PersonalBusiness
Log inOpen an account
Ouvrir un compte

Privacy policy and protection of personal data

This English translation is provided for information only. In case of discrepancy, the French version prevails. CREACARD (hereinafter “we”) collects personal data and uses it in various automated processing operations. The automated processing of personal data is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the “GDPR”, and by French Law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

This is CREACARD's Privacy Policy, intended to inform you of how we protect your personal data. It applies uniformly to all products and services sold by CREACARD.

CREACARD is a French public limited company (Société Anonyme) with share capital of €6,532,960, registered with the Paris Trade and Companies Register under number 520 833 302, located at TSA 11765, 75771 PARIS CEDEX 16, FRANCE.

CREACARD is an electronic money distributor offering rechargeable PCS MASTERCARD® payment solutions and cards and electronic money top-ups, issued by Monavate UAB under licence from Mastercard. Monavate UAB is authorised and regulated as an electronic money issuer by the Bank of Lithuania under registration number LB002139. Registered office: UAB Monavate, Konstitucijos av. 21A, Vilnius, LT-08130, Lithuania. Company registration number: 305628001. PCS® Prepaid Cash Services is a trademark of CreaCard SAS.

CREACARD, as the controller of your data, sets out in this document which personal data CREACARD processes and for what purposes, how it is collected and the rights you have under applicable law, in particular the GDPR.

1. Who is the controller of your data

The controller of your personal data is CreaCard, located at TSA 11765, 75771 PARIS CEDEX 16, FRANCE.

2. What personal data we collect

We collect and use the personal data that is strictly necessary for our business in order to offer you personalised, quality products and services. We may collect various categories of personal data from you, including:

  • identification and contact information (last name, first name, gender, company registration extract (Kbis), town, department, country and date of birth, photo, nationality, employment status and business sector, sex, age, signature, ID card and passport numbers, and more generally identity documents);
  • contact details (postal and email address, phone number, proof of address);
  • identification and authentication data, in particular when using online account services (technical logs, computer traces, information on device security and use, IP address);
  • banking and financial information and transaction data (bank details, card number);
  • transaction data, including information on transfers;
  • data relating to the use of the products and services subscribed to (banking, financial and transaction data, including wealth level, monthly income bracket, bank account data, transaction information).

When you change your information yourself in your personal area, CREACARD may collect new personal data about you (phone number, postal address, proof of address).

Finally, CREACARD may collect information about you even if you are not a customer, in particular:

  • ID documents of payers or beneficiaries of a transaction who are not CREACARD customers;
  • ID documents of people housing CREACARD customers.

3. Purposes of processing your personal data

When you subscribe to the payment services sold by CREACARD, your personal data is processed for the following purposes.

a. To comply with our legal and regulatory obligations

  • combating money laundering and terrorist financing;
  • compliance with applicable legislation on international sanctions, asset freezes and embargoes;
  • combating money laundering, service abuse and tax fraud;
  • responding to official requests from duly authorised public or judicial authorities, in connection with the prevention and/or detection of offences and crimes.

b. To perform a contract with you or provide you with pre-contractual information at your request

  • providing you with information about our products and services;
  • providing you with support in relation to our products and services, in particular the banking transactions carried out;
  • providing you with prepaid card services subject to our contractual obligations;
  • providing you with e-wallet services;
  • providing you with IBAN account services;
  • providing you with the above services via a mobile app;
  • processing your account information;
  • verifying your identity;
  • assisting you with requests;
  • managing the customer relationship, in particular the management and performance of the products and services we sell;
  • improving the products and services we provide to you.

c. For the pursuit of our legitimate interests

  • keeping proof of transactions or operations;
  • risk management;
  • updating customer knowledge, including prospecting and data analysis for targeting or marketing purposes;
  • monitoring transactions to identify those that appear unusual;
  • developing and improving our products and services.

4. Lawfulness of processing your data

By consenting to this privacy policy, you give us permission to process your personal data for the reasons specifically identified above. Consent is required for CREACARD to process your personal data, but it must be given explicitly. When we ask you for sensitive information, we will always tell you how and why we use your information.

If you give consent on behalf of a minor under 16, we remind you that children need specific protection regarding their personal data. They may be less aware of the risks, consequences and safeguards involved, or of their rights regarding the processing of their data in connection with our services. By consenting to this privacy notice on behalf of a minor, you authorise their data to be used for the reasons described above.

The uses described above are based on:

  • the performance of the contract you enter into with CREACARD;
  • legal and regulatory texts (this is the case in particular for all processing related to customer due diligence, combating money laundering, terrorist financing and fraud, compliance with international sanctions…);
  • our legitimate interest (for example, risk prevention, developing CREACARD's business, commercial prospecting operations);
  • for more specific uses, your consent.

