Klarna Privacy Policy
It is important to us that you feel secure when paying with Klarna or using any of our other services. With this Privacy Policy, we therefore wish to provide you with all information on how we use your personal data.
1. Who is responsible for your personal data?
Klarna Bank AB (publ), registered with the Swedish companies register with no. 556737-0431, with its registered office at Sveavägen 46, 111 34 Stockholm, also operating through its subsidiaries and through Klarna Technologies AB (556566-7796) for Klarna’s telecom offerings ("Klarna", "we", "our" or "us"), is the data controller for your personal data in accordance with the EU General Data Protection Regulation ("GDPR"). If you have any questions about the processing of your personal data, please contact our data protection team by writing to protezionedati@klarna.it.
2. Your rights as a data subject regarding personal data protection
Under the GDPR, you have several rights related to having control over your personal data and receiving information directly from us about how we process your personal data. You can read about your rights below. If you wish to receive information about the data Klarna holds on you through a so-called data subject access request, have certain data deleted, or contact us to exercise your other rights, the easiest way is to log in to your Klarna account and submit your request from there. You can also find our contact details in section 12 for other questions.
Your rights
-
Right to erasure of personal data (“Right to be forgotten”).
In some cases, you have the right to have us erase your personal data. For example, you can ask us to erase personal data that we (i) no longer need for the purpose for which they were collected or (ii) that we process based on your consent, and you withdraw it. There are situations where Klarna is unable to erase your data, for example when it is still necessary to process the data for the purpose for which it was collected, Klarna's interest in processing the data outweighs your interest in having them erased, or because we have a legal obligation to retain it. You can read more about our legal data retention obligations in paragraphs 4 and 9 of this Privacy Policy. The laws described therein prevent us from immediately erasing some data. You also have the right to object to our use of your personal data for certain purposes such as direct marketing, which you can read more about in this list of your rights.
-
Right to be informed.
You have the right to be informed about how we process your personal data. This is done through this privacy policy, through service-specific FAQs, and by answering your questions.
-
Right to access your personal data (“Data subject access”).
You have the right to know whether Klarna processes your personal data and to receive a copy ("data extract") of such data, referred to as "data subject access". Through the data extract, you will receive information about the personal data Klarna holds about you and how we process it.
-
Right to access and to request transfer of your personal data to another recipient ("Data portability")
Under this right, you can request a copy of the personal data about you held by Klarna for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use such data elsewhere, for example, to transfer your personal data to another controller/recipient.
-
Right to rectification.
You have the right to request us to rectify inaccurate information or complete information about you that you believe is inaccurate or incomplete.
-
Right to restriction of processing.
If you believe the data is inaccurate, that our processing is unlawful, or that we do not need the information for a specific purpose, you can request a restriction on the processing of such personal data. You also have the option to request the suspension of processing of your personal data pending the evaluation of your request. If you object to our processing under your right described directly below, you can also ask us to restrict the processing of that personal data pending our evaluation.
-
Right to object to the processing of your personal data.
You have the right to object to the processing of your personal data carried out by us based on our legitimate interest (Art. 6(1)(f) GDPR), with reference to your personal circumstances. Furthermore, you can always object to our use of your personal data for direct marketing purposes. When you inform us that you no longer wish to receive direct marketing communications, we will disable the sending of marketing to you.
-
Right to object to an automated decision that significantly impacts you.
You have the right to object to an automated decision taken by Klarna if such a decision produces legal effects or similarly significantly impacts you. Please refer to paragraph 6 for how Klarna uses automated decisions.
-
Right to withdraw your consent.
As described in paragraph 5 below, when we process your personal data based on your consent, or explicit consent, you have the right to withdraw such consent at any time. When you withdraw your consent, we will cease processing your data for such purposes.
-
Right regarding the fate of personal data after death.
You have the right to provide (or designate the person authorized to do so) instructions regarding the storage, deletion, and communication of your personal data after your death.
-
Right to lodge a complaint.
If you have a complaint regarding Klarna's processing of your personal data, you have the right to lodge a complaint with the Integritetsskyddsmyndigheten, the Swedish supervisory authority competent for personal data processing carried out by Klarna. You can contact the Integritetsskyddsmyndigheten at the following link. You can also lodge a complaint with your national data protection authority, which you can find here.
3. What types of personal data do we collect?
This paragraph describes the types of personal data we collect or create. In paragraph 4, we will explain for what purposes we use these types of personal data.
-
Contact and identification data - Name, date of birth, place of birth, social security number, title, occupation, gender, billing and delivery address, email address, mobile phone number, Klarna-generated identifiers, nationality, age, audio recordings, photos, and video recordings concerning you and your ID card, electronic ID, qualified electronic signatures, etc.
-
Information about goods/services - Details relating to the goods/services you have purchased or ordered (or plan to purchase or order), such as the item type or delivery tracking number. If you choose to make payments via pagoPA, Klarna will collect information provided by you, including invoice details and, if you choose to pay your car tax through this feature, vehicle data and license plate number.
-
Information about your financial situation - Information related to, for example, your income, any credits, negative payment history, and previous credit approvals.
-
Payment information - Credit and debit card details (card number, expiry date, and CVV code), bank account number, bank name, bank account holder's name, bank account login details.
-
Information about your use of Klarna's services - Which services and their features you have used and how you have used them. This includes information about outstanding debt and history, your payment and refund history, participation in surveys, as well as your personal preferences or searches performed, including derived interests and loyalty points.
-
Technical information generated by your use of Klarna's services - Technical data such as web page response time, logs of how you navigate our services, download errors, and the date and time you used the service.
-
Information about your contact with Klarna's customer service - Recorded and/or transcribed phone calls, chat conversations, and email correspondence.
-
Your contact with stores where you shop or visit - Information about how you interact with stores, e.g., if you have received goods and the type of store where you shop.
-
Device information - Device ID, IP address, Mobile Advertising ID (MAID), language settings, browser settings, time zone, operating system, platform, screen resolution, and similar information about your device and device settings/usage.
-
Information from external sanction lists and PEP lists - Sanction lists and lists of politically exposed persons ("PEP") include information such as name, date of birth, place of birth, occupation or position, and the reason why the person appears on the list in question.
-
Sensitive personal data - Sensitive personal data are data revealing religious beliefs, political or philosophical opinions, trade union membership, or constitute information about health, sexual life, or sexual orientation, as well as biometric data.
-
Service-specific personal data - Within our services according to Klarna's terms of use, Klarna's savings and payment accounts, Auto-Track, and Financial Details, we use additional personal data that do not fall into the types listed above. Information regarding each service is listed below:
-
Services under Klarna's terms of use: All content you upload or submit (such as requests or searches, photos, receipts, product or store reviews, profile picture, or other uploaded information), location information, and websites you visit through the application browser or with the installed extension. Klarna also displays product reviews from third-party review sites.
-
Klarna savings and payment accounts: Information about your transactions and deposits and information about the origin or use of your money. For this service, Klarna also processes third-party data (such as beneficiaries or payers);
-
Auto-track: Information from the linked email account regarding your purchases/orders, deliveries, and promotions or marketing received (such as order number, product, price, purchase date, quantity, seller, payment method used, promotional codes, delivery tracking numbers, carrier, delivery status, shipping address, type of marketing activity, and marketing offers).
-
Financial Details: Information from your other bank accounts and other types of accounts (such as card accounts) that you choose to link to the service, as well as information such as account number, bank, transaction history of your linked accounts, and balances and activities;
-
Loyalty Cards Feature: Information from a membership account or a loyalty card added by third parties, such as points, membership information and credentials, status, levels, and balance history;
-
Open Banking Service: Information from your third-party bank account, such as basic account information (account holder, bank account number, account login details), and information about your transactions, account balance, and overdraft limit; and
-
Contact List: If you choose to upload your contact list, we will collect phone numbers and email addresses in your contact list. Depending on your device settings, the Klarna App will periodically collect such data to ensure it is kept up to date. By providing us with information about your contacts, you confirm that you have permission to share this information with Klarna for the purposes described in this privacy notice.
-
Travel eSIM Data: Information related to your Klarna Travel eSIM, including plan selection, data consumption, and payment history. Neither Klarna nor Gigs Wireless LLC (or the Gigs affiliated company you contracted with) have access to the content of your internet browsing data.
Social Media Event Registration: Information about your profile from your social media accounts and commercial information such as your employer's name, address and company type.
-
Detailed information about the personal data relevant for each service can also be found in the terms and conditions listed here.
4. What personal data is used for which purposes and on what legal basis?
In the tables below, you can find information:
-
on the purpose for which we will use your personal data (the purpose),
-
on what types of personal data we use for the respective purpose, and whether the personal data comes directly from you or from other sources. If we receive personal data about you from other sources, we will indicate the source in parentheses,
-
on what our rights are under current data protection legislation, including the GDPR, to process data about you, indicated as our “legal basis”, and
-
on when Klarna stops using personal data for each of the purposes.
