Datenschutzrichtlinie

Gültig seit: 1. Januar 2020

Stand: 12. Juni 2022

Billtrust’s Commitment to Privacy

BTRS Holdings, Inc. and its wholly owned subsidiaries (“Billtrust”, “we”, “us”, “our”) takes the protection of personal information (“Personal Data”) very seriously. We are a software company, specializing in order-to-cash solutions. In the normal course of our business activities, we act as processor or service provider on behalf of our clients. Such activities fall outside the scope of this “Privacy Notice”, “Privacy Policy”, or “Policy”. Please read this Policy carefully to understand the limited circumstances in which it may apply to your Personal Data and to learn more about how we protect your Personal Data and what privacy rights may be available to you under applicable data protection and privacy laws, such as the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act of 2018 (“CCPA”).

What is Covered by this Privacy Policy

Billtrust is responsible for processing your Personal Data described in this Policy.

This Policy applies to Personal Data collected by us, or provided by you, through the delivery of our products, on the Billtrust websites, mobile applications, social media pages that link to this Privacy Notice; during your interactions with Billtrust regarding training, publications, meetings, and events, and in the context of other sales and marketing activities. This Policy explains Billtrust’s practices regarding the collection of Personal Data that is gathered through:

  • our websites (the “Sites”)
  • through the delivery of our Products (including Business Payments Network (“BPN”), Billtrust Business Directory (“BBD”), Cash Application (“Cash App”), Credit; eCommerce; Collections and Invoicing and Payments and the new Billtrust Platform (collectively “Products”) as well as customer portals (Vuebill and Client Connect) and
  • through interactions via telephone, email and other communication channels and other sales and marketing activities.

By visiting the Sites or using our Products, you are accepting the practices described in this Policy.

If you provide us or our service providers with any personal data relating to other individuals, you represent that you have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that any such personal data may be used in accordance with this Privacy Notice.

This Policy tells you, among other things:

This Policy does not apply to Billtrust’s processing of the personal data of its personnel, such as employees and contractors.

This Policy does not apply to personal data we process in the role of a data processor or service provider on behalf of our clients or customers, including where we offer to our clients or customers various cloud products and services through which our clients or customers (or their affiliates) collect, use, share or process personal data using our cloud products and services.

We are not responsible for the privacy or data security practices of our clients or customers, which may differ from those detailed in this Policy.

We may alter this Policy as needed to abide by local laws or regulations around the world, such as by providing supplemental information in certain countries.

Our Role with Respect to Your Personal Data

When we process the Personal Data on behalf of our Customers to provide our services, we act as a data processor or service provider. Where you give your data to one of our Customers or where we collect your Personal Data on their behalf, our Customer’s privacy policy, rather than this Privacy Policy, will apply to our processing of your Personal Data. If you have a direct relationship with one of our Customers, please contact them to exercise your privacy rights.

For the Personal Data of our Customers, business contacts and prospects, visitors of our Sites, and the data of sole proprietors that we may disclose in the context of the Business Payment Network (“BPN”), Credit and our Business Directory (“BBD”), we decide the purposes and means of processing, and consequently behave as a data controller. Please note that we offer a business-to-business service. We incidentally process personal data of sole proprietors, when our Customers provide them to us as part of a wider list of business contacts. It is not always possible for us to differentiate between sole proprietors and corporations, based on the data we receive from our Customers.

What Personal Data We Process and How We Obtain It

The table below describes the categories of Personal Data that we have collected when we act as a data controller:

