Privacy Notice

Last updated: May 2025

Getnet Platforms Services S.L. provides end-to-end payments and messaging solutions through a modern and scalable platform for (hereinafter we or Getnet Platforms). Our clients are companies and financial institutions (legal entities, hereinafter the Client or the Clients).

The purpose of this privacy policy is to explain in a transparent, clear and simple way how we collect, process and protect your personal information and to ensure that Getnet Platforms does not trade in personal information and that it allows data subjects to handle it in accordance with applicable regulations.

This policy is aimed at data subjects who are the holders of the personal information that Getnet Platforms processes. Specifically, we distinguish the following types of data subjects to which we will refer throughout this document:

1. Users: These are the data subjects who browse our website.
2. Applicants: data subjects who request information through one of our contact channels.
3. Representatives:  data subjects representing one of the companies or institutions that are customers of Getnet Platforms or are in the process of becoming so. This group includes the following: Legal representatives or representatives. Contact persons. Authorized persons. This being understood to mean those persons authorized by our clients to access the different portals that Getnet Platforms makes available to them such as the Developer Portal, the Quantum Portal, the Incident Portal or any others.
4. Developers: Developer Portal users.
5. Candidates: data subjects who have applied for one of Getnet Platforms’s job offers. The information regarding the processing of their data is collected at the end of this notice (here).

To facilitate understanding, we include the most relevant information in the table below. You can find more detailed information in the following heading and contact our Data Protection Officer (DPD) for any clarification or additional queries by writing to privacy.payments@getnet.net or through any of our channels.

‍Yes. Getnet Platforms requests data from you directly, for example, when you contact us to request information or when we request data from your company, such as proxies or contact persons authorized to use different portals. Providing this data is necessary for the purposes for which it is requested and therefore mandatory.

No international transfers are carried out outside the European Economic Area, except in the case of the incident portal that is located whose services are provided by a processor besieged in the United States that is certified under the Data Privacy Framework which provides it with adequate guarantees.

You have the following rights:

• Access: in other words, we tell you what information we have about you.
• Rectification: we correct the information we hold about you if it is incorrect.
• Cancellation or deletion: we delete your data when they are no longer needed or when we are processing them because you have given us your consent.
• Opposition: when the processing of your data is based on a legitimate interest.
• Limitation of processing: for example, where you have challenged the accuracy of the data themselves.
• Portability: by requesting that we communicate your data to a third party in a structured, commonly used, machine-readable format, where possible, or to you.
• The right not to be subject to automated decisions: that we do not base a decision that has legal effect on you or significantly affects you on automated processing, with some exceptions.

You can also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

If you want more information about rights in the framework of data protection you can access the infographic about the AEPD here.

You can exercise your rights through your private portal, by writing an email to privacy.payments@getnet.net or by contacting us through any of our channels, indicating that this is a request to exercise your rights of GDPR. Remember if we need to confirm your identity we may ask you for some kind of documentation about it.

At Getnet Platforms we are committed to security, and we apply technical and organizational measures aimed at guaranteeing the integrity, unavailability and confidentiality of your data.

For example, all persons who can access personal information are subject to a contractual obligation of confidentiality, we use Data Lost Prevention (DLP) measures, encryption of information in transit and at rest, access control, establishment of secure passwords, etc.

As we have already explained in some cases the personal information, we collect is not received directly from you as a data subject, but rather from another person, that represents or provides services for our Client is the one that communicates to us that information or it is information that we access in the framework of the provision of our services.If you are that person, you declare that you have sufficient authorization both to act on behalf of our Client and to communicate such personal information that, in addition, you guarantee that it is true, accurate, complete and up to date. In addition, on behalf of the Client you will inform the interested party of the communication and indicate that you can review this document on our website or, if applicable, show a physical copy of this document.

If it is necessary for us to change the content of this privacy policy we will inform you of the relevant aspects indicating the date from which they will be applicable. We will also publish it on our website.

Additional information on the use of AI tools to assess whether the candidate meets the requirements of the offer for which he or she is applying

1. How does the automated tool used by Getnet Platforms work?

During the initial selection of candidates, Getnet Platforms can use an analysis tool based on artificial intelligence to assess whether the characteristics of the candidates contained in the information provided by them (mostly CVs) meet the requirements of the job offer.

The system analyses this information and generates different scores showing the percentage of matching between the candidates and the job offer based on the information they have provided. The result generated by the tool does not in itself determine a final decision. Candidate selection decisions are made exclusively by human beings, who may or may not consider the results generated by the tool. In any case, there is always human supervision during the evaluation process.

2. What type of information is processed by the automated tool and what is the legal basis for the processing?

The tool only processes the information provided by the candidate at the time of applying for the vacancy, in particular the information contained in the CV.

Candidates participate in the recruitment process on a voluntary basis and the processing of their data is based on the adoption of pre-contractual measures. However, the automated processing of personal data through the tool is legally based on the legitimate interest of Getnet Platforms.

This legitimate interest is specified in the need to use technological tools to improve efficiency, objectivity and traceability, to optimise the management of the recruitment process and to ensure an initial technical evaluation based on previously defined criteria.

Candidates may, at any time, object to their application being evaluated by the automated tool and request that their profile be reviewed manually by the person responsible for the selection process. To do so, the candidate should contact Getnet Platforms by e-mail at: privacy.payments@getnet.net. We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.

1. With service providers
   We may share your personal information with companies that provide services to us and with whom we have entered into a data processing agreement in accordance with applicable law. These will process your data on our behalf and following our instructions.
2. International transfers of data‍
   In exceptional cases, as we may use service providers located outside the EEA, or our EEA-based providers may sub-contract to providers outside the EEA, your data may be transferred outside the EEA to countries such as Brazil, Chile, Mexico or others which do not provide a similar or adequate level of protection to that provided in the EEA, we will provide adequate safeguards in accordance with data protection legislation. If you wish to request a copy of these guarantees or additional information, you may do so by contacting the relevant DPO.

We will process your personal data for as long as the selection process lasts and, where appropriate, as necessary to manage queries. Once the process is complete, we will retain your information in case of future opportunities in which you may be interested in a maximum period of 18 months. After that period, we will proceed to block the information and delete it after the period of exercise of actions.

If you are applying for a job position in Germany, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 6 months.

If you are applying for a job position in the UK, we will process your personal data during the recruitment process. In case you do not receive a job offer from us, we will delete your data after 12 months.