies providing services to us, as our processors; auditors and legal advisers;
- authorities, such as the Financial Intelligence Unit, the police or the Financial Supervisory Authority, where the law requires it.
We do not sell your data. We do not share it with the clients you introduce, and we tell you nothing about their applications beyond the Rewards they earn.
9. Transfers outside the EU/EEA
Where a recipient is outside the EU/EEA, we transfer data only to a country covered by an adequacy decision of the European Commission (for the United States, only to organisations certified under the EU-U.S. Data Privacy Framework), or under the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) with additional measures where needed.
You can ask for a copy of the safeguards at dpo_privacy@paysaxas.com.
10. How long we keep the data
| Data | How long we keep it |
|---|---|
| Registration, company, payout and Programme data, statements and our communications with you | While you are a partner and afterwards for as long as a balance may still be payable or a claim may be made under the Partner Agreement (as a rule, 3 years after the final settlement becomes due) |
| Payout documents and other accounting vouchers, including your supplier record and the tax identifier | 6 years from the end of the year in which the financial year ended (Accounting Act 1336/1997) |
| Accounting books and financial statements, to the extent that they contain your data (for example, your name) | 10 years from the end of the financial year (Accounting Act 1336/1997) |
| Registrations that are not completed | Deleted within 30 days after the registration link expires |
| Screening results and the record of how a possible match was resolved | 5 years from the screening, to show that we screened before each payout and to establish or defend legal claims |
| Identity document, match cleared | While you remain a partner; deleted once the partnership has ended and nothing more is payable to you |
| Identity document, match confirmed | 5 years from the decision on the match |
| Unreadable upload | Deleted straight away |
| Data on representatives and users of company partners | While they act for the partner, then as for registration data |
| Partner Portal operational logs | 90 days in our working systems, then up to 12 months in an encrypted archive |
| Records of sign-ins (time, IP address, browser and device) | 2 years after the session ends |
| Records of actions taken in your Partner Portal account | As for registration and Programme data (first row of this table) |
| Sign-in methods you have set up | While you are a partner |
If, for 24 months, no one has started an application through your referral link or been assigned to you, we may end the partnership under clause 16.2 of the Partner Agreement; the periods above then start to run.
We keep data longer where the law requires it, for example during an investigation or legal proceedings.
Deleted data may remain in backups for up to 35 days. Backups are used only to restore systems.
11. Your rights
You have the right to:
- access the data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased when we no longer need it. Data we must keep by law, such as accounting records, stays for the period in section 10. If you ask for erasure, an identity document from a cleared match is deleted; a document from a confirmed match is kept for its 5 years for legal claims (GDPR Art. 17(3)(e));
- restrict processing in certain cases;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive the data you gave us in a machine-readable format and have it sent to another controller, where processing is automated and based on our agreement or your consent.
To use your rights, write to dpo_privacy@paysaxas.com. We may ask you to confirm your identity before we act on a request. We reply without undue delay and in any event within one month of receipt. Where a request is complex or we have received many requests, we may extend this period by up to two further months; in that case, we tell you about the extension and the reasons for it within one month of receipt. We handle requests free of charge unless a request is manifestly unfounded or excessive.
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (section 4). We will then stop, unless we have compelling legitimate grounds for the processing or need the data to establish, exercise or defend legal claims. You can also object at any time to the use of your data for direct marketing, and we will then stop it.
12. Cookies
The partner website, operated by Paysaxas Ltd, and the Partner Portal, operated by us, use cookies and similar technologies, described in the Partner Cookie Policy. Cookies that are strictly necessary are set without your consent; any other cookies are set only if you accept them.
13. Contact and complaints
Questions about this notice: dpo_privacy@paysaxas.com. You may also lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or with the supervisory authority of the EU or EEA country where you live or work or where the alleged infringement took place.
14. Changes to this notice
We update this notice when our processing changes. The version and the date from which it applies are shown at the top. If a change is material, for example a new purpose or a new category of recipients, we tell you in the Partner Portal or by email before it applies.