Personal data we collect, process, or storeHow we obtain it
Data Category: Identifiers
General (This row applies to all Billtrust Products except data processed in Credit, BPN, BBD, and for marketing purposes): first and last name, email address, phone number, shipping address.You provide us with this Personal Data during the order process, registration for, and use of our Products.
Credit: first and last name, business address, email address, Federal Tax ID (which can be a Social Security Number), shipping address, username (and password).Publicly available websites and other Customers.
Business Payment Network (BPN): first and last name, email address, company address, Tax ID (which can be a Social Security Number), account name and name of account owner(s), and Merchant ID.Our Customers (Payables providers and suppliers) and our Sponsors.
Billtrust Business Directory (BBD): company name (such as sole proprietor’s name), email address.Our database for billing and payments, which contains data of our Customers and the customers of our Customers.
Marketing: first and last name, IP address, email address, mailing address.Cookies placed in our Sites as described in our Cookie Policy; communications sent by you or other customers/prospects via our websites or by email; tradeshows/conferences/events; publicly available websites (for example, LinkedIn, Zoominfo, industry websites); and vendors that provide website analytics and account-based marketing platform services.
Special categories of Personal Data
General (This row applies to all Billtrust Products except data processed in Credit, BPN, BBD, and for marketing purposes): credit card company, credit card number and expiration date, credit card billing address, bank account information, invoicing information.You provide us with this Personal Data during the order process, registration for, and use of our Products
Credit: financial statements.Credit bureaus, publicly available websites (i.e. news websites) and other Customers.
Business Payment Network: telephone number; bank account information (to facilitate ACH and wire transactions).Our Customers (Payables providers and suppliers) and our Sponsors.
Marketing: phone number.Communications sent by you or other customers/prospects via our websites or by email; tradeshows/conferences/events; publicly available websites (for example, LinkedIn, Zoominfo, industry websites); and vendors that provide website analytics and account-based marketing platform services.
Data Category: Protected characteristics
Marketing: GenderMarketing: communications sent by you or other customers/prospects via our websites or by email; tradeshows/conferences/events; publicly available websites (for example LinkedIn, Zoominfo, industry websites); and vendors that provide website analytics and account-based marketing platform services.
Data Category: Commercial information
Allgemein (Diese Zeile gilt für alle Billtrust Produkte, ausgenommen Daten, die in Credit, BPN, BBD und zu Marketingzwecken verarbeitet werden) Rechnungsinformation. General: You provide us with this Personal Data during the order process, registration for, and use of our Products.
Credit: Trade data, business operational, employment and financial characteristics; government compliance data; creditor exposure and payment experiences; industry opinions. Credit: Credit bureaus, publicly available websites (i.e. news websites) and other customers.
Business Payment Network: monthly check data/volume, transaction value of payments flowing through the BPN (ultimately, this data is aggregated). Business Payment Network: our Customers (Payables providers and suppliers), our ACH transaction facilitator, and our Sponsors.
Billtrust Business Directory: number of electronic payments, number of payments with paper checks, payment preferences (paper checks/electronic payment) (this is further aggregated). Billtrust Business Directory: our database for billing and payments, which contains data of our Customers and the customers of our Customers.
Marketing: service and product purchase history. Marketing: communications sent by you or other customers/prospects via our websites or by email; tradeshows/conferences/events; publicly available websites (for example, LinkedIn, Zoominfo, industry websites); and vendors that provide website analytics and account-based marketing platform services.
Data Category: Internet or other similar network activity
Allgemein (Diese Zeile gilt für alle Billtrust-Produkte mit Ausnahme von Daten, die in Credit, BPN, BBD und zu Marketingzwecken verarbeitet werden) Ihre Interaktion mit unserer Website, Anwendungen und Werbung.General and marketing: General: you provide us with this Personal Data when you visit our websites or interact with our Apps (with cookies).
Marketing: your interaction with our website, applications and advertisements, such as URLs visited.
Data Category: Geolocation data
Marketing: country information. Marketing: you provide us with this Personal Data, when you visit our websites or interact with our Apps (for example, Google Analytics places a cookie in your device).
Data Category: Sensory data
Marketing: call recordings. Marketing: you accept that we record the call when you phone us.
Data Category: Professional or employment-related information
Credit2B: job title. Credit2B: Credit bureaus, publicly available websites (i.e. news websites) and other Customers.
Marketing: job level, job title, company name Marketing: communications sent by you or other customers/prospects via our websites or by email; tradeshows/conferences/events; publicly available websites (for example LinkedIn, Zoominfo, industry websites); and vendors that provide website analytics and account-based marketing platform services.
Data Category: Inferences drawn from other Personal Data
Business Payments Network: supplier’s payment preferences. Business Payments Network: database for billing and payments, which contains data of our Customers and the customers of our Customers, suppliers and sponsors.
Data Category: Biometric Data
General: fingerprint data General: some mobile applications allow users to optionally provide a fingerprint instead of a password.
Data Category: Other
Credit: any content that you create or share, including any communications with Credit or other users, and other information related to your work or organization. Credit: you create or share it in your communications with Credit or other users.

We don’t collect additional categories of Personal Data, without informing you.

Lawful Bases for Processing

When we process Personal Data based on the instructions of our customers, our Customers must determine the appropriate lawful basis for processing your Personal Data. To learn about their lawful bases for processing your Personal Data, please read the privacy policies of our Customers.

When we determine why and how your Personal Data will be processed, the legal bases for processing are described in the table below:

Processing Purpose*Legal Basis
Providing our products and services To perform a contract with you or to take steps that you request when signing up for the services.
Communicating with you regarding our products and services and general inquiries. If you contact us by email, social media or other method, we process information about you to interact with you and to respond to your requests. It is in our legitimate interests to communicate with you and fulfill your requests.
Operating our websites. We are obligated to perform our contract with you for the use of our websites and services and to fulfill our obligations under the applicable terms of use and service; to the extent we do not have a contract in place, we process your personal data based on our legitimate interest to operate and administer our websites and to provide you with information, offer an improved website user experience, and/or protect and maintain our websites.
Marketing our products, services, or events. Our direct marketing is based on our legitimate interest or, if provided, your prior consent.
For research and development Our legitimate interests, such as our interest in marketing our services; and the interests of third parties, for example the interest of Account Receivable providers in having a network connecting buyers with suppliers that improves the processing of payments. You have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details provided in this Privacy Notice.
For compliance, security, and safety Protecting our business and managing the security of our environments is based on our legitimate interest to protect our systems and rights, and the rights of others.
To comply with our legal obligations Our compliance with the law.
With your consent Your consent, which may be withdrawn at any time. However, this will not affect the lawfulness of our processing, before you withdraw your consent. It will also not affect the validity of our processing of personal data performed on other lawful grounds.

*Details regarding each processing purpose listed below are provided in the section below titled “How do we use your personal data?”.

How Do We Use Your Personal Data?

