Privacy Policy

Table of Contents

1. General Information and Mandatory Disclosures

General note

This Privacy Policy is provided both in a detailed version (black text) and (where required) in a simpler version that is easier for children and young people to understand (green text).

If children or young people have any questions about this Privacy Policy, they are welcome to contact us or their parents or guardians.

The following notes provide a simple overview of what happens to your personal data when you use our app. Personal data is any data by which you can be personally identified. For detailed information on data protection, please refer to the Privacy Policy set out below this text.

In this section you will learn what happens to your personal information (name, email address, etc.) when you use our app.

Who is responsible for data collection in the app?

The controller is the legal person that alone or jointly with others decides on the purposes and means of the processing of personal data (e.g. names, email addresses or similar). Data processing in the app is carried out by:

jointly with:

Responsibility for the processing of your data (name, email address, etc.) lies with PayCenter GmbH jointly with petaFuel GmbH.

The responsibilities of the two companies:

PayCenter GmbH is the card-issuing e-money institution and offers registered users a prepaid Mastercard for use at all electronically connected Mastercard acceptance points.
The use of the VIMpay card is based on a contractual relationship between the user and PayCenter.

The Mastercard you receive from VIMpay is provided by PayCenter.

petaFuel GmbH is the publisher of the VIMpay app and is responsible for the technology, app development and account administration. A contractual relationship concerning the use of the VIMpay card is concluded exclusively between the cardholder and PayCenter.
petaFuel is not an issuing body directly commissioned by Mastercard; it merely forwards customers' data to the authorised bodies and acts as an intermediary between the user and the licensed issuing body (the card-issuing e-money institution).

The company petaFuel is responsible for the technical side of the card.

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data you enter during the registration process. Other data is collected automatically by our IT systems when you use the app. This is primarily technical data (e.g. app version, operating system or the time stamp of the app launch). This data is collected automatically as soon as you start the app.

There is information you give us yourself, e.g. through your registration. We collect some technical data (e.g. app version, time the app was opened) automatically as soon as you start the app.

For what purposes do we process your data?

1. If you have consented to the data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, where special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, the data processing is additionally based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your end device (e.g. via device fingerprinting), the data processing is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent can be withdrawn at any time.
2. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR.
   This applies in particular to the use of the VIMpay card and its functions, such as paying with a smartphone, paying with wearables, express top-up of the card, P2P chat, and sending money in the chat.
   All functions of the VIMpay card can be found at www.vimpay.de/features.
3. Furthermore, we process your data where this is necessary for compliance with a legal obligation, on the basis of Art. 6(1)(c) GDPR.
   As an e-money institution, we are subject to various legal obligations, i.e. statutory requirements (e.g. the German Payment Services Supervision Act, Banking Act, Anti-Money Laundering Act, tax legislation) as well as banking supervisory requirements (e.g. of the German Federal Financial Supervisory Authority, BaFin). The purposes of processing include, among other things, identity and age verification, fraud and money laundering prevention, compliance with tax-law control and reporting obligations, and the assessment and management of risks within the company.
4. Data processing may also take place on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.
   Examples:
   • Securing express top-ups (transmission of your IP address to the account-holding bank)
   • Error-free provision of the app
   • Assertion of legal claims and defence in legal disputes
   • Ensuring IT security and IT operations
   • Prevention of criminal offences
   • Analysis of pseudonymised support chat messages for internal purposes (e.g. staff training, creation of FAQs)

The legal bases applicable in each individual case are set out in the following sections of this Privacy Policy.

We use the information we process about you for the following purposes:

• To fulfil the contract (use of the VIMpay card)
• To improve our app
• For identity and age verification, fraud and money laundering prevention
• For anonymous analysis of how our app is used

Who receives your data?

Within the company, access to your data is granted to those units that need it in order to fulfil our contractual and legal obligations. Service providers and vicarious agents engaged by us may also receive data for these purposes, provided they observe banking secrecy and our written data protection instructions. These are essentially companies in the categories listed below.

With regard to the transfer of data to recipients outside the e-money institution, it must first be noted that, as an e-money institution, we are obliged to maintain secrecy about all customer-related facts and assessments of which we become aware.

We may pass on information about you only if legal provisions so require, if you have consented, if we are authorised to provide bank information, and/or if processors engaged by us equally guarantee compliance with banking secrecy and the requirements of the EU General Data Protection Regulation/the German Federal Data Protection Act. Under these conditions, recipients of personal data may include, for example:

• Public bodies and institutions (e.g. Deutsche Bundesbank, the German Federal Financial Supervisory Authority, the European Banking Authority, the European Central Bank, tax authorities, the Federal Central Tax Office) where a legal or official obligation exists.
• Other credit and financial services institutions, comparable bodies and processors (see item 4, Processing on Our Behalf) to which we transfer personal data for the purpose of conducting the business relationship with you.
  In detail: processing of bank information, support/maintenance of IT applications, archiving, document processing, compliance services, controlling, data screening for anti-money laundering purposes, data destruction, debt collection, payment card processing, customer administration, telephony, video identification, website management, payment transactions.
  Further data recipients may be those bodies for which you have given your consent to the data transfer or for which you have released us from banking secrecy by agreement or consent.

