Klarna Privacy Notice
It is important to us that you feel safe when you pay with Klarna or use any of our other services. We therefore want to provide you with all the information about how we use your personal data through this Privacy Notice.
1. Who is responsible for your personal data?
Klarna Bank AB (publ), registered with the Swedish companies register with no. 556737-0431, with registered office at Sveavägen 46, 111 34 Stockholm, also operating through its branches and through Klarna Technologies AB (556566-7796) for the provision of Klarna’s telecommunication services (“Klarna”, “we”, “our” or “us”), is the data controller of your personal data according to the EU Data Protection Regulation (the “GDPR”). If you have questions about our processing of your personal data, please contact our data protection team by writing to protezionedati@klarna.it.
2. Your data protection rights as a data subject
Under the GDPR, you have several rights related to having control over your personal data and receiving information directly from us on how we process your personal data. Below you can read about your rights. If you want to receive information about the data Klarna holds on you through a so-called data subject access request, have certain data erased, or contact us to exercise your other rights, the easiest way is to log into your Klarna account and submit your request from there. You can also find our contact details in section 12 for other questions.
Your rights
-
Right to erasure of personal data (“Right to be forgotten”).
In some cases, you have the right to have us erase your personal data. For example, you can ask us to erase personal data that we (i) no longer need for the purpose it was collected for or (ii) that we process based on your consent and which you revoke. There are situations where Klarna is unable to erase your data, for example when it is still necessary to process the data for the purpose for which it was collected, Klarna's interest in processing the data outweighs your interest in having it erased, or because we have a legal obligation to keep it. You can read more about our legal data retention obligations in sections 4 and 9 of this Privacy Policy. The laws described therein prevent us from immediately erasing certain data. You also have the right to object to our use of your personal data for certain purposes such as direct marketing, which you can read more about in this list of your rights.
-
Right to be informed.
You have the right to be informed about how we process your personal data. This is done through this privacy policy, through service-specific FAQs, and by answering your questions.
-
Right to access your personal data (“Data Subject Access”).
You have the right to know whether Klarna processes your personal data and to receive a copy (“data extract”) of such data, referred to as “data subject access”. Through the data extract, you will receive information about the personal data Klarna holds about you and how we process it.
-
Right to access and request the transfer of your personal data to another recipient (“Data Portability”)
Under this right, you can request a copy of the personal data about you held by Klarna for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use such data elsewhere, for example, to transfer your personal data to another controller/recipient.
-
Right to rectification.
You have the right to ask us to rectify inaccurate information or complete information about you that you believe to be inaccurate or incomplete.
-
Right to restriction of processing.
If you believe the data is inaccurate, our processing is unlawful, or that we do not need the information for a specific purpose, you can request a restriction on the processing of such personal data. You also have the option to request the suspension of the processing of your personal data pending the evaluation of your request. If you object to our processing under your right described directly below, you can also ask us to restrict the processing of that personal data pending our evaluation.
-
Right to object to the processing of your personal data.
You have the right to object to our processing of your personal data based on our legitimate interest (Art. 6(1)(f) GDPR), with reference to your personal circumstances. In addition, you can always object to our use of your personal data for direct marketing purposes. When you notify us that you no longer wish to receive direct marketing communications, we will disable marketing mailings to you.
-
Right to object to an automated decision that significantly impacts you.
You have the right to object to an automated decision made by Klarna if such decision produces legal effects or similarly significantly impacts you. Please refer to section 6 for how Klarna uses automated decisions.
-
Right to withdraw your consent.
As described in section 5 below, when we process your personal data based on your consent, or explicit consent, you have the right to withdraw such consent at any time. When you withdraw your consent, we will stop processing your data for those purposes.
-
Right regarding the fate of personal data after death.
You have the right to provide (or designate the person authorized to do so) instructions regarding the storage, deletion, and communication of your personal data after your death.
-
Right to lodge a complaint.