4.1 Purposes for which your personal data is always used by Klarna, regardless of the service used.
|
Purpose of processing - what we do and why. |
Type of personal data used for the relevant purpose and source from which it originates. See paragraph 3 for more information on the different types of personal data. |
Legal basis for processing under the GDPR. |
When the purpose of using personal data ends. See paragraph 9 for when Klarna deletes the data. |
|
[1] To manage our relationship with you in accordance with our agreements, for each service used. This includes creating and sending information to you electronically (not for marketing purposes). |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Where the service involves information that constitutes sensitive personal data (e.g., from materials you have chosen to upload), our processing is based on your explicit consent (Art. 9(2)(a) GDPR). |
When the contract between you and Klarna ends or when you withdraw your consent. |
|
[2] To conduct customer satisfaction surveys, market research, and request reviews from you, via email, text messages, phone, or other communication channels. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in carrying out the processing of personal data, that the processing is necessary for the achievement of this purpose, and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. See paragraph 12 for our contact details.
When we send you an email, such sending will be based on your consent. |
When the contract between you and Klarna ends. |
|
[3] To ensure network and information security in Klarna's services. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in being able to ensure network and information security, that the processing is necessary for the achievement of this purpose, and that our interest outweighs your right to prevent the processing of your data for this purpose. Ensuring a good level of information security is also in your interest as a customer.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. See paragraph 12 for our contact details. |
This processing lasts for as long as you use a service. |
|
[4] To be able to help you as vulnerable customers (i.e., if you need additional support when you contact us due to particular circumstances). This means we can offer you special support, e.g., when you contact customer service. |
From you:
From other sources:
|
Based on your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). |
When you tell us you are no longer vulnerable customers or withdraw your consent. We also stop this processing if and when you tell us you no longer wish to be a Klarna customer. |
|
[5] To manage any requests for financial hardship you submit, where we can offer you special support, such as a payment deferral. |
From you:
|
Processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Where your request includes information that constitutes sensitive personal data (e.g., contained in materials you choose to upload in support of the request), processing is based on your explicit consent (Art. 9(2)(a) GDPR). |
When the contract between you and Klarna ends or when you withdraw your consent. |
|
[6] To be able to perform risk analysis, fraud prevention, and risk management.
We carry out processing to confirm your identity and the accuracy of the data you provide, as well as to combat abusive activities.
This processing constitutes profiling and automated decision-making. For this purpose, we use an automated decision-making process, which allows us to determine if you constitute a fraud risk. See paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
Processing is necessary for Klarna to enter into and perform a contract with you (Art. 6(1)(b) GDPR).
Sensitive personal data is processed based on your explicit consent (Article 9, paragraph 2, letter a) of the GDPR), to the extent that this is explained to you at the time of collecting such data.
However, for our financial services, we are also legally obliged to establish the identity of our customers (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing) |
This processing will occur while you use any Klarna service or until you withdraw your consent.
However, if Klarna has identified a potential risk in how you use Klarna, we will continue to use your information for this purpose and will continue to update our risk assessment where there is a risk of fraud. This processing lasts until we are legally required to retain your information. See paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[7] To anonymize your personal data in order to improve our products and services and analyze customer behavior. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in anonymizing your personal data for product development purposes and to analyze customer behavior in order to improve service and customer experience. We assure you that the particular processing this entails is necessary for the achievement of the purpose in question, and that our interest outweighs your right to prevent the processing of your data for this purpose. By anonymizing information about you, we also ensure that we use personal data to the least extent possible.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. See paragraph 12 for our contact details. |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. See paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[8] To perform data analysis for product development and testing in order to improve our risk, fraud, and credit models and to design and improve our services (if possible, we first anonymize the data, which means that no personal data processing is subsequently performed). |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in performing data analysis for product development and testing purposes. We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. Furthermore, our customers benefit from the processing, as it helps us to provide error-free and sustainable services.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. See paragraph 12 for our contact details. |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. See paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[9] To perform data analysis to measure and improve our marketing and advertising channels (where possible, we anonymize the data first, which means that no personal data processing is subsequently carried out). |
From you:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in performing data analysis for product development and testing purposes. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to legally retain information. |
|
[10] To calculate payment fees to providers (where possible, data is anonymized first; therefore, no personal data processing occurs after anonymization). |
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in calculating potential fees. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts up to 90 days after using a service. |
|
[11] To produce statistics and reports for economic analysis or analysis of payment trends or payment volumes in certain regions or industries (where possible, we anonymize the data first, which means that no personal data processing occurs afterwards). |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in obtaining statistical data and reports for this purpose. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to legally retain information. |
|
[12] To control and verify your identity. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Sensitive personal data is processed based on your explicit consent (Article 9(2)(a) GDPR), to the extent explained to you at the time of collecting such data. |
For as long as you use one of Klarna's services. |
|
[13] To share your personal data with the categories of recipients described in paragraph 7.1 (suppliers and sub-suppliers, Klarna group companies, parties with authority over your financial transactions, authorities and credit purchasers, companies or assets). |
|
Varies depending on the recipient (see paragraph 7.1). |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to legally retain information. |
|
[14] To decide which type of marketing or marketing surveys we will provide to you.
If you do not wish for this processing of your data to take place, please contact us. We will then stop using your data for marketing. Our contact details are available in paragraph 12.
The processing may constitute profiling. Please refer to paragraph 6 for more information on profiling. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in identifying the type of marketing we should provide to you. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose. We have also considered the fact that marketing is indicated as an example of legitimate interest in the GDPR.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ends or if you inform us that you are not interested in such processing. |
|
[15] To provide you with marketing material, offers and marketing surveys about other products and services we offer that are similar to those you have already used and are part of Klarna's general offering to consumers.
If you do not wish to receive marketing communications, please contact us to let us know. We will then stop using your data to send marketing communications. Please refer to paragraph 12 for our contact details. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in sending marketing about our services and offers. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose. We have also considered the fact that marketing is indicated as an example of legitimate interest in the GDPR.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ends or if you inform us that you are not interested in such processing. |
|
[16] To provide you with direct marketing and marketing surveys about offers, products or services from Klarna and our stores/partners. |
From you:
From other sources:
|
The processing is based on your consent (Art. 6(1)(a) GDPR). |
When you inform us that you intend to withdraw your consent or are no longer interested in such processing/reject it. |
|
[17] To protect Klarna from legal claims and to safeguard Klarna's legal rights. |
In the event of a dispute, Klarna may also collect other types of personal data about you if necessary to exercise our rights. |
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in being able to defend itself against legal claims. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details.
Sensitive personal data, if necessary to establish, exercise or defend legal claims, is processed on the basis of Article 9(2)(f) GDPR. |
This processing lasts for the entire period that Klarna is required to retain information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to legally retain information. |
4.2 Purposes for which your personal data is used when you use one of Klarna's payment methods, log in to Klarna in a store, or choose to pay by debit or credit card at Klarna's checkout in a store.
|
Purpose of processing - what we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis for processing according to the GDPR |
When the purpose of using personal data expires. See paragraph 9 for when Klarna deletes the data. |
|
[18] Not applicable in this country. |
|
|
|
|
[18] To share your personal data with the categories of recipients described in paragraph 7.2 (stores, payment service providers, cash service providers, card networks and financial institutions, fraud prevention agencies and companies providing identity information, and Google). |
From you:
From other sources:
|
Varies depending on the recipient (see paragraph 7.2). |
Mainly when the purchase occurs, but also for the entire period that Klarna has the data in its systems, i.e., until the data is deleted. Please refer to paragraph 9 for more information on our obligations and the right to legally retain information. |
|
[20] When you shop at a store that offers Klarna as a payment method or has Klarna's checkout, we will evaluate the order in which different payment methods should be presented at the store's checkout.
This processing constitutes profiling. Please refer to paragraph 6 for more information on profiling. |
From you:
From other sources:
|
If you have accepted Klarna's terms of use, as further described in the terms and conditions you can find here, the legal basis for processing is the performance of the contract (Art. 6(1)(b) GDPR).
Alternatively, if you have not accepted Klarna's terms of use, the processing will instead be based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in examining the order in which different payment options will be presented to you at the store's checkout. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest overrides your right to prevent the processing of your data for this purpose.
You may contact us for further information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When payment methods are shown at checkout. |
|
[21] To prevent Klarna's operations from being used for money laundering or terrorist financing, we will verify your identity, monitor and review transactions. Klarna also conducts ongoing risk assessments and creates risk models to combat money laundering and terrorist financing.
This processing constitutes profiling and automated decision-making. Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
For the fulfillment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
With regard to sensitive personal data, the basis is the necessity of processing for reasons of substantial public interest (Art. 9(2)(g) GDPR).
|
When the agreement between you and Klarna ceases or when you withdraw your consent. Please refer to paragraph 9 for more information on our obligations and the right to retain information as required by law. |
|
[22] To perform a fraud prevention assessment before accepting a purchase.
This processing constitutes profiling and automated decision-making. For this purpose, we use automated decision-making, which allows us to determine if you constitute a fraud risk. Please refer to paragraph 6 for more information on profiling and automated decisions.
Please also refer to paragraph 7.2.3 regarding our use of risk detection agencies with whom your information may be shared, and regarding our legal basis for such sharing. Should we identify potentially fraudulent transactions, we will report them to fraud prevention agencies pursuant to paragraph 7.2.3. |
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies, cash service providers, and payment service providers to ascertain whether your data indicates an attempt at fraud. |
For the conclusion and performance of the contract (Art. 6(1)(b) GDPR).