The table below explains why we process your Personal Data, when we act as a data controller:

Category of Personal DataBusinesses and Commercial Purposes for Processing Personal Data
Identifiers

General (All Products except Credit, BPN, BBD, and marketing activity):

  • To maintain or service accounts for our Customers, providing customer service to our Customers, to process or fulfill orders and transactions including ACH or wire transfers, to verify customer information, to process payments, and to provide our Products to our Customers;
  • To detect security incidents, to protect our systems against malicious, deceptive, fraudulent, or illegal activities, and to prosecute those responsible for those activities;
  • To identify errors in our systems, Sites, Products .
  • To perform internal purposes such as auditing, creating an internal directory, data analysis, and research to improve Billtrust’s products, services, and customer communications.
Credit: To create global business profiles, to enable portfolio monitoring and to send alerts on portfolio accounts of our Customers, and to create a portal that gathers credit application information, as part of the credit onboarding decisioning process of our Customers.
Business Payment Network: to maintain or service accounts for our Customers, to provide customer service to our Customers, to process or fulfill order processing and transactions including ACH and wire transfers, to verify customer information, to process payments, and providing the Business Payment Network product to our Customers.
Billtrust Business Directory: to identify opportunities within our customers’ customer bases to convert print invoices to electronic invoices and payments from paper checks to online payments.
Marketing: to keep you informed about upgrades, products and services of Billtrust, its affiliates and other third parties that may be of interest to you.
Special categories of Personal Data General: to process or fulfill orders and transactions, verify customer information, and provide our Products to our Customers.
Business Payment Network: to contact our customers, when required; to process or full order processing and transactions including ACH and wire transfers.
Marketing: to contact customers or prospects in order to market our Products.
Protected characteristics Marketing: to address you in our marketing communications.
Commercial information General: to process or fulfill orders and transactions, to verify customer information, payments, and to provide our Products to our Customers.
Credit: to gather and analyze credit application information for our Customers.
Business Payment Network: to create a two-sided platform in which payable providers can deliver digital payments directly to the suppliers’ acceptance platforms.
Billtrust Business Directory: to allow our customers to identify opportunities within their customer base to convert print invoices to electronic invoices and payments from paper checks to online payments.
Marketing: to send Customers relevant marketing communications in light of Products that they have already purchased.
Internet or other similar network activity General: to detect security incidents, to protect our systems against malicious, deceptive, fraudulent, or illegal activities, and to prosecute those responsible for those activities.
Marketing: to target the marketing of our products and services, to count ad impressions to unique visitors, and to verify positioning and quality of ad impressions.
Geolocation data Marketing: to obtain aggregate demographic information about the entire Billtrust audience, to help us create, develop, operate, deliver, and improve our products, services, content and advertising.
Sensory data General: to provide and improve the quality of our customer service.
Marketing: to contact you about our Products.
Professional or employment-related information General and marketing: to provide customer service; to verify customer information, to process payments; and to provide our Products to our Customers; to contact you about our Products.
Biometric Data General: to enable login to some mobile applications.
Inferences drawn from other Personal Data Billtrust Business Directory: to allow our customers to identify opportunities within their customer base to convert print invoices to electronic invoices and payments from paper checks to online payments.

How Long We Keep Your Personal Data

With respect to the data processing operations where we act as a data controller, we will retain your Personal Data for the period necessary to fulfil the purposes outlined in this Policy unless a longer retention period is required or permitted by law, for legal, tax or regulatory reasons, or other lawful legitimate purposes. Where required by law, we will also delete your Personal Data upon a verifiable request to delete the personal data.

With respect to Personal Data that we process on behalf of our Customers, we retain Personal Data for as long as instructed by the respective Customer (who typically acts as a data controller) or as required by applicable law.

Where we process Personal Data for marketing purposes or with your consent, we process the information until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your Personal Data so that we can respect your request in future.

Your Personal Data may need to be retained in our backup systems and will only be deleted or overwritten at a later time, which is normally within two weeks. This may be the case, even when you or a Supervisory Authority has validly asked us to delete your Personal Data or when we no longer have a legal basis for processing such Personal Data.

Sharing Data with Third Parties

We may disclose Personal Data to third party service providers who process information on our behalf, act as professional advisors, or who are involved in a corporate transaction. We may also disclose Personal Data to law enforcement agencies, government bodies or private parties as required by law. Disclosures of Personal Data may be necessary for the performance of our contract, our legitimate interests, or when we are required to do so by law. For any recipient categories not mentioned in this section, we may share your Personal Data where you have given us permission to do so.

We describe below the categories of Personal Data that we have disclosed for our own operational business purposes, what categories of Personal Data we have sold, and the types of recipients of your Personal Data. The information about our data sharing practices is structured as follows:

  • Our disclosures of Personal Data processed in the context of most Billtrust Products (excluding Credit, BPN and BBD).
  • Our disclosures of Personal Data processed in the context of Credit.
  • Our disclosures of Personal Data processed in the context of the BPN.
  • Our disclosures of Personal Data processed in the context of the BBD.
  • Our disclosures of Personal Data processed for our marketing purposes.
  • International data transfers.

Personal Data Shared in the Billtrust Products (excluding Credit, BPN and BBD)

What Categories of Personal Data Does Billtrust Share with Service Providers?

Identifiers, special categories of Personal Data, commercial Information, inferences drawn from other Personal Data, and biometric data

What Types of Service Providers May Receive These Categories of Personal Data?

Payment gateways; service providers who provide fax and printing services; hosting services; cloud data storage services and SaaS-based integration platforms; cloud-computing software; co-location and infrastructure services; electronic signature software; anti-money laundering screening solutions; payment infrastructure platforms; ACH wire transaction facilitators; business intelligence software; big data analytics platform; event logging platforms; security solutions; and interactive voice response systems.

What Categories of Personal Data May We Sell to Third Parties?

We don’t sell any Personal Data processed in the context of the use of any of the Billtrust Products, except as described in the data sharing sections related to other products, below.

Personal Data from Credit

What Categories of Personal Data from Credit Does Billtrust Share with Service Providers?

