Privacy Policy

It is important for us that we safeguard your privacy and take all the necessary measures as required.

1. Who is responsible for your private data?

Frictionless Technologies Ltd, registered with the Companies House under company number 13368384 and with registered office at 124 City Road, London, England, EC1V 2NX (“FTL”, “we”, “our” or “us”), is the data controller in accordance with the UK data protection laws (such as the EU Regulation 2016/679 as incorporated and amended into UK domestic law (the “UK GDPR”) and the Data Protection Act 2018. 

2. Your data protection rights as a data subject

You have several rights under the UK GDPR related to you having control of your personal data and to receive information directly from us on how we process personal data about you. In the following you can read about your rights. If you want to know more or come in contact with us to exercise your rights, the easiest way is to email us on legal@joinfam.com. If you want to receive information about the data FTL holds about you through so-called subject access, or have certain data deleted, you can send a request to us on legal@joinfam.com.

Your rights

• Right to have personal data deleted (“Right to be forgotten”). In some cases, you have the right to have us delete personal data about you. For example you can request us to delete such personal data that we (i) no longer need for the purpose it was collected for, or (ii) that we process based on your consent and you revoke your consent. There are situations where FTL is unable to delete your data, for example, when the data is still necessary to process for the purpose for which the data was collected, FTL’s interest to process the data overrides your interest in having them deleted, or because we have a legal obligation to keep it. You can read more about our legal obligations to keep data in section 4 and 9 in this Privacy Notice. The laws described there prevent us from immediately deleting certain data. You also have the right to object to us using your personal data for certain purposes such as direct marketing, which you can read more about in this list of your rights.
• Right to be informed. You have the right to be informed of how we process your personal data. We do this through this privacy notice, by service-specific FAQs, and by answering your questions.
• Right to receive access to your personal data (“Subject access”). You have the right to know if FTL processes personal data about you, and to receive a copy (“data extract”) of such data, so-called subject access. Through the data extract you will receive information about what personal data FTL holds about you and how we process it.
• Right to access, and request a transfer, of your personal data to another recipient (“Data portability”). This right means that you can request a copy of the personal data relating to you that FTL holds for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use this data somewhere else, for example to transfer your personal data to another controller/recipient.
• Right to rectification. You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.
• Right to restrict processing. If you believe that your personal data is inaccurate, that our processing is unlawful or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. You also have the possibility to request that we stop processing your personal data while we assess your request. If you object to our processing per your right described directly below, you may also request us to restrict processing of that personal data while we make our assessment.
• Right to object against our processing of your personal data. You have the right to object to processing of your personal data which is based on our legitimate interest (Article 6(1)(f) UK GDPR), by referencing your personal circumstances. You can also always object to our use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will turn off marketing for you, and stop sending it to you.
• Right to object to an automated decision that significantly affects you. You have the right to object to an automated decision made by FTL if the decision produces legal effects or significantly affects you in a similar way. See section 6 on how FTL makes use of automated decisions.
• Right to withdraw one’s consent. As described in section 5 below, where we process your personal data based on your consent or explicit consent, you have the right to revoke that consent at any time. When you revoke your consent we will stop processing your data for such purposes.
• Right to lodge a complaint. If you have complaints about FTL’s processing of your personal data, you may lodge a complaint with your supervisory data protection authority, (the Information Commissioner), which can be reached using this link: https://ico.org.uk/.

3. What kind of personal data do we collect?

In this section, we describe the types of personal data that we may collect or create. In section 4, we describe for what purposes we use these types of personal data.

• Contact and identification data - Name, date of birth, gender, billing and delivery address, e-mail address, mobile phone number, nationality, age, audio recordings, photos and video recordings of you and your ID card etc.
• Information about goods/services - Details concerning the goods/services you have bought or ordered, such as type of item or delivery tracking number.
• Payment information - Bank name, Bank account number, Sort code, Payment Initiation Service (PIS) and Account Information Service (AIS) consents
• Information about your use of FTL’s services - Which service(s) and what different functions in these services you have used and how you have used them. This includes information about the number and value of orders, refunds, credits redeemed (including credit reversals and adjustments) and your personal preferences such as your buying interests.
• Technical information generated through your use of FTL’s services - Technical data such as response time for web pages, download errors and date and time when you used the service.
• Information about your contacts with FTL’s customer service - Recorded phone calls, chat conversations and email correspondence.
• Your contacts with the stores you shop at or visit - Information about how you interact with stores, such as whether you have received goods and the type of store you shop at.
• Device information - IP address, language settings, browser settings, time zone, operating system, platform, screen resolution and similar information about your device settings.
• Information from external sanction lists and PEP lists - Sanction lists and lists of persons constituting politically exposed persons (“PEP”) include information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the list in question.