Sensitive personal data is processed on the basis of your explicit consent (Art. 9(2)(a) GDPR). |
When the fraud assessment is performed or when you withdraw your consent. |
|
[23] For bookkeeping and record-keeping as required by accounting regulations and to retain it in accordance with applicable law. |
From you:
From other sources:
|
For the fulfillment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Accounting Act (1999:1078)). |
For the period during which the accounting is recorded and 7 years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[24] To perform calculations in accordance with capital adequacy regulations. |
From you:
From other sources:
|
For the fulfillment of a legal obligation (Art. 6(1)(c) GDPR) (Capital Requirements Regulation 575/2013 and Capital Requirements Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
4.3 Purposes for which your personal data is used when you use one of Klarna's credit-providing payment methods or when you use the Klarna card, pay with Instore, pay with Klarna via digital wallets, or the Shopping Service with a disposable card.
The following services provide credit to you: "Pay later" (invoice), "Pay now" (for payment by direct debit), "Financing" (instalment payment), as well as the Klarna card and the Shopping Service with a disposable card.
|
Purpose of processing - what we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
Time when the purpose of personal data use expires. See paragraph 9 for when Klarna deletes data |
|
[25] To perform a credit assessment before granting credit.
This constitutes profiling and the decision to approve or deny credit constitutes an "automated decision". Please refer to paragraph 6 for more information on profiling and automated decisions.
Please also refer to paragraph 7.3.1 regarding our use of credit information agencies with whom your information may be shared, and regarding our legal basis for such sharing. |
From you:
From other sources:
|
For the conclusion and performance of the credit agreement (Art. 6(1)(b) GDPR). |
When the credit assessment is performed. |
|
[26] To determine the most efficient way to contact you regarding your outstanding debt. This is without prejudice to communications required by law under consumer credit regulations. This processing constitutes profiling. Please refer to paragraph 6 for more information on profiling. |
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest (with you) in ensuring that you are efficiently contacted regarding your outstanding debt. We ensure that the processing is necessary for the achievement of this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
Until you have an outstanding debt to Klarna. |
|
[27] To share your personal data with the types of recipients described in paragraph 7.3 (credit bureaus, debt collection agencies, and other buyers of outstanding debts, as well as VISA, credit buyers, and digital wallet providers). |
From you:
From other sources:
|
Varies depending on the recipient (see paragraph 7.3). |
Mainly when the purchase occurs, but also for as long as Klarna retains the data in its systems, i.e., until they are deleted. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[28] To transfer Klarna's credit right related to your purchase to a new owner. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in the assignment of outstanding debts as part of its business operations. We assure you that the processing is necessary for the pursuit of this interest and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
Processing may be carried out until the debt is paid (you will be notified of any assignment of the debt). |
|
[29] To perform debt collection services, i.e., to collect and assign overdue debts. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in the collection and assignment of debts. We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the debt has been paid. |
|
[30] To prevent Klarna's operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments, and creating risk models.
This processing constitutes profiling, and the decision that you pose a money laundering risk constitutes an "automated decision". Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
For the fulfillment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
With regard to sensitive personal data, the condition is that the processing is necessary for reasons of substantial public interest (Art. 9(2)(g) GDPR). |
Up to five years from the termination of the agreement or the end of the client relationship (up to ten years in cases where law enforcement authorities request it). Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[31] Archiving and accounting according to accounting regulations. |
From you:
From other sources:
|
To comply with a legal obligation (Art. 6(1)(c) GDPR) (The Swedish Accounting Act (1999:1078)). |
Seven years after the end of the financial year in which the information was recorded. See section 9 for more information about our obligations and right to retain information by law. |
4.4 Use of your (and third parties') personal data for accessing Klarna account services (Klarna balance, savings and payment accounts)
|
Purpose of the processing - what we do and why |
Types of personal data used for the relevant purpose and from which source they originate. See section 3 for more information about the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data ceases (See section 9 for when Klarna deletes the data) |
|
[32] Not applicable in the market. |
|
|
|
|
[33] To provide Klarna's savings and payment accounts, including showing your information to other Klarna Account customers when they make a payment to you or you make a payment to them. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Information about third parties (such as the payment recipient or payer) is based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has considered that we and you (and also the payment recipient/payer) have a legitimate interest in processing such data for the execution of the transactions in question. We assure you that the processing involved is necessary for the fulfillment of the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination. See section 12 for our contact details. |
When the contract between you and Klarna ceases. |
|
[34] To share your personal data with the categories of recipients indicated in section 7.4 (credit institutions and other financial institutions). |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR). The terms of service are available here. |
When the contract between you and Klarna ceases. |
|
[35] To prevent Klarna's operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments and creating risk models.
This processing constitutes profiling, and the decision that you are exposed to a money laundering risk constitutes an "automated decision". See section 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
To comply with a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
Regarding sensitive personal data, the condition is that the processing is necessary for reasons of public interest (Art. 9(2)(g) GDPR). |
Up to five years after the termination of the agreement or the end of the customer relationship (up to ten years in cases where law enforcement authorities request it). See section 9 for more information about our obligations and right to retain information by law. |
|
[36] Archiving and accounting in accordance with accounting legislation. |
From you:
From other sources:
|
To comply with a legal obligation (Art. 6(1)(c) GDPR) (The Swedish Accounting Act (1999:1078)). |
Seven years after the end of the financial year in which the information was first recorded. See section 9 for more information about our obligations and right to retain information by law. |
|
[37] To perform calculations in accordance with capital adequacy regulations. |
From you:
From other sources:
|
Compliance with the law (Art. 6(1)(c) GDPR) (Capital Requirements Regulation 575/2013, and Capital Requirements Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. See section 9 for more information about our obligations and right to retain information by law. |
|
[38] To enable you to import contacts from your address book in order to populate the contact list with Klarna Account holders to whom you can send instant transfers from your Klarna Account. You can stop this service at any time, thereby revoking Klarna's access to your address book. |
From you:
|
Uploading from your address book is based on your consent (pursuant to Art. 6(1)(a) GDPR) (to access contacts stored on your phone). Information relating to third parties (i.e. non-Klarna customers in your address book) is processed based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has considered that we and you have a legitimate interest in processing such data to identify Klarna customer contacts, in order to assist Klarna customers in carrying out the transactions in question. We assure you that the processing involved is necessary to pursue this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. See section 12 for our contact details. |
When the contract between you and Klarna ends, or when you revoke your consent by changing your device settings. |
4.5 Use of personal data for the services provided in the Klarna User Terms, Klarna Subscription Terms and/or Referral Program Terms.
For the services described in Klarna's terms of use and/or Klarna Subscription Terms, Klarna will process your personal data for the purposes described in the table below. Klarna's terms of use are available here. You can find more information about the features on our website or in our app.
|
Purpose of the processing - what we do and why |
Types of personal data used for the relevant purpose and from which source they originate. See section 3 for more information about the different types of personal data. |
Legal basis according to GDPR. |
When the purpose of the use of personal data ceases. See section 9 for when Klarna deletes the data. |
|
[39] To provide the services provided for in Klarna's terms of use and related features, as well as to determine your eligibility for certain services.
|
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna terms of use) with you (Article 6(1)(b) of the GDPR).
If we process data that constitutes sensitive personal data (if you have uploaded this data or otherwise provided us with access to such data or asked us to share it), your processing takes place on the basis of your explicit consent (Article 9(2)(a) of the GDPR). See section 3 for more information about this type of personal data. |
When the contract between you and Klarna ceases or when you revoke your consent. |
|
[40] You can choose to share your location information with us. We use this information to find stores and offers near you.
|
From you:
|
The processing is necessary for Klarna to perform a contract (Klarna terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between you and Klarna ceases. |
|
[41] To provide you with a browser through which to visit, for example, merchant websites. Klarna will collect information about how you use the browser in order to personalize the content of Klarna's services. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes information that constitutes sensitive personal data (e.g., from the pages you visit), your processing will take place on the basis of your explicit consent (Art. 9(2)(a) GDPR). However, such sensitive information will not be used for any other purpose than to display the current website in the browser. |
When the contract between you and Klarna ceases. |
|
[42] To perform fraud prevention assessments when using the services provided in Klarna's terms of use.
See also section 7.5.6 on our use of fraud prevention agencies, with whom your information may be shared, and our legal basis for such sharing. |
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies as to whether the user's information indicates an attempted fraud. |
The processing is necessary for Klarna to perform a contract (Klarna terms of use) with you (Article 6(1)(b) of the GDPR). |
Upon execution of the fraud assessment. |
|
[43] To share your personal data with the categories of recipients indicated in paragraph 7.5 (affiliate networks, Google, partners within the Financial Details service and the offers and benefits program, logistics and transport companies, advertising services, third-party apps and services (for SIWK), risk detection agencies and companies providing identity verification services and resale platforms). |
From you:
From other sources:
|
Varies depending on the recipient (see paragraph 7.5). |
When the contract between you and Klarna ceases. |
|
[44] To provide you with more relevant advertising, we share personal data, including audience segments created by Klarna, with advertising partners. This includes advertising Klarna products and services on third-party websites and apps, as well as third-party advertising shown within the Klarna website and app; audience segments created by Klarna may also be used within third-party advertising platforms to display ads on third-party websites and apps. We also evaluate the relevance of such advertisements. This is based on your user behavior and your Klarna profile.
|
From you:
From other sources:
|
This is based on your consent (pursuant to Article 6(1)(a) of the GDPR). |
When you inform us that you wish to withdraw your consent or from you: Contact and identification data.