In case of a complaint regarding the processing of your personal data by Klarna, you have the right to lodge a complaint with the Integritetsskyddsmyndigheten, the Swedish supervisory authority competent for the processing of personal data carried out by Klarna. You can contact the Integritetsskyddsmyndigheten at the following link. You can also lodge a complaint with your national data protection authority, which you can find here.
3. What types of personal data do we collect?
This section describes the types of personal data we collect or create. In section 4, we will explain for what purposes we use these types of personal data.
Contact and identification data - Name, date of birth, place of birth, social security number, title, occupation, gender, billing and delivery address, email address, mobile phone number, Klarna-generated identifiers, nationality, age, audio recordings, photos and video recordings concerning you and your identity card, electronic ID, qualified electronic signatures, etc.
Information about goods/services - Details relating to the goods/services you purchased or ordered (or plan to purchase or order), such as item type or delivery tracking number. If you choose to make payments through pagoPA, Klarna will collect the information you provide, including invoice details and, if you choose to pay vehicle tax through this feature, vehicle data and license plate number.
Information about your financial situation - Information relating, for example, to your income, any credits, negative payment history, and previous credit approvals.
Payment information - Credit and debit card details (card number, expiry date and CVV code), bank account number, bank name, bank account holder name, bank account login details.
Information about your use of Klarna services - Which services and their features you have used and how you have used them. This includes information about outstanding debt and history, your payment and refund history, participation in surveys, as well as your personal preferences or searches, including derived interests and loyalty points.
Technical information generated by your use of Klarna services - Technical data such as web page response time, logs of how you navigate our services, download errors, and the date and time you used the service.
Information about your contacts with Klarna customer service - Recorded and/or transcribed phone calls, chat conversations, and email correspondence.
Your contacts with stores where you shop or visit - Information about how you interact with stores, e.g., if you have received merchandise and the type of store where you shop.
Device information - Device ID, IP address, Mobile Ad ID (MAID), language settings, browser settings, time zone, operating system, platform, screen resolution, and similar information about your device and device settings/usage.
Information from external sanctions lists and PEP lists - Sanctions lists and lists of politically exposed persons (“PEP”) include information such as name, date of birth, place of birth, occupation or position, and the reason the person appears on the list in question.
Sensitive personal data - Sensitive personal data is data that reveals religious beliefs, political or philosophical opinions, trade union membership or constitutes information about health, sex life or sexual orientation, as well as biometric data.
-
Service-specific personal data - Within the scope of our services under Klarna’s terms of use, Klarna’s savings and payment accounts, Auto-Track, and Financial Details, we use additional personal data that do not fall into the types listed above. Information regarding each service is listed below:
Services under Klarna’s terms of use: All content you upload or submit (such as requests or searches, photos, receipts, product or store reviews, profile picture or other uploaded information), location information, and websites you visit through the application browser or with the installed extension. Klarna also displays product reviews from third-party review sites.
Klarna savings and payment accounts: Information about your transactions and deposits and information about the origin or use of your money. For this service, Klarna also processes third-party data (such as beneficiaries or payers);
Auto-track: Information from the linked email account regarding your purchases/orders, deliveries, and promotions or marketing received (such as order number, product, price, purchase date, quantity, seller, payment method used, promotional codes, delivery tracking numbers, carrier, delivery status, shipping address, type of marketing activity, and marketing offers).
Financial Details: Information from your other bank accounts and other types of accounts (such as card accounts) that you choose to link to the service, as well as information such as account number, bank, transaction history of your linked accounts, and balances and activities;
Loyalty Cards Feature: Information from a membership account or loyalty card added by third parties, such as points, membership information and credentials, status, tiers, and balance history;
Open Banking Service: Information from your third-party bank account, such as basic account information (account holder, bank account number, account login details), and information about your transactions, account balance, and overdraft limit; and
Contact list: If you choose to upload your contact list, we will collect the phone numbers and email addresses in your contact list. Depending on your device settings, the Klarna App will periodically collect such data to ensure it is up to date. By providing us with information about your contacts, you confirm that you have permission to share such information with Klarna for the purposes described in this privacy policy.