4. What personal data are used for what purposes and with which legal basis?

In the tables below you can read about,

1. What we will use your personal data for (the purpose),
2. Which types of personal data we use for that purpose, and if the personal data comes directly from you or from another source. In the cases where we have received personal data about you from another source, we provide the name of that source in brackets,
3. What legal rights we have under current data protection legislation, such as the UK GDPR, to process the data about you, referred to as our “legal basis”, and
4. When FTL stops using the personal data for each purpose.

4.1 Purposes for which your personal data is always used, regardless of the service you use.

4.2 Purposes for which your personal data are used when you use one of the payment methods offered on the FTL Platform

4.3 FTL’s processing when you contact FTL’s customer service.

5. How do you withdraw your consent?

When FTL uses your personal data based on your consent, you can withdraw your consent at any time. You can do this by sending an e-mail to legal@joinfam.com or via the contact information you find in section 12.

If you withdraw your consent or delete the uploaded information, you may be unable to use the service in cases where FTL’s processing of personal data takes place based on your consent.

Lastly: As described in section 2 above you also have the right to object against certain personal data processing (for example you may turn off marketing). You also have a right to have certain personal data erased, which is also described in section 2.

6. FTL’s profiling and automated decisions that significantly affect you.

6.1 FTL’s profiling of you as a customer.

“Profiling” means an automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences, such as buying interests. At the same time, we compare your data with what our other customers, with similar use of our services, have preferred.

The purpose of FTL’s profiling and the personal data types used for each occasion and for each profiling are described in detail in section 3 above. The profiling for these purposes does not have a significant impact on you as a customer.

We use profiling for the following purposes:

• to deliver our customised services, which customise their content based on what we think is most interesting to you (this applies to the FTL mobile application, its various functions, and the order different payment methods appear at FTL’s checkout), and
• to deliver customised marketing to you across both our own and external platforms and services.

If you have any questions about how the profiling process works, please contact us. Contact information is available in section 12. You may object to our marketing profiling at any time by contacting us (and we will then cease profiling for marketing purposes). You may also end our profiling for our services by terminating the service.

7. Who do we share your personal data with?

When we share your personal data, we ensure that the recipient processes it in accordance with this notice, such as by entering into data transfer agreements or data processor agreements with the recipients. Those agreements include all reasonable contractual, legal, technical and organizational measures to ensure that your information is processed with an adequate level of protection and in accordance with applicable law.

7.1 Categories of recipients with whom FTL will always share your personal information, regardless of the service you use.

7.1.1 Suppliers and subcontractors. 

Description of the recipient: Suppliers and subcontractors are companies that only have the right to process the personal data they receive from FTL on behalf of FTL, i.e. data processors. Examples of such suppliers and subcontractors are software and data storage providers, payment service providers and business consultants.

Purpose and legal basis: FTL needs access to services and functionality from other companies where it cannot perform them itself. FTL has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.1.2 Divestment of business or assets.

Description of the recipient: In the event that FTL sells business or assets, FTL may hand over your personal information to a potential buyer of such business or assets. If FTL or a significant part of FTL’s assets is acquired by a third party, personal information about FTL’s customers may also be shared.

Purpose and legal basis: FTL has a legitimate interest in being able to perform these transactions (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.2 Categories of recipients with whom FTL shares your personal information when you use the FTL platform on a merchant check-out.

7.2.1 Merchants.

Description of the recipient: By merchants we mean the merchants you visit or shop at (which may include the merchant’s group companies if you have been informed thereof by the merchant).

Purpose and legal basis: In order for the merchant to be able to perform and manage your purchase and your relationship with the merchant or its group companies, e.g. by confirming your identity, sending goods, handling questions and disputes, in order to prevent fraud and, where appropriate, send relevant marketing. The merchant’s privacy notice applies to the processing of your personal data that has been shared with the merchant and that the merchant processes. Normally, you will find a link to the merchant’s privacy notice on the merchant’s website. The legal basis for sharing data with merchants is partly the performance of a contract (Article 6(1)(b) UK GDPR) insofar as the data sharing takes place to perform the contract between you and the merchant, and partly based on FTL’s and the merchant’s legitimate interest (Article 6(1)(f) UK GDPR) or your consent (Article 6(1)(a) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.2.2 Payment service providers and financial institutions.