We only pass on your data to those bodies or persons who absolutely need it or who are authorised to receive it.

Data transfer to third countries

Among other things, we use tools and service providers based outside the EEA. Personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries) only if one of the following conditions is met:

• To carry out your orders: This may be the case, for example, when processing payment orders.
• Due to legal obligations: These include, for example, tax-law reporting obligations.
• With your express consent: You will be informed separately in advance about the risks of the data transfer.
• In the context of processing on our behalf: We use service providers based in third countries. In these cases, we ensure that either (i) an adequacy decision pursuant to Art. 45 GDPR exists (e.g. for US recipients certified under the "EU-US Data Privacy Framework" (DPF)) or (ii) appropriate safeguards pursuant to Art. 46 GDPR have been agreed (e.g. standard data protection clauses – Standard Contractual Clauses (SCCs)); where necessary, we carry out a Transfer Impact Assessment (TIA) and implement additional protective measures.

One example of a data transfer to the USA is the automatic data exchange under the Mastercard Automatic Billing Updater (ABU), which minimises the rejection of card payments when credit card data expires or changes. The data is transferred to the following body:

• Mastercard Inc., 2000 Purchase Street, Purchase, NY 10577, USA.

We would like to point out that, in the case of transfers to third countries without an adequacy decision (Art. 45 GDPR) – in particular to US recipients not certified under the EU-US Data Privacy Framework (DPF) – a level of data protection equivalent to that of the European Union may not be guaranteed in all respects. This concerns in particular governmental rights of access to your data. However, we endeavour to ensure the highest possible level of protection by selecting suitable providers and applying appropriate safeguards (e.g. SCCs) as well as – where necessary – additional protective measures (e.g. a Transfer Impact Assessment/TIA).

Some of your data is transferred to Mastercard in the USA.

Recipients of personal data

In the course of our business activities, we work together with various external bodies. In some cases, this also requires the transfer of personal data to these external bodies. We only pass on personal data to external bodies if this is necessary in the context of the performance of a contract, if we are legally obliged to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest in the transfer pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the data transfer. When using processors, we only pass on our customers' personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint controllership agreement is concluded.

Analytics tools and third-party tools

When you use our app, your usage behaviour may be statistically analysed. This is done primarily with so-called analytics programmes. The analysis with these tools is anonymous; your usage behaviour cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. Details can be found in this Privacy Policy under the heading "Analytics Tools".

Your rights at a glance

1. Withdrawal of your consent to data processing

   Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

2. Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

   If data processing is carried out on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation. This also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR).

   If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purposes of direct marketing (objection pursuant to Art. 21(2) GDPR).

3. Right to lodge a complaint with the competent supervisory authority

   In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedy.

   The supervisory authority competent for us in data protection matters is:

   Bayerisches Landesamt für Datenschutzaufsicht
   (Bavarian State Office for Data Protection Supervision)
   Postfach 1349
   91504 Ansbach, Germany
   Phone: +49 981 180093-0
   Fax: +49 981 180093-800
   Email: poststelle@lda.bayern.de
   Website: www.lda.bayern.de

   If you feel that your data is not being properly protected, you have the right to contact this authority.

4. Right to data portability

   You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible.

   If you would like us to forward your data to you or to another company, let us know.

5. Access, rectification and erasure

   Within the scope of the applicable statutory provisions, you have the right at any time to free-of-charge information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data. You can contact us at any time on this matter and with any further questions concerning personal data.

6. Right to restriction of processing

   You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

   • If you contest the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
   • If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of erasure.
   • If we no longer need your personal data, but you need it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
   • If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

   If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

   • If you wish, we will tell you at any time where we got your data from and what we do with it.
   • If you no longer want us to use your data, just let us know.

2. Data Protection Officer

Statutory data protection officer

We have appointed a data protection officer for each of our companies. For all questions concerning data protection, the following contact options are available to you:

3. Data Processing in the App

Data processing during registration and subsequent card use

Users can register and create a user account in the process. The data entered during registration is used for the purposes of using the service.

We collect, process and use personal data only to the extent that it is necessary for the establishment, content or amendment of the legal relationship (master data). This is done on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures, as well as on the basis of Art. 6(1)(c) GDPR, which permits processing to the extent that it is necessary for compliance with a legal obligation to which the controller is subject. We collect, process and use personal data about the use of our app (usage data) only to the extent that this is necessary to enable the user to use the service or to bill for it.