We will also cease such processing if and when you inform us that you no longer wish to be a Klarna customer. |
|
[45] If you choose to access Klarna (through "SIWK") via a third-party app or service, Klarna will share your personal data with the store or online service. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR). |
When the contract between you and Klarna ceases. We will also cease such processing if and when you inform us that you no longer wish to be a Klarna customer. |
|
[46] To automatically manage purchase disputes or complaints related to goods.
This processing constitutes automated decision-making. For this purpose, we use an automated decision-making process, which allows disputes or complaints to be resolved in a timely and consistent manner. Please refer to paragraph 6 for more information on automated decisions. |
From you:
From other sources:
Information about your contacts with Klarna customer service. (Klarna) |
If you have accepted Klarna's terms of use, as described in more detail in the service terms and conditions, available here, the legal basis for processing is the performance of the contract (Article 6(1)(b) GDPR). Alternatively, if you have not entered into the Klarna terms of use agreement or have not made the disputed purchase, the processing will be based on your consent (Article 6(1)(a) of the GDPR). |
When the dispute has been handled, or alternatively, when the processing is based on consent and you inform us that you wish to withdraw your consent. |
|
[47] To present you with relevant content, answers to queries, and product recommendations when you use our AI-powered assistants. These assistants base their recommendations on information we have about you, along with preferences or questions you have provided to us.
This processing constitutes profiling. Please refer to paragraph 6 for more information on profiling.
|
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between you and Klarna ceases. |
|
[48] In the event that you have linked your email account to Klarna's Auto-Track service, Klarna will regularly connect to your email account(s) to obtain information about your purchases.
You can stop this service at any time and thus remove Klarna's access to your email account. |
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes sensitive personal data (from your transactions), your processing will be based on your explicit consent (Art. 9(2)(a) GDPR). Please refer to paragraph 3 for further descriptive information. |
When the contract between you and Klarna ceases or when you withdraw your consent. |
|
[49] If you have chosen to link your bank accounts to the Financial Details service, Klarna will show you and give you the tools to control your finances, through offers tailored to your specific needs.
This processing constitutes profiling, the purpose of which is to personalize the content of the service based on what we think might interest you. You can read more about profiling in paragraph 6.
If you choose to take advantage of offers and benefits that Klarna provides within this service, we will share your personal data with the partner providing them (see paragraph 7.5.3). |
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes sensitive personal data (from your operations), your processing will be based on your explicit consent (Art. 9(2)(a) GDPR). Please refer to paragraph 3 for more information. |
When the contract between you and Klarna ceases or when you withdraw your consent. |
|
[50] If you use our browser extension, Klarna processes your data to provide the service, which includes processing information about the websites/web domains you visit:
Klarna processes information about the e-commerce websites/web domains you visit to identify offers, provide cashback, and offer personalized deals in the Klarna extension and mobile application. This processing is also carried out to allow you to create Disposable Cards directly in your browser on websites where this service is enabled.
Information about non-e-commerce websites/web domains visited is not stored by Klarna.
More information on how your personal data is used can be found in the extension's FAQ. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes information that constitutes sensitive personal data (i.e., data related to the websites/web domains you visit), our processing will be based on your explicit consent (Art. 9(2)(a) GDPR). Please refer to paragraph 3 for more information. |
When the contract between you and Klarna ceases or when you withdraw your consent. |
|
[51] If you have added a third-party membership or loyalty card account to Klarna's Loyalty Cards Feature, Klarna will process your data to provide the service.
This includes Klarna regularly connecting to the third-party card account to import membership points, tiers, and balance history.
You can stop this service at any time, thereby revoking Klarna's access to your membership or loyalty card account. |
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between you and Klarna ceases. |
|
[52] If you have chosen to connect to Klarna's "accept all cookies" service, Klarna will process your data to provide the service. You can stop this service at any time. |
From you:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between the user and Klarna ends. |
|
[53] If you have chosen to use Klarna's Open Banking service, Klarna will process your data to provide the service. The terms of the Open Banking service and the description of the included features are available here]. |
From your side:
From other sources:
|
The processing is necessary for Klarna to perform a contract (terms and conditions for the Open Banking service) with you (Article 6(1)(b) of the GDPR).
If the service processes sensitive personal data (from your transactions), the processing will be based on your explicit consent (Article 9(2)(a) of the GDPR). For more information on this type of personal data, please refer to section 3]. |
When the contract between the user and Klarna ceases to exist. |
|
[54] Displaying product reviews from third-party review sites. |
From other sources:
|
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in being able to process personal data, that such processing is necessary to achieve the intended purpose, and that our interest overrides your right not to have your data processed for this purpose.
|
Until you, as the data subject, request the deletion of your reviews or they are deleted from the third-party review site. |
|
[55] Provide you with subscription benefits if you are a subscriber to the Klarna Membership. This involves sharing your personal data with our partners. This list may change from time to time. See section 7.5.9 for information related to this data sharing. |
From you:
|
The processing is necessary for Klarna to perform a contract (Terms of Use) with you (Article 6(1)(b) GDPR). |
When your subscription is terminated. |
|
[56] Not applicable in the market. |
|
|
|
|
[57] If you participate in the Klarna Referral Program as an invited Consumer, we will share your data with the Referrer. |
From you:
|
The processing is necessary for Klarna to perform a contract (Terms of Use and Referral Program Terms) with you (Art. 6(1)(b) GDPR). |
When the contract between you and Klarna ceases.
|
|
[58] If you participate in the Klarna Referral Program as a referrer, we will share your data with the invited consumer. |
From you:
|
Processing is necessary for Klarna to perform a contract (User Terms and Referral Program Terms) with you (Art. 6(1)(b) GDPR). |
When the contract between you and Klarna ceases.
|
4.6 Offers, event invitations and participation in prize draws communicated via social media, other Klarna channels, or when you contact us via social media or other digital channels.
|
Purpose of the processing - What we do and why. |
Types of personal data used for the relevant purpose and source. See Section 3 for more information about the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data expires. See Section 9 for when Klarna deletes the data. |
|
[59] If you register for an event published on social media, we will process your personal data to provide the requested service.
You can always unsubscribe by contacting us. Please refer to Section 12 for contact details. |
From you:
|
Processing is necessary for Klarna to perform a contract with you (regarding event participation) (Art. 6(1)(b) GDPR).
You can contact us for more information on how we reached this determination. Please refer to Section 12 for our contact details. |
When the event was held |
|
[60] If you choose to participate in a prize draw organised by Klarna and/or its co-organisers and sponsors, we will process your personal data in order to manage the prize draw, including winner selection and prize delivery. |
From you:
|
Processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR). |
We will stop processing your personal data for this purpose once the prize draw you participated in has concluded. |
4.7 Processing carried out by Klarna when you contact Klarna customer service.
|
Purpose of the processing - What we do and why |
Types of personal data used for the relevant purpose and source. See Section 3 for more information about the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data expires. See Section 9 for when Klarna deletes the data. |
|
[61] To handle all matters submitted to Klarna's customer service. This includes retaining various forms of written conversations to document issues encountered by customers, as well as for security and fraud prevention purposes. |
From you:
From other sources:
|
Performance of contracts (Art. 6(1)(b) GDPR). |
Up to ten years, based on limitation periods. Please refer to Section 9 for more information on our obligations and right to retain information by law. |
|
[62] To help you resolve issues related to your purchase when using the customer service assistant.
This processing constitutes profiling. Please refer to Section 6 for more information on profiling. |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) GDPR).
If the service processes information that constitutes sensitive personal data (e.g., from materials you choose to upload), our processing is based on your explicit consent (Article 9(2)(a) GDPR).
|
When the contract between you and Klarna ceases. |
|
[63] Quality and service improvement (to ensure satisfactory customer service). We may record phone conversations and screen-sharing sessions between you and our employees for quality control purposes, to provide you with better products and services. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in improving its services, internal training, and quality control. We assure you that the particular processing involved is necessary for achieving this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. As customers, you also have an interest in the quality of your interactions with Klarna.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. Please see contact details in Section 12. |
We process recordings of phone conversations for up to 90 days for quality assurance purposes, and recorded screen-sharing sessions for up to 30 days for quality assurance purposes. |
|
[64] To document what was said when speaking with our customer service (to ensure we have documented what was agreed upon or discussed). We use recorded phone conversations between you and our employees, and manual and automatic annotations to document what was said. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in improving its services, internal training, and quality control, and in documenting communications with Klarna customer service. We assure you that the particular processing involved is necessary for achieving this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. As customers, you also have an interest in ensuring impartial means of documenting what was discussed.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. Please see contact details in Section 12.