Description of the recipient: Payment service providers and financial institutions provide services to you, merchants and FTL to implement and administer electronic payments

Purpose and legal basis: Some merchants use payment service providers with whom they share your information for managing your payment. This sharing takes place in accordance with the merchants’ own privacy notices. The merchant may also let FTL share your information with the payment service provider they use for processing your payment. Some payment service providers also collect and use your information independently, in accordance with their own privacy notices. In addition, FTL may share your information with other financial institutions when conducting transactions with your account to complete the transactions. Sharing with payment service providers and financial institutions is performed to make a transaction initiated by you and it is done to fulfil the agreement with you (Article 6(1)(b) UK GDPR).

7.2.3 Companies providing identity checks.

Description of the recipient: Your personal data are shared with companies that provide identity checks.

Purpose and legal basis: FTL shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent and criminal activities. The companies with which we work are listed here. Please note that these companies may process your data in accordance with their own data privacy notices.

FTL shares your information based on FTL’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), as the companies providing identity checks have information on identity confirmation which are important for FTL to use as input to decrease its level of fraudulent transactions. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. 

7.2.4 Google reCAPTCHA 

Description of the recipient: When you use the FTL mobile application through our web portal, Google will collect your device information through Google’s reCAPTCHA service which is implemented there, in some cases together with additional information that you choose to enter into the reCAPTCHA service.

Purpose and legal basis: FTL processes this information based on FTL’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), since the reCAPTCHA service prevents misuse of our services (for example by preventing bots from trying to log in). Google will process this information in accordance with its terms of service and privacy policy. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.

You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.2.5 Affiliate Networks.

Description of the recipient: When you choose to checkout with a merchant with whom FTL has an affiliate partnership, the data for such transactions are also captured by a third party (in addition to FTL and the merchant) known as an affiliate network. You can learn which affiliate networks FTL cooperates with (See Appendix A). The affiliate networks will process your device information in accordance with their own privacy notices (you will find these privacy notices in Appendix A as referenced above). You can get more information about which network a particular merchant works with by contacting us (or the merchant).

Purpose and legal basis: The affiliate network may place tracking technology on your device that may be used to track your activities on the FTL platform, and which is then used to document your visits and payments to the merchants using the FTL platform and to calculate a potential commission due to FTL.

The processing is based on a balancing of interests (Article 6(1)(f) UK GDPR). When balancing interests, FTL has determined that we have a legitimate interest in the affiliate network tracking your activities on the merchants’ websites using the FTL platform. This tracking also enables FTL to offer certain benefits and rewards to you when you use the FTL platform. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.

You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.2.6 Advertising services.

Description of the recipient: You may see FTL advertisements when you are on other websites and apps, such as on social media. We manage this through a variety of digital marketing networks and using a range of advertising technologies.  To enable us to do this, we may share certain data with third party social media advertisers, such as your device ID and information about your use of FTL’s services.  The social media advertisers will use this data to deliver relevant advertising to you. Some may also use the collected data for their own purposes and in accordance with their own privacy policies which can be found here. You can get more information about this by contacting us.

Purpose and legal basis: We will collect information from your device using tracking technology that contains information about your use of the FTL services and your device ID, which is then used to decide and deliver relevant advertising to you.

Depending on which marketing networks and technologies are used for the specific advertisements you see, the processing is based either on where you have given your consent (under Article 6(1)(a) UK GDPR) or where we have a legitimate interest for doing so based on a balancing of interests (Article 6(1)(f) UK GDPR). When balancing interests, FTL has determined that we and you have a legitimate interest in identifying which type of advertising we should provide to you. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.

This processing may constitute profiling which aims to customise the service’s content based on what we think you may be interested in. You can read more about profiling in section 6.
 

You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.

7.3 Categories of recipients with which FTL shares your personal information if you contact our customer service through social media.

7.3.1 Social media.

Description of the recipient: Social media companies such as Facebook, Instagram or Twitter.

Purpose and legal basis: If you contact us via social media such as Facebook, Instagram or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy notices. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) UK GDPR).