The customer data collected is erased after completion of the order or termination of the business relationship. It is the users' responsibility to back up their data before the end of the contract once notice has been given. We are entitled to irretrievably erase all of the user's data stored during the term of the contract, provided this does not conflict with statutory retention periods.
Statutory retention periods remain unaffected. These include the retention obligations under commercial and tax law: the German Commercial Code (HGB), the German Banking Act (KWG) and the German Anti-Money Laundering Act (GwG). The periods specified there range from two to ten years. If data is retained as evidence, it is subject to the limitation periods of the German Civil Code (BGB), Sections 195 et seq., and may be retained for up to 30 years, the standard limitation period being three years.
IP addresses are erased after 90 days at the latest.

As a matter of principle, this data is not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.

It is also possible that your IP address will be transmitted to the account-holding bank for security and fraud prevention purposes when a payment is initiated (express top-up). This is done on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

If identification pursuant to Section 11 of the German Anti-Money Laundering Act (GwG) is required for registration, the personal data collected during identification is stored by the identifying company (Deutsche Post AG or IDnow GmbH) only to the extent necessary for the proper determination, billing and evaluation as well as for proving the accuracy of service charges (charge data). We also use the data provided in the course of the Postident procedure to compare the personal master data stored in our database for the purposes of the legally required identification.

The data recorded in your user account always belongs to you. We use your data only for its intended purpose and confidentially, and pass it on to third parties only in the context of the services you have requested.

Once you have cancelled your user account, we delete your data – except for data we are required by law to keep for a certain period of time.

If you want to cancel your contract, save your data beforehand.
Otherwise, we would automatically delete all data that we are not required by law to retain.

In order to be able to use the service, we may collect the following data from you:

• Company name
• First and last name
• Address
• Date of birth
• Identity document data
• Email address
• Bank account details
• Mobile phone number
• PEP status
• Direct debit mandates
• IP address at the time of registration
• IP address at login
• HBCI access data
• Account numbers of payees
• Account transactions
• Tax ID
• Communication data for managing your VIMpay card via the petaFuel GmbH interface
• Message texts when using the chat function
• User status when using the chat function

Age verification for age-restricted transactions

If you wish to pay with your VIMpay Mastercard at acceptance points where statutory age restrictions apply (e.g. cigarette vending machines), we carry out automated age verification. In doing so, we internally evaluate your date of birth stored with us and transmit to the merchant only the result of whether or not you are of legal age. Your date of birth itself is not passed on.

This processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in fulfilling our contractual obligations towards Mastercard as a network partner and in supporting statutory youth protection (Sections 9 and 10 of the German Protection of Young Persons Act, JuSchG). You have the right to object to this processing pursuant to Art. 21 GDPR; as a result, we will no longer be able to authorise payments at the relevant acceptance points.

Server log files

petaFuel GmbH automatically collects and stores information from the app in so-called server log files. The following information is transmitted to us by the app:

• App name and version
• Operating system used
• Device model
• Referrer URL
• Host name of the mobile device
• Time of the server request
• IP address
• Language and region

This data is not combined with other data sources.

The basis for the data processing is Art. 6(1)(f) GDPR, which permits the processing of data to safeguard legitimate interests. We use this data both to operate and improve the app and for fraud prevention.

The data is erased automatically after 90 days at the latest.

We automatically store information from the app. This data is not combined with other data sources.

App permissions

The app may request the following permissions, which are classified as critical. These permissions can be set individually and separately by the customer.

1. iOS

   • Network connections
     Required so that the app is fully functional and can transmit and receive data.
   • Background refresh
     Required by Apple Services, specifically for push notifications.
   • Notifications
     Required to receive messages, in this case push notifications.
   • Access to photos and camera
     Required to set a profile picture for the app, to create card images (Picturecard and card avatars), to use the QR scanner and for identity verification via video identification.
   • Contacts
     Required to check whether a contact is also a VIMpay user in the chat and to top up prepaid mobile phone credit.
   • Microphone
     Used for communication for identity verification via video identification.

2. Android

   • Read, modify or delete storage contents
     Required for exporting PDFs (e.g. when exporting your transactions as a PDF).
   • Access to all networks
     Required so that the app is fully functional and can transmit and receive data.
   • Disable sleep mode
     Required to be able to receive push notifications.
   • Contacts
     Required to check whether a contact is also a VIMpay user in the chat and to top up prepaid mobile phone credit.
   • Notifications
     Required to receive messages, in this case push notifications.
   • Access to photos and camera
     Required to set a profile picture for the app, to create card images (Picturecard and card avatars), to use the QR scanner and for identity verification via video identification.
   • Microphone
     Used for communication for identity verification via video identification.