Your personal data (photo) may be subject to processing involving automated decision-making by our provider MONAVATE. This processing is necessarily based on one of the legal bases set out above. In addition, CREACARD only keeps your data for as long as is necessary for each of these uses and/or in accordance with the applicable legal requirements.

5. Recipients of your data

Your data is mainly intended for CREACARD and for the purposes set out in this policy. In addition, to achieve these purposes, it may be passed on to the following third parties:

  • the issuer of PCS cards (the electronic money institution MONAVATE);
  • legally authorised administrative and judicial authorities, for the performance of their duties, on request and within the limits permitted by regulations;
  • subcontractors, partners or service providers involved in the products and services offered by CREACARD, solely for the needs of these activities;
  • certain regulated professions such as lawyers, notaries, bailiffs or statutory auditors in the performance of their duties;
  • Walleo and its partners for purchases of e-vouchers or PCS Shopping gift cards;
  • Paymium and its partners for cryptocurrency purchases in PCS Crypto.

6. Transfer of your personal data abroad

In the course of certain operations, personal data may be disclosed to partners or subcontractors established in a foreign country. When these transfers are made to member countries of the European Economic Area (EEA), the level of data protection is considered high, as it is when the recipient country is covered by an adequacy decision of the European Commission. For transfers to other countries (outside the EU and EEA), transfers are governed by standard contractual clauses in line with the models drawn up by the European Commission. In any event, we require your personal information to be protected according to data protection standards and ensure that adequate security measures are in place.

7. Retention period of your personal data

Personal data is kept for as long as necessary to provide the products and services offered by CREACARD, to comply with regulatory obligations and to keep contractual evidence until the parties' rights are extinguished.

  • Provision of products and services, performance of the contract: 5 years from the end of the business relationship.
  • Support in connection with banking transactions: 5 years from the end of the business relationship.
  • Improvement of products and services: 3 years from data collection.
  • Accounting records and supporting documents: 10 years from the close of the financial year concerned.
  • Mobile apps: 5 years from the end of the business relationship.
  • Commercial prospecting aimed at an existing customer: 5 years from the end of the business relationship.
  • Commercial prospecting aimed at a prospect: 3 years from collection or from the last inbound contact from the person concerned.
  • Prevention and detection of offences and crimes and processing related to our legal and regulatory obligations: 5 years from the discovery of the offence. In the event of legal proceedings, data is kept until their conclusion and then for the applicable statutory limitation period.
  • Recording of telephone conversations: 1 month from recording.
  • Analysis of certain data for targeting purposes: duration of the contractual relationship, from collection.
  • Cookies, trackers: 13 months from collection.
  • Data collected via cookies: 25 months from collection.
  • Marketing: duration of the contractual relationship, or 3 years for non-customer individuals from their collection or from the last contact from the prospect.

If an account is created fraudulently, your personal data (photo) will be stored for fraud prevention purposes for 5 years from the closure of the fraud file. The periods above may be extended to meet our legal and/or regulatory obligations. Once the retention period has expired, your personal data will be destroyed or anonymised.

8. Your rights

As a data subject, you have the following rights at any time while we hold or process your personal data:

  • right of access – you have the right to request a copy of the information we hold about you;
  • right to rectification – you have the right to correct data we hold about you that is inaccurate or incomplete;
  • right to erasure – you can ask for the personal data we hold about you to be erased from our records in certain situations. Your data relating to your financial transactions, accounts and cards cannot be erased under national law on the prevention of fraud, money laundering, terrorist financing or the misuse of services for criminal purposes;
  • right to withdraw your consent – you can tell us at any time that you wish to withdraw your consent to the processing of your data by CreaCard;
  • right to restriction of processing – where certain conditions apply, you are entitled to restrict processing;
  • right to object – you have the right to object to certain types of processing such as direct marketing, as well as to automated processing, including profiling;
  • right to give instructions on what happens to your data after your death.

Please note that exercising some of these rights may, on a case-by-case basis, make it impossible for CREACARD to provide the product or service. You can contact us at DPO@creacard.net for more information. You can also, at any time and free of charge, without having to give reasons, object to your data being used for commercial prospecting. All the above requests will also be passed on to any third parties who may be involved in processing your personal data.

9. Data protection officer

You can exercise your rights at any time by contacting CREACARD and enclosing a copy of an ID document with your request, by post to the data protection officer: CREACARD, Data Protection Officer, TSA 11765, 75771 PARIS CEDEX 16, FRANCE. Or by email: DPO@creacard.net.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the supervisory authority responsible for compliance with personal data obligations: www.cnil.fr/fr/plaintes.

10. Changes

This privacy policy may change. It is your responsibility to read the latest version of this document on our website. Any substantial change will be brought to your attention.