-
Travel eSIM Data: Information related to your Klarna Travel eSIM, including plan selection, data consumption, and payment history. Neither Klarna nor Gigs Wireless LLC (or the affiliated Gigs company with whom you have contracted) have access to the content of your internet browsing data.
Social media event registration: Information about your profile from your social media accounts and business information such as your employer's name, address, and company type.
Detailed information about the personal data relevant for each service is also included in the terms and conditions listed here.
4. What personal data is used for what purposes and on what legal basis?
In the tables below, you can find information:
about the purpose for which we will use your personal data (the purpose),
about what types of personal data we use for the respective purpose, and whether the personal data comes directly from you or from other sources. If we receive personal data about you from other sources, we will indicate the source in parentheses,
about what our rights are under current data protection legislation, including the GDPR, to process data about you, referred to as our “legal basis,” and
about when Klarna stops using the personal data for each of the purposes.
4.1 Purposes for which your personal data is always used by Klarna, regardless of the service used.
Purpose of processing - what we do and why. |
Type of personal data used for the relevant purpose and source from which it originates. Please refer to section 3 for more information on the different types of personal data. |
Legal basis for processing according to the GDPR. |
Time when the purpose of using personal data expires. See section 9 for when Klarna deletes the data. |
[1] For managing our relationship with you in accordance with our agreements, for each service used. This includes creating and sending information to you electronically (not for marketing purposes). |
From you:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
If the service involves information that constitutes sensitive personal data (e.g., from materials you have chosen to upload), our processing is based on your explicit consent (Art. 9(2)(a) GDPR). |
When the contract between you and Klarna ends or when you withdraw your consent. |
|
[2] To conduct customer satisfaction surveys, market research, and to request reviews from you via email, text messages, phone, or other communication channels. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in carrying out the processing of personal data, that the processing is necessary to achieve this purpose, and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details.
When we send you an email, such sending will be based on your consent. |
When the contract between you and Klarna ends. |
|
[3] To ensure network and information security in Klarna's services. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in being able to ensure network and information security, that the processing is necessary to achieve this purpose, and that our interest outweighs your right to prevent the processing of your data for this purpose. Ensuring a good level of information security is also in your interest as a customer.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts as long as you use a service. |
|
[4] To be able to assist you as vulnerable customers (i.e., if you require additional support when contacting us due to particular circumstances). This means we can offer you special support, e.g., when you contact customer service. |
From you:
From other sources:
|
Based on your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). |
When you inform us that you are no longer a vulnerable customer or withdraw your consent. We also stop this processing if and when you inform us that you no longer wish to be a Klarna customer. |
|
[5] To manage any requests for financial hardship you submit, where we can offer you special support, such as a payment deferral. |
From you:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
If your request includes information that constitutes sensitive personal data (e.g., contained in materials you choose to upload in support of the request), the processing is based on your explicit consent (Art. 9(2)(a) GDPR). |
When the contract between you and Klarna ends or when you withdraw your consent. |
|
[6] To be able to perform risk analysis, fraud prevention, and risk management.
We perform the processing to confirm your identity and the accuracy of the data you provide, as well as to combat abusive activities.
This processing constitutes profiling and automated decision-making. For this purpose, we use automated decision-making, which makes it possible to determine whether you pose a fraud risk. Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
The processing is necessary for Klarna to enter into and perform a contract with you (Art. 6(1)(b) GDPR).
Sensitive personal data is processed based on your explicit consent (Article 9(2)(a) GDPR), to the extent that this is explained to you at the time of collection of such data.
However, for our financial services, we are also legally obliged to establish the identity of our customers (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing) |
This processing will take place while you are using any Klarna service or until you withdraw your consent.