To enable use of the app, the app may also request further, non-critical permissions in addition to those listed here.

The app may request these permissions. You can set these permissions individually and separately.

HBCI error reports in the app

If you consent to the storage and transmission of the error report in the app, you agree that your HBCI data (e.g. account number and transactions) will be transmitted to petaFuel in encrypted form so that errors occurring in the app can be analysed and rectified. To protect your login from unauthorised access, the banking password is removed before transmission. Error reports containing HBCI data are not transmitted automatically. HBCI transactions are stored exclusively locally in the app. When the app is deleted, the locally stored HBCI transactions are also deleted.

The transmission and storage are carried out on the basis of Art. 6(1)(a) GDPR (consent of the data subject).

If you consent to the storage and transmission of the error report in the app, you agree that your data (e.g. account number and transactions) will be transmitted to petaFuel in encrypted form in order to identify the error.

Your transaction data is stored locally in your app. If you decide to delete the app, your locally stored data will also be deleted.

4. Processing on Our Behalf

We commission external service providers to provide services on our behalf to a limited extent. These service providers may process personal data exclusively for the respective purpose and are bound to confidentiality. We have concluded data processing agreements pursuant to Art. 28 GDPR with all processors we use.

We use service providers in the following categories:

• Technical service providers and IT infrastructure: Operation, maintenance and further development of the app as well as processing of card transactions.
• Identification and verification service providers: Performance of legally required identity checks, e.g. via video identification, PostIdent or eID. (Contractual partners of petaFuel GmbH)
• Address validation service providers: Verification and normalisation of address data to ensure data quality. (Contractual partners of PayCenter GmbH and petaFuel GmbH)
• Receipt processing: Automated processing and management of receipts and till receipts as part of the optional receipt processing add-on service. Legal basis: Art. 6(1)(b) GDPR.

Where necessary, we have to pass on your data to third-party providers in order to provide our services. However, they are obliged to protect your data.

5. Analytics Tools

Matomo

This app uses the open-source web analytics service Matomo (only in the iOS version of the app).

With the help of Matomo, we are able to collect and analyse data about the use of our app by app visitors. This enables us, among other things, to find out when which pages were viewed and from which region they originate. We also collect various log files (e.g. IP address, referrer, browsers and operating systems used) and can measure whether our app visitors perform certain actions (e.g. clicks, purchases and the like).

The use of this analytics tool is based on Art. 6(1)(f) GDPR. The app operator has a legitimate interest in analysing user behaviour in order to optimise its app. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

IP anonymisation

We use IP anonymisation for the analysis with Matomo. Your IP address is shortened before the analysis so that it can no longer be clearly attributed to you.

Cookieless analysis

We have configured Matomo so that Matomo does not store any cookies.

Matomo processes the following data:

• Anonymised IP addresses, with the last 2 bytes removed (i.e. 192.68.0.0 instead of 192.68.100.54)
• Approximate location (based on the anonymised IP address)
• Date and time
• Title of the page viewed
• URL of the page viewed
• URL of the previous page (where permitted by that page)
• Screen resolution
• Local time
• Files that were clicked and downloaded
• External links
• Page load time
• Country, region, city (with low accuracy based on the IP address)
• Main language of the device
• User agent of the device

You can object to the storage and analysis of this data by Matomo at any time. To do so, navigate to Security → Improve app.

6. Data Collection When You Contact Us

If you contact us by email, contact form, telephone or fax, your enquiry, including all personal data resulting from it (name, enquiry), will be stored and processed by us for the purpose of handling your request. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time.

The data you send to us via contact enquiries remains with us until you request its erasure, withdraw your consent to storage, or the purpose for the data storage no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Standard automatic erasure periods:

• Tickets from non-customers: 6 months
• Tickets from customers: 1 year
• Tickets with a data protection reference: 3 years

When you contact us (e.g. via contact form, email, chat, telephone or social media), your contact details are stored in order to answer your enquiry. However, we also regularly delete this data again. For messages in the support chat, the erasure periods in the "Chat Function" section apply.

7. Chat Function

The VIMpay app offers a chat function that allows the user to contact both the customer service team and other VIMpay users.
In addition, VIMpay card functions can be used via the chat (e.g. sending money).
A list of all functions of the VIMpay card and the chat can be found at www.vimpay.de/features (see also Section 1 – For what purposes do we process your data).

The chat function for communication with customer service is permanently activated. It cannot be deactivated.

The chat function for communication with other VIMpay users is deactivated by default. It must first be activated before use.

When this chat function is activated and used, the following data is processed:

• Your current online status is displayed to other users,
• Your name stored with VIMpay (first and last name) is displayed to other users,
• Your profile picture is displayed to other users,
• the messages sent and received are stored server-side for a limited period of time (this allows messages to be restored after the app is reinstalled).