If there is information that constitutes sensitive personal data, our processing is based on your explicit consent (Article 9(2)(a) GDPR). |
90 days from the day the recording was made. |
|
[65] If you contact us via social media such as Facebook, Instagram, or Twitter, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The above also applies to the response you receive from us. Klarna processes this information to answer your questions. |
From you:
From other sources:
|
Performance of contracts (Art. 6(1)(b) GDPR). |
Once we have answered your question. |
|
[66] To manage voluntary blocks for using Klarna services, for example, if you contact us and ask us to prevent you from using our services. The voluntary block can be revoked at any time by contacting us again. |
From you:
|
Based on your consent (Art. 6(1)(a) GDPR). |
When you inform us that you no longer wish your use of our services to be blocked or you withdraw your consent. We also stop processing if and when you inform us that you no longer wish to be a Klarna customer. |
4.8 Processing carried out by Klarna when using Klarna Mobile.
For the activities described in the Klarna Travel eSIM Terms, Klarna will process your personal data for the purposes described in the table below. The Klarna Travel eSIM Terms are available on this page.
|
Purpose of the processing - What we do and why |
Types of personal data used for the relevant purpose and source. See Section 3 for more information about the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data expires. See Section 9 for when Klarna deletes the data. |
|
[67] To provide the Klarna Travel eSIM (as an agent for Gigs Wireless LLC or the Gigs affiliate with which it has contracted), including managing its plan, data consumption, and billing. |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) GDPR). |
When the contract between you and Klarna ceases. |
|
[68] To share your personal data with the categories of recipients described in Section 7.7 (Gigs UK Ltd, Gigs Wireless LLC, or the Gigs affiliate with which it has contracted). |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) GDPR).
|
When the contract between you and Klarna ceases. |
5. How can you withdraw consent?
When Klarna uses your personal data based on your consent or explicit consent, you can withdraw it at any time. You can do this by sending an email to protezionedati@klarna.it or by using the contact details provided in Section 12. You can also delete the information uploaded from Klarna services or stop the functionality where such personal data is processed. In that case, we will delete the information (or stop using it for the purpose for which consent was given). If you withdraw consent or delete uploaded information, you may not be able to use the service in cases where Klarna's processing of personal data is based on consent.
Finally: As described in Section 2 above, you also have the right to object to certain personal data processing (for example, you can opt out of marketing communications). You also have the right to have certain personal data deleted, as described in Section 2.
6. Klarna's profiling and automated decisions that significantly impact you.
6.1 Your profiling as a Klarna customer.
"Profiling" means automated processing of personal data to evaluate certain personal aspects, for example, by analyzing or predicting your personal preferences, such as shopping interests, or by analyzing your financial information. At the same time, we compare your data with that of our other customers who use our services in a similar way and observe what their preferences have been.
The purposes of Klarna's profiling and the types of personal data used on each occasion and for each profiling are described in detail in the preceding paragraph 4. You can link the descriptions below to the purposes in paragraph 4 using the numbers in parentheses "[x]". Profiling for these purposes does not have a significant impact on you as a customer.
We use profiling for the following purposes:
-
to provide our personalized services, capable of adapting their content and recommendations based on what we believe is most interesting or relevant to you (this applies to Klarna's various features, such as product expert and shopping assistants, in interaction with our customer service assistant and the order in which different payment methods appear in the Klarna checkout), (Purposes [20, 39, 47, 49 and 62] in paragraph 4)
-
to determine the most efficient way to contact you regarding your overdue debt (with regard to different channels, e.g., via SMS or email, or the timing of such communication), (Purpose [26] in paragraph 4), and
-
to provide you with personalized marketing both on our own and external platforms and services. (Purposes [14 and 44] in paragraph 4)
Our services use machine learning and artificial intelligence models to ensure you receive the most relevant content possible.
If you have any questions about how the profiling process works, please contact us. Contact details are available in paragraph 12. You can object to our marketing profiling at any time by contacting us (and we will cease profiling for marketing purposes). You can also stop profiling for our services by discontinuing the service.
6.2 Klarna's automated decisions that significantly impact you.
Automated decisions with legal effects, or automated decisions that significantly impact you, mean that some decisions in our services are fully automated, with no involvement from our employees. Such decisions have a significant impact on you as a customer, comparable to legal effects. By making such decisions automatically, Klarna increases its objectivity and transparency in deciding to offer you such services. At the same time, you have the right to object to such decisions at any time. For more information on how to object to such decisions, please refer to the end of this paragraph 6.2. For these assessments, we use machine learning and artificial intelligence models to ensure the highest possible quality in our decisions.
Automated decisions that significantly impact you also imply that profiling is carried out based on your data before the decision is made. This profiling is carried out to assess your financial situation (before deciding whether to offer or grant credit, or to initiate a payment) or to identify whether your use of our services involves a risk of fraud or money laundering or to decide whether you are responsible for a purchase. We profile your behavior and financial situation and compare this data with behaviors and conditions that indicate different levels of risk to us.
The different user behaviors and conditions are evaluated and weighted through our automated decision models, in order to obtain an overall score that results in the acceptance or rejection of your use of our Services. We may also decide to request further identification from you if we are unsure of your identity.
When does Klarna make automated decisions that significantly impact you?
The types of personal data used for each decision are described in paragraph 4. You can link the descriptions below to the purposes in paragraph 4 using the numbers in parentheses "[x]".
We make this type of automated decision when:
-
We decide to approve your application, or to offer you, to use a credit service.
-
We decide not to approve your application, or not to offer you, to use a credit service.
Such automated credit decisions are based on data provided by you, data from external sources, such as credit reports from credit bureaus, and internal Klarna information about you, in case we have lent you money previously. Klarna's credit model includes, in addition to information about you, numerous other factors, such as Klarna's internal credit risk level and our customers' general repayment rates (based, for example, on the current product category). (Purposes [25 and 32] in paragraph 4). -
We decide if you pose a fraud risk, if our processing shows that your behavior indicates potential fraudulent conduct, that your behavior is not consistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions where we assess if you pose a fraud risk are based on information provided by you, data from fraud prevention agencies (for details on those used, please refer to paragraph 7.2.3), and internal Klarna information. Klarna continuously develops its fraud models to keep its services secure and closely studies how fraudsters operate in different markets (for example, which merchant categories or products are most susceptible to fraud attempts). (Purposes [6, 22 and 42] in paragraph 4).
-
We decide if there is a risk of money laundering, if our processing reveals that your behavior indicates money laundering. In specific cases, Klarna also checks if certain customers are listed on sanction lists. (Purposes [21, 30 and 35] in paragraph 4).
-
We decide whether you are responsible for a purchase you have disputed as “unauthorized” based on whether the information you provided, or that we have, indicates potential fraudulent behavior or not. This is done by comparing what happened in your case with other transactions that indicate fraudulent behavior. (Purpose [46] in paragraph 4).
Please refer to paragraph 7 for more information on who we share information with regarding profiling during automated decisions.
If you are not approved based on the automated decisions described above, you will not have access to, or be able to use, Klarna's services, including our payment methods. Klarna has various security mechanisms in place to ensure that decisions are appropriate and correct. These mechanisms include a continuous overview of our decision models and random sampling in individual situations. If you have any concerns about the outcome, you can always contact us, and we will assess whether the procedure was carried out appropriately. You can also object according to the following instructions.
Your right to object to such automated decisions
You always have the right to object to an automated decision with legal consequences or decisions that may otherwise significantly impact you (together with related profiling) by sending an email to protezionedati@klarna.it. A Klarna representative will review the decision, taking into account any additional information and circumstances you provide to us.
7. Who do we share your personal data with?
When we share your personal data, we ensure that the recipient processes it in accordance with this policy, for example by entering into data transfer or processing agreements with recipients. Such agreements include all reasonable contractual, legal, technical and organizational measures to ensure that your data is processed with an adequate level of protection and in accordance with applicable law.
7.1 Categories of recipients with whom Klarna will always share your personal data, regardless of the service used.
7.1.1 Suppliers and sub-suppliers.
Description of recipient: Suppliers and sub-suppliers are companies that are entitled to process personal data received from Klarna solely on Klarna's behalf, i.e., as processors. Examples of such suppliers and sub-suppliers are software and data storage providers, payment service providers and business consultants, machine learning/artificial intelligence functionality providers, identity verification service providers, market research providers or Klarna Group companies.
Purpose and legal basis: Klarna needs access to services and functionalities from other companies when it cannot provide them itself. Klarna has a legitimate interest in being able to access such services and functionalities (Art. 6(1)(f) GDPR). We ensure that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to your particular circumstances. Please refer to paragraph 2 for more information on your rights.
7.1.2 Klarna Group.
Description of recipient: Companies within the Klarna Group.
Purpose and legal basis: This is necessary for Klarna to be able to provide you with services and functionalities. Klarna has a legitimate interest in being able to access and provide such services and functionalities (Art. 6(1)(f) GDPR). We ensure that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to your particular circumstances. Please refer to paragraph 2 for more information on your rights.
When you shop at a foreign store (i.e., a store located outside the EU/EEA area) that has an agreement with another Klarna group company, the communication of your personal data between Klarna companies is necessary for the two Klarna companies to handle your payment and allow the foreign store to manage your purchase. The legal basis for such processing is the performance of a contract (Article 6(1)(b) GDPR).