Identifiers, special categories of Personal Data, commercial information, inferences drawn from other Personal Data; and other Personal Data included in the content that you create or share, including any communications with Credit or other users, and other information related to your work or organization.

What Types of Service Providers May Receive These Categories of Personal Data?

Credit-reporting companies, payment gateways, and who provide fax and printing services; hosting services; cloud data storage services and SaaS-based integration platforms; cloud-computing software; co-location and infrastructure services; electronic signature software; anti-money laundering solutions; payment infrastructure platforms; ACH wire transaction facilitators; business intelligence software; big data analytics platform; event logging platforms; security solutions; and interactive voice response systems.

What Categories of Personal Data May We Sell to Third Parties?

In order to facilitate intelligent decision making by the customers of our Credit product, we may share information entered by our customers with credit agencies and other third parties, and receive information from them in turn. When that exchange of information involves the Personal Data of an individual or household, as in the case of a sole proprietorship, these types of data flows may be considered a “sale” under the CCPA.

Identifiers, special categories of Personal Data, commercial information, and inferences drawn from other Personal Data.

What Types of Third Parties May Receive These Categories of Sold Personal Data?

Credit bureaus, credit analysts, factoring organizations, and our Customers.

Personal Data Shared in the Context of the Use of the BPN

What Categories of Personal Data Does Billtrust Share with Service Providers?

Identifiers, special categories of Personal Data, commercial information, inferences drawn from other Personal Data.

What Types of Service Providers May Receive These Categories of Personal Data?

Payment gateways, and service providers who provide fax and printing services; hosting services; cloud data storage services and SaaS-based integration platforms; co-location and infrastructure services; payment infrastructure platforms; ACH wire transaction facilitators; business intelligence software; big data analytics platform; and event logging platforms.

What Categories of Personal Data May We Sell to Third Parties?

We don’t sell any Personal Data processed in the context of the use of the BPN.

Personal Data Shared in the Context of the Use of the BBD

What Categories of Personal Data Does Billtrust Share with Service Providers?

We don’t share any Personal Data processed in the context of the use of the BBD with our service providers.

What Categories of Personal Data May We Sell to Third Parties?

We don’t sell any Personal Data processed in the context of the use of the BBD to third parties as defined in the CCPA. We share commercial information in aggregated form with our customers.

Personal Data Shared for our Marketing Purposes

What Categories of Personal Data Does Billtrust Share with Service Providers?

Identifiers, special categories of Personal Data, protected characteristics, commercial information, internet or other similar network activity information, geolocation information, sensory data, professional or employment-related information.

What Types of Service Providers May Receive These Categories of Personal Data?

Service providers that provide account-based marketing automation software, customer relationship management services, sales engagement platforms, enterprise electronic invoice presentment and payment solutions, analytics, and B2B intelligence tools.

What Categories of Personal Data May We Sell to Third Parties?

We don’t sell any Personal Data processed for our marketing purposes to third parties as defined in the CCPA. Where required by law, we will obtain your opt-in consent before we share your personal data with any company outside of Billtrust for marketing purposes.

Please note that marketing cookies are disabled by default for IP addresses from California and the European Economic Area. If you do not want us to use cookies for marketing purposes as described in our Cookie Policy, please change your cookie settings in our cookie banner.

Further, we take technical measures to restrict how our partners use the data of persons in California. For example, we enable Google Restricted Data Processing not to use California-based information for our remarketing efforts and to ensure that Google will only use data collected on behalf of us in Google Analytics to provide Google Analytics services.

International Data Transfers

Billtrust is headquartered in the United States, and it maintains offices in other countries, such as Belgium and the Netherlands. Sometimes we transfer your personal data within the Billtrust group, including outside of Europe to countries not deemed by the European Commission to provide an adequate level of protection for personal data, in which case the transfer will be based on appropriate standard contractual clauses and other safeguards as necessary under applicable law.

In general, when we transfer personal data outside of Europe, whether within the Billtrust group, or to third parties in countries not deemed by the European Commission to provide an adequate level of protection for personal data, the transfer will be made pursuant to:

  • A contract with appropriate standard contractual clauses and other safeguards as necessary under applicable law;
  • The recipient’s Binding Corporate Rules;
  • The consent of the individual to whom the personal data relates; or
  • Other mechanisms or legal grounds as may be permitted under applicable law

Billtrust beruft sich auf die Zertifizierung unserer Verpflichtung zur Einhaltung des Transatlantischen Datenschutzrahmens als rechtmäßige Methode für die Übertragung personenbezogener Daten aus der Europäischen Union, der Schweiz und Großbritannien/Nordirland. Weitere Informationen dazu entnehmen Sie bitte unserem Hinweis zur Einhaltung des Transatlantischen Datenschutzrahmens.

In the event that all or a part of Billtrust is bought, sold, or otherwise transferred, or is in the process of a potential transaction, Personal Data that you have provided for use, will likely be shared for evaluation purposes and included among the transferred business assets.

We may also disclose Personal Data when required by law or in the good-faith belief that such action is necessary in order to conform to the edicts of the law or comply with a legal process served on Billtrust or our Site.

What Privacy Rights Do You Have?

