Privacy policy for retailers

This Privacy Policy explains how we process personal data (hereinafter referred to as “personal data” or “data”) in connection with the acceptance of cashless payment methods such as credit and debit cards. The following explains which personal data is stored and how it is processed concerning you (hereinafter referred to as you) in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European General Data Protection Regulation (GDPR). Furthermore, your rights regarding the use of your personal data are described.

Responsible body for data processing

The following company is responsible for data processing in accordance with this privacy policy:

SwiPay AG
Compliance
Oberneuhofstrasse 3
CH-6340 Baar ZG
E-Mail: compliance@swipay.ch

If you have any questions about data protection, you are welcome to contact us at this address.

What data we process

Depending on the occasion and purpose, we process different data from different sources. We collect and process information on natural and legal persons as well as data on contact persons of merchants with whom we work. This data may also include information about third parties, e.g. in the context of complaints or about other employees of the retailer.

The most important data categories include

Master data: This includes data that relates directly to your person and characteristics, e.g. name, language, nationality, date of birth, information from identification documents, copies of identification documents of the merchant’s representatives, further details in connection with your activity for the merchant (e.g. company, additional contact details, function), details about the contractual relationship with us, about the merchant or branch and their bank or postal details. The private address of the authorized signatories can also be processed as part of the creation of a service request. We usually receive this data directly from you or from third parties (e.g. from the commercial register).
Financial and risk data: This includes information on the financial situation as well as data to combat abuse and fraud or to comply with legal provisions and compliance requirements, e.g. information on the merchant’s creditworthiness. We may receive this information from financial institutions, credit agencies, the Central Office for Credit Information (ZEK), government agencies or from publicly accessible sources.
Transaction data: This data relates to transactions, e.g. transaction type, amount, currency, time, terminal ID, contracting party number and certain card details. Such data is processed when your customers use their cards, made available to you via a portal or analyzed as part of investigations into complaints or possible misuse.
Contract data: This includes further information in connection with the contractual relationship, e.g. information on the application, conclusion, execution and termination of an acceptance contract or information on complaints and feedback to customer service.
Behavioral and preference data: We collect this data to get to know you better and to tailor our products and services optimally to your needs. To do this, we analyze transaction data and derive your behavior and preferences from it.
Communication data: This includes all information related to our communication with you, such as the content of messages or details of the nature and timing of communications. This may also include recordings of telephone conversations.
Other data: We process other data that we collect or receive in connection with the contractual relationship, e.g. information from authorities as part of official investigations.

Who do we share your data with?

We may share your data as follows:

Service providers: e.g. for IT services and sending information.
SwiPay AG’s card networks and group companies.
Other recipients: e.g. courts and authorities (in proceedings and statutory information and cooperation obligations), intermediaries, financing companies, debt collection companies and credit agencies.

The disclosure of data may be necessary for legal or operational reasons. By submitting an application, e.g. for the acceptance of credit cards, or placing an order for the provision of services, you expressly release us and our partners in the SwiPay network from statutory and contractual confidentiality obligations that could prevent the disclosure of this data.

From whom do we receive your data?

We may receive your data as follows:

Service providers: e.g. financial and IT services, social media platforms, Swiss Post and other information services.
SwiPay AG’s card networks and group companies.
Other senders: e.g. courts and authorities (for proceedings and statutory information and cooperation obligations), intermediaries and partners in our payment network.

Is personal data passed on abroad?

The recipients of your data are not only located in Switzerland. Due to the internationally organized card services and networks, your data may also be transferred abroad, e.g. to the USA. We take contractual precautions to ensure an appropriate level of data protection.

Business contacts and prospects

We contact businesses in Switzerland that accept card payments and present our payment solutions to them by email, phone, or in person. For this, we use the company name, legal form, address, industry, business email address and phone number, website, and—where known—the name and role of the contact person. We do not use private information.

Where the information comes from. From publicly accessible sources: the commercial register (Zefix and cantonal registers), your business’s website, and public industry and company directories. We also work with associations and organisations. They provide us with member lists so we can inform their members about the agreed preferential terms. If you contacted us yourself, the information comes from you.

What we use it for. For initial contact and advice on payment solutions that fit your business, and for association members, to provide information about the preferential terms. We rely on our legitimate interest in approaching businesses with a suitable offer. We will contact you about a matter no more than three times and will stop immediately if you wish.

How to end contact. Reply to one of our messages with “Stop”, or write to compliance@swipay.ch. We will then add your address to a blocklist so we do not contact you again. The blocklist contains only the company name and email address.

How long we keep the information. If no contact is established, we delete your information no later than 12 months after our last message. After each outreach, we will leave you alone for at least 180 days. If the contact leads to a collaboration, the other sections of this notice apply.

Who else can see the information. Our own systems run on servers in Switzerland. For email we use Microsoft 365, and Salesforce as our customer database. These providers process the data on our behalf and under contract; data may also be processed outside Switzerland, in countries with adequate data protection or with contractual safeguards. We do not pass on your information to third parties for their own purposes and do not sell addresses.

Your rights. You can request information at any time and have your details corrected, deleted, or blocked. To do so, write to compliance@swipay.ch. We do not make decisions about you solely by automated means and do not create a profile about you as a person.

What rights do you have?

You have the right to information about the processing of your personal data, to rectification of incorrect data, to restriction of processing for certain purposes and to erasure of the data, provided there are no legal retention obligations to the contrary. Further information on your rights can be found in the full privacy policy.

Changes to this privacy policy

This privacy policy can be amended at any time. The currently valid version can be found on our website.