Messages are automatically deleted server-side after a certain period:

• Messages from single or group chats after 30 days
• Messages from the support chat:
  • non-authenticated users: after 90 days
  • authenticated users: after 10 years

If a user wishes to deactivate the chat function again after activation, an opt-out option is available in the app (not possible for the chat function with customer service!).

After an opt-out, all messages are deleted server-side in accordance with the periods stated above. Messages are not deleted from the user's smartphone; this must be done by the user themselves.

The storage of chat messages is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

When you use the chat, the other users can see, among other things, your name, your profile picture and your online status, and all messages are stored by us. If you no longer want to use the chat, you can deactivate it, but then all messages will also be deleted by us after a certain time.

Analysis of support chat messages for internal purposes

We analyse messages from the support chat (communication with customer service) in pseudonymised form for internal purposes. These include, in particular, training our staff, creating and maintaining FAQs, and improving the quality of our customer service. Messages from single or group chats with other VIMpay users as well as support chat messages from Scout users (sub-accounts for minors, see the section "VIMpay Scout Card") are excluded from this analysis.

Before the analysis, the messages are pseudonymised. This means that information enabling direct identification (e.g. name, email address, telephone number, card data) is removed or replaced. The re-identification information remains with us.

The controller for this analysis is PayCenter GmbH; in this respect, petaFuel GmbH acts as a processor on behalf of PayCenter GmbH.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving our customer service and answering frequent customer enquiries efficiently.

You can object to this analysis at any time with effect for the future (Art. 21 GDPR). To do so, please contact our customer service team or datenschutz@petafuel.de or datenschutz@paycenter.de. In the event of an objection, your support chat messages will no longer be analysed for the purposes stated.

We sometimes use messages to our customer service team to train our team and to answer frequently asked questions better. Beforehand, we remove everything that could identify the sender (e.g. the name). Your messages are excluded from this: if you have a Scout card, we do not analyse your chats. We also never look at chats between VIMpay users. If you have any questions about this, just let us know.

Use of chatbots

We use chatbots to communicate with you. Chatbots are able to respond to your questions and other input without human assistance. To do this, in addition to your input, the chatbots analyse further data in order to provide suitable answers (e.g. names, email addresses and other contact details, customer numbers and other identifiers, as well as chat histories). Furthermore, your IP address, log files and other metadata may be collected via the chatbot. This data is stored on the servers of the chatbot provider.

The data you enter in the course of the communication remains with us or the chatbot operator until you request its erasure, withdraw your consent to storage, or the purpose for the data storage no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions – in particular retention periods – remain unaffected.

The legal basis for the use of chatbots is Art. 6(1)(b) GDPR, insofar as the chatbot is used for contract initiation or in the context of contract performance. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time. In all other cases, the use is based on our legitimate interest in the most effective customer communication possible (Art. 6(1)(f) GDPR).

When you write to our customer service team, a chatbot – a computer program that answers your questions automatically – will sometimes reply to you.

Google Dialogflow

For our chat, we use Dialogflow, a service of Google LLC ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Dialogflow is a conversational interface for websites, mobile applications, popular communication platforms and IoT devices that enables interactions between users and companies. Google Dialogflow is part of the Google Cloud Platform offered by Google. Your input is processed by Google in accordance with the Google privacy policies before being forwarded to our servers.

Dialogflow uses machine learning to "understand" input and be able to answer it. Dialogue questions or details entered are stored and used without personal reference for learning and training purposes and serve to improve the chat system.

We use exclusively our own IP address to communicate with Google Dialogflow.
Accordingly, personal data is only transmitted to Google if you disclose personal data in the course of the chat (= chat messages).

The data processing is based both on Art. 6(1)(f) GDPR (legitimate interest) and on Art. 6(1)(a) GDPR (consent). Before starting the chat, you consent to the transfer of your data to Google.

For data transfers outside the EEA, Google relies on standard contractual clauses pursuant to Art. 46 GDPR.

The Google terms of use for Dialogflow data logging can be found here: Terms of use

The Google privacy policy can be found here: Privacy policy

ChatGPT

We use ChatGPT for our customer communication. The provider is OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, https://openai.com.

When you start a conversation with us via our app and ChatGPT is activated, your input, including metadata, is transmitted to the ChatGPT servers and processed there in order to generate a suitable response.

We have configured ChatGPT so that the personal data entered is not used to train the ChatGPT algorithm.

Insofar as personal data is transferred to the USA in the course of the processing, the transfer is based on the standard contractual clauses of the EU Commission (Art. 46 GDPR). Details can be found here: https://openai.com/policies/data-processing-addendum/.

