Privacy Policy

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (the “Regulation”) and Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts (the “Personal Data Protection Act”)

(“Privacy Policy”)

1. INTRODUCTORY PROVISIONS

1.1 These Privacy Policy rules of Wage services EU s.r.o., registered office: Varšavská 715/36, Vinohrady, 120 00 Prague 2, Czech Republic, Company ID: 23118059, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 421681 (the Provider), govern personal data protection principles connected to the collection and processing of personal data arising from contractual and related relationships between the Provider and the Recipient as defined below.

1.2 This Privacy Policy describes what information the Provider (as the personal data controller) collects and processes from the Recipient and which security measures are in place to ensure the required protection of the Recipient’s personal data.

1.3 By activating an Account and using the Application, the Recipient consents to the processing of personal data and agrees to this Privacy Policy.

1.4 The Provider also processes personal data without the Recipient’s explicit consent under Article 6(1)(b) of the Regulation, as the processing is necessary for the performance of contracts to which the Recipient is a party.

1.5 Provider contacts: tel: +421 918 445 694, emails: help@wagenow.com, info@wagenow.com, website: www.wageservices.eu.

2. DEFINITIONS

Terms used in this Privacy Policy have the meanings below unless stated otherwise:

Application – the Provider’s application “WageNow”, used as a mobile app (“Mobile Application”) after installation on a Device or as a web app accessible on the Website (“Web Application”) for:

a) creating a Recipient’s personal Account,

b) logging into the Account,

c) submitting Requests by the Recipient,

d) displaying the Available Balance,

e) displaying Reports.

WageNow™ Benefit – a set of products and services provided by the Provider and cooperating third parties, in particular enabling flexible access to salary in the form of providing part of the salary before payday based on the Recipient’s Request, or providing funds to the Recipient as an interest-free, free-of-charge loan.

Account – the Recipient’s user account created by the Provider and subsequently activated by the Recipient, protected by the Recipient’s login (email) and password, used to access the Application and services.

Personal Data – the data listed in Article 3.1 of this Privacy Policy.

Report – information about WageNow™ Benefits provided, including their repayment. Reports are displayed to the Recipient in the Application after logging in under “Withdrawal History”.

Recipient – a natural person employed by an Employer and/or cooperating with an Employer under another contractual relationship who, subject to agreed conditions, is entitled to draw the WageNow™ Benefit.

Provider – the administrator and provider of WageNow™ Benefits, the owner of copyrights and other IP rights to the Application, and the personal data controller: Wage services EU s.r.o., Varšavská 715/36, Vinohrady, 120 00 Prague 2, Czech Republic, Company ID: 23118059, Municipal Court in Prague, Section C, Insert 421681.

Complaint – the Recipient’s claim to verify correctness and quality of services provided by the Provider via the Application that are the subject of Other Agreements.

Website – the Provider’s website: www.wageservices.eu.

Device – a mobile phone, tablet, PC or other device with internet access that meets the hardware/software requirements to use (and, where relevant, install) the Application.

Employer – a company employing or otherwise cooperating with the Recipient which has concluded a cooperation agreement with the Provider defining rights and obligations in connection with providing the WageNow™ Benefit to the Employer’s employees and/or cooperating persons.

Request – a submission made by the Recipient through the Application requesting a WageNow™ Benefit in an amount determined by the Recipient, with the maximum set by the Provider under pre-defined criteria forming part of the Agreements.

Agreements – agreements between (inter alia) the Recipient and the Provider. If the Recipient is an employee, these include in particular: (i) a Framework Agreement between the Provider and the Recipient setting the parties’ rights and obligations and the conditions for drawing the WageNow™ Benefit; (ii) a Wage Deduction Agreement between the Recipient and the Employer governing repayment to the Provider via payroll deductions. If the Recipient cooperates on a non-employment basis, the Agreement is typically a Framework Agreement among the Recipient, Employer and Provider covering provision and repayment of the WageNow™ Benefit.

3. PERSONAL DATA PROCESSED

3.1 The Provider processes in particular:

a) identification data provided by the Employer (e.g., name and surname, date of birth, national ID number),

b) contact data (e.g., email address, phone number),

c) information from communications between the Recipient and the Provider (email, chat, SMS, notifications),

d) data about use of the Application and services (e.g., usage statistics; Account activity),

e) transaction data (e.g., Recipient’s bank account number),

f) economic data (e.g., salary, hours worked, amounts of WageNow™ Benefits provided and repaid, total income and regular expenses),

g) other data needed to generate Reports (to the extent of the Reports),

h) technical data about the Device used to access/manage the Account (e.g., IP address, OS, browser settings, app settings, cookies),

i) other personal data voluntarily entered by the Recipient into the Account.

3.2 Personal data may be provided to the Provider by the Recipient or the Employer.

3.3 The Recipient undertakes to provide accurate and truthful personal data and to inform the Provider and the Employer without undue delay of any changes.

4. PURPOSES AND RETENTION

4.1 The Provider processes personal data under the Regulation on the basis of: (i) performance of Agreements, (ii) legal obligations, (iii) the Provider’s legitimate interests, and/or (iv) the Recipient’s legitimate interests.