Wenn Sie einem Datenschutzgesetz wie der DSGVO, dem CCPA sowie in bestimmten Fällen dem Datenschutzgesetz von Nevada unterliegen, haben Sie bestimmte Rechte in Bezug auf Ihre personenbezogenen Daten, die wir erheben und verarbeiten. Wenn wir als Datenverantwortlicher fungieren, können Sie sich direkt an uns wenden, um Ihre Datenschutzrechte auszuüben. Wenn wir lediglich als Dienstleister agieren und Ihre personenbezogenen Daten nur auf der Grundlage der Anweisungen unseres Kunden verarbeiten, müssen Sie sich an diesen Kunden wenden, um Ihre Datenschutzrechte auszuüben. Dieser Kunde hat Billtrust dann über die Änderungen, Korrekturen usw. zu informieren, die (basierend auf der von Ihnen gestellten Anfrage) an Ihren personenbezogenen Daten vorgenommen werden müssen.

Wir fungieren nur in solchen Fällen als Datenverantwortlicher, in denen wir selbst darüber entscheiden, welche Ihrer personenbezogenen Daten zu welchem Zweck verarbeitet werden.

In vielen Fällen agiert Billtrust als Dienstleister im Namen unserer Kunden. Die Entscheidung, welche Daten über Sie erfasst und zu welchen Zwecken sie verwendet werden, liegt in diesen Fällen beim jeweiligen Kunden. Dieser ist dann Ihr direkter Ansprechpartner für alle datenschutzbezogenen Anfragen.

In diesem Abschnitt werden diese Rechte sowie Ihre Möglichkeiten zu ihrer Ausübung erläutert.

Right to Know What Happens to Your Personal Data

This is called the “right to be informed”. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it and who it will be shared with, among other things.

We are informing you of how we process your Personal Data with this Privacy Policy.

We will always try to inform you about how we process your Personal Data. However, if we do not collect the Personal Data directly from you, the GDPR exempts us from the obligation to inform you (i) when providing the information is either impossible or unreasonably expensive; (ii) the gathering and/or transmission is required by law, or if (iii) the Personal Data must remain confidential, due to professional secrecy or other statutory secrecy obligations.

Right to Know What Personal Data We Have About You

This is called the right of access. You may ask us for a copy of the personal data we hold about you, as well as know more about how we process your personal data.

Please take into account that the GDPR allows us not to satisfy your access request when:

  • You already have the information;
  • Providing such information proves impossible or would involve a disproportionate effort, or in so far as providing such information is likely to render impossible or seriously impair the achievement of the objectives of that processing; and
  • That Personal Data must remain confidential, subject to an obligation of professional secrecy regulated by European Union or Member State law, including a statutory obligation of secrecy.

CCPA does not allow us to disclose Social Security numbers, driver’s license numbers or other government-issued identification numbers, financial account numbers, any health insurance or medical identification numbers, account passwords, or security questions and answers.

Right to Change Your Personal Data

This is called the right to rectification. It gives you the right to ask us to correct, without undue delay, anything that you think is wrong with the Personal Data we have on file about you and to complete any incomplete personal data.

If your account settings do not allow you to change it, please contact us and we will do our best to change the Personal Data for you.

Right to Delete Your Personal Data

This is called the right to erasure, right to deletion or the “right to be forgotten”. This means that you can ask us to delete your Personal Data.

Bitte kontaktieren Sie unseren Kundenservice telefonisch unter 1-888-580-2455, um das Recht auf Löschung auszuüben. In manchen Fällen ist es möglich, Ihre personenbezogenen Daten löschen. Es gibt jedoch Fälle, in denen dies nicht möglich ist, beispielsweise, wenn das Gesetz die Löschung verbietet. In solchen Fällen prüfen wir, ob wir das Ausmaß der Verwendung Ihrer personenbezogenen Daten einschränken können, anstatt sie zu löschen.

Occasions Where We Cannot fulfill a Deletion Request Under the GDPR or the CCPA

The GDPR and the CCPA allow us to deny a request to erase your Personal Data, if we or our service providers need to retain the Personal Data to:

  1. Complete the transaction for which we collected the Personal Data;
  2. fulfill the terms of a written warranty or product recall conducted in accordance with federal law;
  3. Provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
  4. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
  5. Debug products to identify and repair errors that impair existing intended functionality;
  6. Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided for by law;
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
  8. Enable solely internal uses that are reasonably aligned with your expectations, based on your relationship with us;
  9. Comply with a legal obligation, including (but not limited to) obligations from the California Electronic Communications Privacy Act; or
  10. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Right to Ask Us to Change How We Process Your Personal Data

This is called the right to restrict processing. It is your right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain occasions, such as where you believe the data is inaccurate or the processing activity is unlawful. This right enables you to ask us to suspend the usage of Personal Data about you, such as when you want us to establish its accuracy or the reason for processing it.

Right to Ask Us to Stop Using Your Personal Data

This is called the right to object. This is your right to tell us to stop using your Personal Data. You have this right, where we rely on a legitimate interest of ours (or of a third party). You also have the right to object at any time to the processing of your Personal Data for direct marketing purposes.

We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim.

Wenn wir Ihre personenbezogenen Daten unter Berufung auf den Transatlantischen Datenschutzrahmen erhalten haben, haben Sie möglicherweise auch das Recht, die Weitergabe Ihrer personenbezogenen Daten an Dritte abzulehnen und Ihre Zustimmung zur Weitergabe Ihrer personenbezogenen Daten an Dritte zu widerrufen. Sie haben möglicherweise auch das Recht, die Weitergabe abzulehnen, wenn Ihre personenbezogenen Daten für einen Zweck verwendet werden, der sich wesentlich von den Zwecken unterscheidet, für die sie ursprünglich erfasst wurden bzw. denen Sie ursprünglich zugestimmt haben.