The use of ChatGPT is based on Art. 6(1)(f) GDPR. The app operator has a legitimate interest in the most efficient customer communication possible using modern technical solutions. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time.

Further information can be found here: https://openai.com/policies/privacy-policy.

Anthropic Claude

For the analysis of pseudonymised support chat messages (see the section "Analysis of support chat messages for internal purposes"), we use Claude, an AI service of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, https://www.anthropic.com.

Only previously pseudonymised messages are transmitted to Anthropic. Information enabling direct identification (e.g. name, email address, telephone number, card data) is removed or replaced before transmission. The re-identification information remains with us and is not passed on to Anthropic.

Anthropic is contractually obliged not to use the transmitted data to train its AI models.

Insofar as personal data is transferred to the USA in the course of the processing (processing on infrastructure of Anthropic, PBC, USA, or its cloud service providers), the transfer is based on the standard contractual clauses of the EU Commission (Art. 46 GDPR).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our customer service, see above). Your right to object pursuant to Art. 21 GDPR also applies to this processing.

Further information can be found here: https://www.anthropic.com/privacy.

For the analysis, we use the computer program Claude. It only receives messages without the information that could identify the sender. If you have a Scout card, your chats are completely excluded from this.

8. Wallet Services and Other Services

Use of Apple Pay

If you activate and use the Apple Pay widget, your personal data is transferred by Mastercard to Apple (Apple Distribution International, Holly Hill Industrial Estate, Cork, Ireland) for payment processing.

The following data is transferred: username, PAN, expiry date.

This data is transmitted to Apple in encrypted form. Apple decrypts the data, determines the card's payment network (Mastercard) and re-encrypts the data with a key that can only be decrypted by the payment network. Apple retains anonymised transaction data, including the approximate purchase amount, the name of the app developer and the app, the approximate date and time, and an indication of whether the transaction was completed successfully.

The transfer of your data to Apple is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Apple Pay, your data is sent to Apple for payment processing.

Use of Google Pay

If you activate and use the Google Pay widget, your personal data is transferred by Mastercard to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States) for payment processing.

The following data is transferred: name, address, telephone number, transaction data (e.g. merchant name, location, amount).

The transfer of your data to Google is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Google Pay, your data is sent to Google for payment processing.

Use of Samsung Pay

If you activate and use the Samsung Pay widget, your personal data is transferred by Mastercard to Samsung Electronics Co., Ltd. (416, Maetan 3-dong, Yeongtong-gu, Suwon-si, Gyeonggi-do 443-772, Korea) for payment processing.

The following data is transferred: name, card number, CVC, transaction data (e.g. merchant name, location, amount).

The transfer of your data to Samsung is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Samsung Pay, your data is sent to Samsung for payment processing.

Use of Swatch Pay

If you activate and use the Swatch Pay widget, your personal data is transferred by Mastercard to Fidesmo AB (Regeringsgatan 111, 111 39 Stockholm, Sweden) for payment processing.

The following data is transferred: name, address, telephone number, transaction data (e.g. merchant name, location, amount).

The transfer of your data to Fidesmo AB is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Swatch Pay, your data is sent to Fidesmo AB for payment processing.

Use of Fidesmo Pay

If you activate and use the Fidesmo Pay widget, your personal data is transferred by Mastercard to Fidesmo AB (Regeringsgatan 111, 111 39 Stockholm, Sweden) for payment processing.

The following data is transferred: name, address, telephone number, transaction data (e.g. merchant name, location, amount).

The transfer of your data to Fidesmo AB is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Fidesmo Pay, your data is sent to Fidesmo AB for payment processing.

Use of Digiseq

If you activate and use the Digiseq widget, your personal data is transferred by Mastercard to Digiseq Ltd. (International House, 64 Nile Street, London, N1 7SR, United Kingdom) for payment processing.

The following data is transferred: name, address, telephone number, transaction data (e.g. merchant name, location, amount).

The transfer of your data to Digiseq is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If you choose Digiseq, your data is sent to Digiseq for payment processing.

Use of Click to Pay

If you activate and use the Click to Pay widget, your personal data is transferred to Mastercard (Mastercard Inc., 2000 Purchase Street, Purchase, NY 10577, USA) to enable payment processing.

The following data is transferred: name, address, telephone number, card number (encrypted).

The transfer of your data to Mastercard is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

Further information on data protection can be found in Mastercard's privacy notice at https://www.mastercard.com/global/click-to-pay/de-de/privacy-notice.html#dataTransfer.

If you choose Click to Pay, your data is sent to Mastercard for payment processing.

Use of Garmin Pay

If you activate and use the Garmin Pay widget, your personal data is transferred by Mastercard to Garmin (Garmin Deutschland GmbH, Parkring 35, 85748 Garching, Germany) for payment processing.

The following data is transferred: name, address, telephone number, card number (encrypted).