However, if Klarna has identified a potential risk in the way you use Klarna, we will continue to use your information for this purpose and will continue to update our risk assessment where there is a risk of fraud. This processing lasts until we are legally required to retain your information. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[7] To anonymize your personal data in order to improve our products and services and analyze customer behavior. |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in anonymizing your personal data for product development purposes and to analyze customer behavior in order to improve the service and customer experience. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest outweighs your right to prevent the processing of your data for this purpose. By anonymizing the information about you, we also ensure that we use personal data to the least extent possible.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[8] To perform data analysis for product development and testing to improve our risk, fraud, and credit models and to design and improve our services (where possible, we first anonymize the data, meaning no personal data processing is subsequently performed). |
From you:
From other sources:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in performing data analysis for product development and testing purposes. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose. Furthermore, our customers benefit from the processing because it helps us provide error-free and sustainable services.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[9] To perform data analysis to measure and improve our marketing and advertising channels (where possible, we first anonymize the data, meaning no personal data processing is subsequently performed). |
From you:
|
Processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in performing data analysis for product development and testing purposes. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[10] To calculate payment fees to suppliers (where possible, data is first anonymized; therefore, no personal data processing occurs as a result of anonymization). |
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in calculating potential fees. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts up to 90 days after the use of a service. |
|
[11] To produce statistics and reports for economic analysis or analysis of payment trends or payment volumes in certain regions or industries (where possible, we first anonymize the data, which means that no personal data processing occurs thereafter). |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in obtaining statistical data and reports for this purpose. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
This processing lasts for the entire period during which Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[12] For identity verification and checks. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Sensitive personal data is processed based on your explicit consent (Article 9(2)(a) GDPR), to the extent that this is explained to you at the time of collecting such data. |
For as long as you use one of Klarna’s services. |
|
[13] To share your personal data with the categories of recipients described in paragraph 7.1 (suppliers and subcontractors, Klarna Group companies, entities with authority over your financial transactions, authorities, and purchasers of receivables, businesses, or assets). |
|
Varies depending on the recipient (see paragraph 7.1). |
This processing lasts for the entire period during which Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[14] To decide what type of marketing or marketing surveys we will provide to you.
If you do not wish for such processing of your data, please contact us. We will then stop using your data for marketing. Contact details are available in paragraph 12.
The processing may constitute profiling. Please refer to paragraph 6 for more information on profiling. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in identifying the type of marketing we should provide to you. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose. We have also considered the fact that marketing is indicated as an example of legitimate interest in the GDPR.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ends or if you inform us that you are not interested in such processing. |
|
[15] To provide you with marketing materials, offers, and marketing surveys about other products and services we offer that are similar to those you have already used and that are part of Klarna's general consumer offering.
If you do not wish to receive marketing communications, please contact us to let us know. We will then stop using your data for sending marketing communications. Please refer to paragraph 12 for our contact details. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in sending marketing about our services and offers. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose. We have also considered the fact that marketing is indicated as an example of legitimate interest in the GDPR.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ends or if you inform us that you are not interested in such processing. |
|
[16] To provide you with direct marketing and marketing surveys about offers, products, or services from Klarna and our stores/partners. |
From you:
From other sources:
|
The processing is based on your consent (Art. 6(1)(a) GDPR). |
When you inform us that you intend to withdraw your consent or are no longer interested in/object to such processing. |
|
[17] To protect Klarna from legal claims and to safeguard Klarna’s statutory rights. |
In case of a dispute, Klarna may also collect other types of personal data about you, if necessary for the exercise of our rights. |
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in being able to defend itself against legal claims. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details.
Sensitive personal data, if necessary to establish, exercise, or defend legal claims, are processed based on Article 9(2)(f) of the GDPR. |
This processing lasts for the entire period during which Klarna is required to store the information in its systems, e.g., for the performance of the contract entered into with you or to comply with applicable law. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
4.2 Purposes for which your personal data is used when you use one of Klarna's payment methods, log in to Klarna in a store, or choose to pay with a debit or credit card at Klarna's checkout in a store.
|
Purpose of processing - what we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis for processing according to GDPR |
Time when the purpose of personal data use expires. See paragraph 9 for when Klarna deletes the data. |
|
[18] Not applicable in the country. |
|
|
|
|
[18] To share your personal data with the categories of recipients described in paragraph 7.2 (stores, payment service providers, cash service providers, card networks and financial institutions, fraud prevention agencies and companies providing identity information, and Google). |
From you:
From other sources:
|
Varies depending on the recipient (see paragraph 7.2). |
Mainly when the purchase occurs, but also for the entire period Klarna has the data in its systems, i.e., until the data is deleted. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[20] When you shop at a store that offers Klarna as a payment method or has Klarna checkout, we will evaluate the order in which different payment methods should be presented at the store's checkout.