The receiving Klarna Group will process your personal data in accordance with the privacy policy applicable in your country (see list). More information on how Klarna protects your personal data in case of transfer outside the EU/EEA is provided in paragraph 8.
7.1.3 Attorneys for your financial affairs.
Description of recipient: Klarna may share your personal data with a person who has the right to access it by virtue of a power of attorney.
Purpose and legal basis: This processing is carried out to facilitate your contact with us (through agents), and is based on your consent (Art. 6(1)(a) GDPR).
7.1.4 Authorities.
Description of recipient: Klarna may provide necessary information to police, financial, tax or other authorities and courts.
Purpose and legal basis: Personal data is shared with the authority if required by law, in some cases at your request, or if necessary for the management of tax deductions or for combating crime. An example of a legal obligation to provide information is when measures need to be taken against money laundering and terrorist financing. Depending on the authority and purpose, the legal bases are the fulfillment of a legal obligation (Art. 6(1)(c) GDPR), the performance of a contract with you (Art. 6(1)(b) GDPR) or Klarna's legitimate interest in protecting itself against possible crimes (Art. 6(1)(f) GDPR).
7.1.5 Sale of business or assets.
Description of recipient: In the event that Klarna sells assets or assets, it may transfer your personal data to a potential buyer. If Klarna or a significant part of Klarna's assets is acquired by third parties, Klarna's customers' personal data may also be shared.
Purpose and legal basis: Klarna has a legitimate interest in being able to carry out such operations (Art. 6(1)(f) GDPR). We ensure that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to your particular circumstances. Please refer to paragraph 2 for more information on your rights.
7.2 Categories of recipients with whom Klarna shares your personal data when you use Klarna's payment methods, Klarna in a store, or choose to pay with a debit or credit card at Klarna's checkout in a store.
7.2.1 Stores.
Description of recipient: By stores we mean the stores you visit or shop at (which may include their group companies if you have been informed by the store).
Purpose and legal basis: To enable the store to perform and manage your purchase and your relationship with the store itself or its group companies, e.g., by confirming your identity, sending you products, handling inquiries and disputes, as well as preventing fraud and, if applicable, sending relevant marketing. The store's privacy policy applies to the processing of your personal data shared with the store and processed by it. Generally, you will find a link to the store's privacy policy on its website. The legal basis for sharing data with stores is partly the performance of a contract (Art. 6(1)(b) GDPR), insofar as the data sharing takes place for the performance of the contract between you and the store, and partly the legitimate interest of Klarna and the store (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). We ensure that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to your particular circumstances. Please refer to paragraph 2 for more information on your rights.
7.2.2 Payment service providers, cash service providers, card networks and financial institutions.
Description of recipient: Payment service providers (including digital wallets), cash service providers, card networks and financial institutions provide services to you, stores and/or Klarna for the implementation, facilitation and administration of electronic payments through various payment methods, such as credit cards and bank-backed payment methods (e.g., direct debit and bank transfer).
Purpose and legal basis: Some stores use payment service providers and cash service providers with whom they share your information for payment and purchase management. This sharing occurs in accordance with the privacy policies of the stores or cash service providers. The store may also allow Klarna to share your information with the payment service provider responsible for processing your payment. Some payment service providers also receive your information from Klarna, or collect and use your information independently, in accordance with their privacy policies or to prevent fraud. This is the case, for example, for digital wallet providers. Furthermore, Klarna may share your information with your card network and other financial institutions it relies on for managing the payment method or for executing transactions on your account, in order to complete operations, prevent fraud, or money laundering activities. Sharing with payment service providers, cash service providers, card networks, and financial institutions is done to enable a payment method or to execute transactions initiated by you and occurs to fulfill the contract with you (Article 6(1)(b) GDPR).
When sharing occurs with financial institutions that Klarna relies on to process your payment, or otherwise with payment service providers, Klarna also shares your data based on Klarna's and the recipient's legitimate interest in preventing abusive activities, including fraud (Article 6(1)(f) GDPR). We ensure that the subsequent processing is necessary to pursue this interest and that our interest overrides your right to prevent the processing of your data for this purpose. You have the right to object to such processing for reasons related to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.2.3 Risk detection agencies and companies providing identity verification services
Description of the recipient: Your personal data is shared with risk detection agencies and companies that provide identity verification services.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to counter fraudulent or abusive activities. The companies we work with are listed here. Please note that these companies process your data in accordance with their privacy policies.
Klarna shares your information, as well as information regarding whether a particular transaction may constitute potential fraud, based on Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as risk detection agencies and companies providing identity verification services have information on fraudulent activities and identity confirmation that are important for Klarna, as they can be used as input to reduce the level of unauthorized operations.
Such sharing is also in your interest, as it helps prevent your information from being used to make unauthorized purchases. We ensure that the processing involved is necessary to pursue this interest and that our interest overrides your right not to have your information processed for this purpose. You have the right to object to such processing for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for further information on your rights. You may also contact the entities listed in the link above to exercise the same rights described in paragraph 2 with respect to them.
7.2.4 Google.
Description of the recipient: When you use Google Maps in the checkout or on the Klarna app (e.g., when searching for your address in the address bar, viewing "stores near me" or asking for information about nearby promotions and offers), your personal information will be shared with Google. Google will process your data in accordance with Google Maps/Google Earth's terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on its legitimate interest in conducting its business (Article 6(1)(f) GDPR), as Google Maps allows for the address functionality at checkout and displays maps and promotions related to your current location on the Klarna App. We assure you that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest overrides your right to prevent the processing of your data for this purpose. You have the right to object to such processing for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights.
7.2.4 pagoPA.
Description of the recipient: if you choose to make payments to public bodies via pagoPA, Klarna will share some information with pagoPA S.p.A. Klarna will share the information you provide, including invoice details and, if you choose to pay the car tax via this functionality, vehicle data and license plate number. pagoPA will use this information to regulate payment to the relevant public bodies.
Purpose and legal basis: so that pagoPA can execute and manage payment to public bodies on your behalf. pagoPA's privacy policy applies to the processing of your personal data shared with and processed by that entity. For more information, please consult the pagoPA website here. The legal basis for sharing data with pagoPA is the performance of a contract (Article 6(1)(b) GDPR), insofar as the data sharing occurs for the performance of the contract between you and pagoPA or the competent public body.
7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna's payment methods that involves credit granting, the Klarna card, pay with Instore, pay with Klarna via digital wallets, or the Shopping Service with a single-use card.
7.3.1 Credit information bureaus.
Description of the recipient: In the event that you request to use a Klarna service that involves the granting of credit (see paragraph 4.3 on which Klarna services involve credit), we will share your personal data with credit information bureaus. Sharing does not occur for small amounts or when we already have sufficient information.
Purpose and legal basis: Your personal information is shared with credit bureaus to assess your creditworthiness in relation to your credit application, to confirm your identity and contact information, and to protect you and other customers from fraud. This data sharing constitutes a credit relationship.
In Italy, Klarna sends your address, date of birth, and tax code to the credit bureau to receive the outcome of the search conducted on you.
Our credit search will affect your credit rating at the credit bureau. Klarna will also share information about your repayments (including undisputed arrears and defaults) with the credit bureau, and this data may be reported in default registers, which may also affect your score at the credit bureau, and be consulted by third parties. The credit bureau will process your information in accordance with its privacy policies. You can view the bureaus we collaborate with here.
In Italy, Klarna sends your address, date of birth, and social security number to the credit bureau to receive the outcome of the search conducted on you. In addition, on a monthly basis, Klarna shares with the credit bureau information regarding your creditworthiness, your credit commitment, the status of the credit (i.e., active, paid, defaulted, overdue), and related supporting data.
Klarna shares your information based on Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as credit information bureaus have information on your financial situation, which is important for Klarna in order to ensure a proper credit assessment and not to grant credit to consumers who are unable to repay it. We assure you that the resulting processing is necessary for the pursuit of this interest and that our interest overrides your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights. You may also contact the entities listed in the preceding link to exercise the same rights set out in paragraph 2 with respect to those entities.
Klarna retains your credit information received from a credit information agency only in written data form. To receive a readable version, we suggest you contact the credit bureau from which you learned that Klarna requested a credit report directly.
7.3.2 Debt collection companies (for overdue debts).
Description of the recipient: Klarna may need to share your data when selling or outsourcing the collection of overdue and unpaid debts to third parties, such as a debt collection company.
Purpose and legal basis: This data is shared for the collection of your overdue debts. Debt collection companies process personal data in accordance with their own privacy policies or solely on behalf of Klarna as data processors. Debt collection companies may report your unpaid debts to credit information bureaus or authorities, which may affect your creditworthiness and your ability to obtain credit in the future. This data is shared based on our legitimate interest in collecting and assigning debts (Article 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in collecting and assigning debts. We assure you that the resulting processing is necessary for the fulfillment of the processing purpose and that our interest overrides your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights.
7.3.3 VISA and digital wallet providers.
Description of the recipient: We share information about you and your purchases when you use the Klarna card with VISA and with members of the VISA card network. If you add the Klarna card or an Instore card to your digital wallet, or choose to pay with Klarna via your digital wallet, we may need to share your information with the provider of that wallet. In this case, the data will be processed in accordance with that provider's privacy policy.