The transfer of your data to Garmin is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

Further information on data protection can be found in Garmin's privacy notice at https://www.garmin.com/de-DE/privacy/garminpay/.

If you choose Garmin Pay, your data is sent to Garmin for payment processing.

Use of digital receipts

If you activate and use digital receipts, we will transfer data to Mastercard (Mastercard Inc., 2000 Purchase Street, Purchase, NY 10577, USA) to provide the digital till receipts.

The following data is transferred: name, card number (encrypted), expiry date, CVC.

The transfer of your data to Mastercard is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

Further information on data protection can be found in Mastercard's privacy notice at https://mea.mastercard.com/en-region-mea/vision/privacy.html.

If you choose digital receipts, your data is sent to Mastercard for payment processing.

Receipt processing

If you wish to use the optional receipt processing service, the transaction and receipt data required for this purpose is transferred to Privadsy UG as a processor. The transfer is based on Art. 6(1)(b) GDPR.

If you use the receipt processing service, your receipt data is passed on to Privadsy so that the service can work.

9. Prepaid Mobile Top-Up

For prepaid mobile top-ups, we use the service of our contractual partner transact Elektronische Zahlungssysteme GmbH, Fraunhoferstr. 10, 82152 Martinsried, Germany. If you wish to use this service, we transmit your mobile phone number to transact Elektronische Zahlungssysteme GmbH. The legal basis for this is Art. 6(1)(b) GDPR (processing for the purpose of contract performance).

10. Social Media

We maintain publicly accessible profiles on social networks. The social networks we use in detail are listed below.

Social networks such as Facebook, X, etc. can generally analyse your user behaviour comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous processing operations relevant to data protection. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can attribute this visit to your user account. However, your personal data may under certain circumstances also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies stored on your end device or by recording your IP address.

Using the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you both inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are or were logged in.

Please also note that we cannot trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Legal basis

Our social media presences are intended to ensure the broadest possible presence on the internet. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on differing legal bases, which are to be stated by the operators of the social networks (e.g. consent within the meaning of Art. 6(1)(a) GDPR).

Controller and exercise of rights

If you visit one of our social media presences (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by this visit. You can in principle exercise your rights (access, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

Please note that despite the joint controllership with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

Storage period

The data collected directly by us via the social media presence is erased from our systems as soon as you request its erasure, withdraw your consent to storage, or the purpose for the data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected.

We have no influence on the storage period of your data that is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. via their privacy policy, see below).

Your rights

You have the right at any time to obtain free-of-charge information about the origin, recipients and purpose of your stored personal data. You also have a right to object, a right to data portability and a right to lodge a complaint with the competent supervisory authority. Furthermore, you can request the rectification, erasure and, under certain circumstances, the restriction of the processing of your personal data.

The social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter Meta). According to Meta, the data collected is also transferred to the USA and other third countries.

We have concluded a joint processing agreement (Controller Addendum) with Meta. This agreement determines which data processing operations we or Meta are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Details can be found in Facebook's privacy policy: https://www.facebook.com/about/privacy/.

The company holds a certification under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452

X (formerly Twitter)

We use the short message service X (formerly Twitter). The provider is the parent company X Corp., 865 FM 1209, Building 2, Bastrop, TX 78602, USA. The controller for the data processing of persons living outside the USA is X Internet Unlimited Company (formerly Twitter International Unlimited Company), One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can adjust your X privacy settings yourself in your user account. To do so, click on the following link and log in: https://x.com/settings/account/personalization.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://gdpr.x.com/en/controller-to-controller-transfers.html.

Details can be found in the privacy policy of X (formerly Twitter): https://x.com/de/privacy.

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Details on their handling of your personal data can be found in Instagram's privacy policy: https://privacycenter.instagram.com/policy/.

The company holds a certification under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on their handling of your personal data can be found in YouTube's privacy policy: https://policies.google.com/privacy?hl=en.

The company holds a certification under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780

TikTok

We have a profile on TikTok. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Details on their handling of your personal data can be found in TikTok's privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de.

TikTok transfers data to third countries, including the People's Republic of China. In May 2025, the Irish Data Protection Commission (DPC) decided that these transfers infringe Art. 46 GDPR, imposed a fine of 530 million euros and ordered that the transfers be suspended unless they are brought into conformity with the GDPR within the set deadline. TikTok has appealed against the decision; in November 2025, the Irish High Court suspended the enforcement of the orders pending the decision in the main proceedings, subject to the condition that users be informed about the ongoing proceedings. Data transfers to China therefore currently continue. We are monitoring developments and will update this section accordingly.