8. When can we transfer your personal data outside of the EU, and how do we protect it then?

We always strive to process your personal data within the EU/EEA area. But in certain situations, such as when we share your information within the FTL Group or with a supplier, subcontractor or merchant which operates outside the EU/EEA, your personal data may be transferred outside the EU/EEA. FTL always ensures that the same high level of protection applies to your personal data according to the UK GDPR, even when the data is transferred outside of the EU/EEA. Your rights in respect to your personal data (described in detail in section 2), are not affected when data is transferred outside of the EU/EEA. More information about the recipients FTL shares your data with you can find in section 7.

When you shop with a merchant placed in a country outside of the EU/EEA area, our sharing of your personal data with that merchant means that your personal data will be transferred to this country outside of the EU/EEA area.

If you want more information about our safety measures you can always contact us. You can find our contact information in section 12. You find more information about which countries are deemed to have an “adequate level of protection” on the European Commission’s website, and you can read more about the European Commission’s standard clauses here.

Safety measures which FTL uses when transferring personal data outside of the EU/EEA

Countries outside of the EU/EEA may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the UK GDPR). Such appropriate safeguards include, but are not limited to, ensuring:

• if the European Commission has decided that the country outside of the EU/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. This means for example that the personal data is still protected from unauthorized disclosure, and that you may still exercise your rights in regards to your personal data, or
• the European Commission’s standard clauses have been entered into between FTL and the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affects the protection of your personal data. Where necessary, we take technical and organizational measures so that your data remain protected during the transfer to the relevant country outside the EU/EEA.

Despite the above, if the merchant where you choose to shop is located in a country outside the EU/EEA, our data sharing with that foreign merchant (or with that foreign merchant’s local FTL entity) means that your personal data will be transferred to this country outside the EU/EEA. Otherwise it would not be possible to administer your purchase. FTL primarily relies on the European Commission’s standard clauses to ensure the protection of your personal data for such data transfers, but as set out above, countries where the foreign merchant is located may have laws preventing the efficient protection by the standard clauses. Even if this is the case, your personal data will still be transferred to the foreign merchant (or the foreign merchant’s local FTL entity), as long as the data transfer is necessary to administer your specific purchase.

9. How long we store your personal data

How long FTL stores your personal data depends on the purposes for which FTL uses the personal data:

• Personal data used for the contractual relationship between you and FTL is generally stored for the duration of the contractual relationship and thereafter for a maximum of 10 years based on statutes of limitations.
• Personal data that FTL is under a legal obligation to retain, for example under bookkeeping laws, is generally retained for 7 years but may be extended for a period not exceeding 10 years.
• We process the recordings of telephone conversations for a time period of 90 days for quality assurance purposes. We will also retain recordings of inbound and outbound calls for up to three years, as well as FTL employees’ notations from these calls for up to six years, in order to document what has been discussed and decided on the call.
• Personal data which is not used for the purposes of your contractual relationship with FTL or where FTL does not have a legal obligation to retain the data is only retained as long as necessary to fulfill the respective purpose for our data processing (usually 3 months). More information can be found in the table in section 4.

The legal obligations referred to above means that FTL can not delete your personal data, even if you request us to delete it, as described in section 2. If we don’t have a legal obligation to retain the personal data, we instead have to make an assessment if we may require the personal data in order to protect FTL from legal claims.

Please note that just because we have a legal obligation to store your personal data, this does not mean that we are also permitted to use this data for any other purpose. FTL will make an assessment for each specific purpose of how long we may use your personal data. You can read more about this in section 4.

10. How we use cookies and other types of tracking technology

To provide a tailored and smooth experience, FTL uses cookies and similar tracking technologies in our multiple interfaces, such as our website and at the checkout of a merchant that uses the FTL platform. You can find information about the tracking technology that FTL uses, and information about how you accept or decline the tracking technology, in each interface.

11. Updates to this Privacy Notice

We are constantly working to improve our services so that you have a smooth user experience. This may involve modifications of existing and future services. If that improvement requires a notice or consent in accordance with applicable law, you will be notified or given the opportunity to give your consent. It is also important that you read this privacy notice every time you use any of our services, as the processing of your personal data may differ from your previous use of the service in question.

12. FTL contact information

FTL’s registered office is at 124 City Road, London, EC1V 2NX, England, United Kingdom.

For any queries or concerns with this privacy policy or regarding activities on the FTL platform, you can reach out to us at legal@joinfam.com. 

Please visit www.joinfam.com for more information about FTL.