Purpose and legal basis: Sharing takes place to the extent necessary for the execution of card transactions, fraud prevention, and compliance with VISA card network regulations. If you renew your Klarna card or receive a new one, we will transmit this information to VISA, so that VISA can inform third parties with whom you have chosen to save your Klarna card data (e.g., for recurring transactions). Sharing is carried out for the performance of the contract with you (Article 6(1)(b) GDPR).
7.3.4 Debt buyers (for open debts).
Description of the recipient: Klarna may assign your open debt to debt buyers.
Purpose and legal basis: Upon the assignment of your debt to a buyer, and continuously until the debt is extinguished, Klarna will share your contact and identification information (name, date of birth, social security number, address, and telephone number), information about your financial situation (such as outstanding credit, repayments, and any negative payment history in relation to the current credit), as well as information about the goods or services associated with the credit. The buyer will process your personal data in accordance with their own privacy policy, about which you will receive information upon the assignment of the credit.
The sharing of personal data with different buyers is based on our legitimate interest in assigning outstanding debts as part of our business operations (Article 6(1)(f) GDPR). We assure you that the resulting processing is necessary for the pursuit of this interest and that our interest overrides your right to prevent the processing of your personal data for this purpose. You have the right to object to such processing for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights.
7.4 Categories of recipients when using Klarna's account services (Klarna balance, savings, and payment accounts).
7.4.1 Credit institutions and other financial institutions.
Description of the recipient: We share your information with credit institutions and other financial institutions (such as other banks) when you make transactions or payments to other accounts.
Purpose and legal basis: If you have made payments to a Klarna account, Klarna will process the information received from the bank you used for the transaction, such as contact and identification data and payment information. If you make transactions or payments to other bank accounts, Klarna will transmit some of your contact and identification data, as well as payment information, to the recipient, as well as to the recipient's credit or financial institution. Sharing is carried out for the performance of the contract with you (Article 6(1)(b) GDPR).
7.4.2 Other Klarna customers
Description of the recipient: We share your information with other Klarna customers when they make an instant transfer to you from their Klarna Account, when you request a payment from such customers, when you make a payment to them, or when both you and another Klarna customer choose to upload your address book to the Klarna App.
Purpose and legal basis: When someone makes an instant transfer to you, they will see that you are a Klarna user. This sharing is necessary to fulfill the contract with you (Article 6(1)(b) GDPR), allowing you to make and receive payments. If you have not disabled in-app discoverability features in the Klarna App settings, the other customer will also see your name and profile picture. This is based on our legitimate interest (Article 6(1)(f) GDPR) in displaying such information. You can control which information is shown to other users through your app settings. By default, your name is visible to those making a payment to you.
You can give your consent for us to sync your phone contacts with Klarna. However, to see which of your contacts are Klarna customers, both you and the other Klarna customers must (a) appear reciprocally in each other's address books, and (b) have synchronized your respective address books.
If you are not a Klarna user, your phone number will be uploaded to our systems, but it will be double-hashed. If you later become a Klarna user and choose to sync your address book, you will appear as a Klarna user in the contact lists of your contacts who are Klarna users and who have synchronized their respective address books, provided that you are also in their address book.
7.5 Categories of recipients with whom Klarna shares your personal data when you use the services provided under Klarna's terms of use.
You can find Klarna's terms of use here.
7.5.1 Affiliate Networks.
Recipient description: When you choose to click on a sponsored link or make a purchase through a cashback offer within Klarna’s services, including on our website, that leads to a store, product, or service, you will be redirected to another company’s website via a third party, known as an affiliate network. Here you can see which affiliate networks Klarna collaborates with (listed in the left column). Affiliate networks will process your device information in accordance with their privacy policies (you will find these privacy policies in the right column at the same link as above). The store you visit through a sponsored link determines which affiliate network processes your information. Typically, a store only works with one affiliate network. You can get more information on which network by contacting us (or the store).
Purpose and legal basis: The affiliate network may install tracking technology on your device that contains information about you having clicked on that link; this information is then used to document your visit to the store in order to calculate a potential commission owed to Klarna. This processing is based on a balancing of interests (Article 6(1)(f) of the GDPR). In balancing these interests, Klarna has determined that it has a legitimate interest in providing you with sponsored links to promote stores within its services, including on its website. We assure you that the resulting processing is necessary for the fulfillment of the purpose of processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
In addition, we need to share information with our affiliate networks to determine your eligibility for cashback as part of Klarna's Cashback Program. This includes confirming that you have met the criteria specified in our cashback offers. The shared data also serves to determine the amount of cashback potentially due. The processing for our cashback service is based on the performance of a contract (Art. 6(1)(b) GDPR).
7.5.2 Google.
7.5.2.1 reCAPTCHA
Recipient description: When you use Klarna's mobile application (including through our web portal), Google will collect device information through the Google reCAPTCHA service implemented therein (in some cases along with additional information you choose to enter into the reCAPTCHA service), and Klarna will share the phone number used during verification.
Purpose and legal basis: Klarna processes this information based on Klarna's legitimate interest in carrying out its business (Art. 6(1)(f) GDPR), as the reCAPTCHA service prevents misuse of our services (e.g., preventing bots from attempting to log in, or spiking SMS traffic). Google will process this information in accordance with its own terms of service and its own privacy policy. We assure you that the resulting processing is necessary for the fulfillment of the purpose of processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.5.2.2 Google Maps
Recipient description: To show where your package will be delivered on an integrated map, we share the relevant delivery address with Google. Google processes your data in accordance with the terms of service and the privacy policy of Google Maps/Google Earth.
Purpose and legal basis: Klarna shares this information based on Klarna's legitimate interest in carrying out its business (Article 6(1)(f) GDPR). By using Google Maps, we are able to show the delivery address on an integrated map. We ensure that this processing is necessary to pursue this interest and that our interest outweighs your right to prevent your data from being processed for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights and how to exercise them.
7.5.2.3 Youtube
Recipient description: When you use Klarna's various search features where we display content from YouTube, YouTube and Google will process your device information via the YouTube API services. YouTube/Google will process this information in accordance with their respective terms of service and their privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna's legitimate interest in carrying out its business (Article 6(1)(f) of the GDPR). By using YouTube, we can show you additional content. We ensure that the processing involved is necessary to pursue this interest and that our interest outweighs your right to prevent your information from being processed for this purpose.
You have the right to object to such processing on grounds relating to your particular situation. Please refer to paragraph 2 for further information on your rights.
7.5.3 Partners within the Financial Details service and the offers and benefits program.
Recipient description: Partners within the Financial Details service and the offers and benefits program.
Purpose and legal basis: If you choose to take advantage of Klarna's offers and benefits within the Financial Details service or the offers and benefits program, Klarna will share with its business partners the personal data necessary to access the offer (including the fact that you are a Klarna customer). Each offer specifies the data that will be shared. Data is shared for the performance of the contract between you and Klarna (Art. 6(1)(b) GDPR).
7.5.4 Logistics and transport companies.
Recipient description: Logistics and transport companies.
Purpose and legal basis: Klarna will share your personal data with logistics and transport companies that deliver ordered goods, if you have subscribed to the shipment tracking service. Examples of information we share are contact and identification data and tracking numbers.
Logistics and transport companies process your data in accordance with their privacy policies. Data is shared for the performance of the contract between you and Klarna (Art. 6(1)(b) GDPR).
7.5.5 Advertising partners.
Recipient description: Third-party advertising partners.
Purpose and legal basis: Klarna will share your personal data with third-party advertising partners in order to show you more relevant Klarna ads on non-Klarna sites and non-Klarna ads within the Klarna App, marketing channels, and third-party sites. This is based on your interaction with Klarna products and services and your Klarna profile and includes audience segmentation and activation. Klarna will also share such data to measure advertising performance. Certain third-party advertising services and digital advertising platforms will use your data for their own purposes and in accordance with their respective privacy policies, available here, where you can also consult the list of third parties we use. Klarna acts as a joint controller with some of these third parties. You can find more information about these agreements and how to exercise your rights here. You can also obtain further information about this sharing or how to exercise your rights with respect to these companies by contacting us.
Processing is based on your consent (pursuant to Article 6(1)(a) of the GDPR). You can withdraw your consent at any time via the tracking technology settings in the Klarna App. You can also object to the processing – with the same effect as withdrawing consent. Please refer to section 2 for more information on your rights.
Such processing may constitute profiling, with the aim of personalizing the service content based on what we believe may be of interest to you. For more information on profiling, please refer to section 6.
7.5.6 Third-party SIWK apps and services
Recipient description: When the user logs in with Klarna (via "SIWK") to an app store or a third-party online service, Klarna shares their personal data with the third-party app or service.
Purpose and legal basis: Your personal data is shared to enable the SIWK functionality. This data sharing is carried out to fulfill the contract entered into with you (Article 6(1)(b) of the GDPR).
7.5.7 Risk detection agencies and identity verification service providers
Recipient description: Your personal data is shared with risk detection agencies and identity verification service providers.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent or abusive activities. The companies we work with are listed here. Please note that these companies process your data in accordance with their privacy policies.