11. Push Notifications

When you use our app, we may contact you with push notifications about new promotions, vouchers and personal offers from VIMpay. For the further development of our offering and for statistical purposes, we record when and how often a push message is opened. We collect this information in pseudonymised form. Of course, you can unsubscribe from push messages at any time in the app settings. The sending of push notifications is based on our legitimate interest within the meaning of Art. 6(1)(f) GDPR.

We sometimes send you notifications on your phone, e.g. about offers. You can switch this off at any time in the app settings.

12. Payment Services

Styx Customer Frontend

So that customers whose bank does not itself offer a web interface can log in (where applicable with two-factor authentication) and enter/retrieve transactions or account information, PayCenter provides the Styx Customer Frontend in the VIMpay app.

In this process, the customer enters the login details of their bank. PayCenter processes this data and forwards it to the customer's bank. The data is never stored by PayCenter at any time.

The transfer of your data to the bank is based on Art. 6(1)(b) GDPR (processing for the performance of a contract).

If your bank does not have its own login page, you can log in via the VIMpay app. Your bank details are forwarded directly to your bank and are not stored by us.

13. VIMpay Scout Card (Sub-Account for Minors = Scout Users)

Our app is aimed at main cardholders (parents/guardians). Minors can use it in the context of the VIMpay Scout Card. The main cardholder sets up and manages the sub-account. If you suspect that a minor's data is being processed without authorisation, please inform us via datenschutz@petafuel.de.

What is it about?

The VIMpay Scout Card is an additional card for a Scout user that is linked to a sub-account of the main cardholder (parent or guardian).
The controllers are – as described above – PayCenter GmbH (card-issuing e-money institution) and petaFuel GmbH (app provision) as joint controllers.
The general information (rights, recipients, third-country transfers, security, etc.) applies accordingly.
The Scout user does not become a contractual partner in their own right, but is a cardholder within the framework of the contract with the main cardholder.

What data of the Scout user do we process?

• Master data (name, date of birth where applicable, family relationship to the main cardholder)
• Product/account data (sub-account ID, card identifier, configurations such as limits, MCC blocks, wallet approvals)
• Usage/transaction data (time, amount, merchant details, ATM where applicable – as with cards in general)
• Technical and communication data if the Scout user uses their own app view (e.g. device ID, app version, push notifications)
• Wallet tokens / payment data when using Apple or Google Wallet (see the section "Wallet Services")

Where does the data come from? (Art. 14 GDPR)

As a rule, we receive the data from the main cardholder in the course of setting up the Scout Card.
If the Scout user uses their own app view or provides information themselves, Art. 13 GDPR applies (information in the case of direct collection).

For what purposes do we process the data and on what legal basis?

• Provision of the Scout Card and the sub-account (card management, limits, MCC blocks, transactions) – Art. 6(1)(b) GDPR (performance of the contract with the main cardholder)
• Compliance with legal obligations (e.g. payment services, anti-money laundering or supervisory requirements, fraud/misuse prevention) – Art. 6(1)(c) GDPR
• Security and misuse prevention, IT operations, logging – Art. 6(1)(f) GDPR (legitimate interest; balancing in favour of youth protection / security)
• Wallet use (e.g. Apple Pay / Google Pay) – Art. 6(1)(b) GDPR; the terms of the respective wallet providers additionally apply (see the section "Wallet Services").

No processing beyond this takes place for analytics or marketing purposes. Support chat messages from Scout users are excluded from the analysis under the section "Chat Function".

Who receives the data?

Internal units (card/app operations) as well as service providers and payment networks (e.g. Mastercard) and – where wallets are activated – Apple / Google / Samsung in accordance with the terms applicable there (see the section "Wallet Services").

Special feature: transparency towards Scout users (Art. 12 GDPR)

We provide the information for Scout users in clear, simple and age-appropriate language – including in a simplified version (green text) available in the VIMpay app and on the website.
Data subjects can exercise their data protection rights themselves or via the main cardholder.

Note – visibility for main cardholders

The main cardholder can view and control the transactions and settings of the sub-account. This is inherent to the product and serves the protection of minors (Section 1626 of the German Civil Code, BGB).

Wallet specifics

Integration into wallet services (e.g. Apple Pay / Google Pay) depends on the providers' policies and age requirements; functions may be restricted or suspended.

The VIMpay Scout Card is your own card, which belongs to your parents' account. They can manage your card and set limits.

We store your name, your date of birth where applicable, your card settings and your transactions. We usually receive this data from your parents when the card is set up. Your parents can see your transactions and change settings – this is for your protection.

You (or your parents) can contact us at any time if you have questions or would like access, rectification or erasure.

14. Changes to this Privacy Policy

We reserve the right to change this Privacy Policy at any time within the scope of what is legally permissible. The current version can be accessed in the app under "Legal and Data Protection".

We are constantly working on improvements, which may also affect this Privacy Policy. However, we will never change it without informing you.