Right to Port or Move Your Personal Data

This is called the right to “data portability”. It is the right to ask for and download Personal Data about you that you have given us or that you have generated by virtue of the use of our services, so that you can:

  • Move it;
  • Copy it;
  • Keep it for yourself; or
  • Transfer it to another organization.

We will provide your Personal Data in a structured, commonly used and machine-readable format. When you request electronically to determine which data we have about you, we will provide you with a copy in electronic format.

Right Related to Automated Decision Making

We sometimes use computers to study your Personal Data. We might use this Personal Data, so we know how you use our services. For decisions that may seriously impact you, you have “the right not to be subject to automatic decision-making, including profiling”. However, in those cases, we will always explain to you when we might do this, why it is happening and its effect.

Right to Withdraw Your Consent

Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. If you withdraw your consent, our use of your Personal Data before you withdraw your consent is still lawful.

If you have given consent for your details to be shared with a third party, and wish to withdraw this consent, please also contact the relevant third party in order to change your preferences.

Right Not to be Discriminated Against for Exercising your Privacy Rights

We will not discriminate against you for exercising any of your privacy rights. Unless the applicable data protection laws permit it, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you with a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Right to Lodge a Complaint with a Supervisory Authority

If the GDPR applies to the processing of your Personal Data with us, the GDPR grants you the right to lodge a complaint with a supervisory authority, if you’re not satisfied with how we process your Personal Data.

In particular, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work or of an alleged violation of the GDPR.

Your Right to Opt Out of the Sale of Personal Data

You have the right to ask us to not sell your Personal Data at any time. This is called the “right to opt out”. To exercise the right to opt-out, you (or your authorized agent) may submit a request to us by completing this form.

Once you make an opt-out request, we will wait at least twelve months before asking you to reauthorize the sale of your Personal Data. However, if you change your mind, you may opt back into Personal Data sales at any time, by using the contact details below. We will only use Personal Data provided in an opt-out request to review and comply with the request. If you would like to opt out of cookies (except for the strictly necessary ones), click on the “Cookie Settings” button below:

Your Right to Opt In to the Sale of Personal Data

If you have directed us not to sell your Personal Data or if you want us to sell your Personal Data, you can opt-in to the sale of your Personal Data at any time.

In addition, we do not process nor sell the Personal Data of individuals that we know are less than 16 years old. We will not accept opt-in requests from parents or guardians on behalf of their children.

How Can You Exercise Your Privacy Rights?

To exercise any of the rights described above, please submit a request by either:

Authorized Agents

You may appoint an authorized agent to exercise your rights on your behalf. You should appoint such an agent via written permission or a power of attorney pursuant to Probate Code sections 4000 to 4465 (if you reside in the State of California) or the applicable rules for authorizing somebody else to exercise your rights in your country of residence.

To verify that your authorized agent acts on your behalf, we will ask for this written permission from your agent or for the power of attorney. In case you provided your authorized agent with written permission, we will also require that you verify your identity.

Verification of Your Identity

Bear in mind that to evaluate your privacy rights requests (except the requests to stop the sale of your Personal Data), we need to be sure it was you who made the request. Consequently, we might need some identification to check that you are, who you say you are.

To verify your identity, we will ask you some questions concerning information we already hold about you or ask you to verify that you’re the owner of the email address or phone number you are using to contact us. For this verification, we may ask you information related to various identifiers such as, your first name, last name, email address, phone number, complete billing address, and complete mailing address.

We will only use the Personal Data you provide us in a request to verify the requestor’s identity or authority to make the request.

Please note that you may only make a consumer request to know or data portability twice within a twelve (12)-month period.

Response Timing and Format of Our Responses

We will confirm the receipt of your request in ten (10) days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, except when we have already granted or denied the request.

Please allow up to thirty (30) days for us to reply to your requests (except requests to stop selling your Personal Data) from the day we received your request. If we need more time [up to ninety (90) days in total], we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to t

he contact details associated with that account. If you do not have an account with us, we will send our written response electronically, unless you ask us to send our response by mail.

We will only cover the twelve-month period preceding the moment we receive the request in any disclosures that we provide you with.

We will act upon your request to opt out from selling your Personal Data in fifteen (15) days. We will also notify the third parties to whom we sold your Personal Data of your request and instruct them not to further sell your Personal Data, if they do. We will inform you about this within ninety (90) days from the receipt of your request.

If we cannot satisfy a request, we will also provide the reason(s) in our response. For data portability requests, we will choose a format to provide your Personal Data that is readily useable and should allow you to transmit the information from one entity to another entity without difficulty.

We promise that we will not charge a fee for processing or responding to your requests. There may be exceptions when we may charge a fee, if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate, before completing your request.

How Does Billtrust Protect your Information?

Billtrust works to maintain your confidence and trust in us and has, therefore, implemented physical, technical, and administrative measures designed to protect information from accidental loss, unauthorized access, use, alteration, and disclosure. We store and process your information on our servers located within the United States.

Children’s Privacy

Billtrust, einschließlich der Website, richtet sich nicht an Kinder, und Billtrust erfragt oder erhebt online wissentlich keine personenbezogenen Daten von Kindern unter dreizehn (13) Jahren. Wenn Billtrust erfährt, dass ein Kind unter dreizehn (13) Jahren personenbezogene Daten ohne vorherige überprüfbare Zustimmung der Eltern online übermittelt hat, ergreift Billtrust alle angemessenen Maßnahmen, um diese Daten aus unseren Datenbanken zu löschen und sie zu keinem Zweck zu verwenden (außer um ggf. die Sicherheit des Kindes oder anderer Personen gemäß gesetzlichen Vorschriften zu schützen). Wenn Sie Kenntnis von personenbezogenen Daten erlangen, die wir von Kindern unter dreizehn (13) Jahren erfasst haben, kontaktieren Sie uns bitte unter [email protected].