4.2 Purposes include in particular:

(i) Identification and verification of the Recipient for service provision under the Agreements (processed for the term of the Agreements and three years thereafter);

(ii) Use of the Application and handling Requests (term of the Agreements and three years thereafter);

(iii) Communication, complaints and Claims handling (term of the Agreements and three years thereafter);

(iv) Fraud monitoring and prevention (for the term of the Agreements and three years thereafter; longer if fraud handling is ongoing);

(v) Application improvement (for the term of the Agreements);

(vi) Resolution of the Provider’s disputes (for the duration of any dispute);

(vii) Direct marketing of the Provider’s services (for the term of the Agreements);

(viii) Resolution of the Recipient’s disputes (within granted consent/legitimate interest; for the duration of the dispute);

(ix) Archiving/compliance activities.

4.3 When processing based on the Provider’s legitimate interest, the Provider takes all necessary steps to minimise impact on the Recipient’s privacy and to balance interests appropriately.

4.4 The Provider stores data for the periods above unless a longer period is required by law. After the applicable retention period expires, personal data are deleted.

4.5 If the Recipient does not complete Account activation, personal data will be deleted no later than 365 days from the last step in an incomplete registration, provided the Agreements have expired.

4.6 Personal data are processed electronically (automated) or on paper (non-automated). The Provider does not perform automated individual decision-making within the meaning of Article 22 of the Regulation.

5. COOKIES

5.1 The Provider uses cookies when the Application is used. Cookies are small data files stored on the Recipient’s Device when visiting the Website/logging into the Account; they improve user experience and help the Provider deliver better services. Cookies do not damage the Device, do not contain personal data identifying a specific person and cannot be used to collect the Recipient’s personal data.

5.2 When using cookies, the Provider may record the Recipient’s URL, IP address, browser type and language, host name, screen resolution, location and time zone, Device type, date/time of visits, and which parts of the Application were visited.

5.3 If the Recipient’s browser allows cookie storage, this is considered consent to use/store cookies. The Recipient may disable cookies in the Device settings.

6. SHARING OF PERSONAL DATA

6.1 The Provider may share personal data with trusted parties where necessary to perform the Agreements, where the Recipient has consented, or where another legal basis exists (e.g., legal obligations). Such parties may include, for example:

– Employer,

– payment service providers administering WageNow™ Benefits,

– accounting, tax and/or legal service providers,

– cloud service providers,

– providers of other tools/services used by the Provider to implement software that improves efficiency/economy of cooperation and ensures adequate protection measures under the Regulation,

– web analytics providers,

– SMS gateway providers (phone number),

– customer support providers.

6.2 Data are shared only to the minimum necessary extent.

6.3 The Provider does not share processed personal data with entities outside the EU or international organisations, except for transfers to third countries ensuring an adequate level of protection.

7. SECURITY

7.1 The Recipient’s personal data are appropriately protected against loss, destruction, alteration, misuse, unauthorised disclosure, transfer and/or processing through suitable technical and organisational measures, considering the state of the art, implementation costs, nature, scope, context and purposes of processing, and risks to individuals’ rights and freedoms.

7.2 To ensure security, the Provider has implemented, in particular:

– Device protection (e.g., username and password),

– data encryption (SSL),

– restrictions on storage, handling and/or disposal of data,

– regular backups and restoration, etc.

8. RECIPIENT RIGHTS

The Recipient has the following rights:

(i) Right of access (Art. 15 GDPR) – to know whether data are processed, purposes, categories, recipients, etc., and to obtain a copy;

(ii) Right to rectification (Art. 16 GDPR) – to correct inaccurate or complete incomplete data;

(iii) Right to erasure (“right to be forgotten”) (Art. 17 GDPR) – in specified cases (e.g., data no longer needed, consent withdrawn, unlawful processing, legal obligation to erase);

(iv) Right to restriction (Art. 18 GDPR) – e.g., when accuracy is contested;

(v) Right to data portability (Art. 20 GDPR) – to receive supplied data in a commonly used, machine-readable format and transmit them to another controller (where processing is based on contract/consent and automated);

(vi) Right to object (Art. 21 GDPR) – to processing based on public/legitimate interest, including related profiling;

(vii) Right not to be subject to automated decision-making including profiling (Art. 22 GDPR), except where necessary for a contract, authorised by EU/Member State law with safeguards, or based on explicit consent;

(viii) Right to withdraw consent at any time (Art. 7 GDPR) where processing is based on consent;

(ix) Right to lodge a complaint with the competent supervisory authority.

Supervisory authority (Czech Republic):

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)

Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

Phone: +420 234 665 111

Email: posta@uoou.gov.cz (official contact for GDPR matters). Office for Personal Data Protection+2Office for Personal Data Protection+2

8.2 The Recipient may contact the Provider regarding the processing of their personal data at help@wagenow.com (or info@wagenow.com).

8.3 The Provider will respond only to requests containing all information and attachments necessary to handle and assess the Recipient’s claims and only once the Recipient’s identity can be verified. Without successful verification, the Provider is not obliged to provide any information, to prevent unauthorised access to personal data.

9. FINAL PROVISIONS

9.1 The Provider reserves the right to update this notice, in particular due to legislative changes. The current version will always be available on the Website (www.wageservices.eu) and in the Application. If there is a material change to personal data protection, especially the manner of processing, the Provider will visibly notify users in the Application and on the Website before implementing changes.

9.2 The Provider handles the Recipient’s personal data with maximum care and in compliance with applicable law, using available technical safeguards. For any questions not answered in this Privacy Policy, the Recipient may contact help@wagenow.com.