Klarna shares your information, as well as information about whether a particular transaction may constitute potential fraud, based on Klarna's legitimate interest in carrying out its business (Article 6(1)(f) of the GDPR), as risk detection agencies and identity verification service providers have information on fraudulent activities and identity confirmation that are important for Klarna, as they can be used as input to reduce the level of fraudulent transactions.
Such sharing is also in your interest, as it helps prevent your information from being used to make unauthorized purchases. We ensure that the processing involved is necessary to pursue this interest and that our interest outweighs your right to prevent your information from being processed for this purpose. You have the right to object to such processing on grounds relating to your particular situation. Please refer to paragraph 2 for further information on your rights. You can also contact the entities listed in the link above to exercise the same rights described in paragraph 2 with respect to them.
7.5.8 Resale platforms.
Recipient description: Marketplaces and market platforms that allow the resale of products and with which Klarna has collaborated from time to time ("Resale Platforms"). The list of currently available resale platforms is available here. We share information about the goods/services you wish to resell.
Purpose and legal basis: If you choose to resell a product through the Klarna App, Klarna will redirect you to the Resale Platform and pre-fill your listing by sharing information about the purchased product with the Resale Platform. Resale Platforms will process this information in accordance with their terms of service and privacy policies. The sharing is done to fulfill the agreement between you and Klarna (Article 6(1)(b) GDPR).
7.5.9 Klarna Subscription Partners
Recipient description: When you become a Klarna Subscription subscriber, we may share your personal data with our partners if necessary to provide you with the benefits. A list of current Klarna Subscription Partners is available here.
Purpose and legal basis: If you choose to become a Klarna Subscription subscriber, to provide you with specific benefits under the Klarna Subscription. The sharing is done to fulfill the contract between you and Klarna (Article 6(1)(b) GDPR).
7.6 Categories of recipients with whom Klarna shares your personal data if you contact our customer service through social media or participate in a sweepstakes co-organized by Klarna.
7.6.1 Social media.
Recipient description: Social media companies such as Facebook, Instagram, or Twitter.
Purpose and legal basis: If you contact us via social media such as Facebook, Instagram, or Twitter, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The sharing is done for the performance of the contract with you (Art. 6(1)(b) GDPR).
7.6.2 Co-organizers and sponsors of sweepstakes
Recipient description: Co-organizers and sponsors of sweepstakes – third-party partners who organize, sponsor, or otherwise support a sweepstakes that you choose to participate in and with whom personal data is shared, where necessary, to manage the sweepstakes and deliver prizes.
Purpose and legal basis: If you decide to participate in a sweepstakes organized by Klarna and/or its co-organizers and sponsors, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The sharing is done for the performance of the contract with you (Art. 6(1)(b) GDPR).
7.7 Categories of recipients with whom Klarna shares your personal data if you use Klarna Mobile.
7.7.1 Gigs Wireless LLC.
Recipient description: Gigs Wireless LLC (or the Gigs affiliate with which it has contracted) is Klarna’s network partner for the provision of the Travel eSIM. Klarna acts as Gigs’ agent to market the Travel eSIM, facilitate registration and billing, and also acts on behalf of Gigs to provide administrative and customer support, such as plan activation, billing, and assistance.
Purpose and legal basis: To provide you with the Travel eSIM, Klarna shares your contact and identification data, payment information, and customer service contact information with Gigs. This sharing is necessary for the performance of the contract between you and Klarna (Article 6(1)(b) GDPR).
8. When can we transfer your personal data outside the EU/EEA, and how do we protect it?
To provide our services and conduct our business, it is necessary to transfer your personal data outside the EU/EEA. This occurs when we share your information within the Klarna Group or with a supplier, sub-supplier, or store operating outside the EU/EEA. Klarna always ensures that your personal data is subject to the same high level of protection required by the GDPR, even when the data is transferred outside the EU/EEA. Your rights regarding personal data (detailed in paragraph 2) remain unchanged when data is transferred outside the EU/EEA. Further information about the recipients with whom Klarna shares your data can be found in paragraph 7.
If the store where you shop is located outside the EU/EEA, sharing with that store means that your data will also be transferred to that country outside the EU/EEA.
Some of Klarna's suppliers use Binding Corporate Rules ("BCR") when transferring personal data outside the EU/EEA within their corporate group. BCRs have been approved by an EU data protection authority and ensure the same high level of protection for your personal data when transferred.
You can contact us for more information on our security measures. Contact details are available in paragraph 12. You can find more information on which countries are deemed to have an "adequate level of protection" on the European Commission website. You can get more information on the European Commission's standard contractual clauses here and more information on Binding Corporate Rules ("BCR") here.
Security measures employed by Klarna in transferring personal data outside the EU/EEA
Countries outside the EU/EEA may have laws that allow public authorities to request access to personal data stored in the country for law enforcement or national security purposes. Regardless of whether your personal data is processed by us or our suppliers, we will ensure that a high level of protection is guaranteed during the transfer of such data and that appropriate protective measures have been adopted, in accordance with applicable data protection requirements (such as the GDPR). Such appropriate safeguards aim, by way of example, to ensure:
-
that the European Commission has determined that the country outside the EU/EEA to which your personal data is transferred has an adequate level of protection, corresponding to the level of protection guaranteed by the GDPR. This means, for example, that personal data is protected from unauthorized disclosure, and that you can still exercise your rights in relation to your personal data, or
-
that the European Commission's standard clauses have been entered into between Klarna and the recipient of personal data outside the EU/EEA. This means that the recipient guarantees the application of the level of protection of your personal data guaranteed by the GDPR, and that your rights are protected. In such cases, we also assess whether there are rules in the receiving country that affect the protection of your personal data. If necessary, we take technical and organizational measures so that your data remains protected during the transfer to the country concerned outside the EU/EEA.
-
that the transfer is covered by the EU-US Data Privacy Framework. This is an opt-in certification scheme for US companies, administered by the US Department of Commerce. The Data Privacy Framework includes a set of applicable principles and requirements that must be certified by the US company, ensuring that your data is still adequately protected.
Notwithstanding the foregoing, if the store where you choose to shop is located in a country outside the EU/EEA, our sharing of data with that store (and with the Klarna entity with which that store has concluded the contract) means that your personal data will be transferred and processed in this country outside the EU/EEA. Click here to access the privacy policies of other Klarna Group entities. Otherwise, it would not be possible to manage your purchase. Klarna primarily relies on the European Commission's standard contractual clauses to ensure the protection of your personal data for such data transfers, but, as stated above, the countries where the foreign store is located may have laws that prevent effective protection through the standard clauses. Even in this case, your personal data will still be transferred to the foreign store (or the foreign store's local Klarna entity), to the extent that the data transfer is necessary to manage your specific purchase.
9. How long we retain your personal data
The time for which Klarna retains your personal data depends on the purpose for which Klarna uses such personal data:
-
Personal data used for the contractual relationship between you and Klarna is generally retained for the duration of the contractual relationship and subsequently for a maximum of 10 years based on the statute of limitations.
-
Personal data that Klarna is required to retain by law, for example, under anti-money laundering laws or accounting laws, is generally retained for 5 and 7 years respectively.
-
Personal data that is not used for the purpose of the contractual relationship with Klarna or for which Klarna has no legal obligation to retain is only retained for as long as necessary to fulfill the respective data processing purpose (typically, 3 months). Further information can be found in the table in paragraph 4.
In some limited cases, it may be necessary to retain personal data for a longer period due to capital adequacy laws that Klarna must comply with.
The aforementioned legal obligations mean that Klarna cannot delete your personal data, even at your request, as described in paragraph 2. In the absence of a legal obligation to retain personal data, we must instead assess whether we may need the personal data to protect Klarna from legal claims.
The fact that we have a legal obligation to retain your personal data does not mean that we are also allowed to use such data for other purposes. Klarna will assess for each specific purpose how long we may use your personal data. Further information can be found in paragraph 4.
10. How we use cookies and other types of tracking technologies
To provide you with a personalized and smoooth experience, Klarna uses cookies and similar tracking technologies across its various interfaces, such as the website, Klarna's mobile application, and a store's checkout that uses Klarna. Information on the tracking technology used by Klarna and how to accept or reject it in each interface is available.
11. Updates to this Privacy Notice
We are constantly working to improve our services so that you can enjoy a smooth user experience. This may require changes to existing and future services. If such improvement requires a notice or consent in accordance with applicable law, you will be informed or given the opportunity to give your consent. It is also important that you refer to this privacy notice each time you use one of our services, as the processing of your personal data may differ from a previous use of the service in question.
12. Klarna's Contact Information
Klarna Bank AB (publ) is registered with the Swedish Companies Registration Office under no. 556737-0431 and its registered office is at Sveavägen 46, 111 34 Stockholm.
Klarna has appointed a Data Protection Officer and a team of data protection specialists. We also have a number of customer service teams that deal with data protection issues. You can contact all of them at protezionedati@klarna.it. If you wish to specifically contact Klarna's Data Protection Officer, please indicate this in the subject line.
Klarna Bank AB (publ) operates in compliance with Swedish data protection legislation. Visit www.klarna.it for more information about Klarna.