Datenschutzrahmen EU-USA

Im Rahmen der Erfassung personenbezogener Daten unserer Kunden oder deren Kunden im Europäischen Wirtschaftsraum über die Website oder Lösungen kann Billtrust diese personenbezogenen Daten zur Verarbeitung und Speicherung in die USA übertragen. Billtrust nutzt die Standardvertragsklauseln und andere vertragliche Garantien als Übertragungsmechanismus für diese personenbezogenen Daten, hält sich jedoch weiterhin an die Grundsätze des Transatlantischen Datenschutzrahmens. Die Verpflichtung zur Einhaltung der Grundsätze des Transatlantischen Datenschutzrahmens steht im Rahmen unseres allgemeinen Engagements für Datenschutz und -sicherheit. Billtrust hat die Einhaltung der Grundsätze des Transatlantischen Datenschutzrahmens in Bezug auf Inkenntnissetzung, Auswahlmöglichkeiten, Verantwortlichkeit für die Weitergabe, Sicherheit, Datenintegrität und Zweckbindung, Zugriff, Regress, Durchsetzung und Haftung bescheinigt. Eine Liste der Organisationen, die am Transatlantischen Datenschutzrahmen teilnehmen, sowie weitere Informationen zu unserer Zertifizierung finden Sie unter https://www.dataprivacyframework.gov/. Detailliertere Informationen finden Sie in unserem Hinweis zur Einhaltung des Transatlantischen Datenschutzrahmens.

Changes and Updates to the Privacy Policy

This Privacy Policy may be updated and revised from time to time, and we will post the current version of this Privacy Policy on our webpage. When we revise it, we will also update the “Effective” date.

You agree that the Personal Data we gather now, will be subject to the Privacy Policy in effect at the time of use. We may contact you through email regarding material, retroactive changes to our Privacy Policy or practices, but you should check the Site periodically to review any changes. In order to receive communications from Billtrust regarding, among other things, our privacy practices, it is important that the email address you have on record with Billtrust is kept up to date.

We suggest that you review this Privacy Policy periodically, since it may be updated from time to time. In all cases, your continued use of our products or services after the posting of any modified Privacy Policy indicates your acceptance of the terms of the modified Privacy Policy.

Billtrust’s Representative in the UK

Billtrust has appointed VeraSafe as its data protection representative in the UK. You can contact VeraSafe in addition to, or instead of Billtrust at the following details:

VeraSafe United Kingdom Ltd.
37 Albert Embankment, London SE1 7TL, United Kingdom
Phone: +44 (20) 4532 2003
Contact form

Any Questions?

If you have questions or concerns about this Privacy Policy, please feel free to contact BIlltrust’s privacy officer at [email protected].

Order2Cash Privacy Policy

Key details

This website privacy policy describes how Anachron Order2Cash, a company registered in The Netherlands with registered number 58056289, along with its subsidiaries, divisions, and affiliates (“Order2Cash”) protects and makes use of the information you provide the company when you use this website.

If you are asked to provide information when using this website, it will only be used in the ways described in this privacy policy. If you choose to submit information to Order2Cash via this website, you agree to the use of such data in accordance with this privacy policy. This policy is updated from time to time. The latest version is published on this page in April 2020. If you have any questions about this policy, please email [email protected] or write to Anachron Order2Cash, H.J.E. Wenckebachweg 200 (3rd floor), 1096 AS Amsterdam, the Netherlands.

Introduction

We gather and use certain information about individuals in order to provide products and services and to enable functions on this website. We also collect information to better understand how visitors use this website and to present timely, relevant information to them.

What data we gather

You may voluntarily choose to provide Order2Cash with identifiable personal data by completing forms, sending emails, or other means as may be provided from time to time on the website. In addition to information that you voluntarily submit, Order2Cash may, at its option, collect additional information about you from third party sources. Personal information collected by Order2Cash will be as reasonably necessary to fulfill your requests and to provide the most relevant, targeted offers and information from Order2Cash and for no other purpose.

You may also use this website to make use of the services we provide through our secure client environment. Within this environment, you may provide us with personal data to complete or adjust your user profile. In addition, we may receive additional information about you from your company or your supplier as part of the services we provide.

Through the website we may also automatically collect, through our servers and the use of cookies (see below as well), web beacons (also known as clear or single pixel .gifs) and other technologies, information that tells us how you use the website.

We may collect the following information:

  • Name, company name and job title
  • Contact information including email address
  • Other information relevant to client enquiries
  • Other information relevant to services you receive through the website
  • Other information pertaining to special offers and surveys
  • Demographic information, such as postcode and preferences
  • Website usage data
  • Internet Protocol (“IP”) address used to connect your computer to the Internet
  • Computer, device and connection information, such as browser type and version, operating system, mobile platform and unique device identifier (“UDID”) and other technical identifiers

How we use this data

Collecting this data helps us understand what you are looking for from the company, enabling us to deliver improved products and services.

Specifically, we may use data:

  • To provide you with agreed services
  • To contact you in response to a specific enquiry
  • To enlist you, if so requested, for attendance at events or webinars
  • To send you newsletters, information, alerts, offers, and other communications you have subscribed for
  • To record and follow up on your participation to surveys, promotions, and contests as may be available on the website from time to time
  • To customize the website for you
  • To improve the products and services we provide
  • To assemble broad demographic information about visitors, customers, and partners in general
  • For our own internal records

Cookies and how we use them

Cookies are small text files that can be used by websites to make a user’s experience more efficient. The law states that we can store cookies on your device if they are strictly necessary for the operation of our website. For all other types of cookies, we need your permission. Order2Cash uses different types of cookies. Some cookies are placed by third party services that appear on our pages. They enable our website to identify your computer/device as you view different pages on our website.

Cookies allow websites and applications to store your preferences in order to present content, options or functions that are specific to you. They also enable us to see information like how many people use the website and what pages they tend to visit.

We may use cookies to:

  • Analyze our web traffic using an analytics package. Aggregate usage data helps us improve the website structure design, content and functions.
  • Identify whether you are signed in to our website.
  • Test content on our website. For example, 50% of our users might see one piece of content, the other 50% a different piece of content.
  • Store information about your preferences.
  • To recognize when you return to our website.

Cookies do not provide us with access to your computer or any information about you, other than that which you choose to share with us.

Order2Cash provides visitors with the option to approve or deny the use of cookies. You can also use your web browser’s cookie settings to determine how our website uses cookies. Remember, if you do disable or delete cookies, you will not have access to the full functionality of our website.

Controlling information about you

When you fill in a form or provide your details on our website, you will see one or more tick boxes allowing you to opt-in to receive communications from us. You can change your mind easily by using the unsubscribe option at the end of the email sent to you or send an email to [email protected].

We may share personal information that you voluntarily submit with trustworthy business partners. We will only use such third party business partners in order to deliver services to us or on our behalf, and they are prohibited from using that information for any other purpose.

We will never lease, distribute or sell your personal information to other third parties than the above trustworthy business partners, unless

  • we have your permission, or
  • if the law requires us to, or
  • to detect, investigate and help prevent security threats, fraud or other malicious activity, or
  • to enforce and protect our rights and properties or (other) users of the website.

Corrections, Access and Updates to Your Personal Information

We aim to keep your personal information as accurate as possible. Should you at any time desire to review, correct, update or remove your personal information, you may update your relevant profile or registration (when applicable) or contact us using the contact information outlined in the first section above; we will comply with such requests as soon as commercially reasonable or determined by statutory law. In order to ensure the safety of personal information, please note you will be subject to providing sufficient evidence of your identity at the time of any such request before any personal information records will be made available by us.

Data Retention

The information that you submit to us will only be retained for as long as required for the purposes for which it was collected or as required by law. Our retention of your personal information allows us to continue to provide you with highly personalized services without interruption.

Security

We undertake substantial efforts to protect the confidentiality of the personal information, preferences and other information collected through this website and will never knowingly allow access to this information to anyone outside Order2Cash other than as described herein. We have made a substantial investment in our servers, database, backup and firewall technologies to protect the information assets of the Order2Cash network, including the confidentiality of personal information collected through this website. These technologies are deployed as part of a sophisticated security architecture and protocol.

Unfortunately, due to the nature of the Internet as a public transmission network, neither Order2Cash’s network nor data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we strive to protect personal information that is transmitted to us by you, Order2Cash cannot ensure or warrant the security of such information.

Links from our site

Our website may contain links to websites of third parties. When you link to other websites through this website, this privacy policy and our privacy practices no longer apply.

Billtrust Collections (formerly iController) Privacy Policy

In case the user of the website is asked for personal information:

iController BV, located at Moutstraat 64 bus 501, 9000 Ghent, respects the Belgian law of 8 December 1992 concerning the protection of privacy in the processing of personal data and the revised legislation as imposed in accordance with the AVG regulation. (GDPR) 2016/679. The personal data you provide will be used for the following purposes: sending newsletters, announcements of activities, answering questions, customer management and relevant marketing purposes.

You have a legal right to inspect and correct your personal data. Subject to proof of identity (copy of identity card), you can obtain the written notification of your personal data free of charge via a written, dated and signed request to iController BV, Moutstraat 64 bus 501, 9000 Ghent or via an e-mail to [email protected]. If necessary, you can also ask to correct the data that would be incorrect, incomplete or non-pertinent.

Your personal data will not be passed on to third parties.

iController BV may collect anonymous or aggregated data of a non-personal nature, such as browser type or IP address, the operating system you use or the domain name of the website from where you came to the iController website, or through which you leave it. This allows us to permanently optimize the iController website for you and other users.

The use of cookies

During a visit to the site, so-called ‘cookies’ can be placed on the hard disk of your computer. A cookie is a text file that is placed by the server of a website in the browser of your computer or on your mobile device when you consult a website. Cookies can not be used to identify people, a cookie can only identify a machine.

This website contains the following type of cookies: ‘First party cookies’: technical cookies that are used by the visited site itself and that aim to make the site function optimally. Example: settings that the user made on previous visits to the site, or: a prefilled form with data that the user has done during previous visits.

You can set your internet browser so that cookies are not accepted, that you receive a warning when a cookie is installed or that the cookies are subsequently removed from your hard drive. You can do this via the settings of your browser (via the help function). Keep in mind that certain graphic elements cannot appear correctly, or that you will not be able to use certain applications.

By using our website, you agree to our use of cookies.

For questions about our privacy policy you can always contact us.