This processing constitutes profiling. Please refer to paragraph 6 for more information on profiling. |
From you:
From other sources:
|
If you have accepted Klarna’s terms of use, as described in more detail in the terms and conditions found here, the legal basis for processing is the performance of the contract (Art. 6(1)(b) GDPR).
Alternatively, if you have not accepted Klarna’s terms of use, the processing will instead be based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing the interests, Klarna has determined that it has a legitimate interest in examining the order in which the different payment options will be presented to you at the store checkout. We assure you that the resulting processing is necessary to achieve the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You may contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When payment methods are shown at checkout. |
|
[21] To prevent Klarna's operations from being used for money laundering or terrorist financing, we will verify your identity, monitor, and review transactions. Klarna also conducts continuous risk assessments and creates risk models to counter money laundering and terrorist financing.
Such processing constitutes profiling and automated decision-making. Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
For compliance with a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on Measures against Money Laundering and Terrorist Financing).
Regarding sensitive personal data, the basis is the necessity of processing for reasons of public interest (Art. 9(2)(g) GDPR).
|
When the agreement between you and Klarna ceases or when you withdraw your consent. Please refer to paragraph 9 for more information on our obligations and the right to retain information as required by law. |
|
[22] To perform a fraud prevention assessment before accepting a purchase.
Such processing constitutes profiling and automated decision-making. For this purpose, we use automated decision-making, which allows us to determine whether you pose a fraud risk. Please refer to paragraph 6 for more information on profiling and automated decisions.
Please also refer to paragraph 7.2.3 regarding our use of risk detection agencies with whom your information may be shared, and regarding our legal basis for such sharing. Should we identify potentially fraudulent transactions, we will report them to fraud prevention agencies as per paragraph 7.2.3. |
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies, cash service providers, and payment service providers to determine if your data indicates a fraud attempt. |
For the conclusion and performance of the contract (Art. 6(1)(b) GDPR).
Sensitive personal data is processed based on your explicit consent (Art. 9(2)(a) GDPR). |
When the fraud assessment is performed or when you withdraw your consent. |
|
[23] For bookkeeping and record-keeping as required by accounting regulations and to retain it in accordance with applicable law. |
From you:
From other sources:
|
For compliance with a legal obligation (Art. 6(1)(c) GDPR) (Swedish Accounting Act (1999:1078)). |
For the period during which accounting is recorded and 7 years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[24] To perform calculations in accordance with capital adequacy regulations. |
From you:
From other sources:
|
For compliance with a legal obligation (Art. 6(1)(c) GDPR) (Capital Requirements Regulation 575/2013 and Capital Requirements Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
4.3 Purposes for which your personal data is used when you use one of Klarna's payment methods that involve providing credit or when you use the Klarna card, pay with In-store, pay with Klarna via digital wallets, or the Shopping Service with a one-time card.
The following services involve the provision of credit to you: "Pay later" (invoice), "Pay now" (for direct debit payment), "Financing" (instalment payment), as well as the Klarna card and the Shopping Service with a one-time card.
|
Purpose of processing - what we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
Time when the purpose of using personal data expires. See paragraph 9 for when Klarna deletes data |
|
[25] To perform a credit assessment before granting credit.
This constitutes profiling and the decision to approve or refuse credit constitutes an "automated decision". Please refer to paragraph 6 for more information on profiling and automated decisions.
Please also refer to paragraph 7.3.1 regarding our use of credit reference agencies with whom your information may be shared, and regarding our legal basis for such sharing. |
From you:
From other sources:
|
For the conclusion and performance of the credit agreement (Art. 6(1)(b) GDPR). |
When the credit assessment is performed. |
|
[26] Determine the most efficient way to contact you regarding your outstanding debt. This is subject to legally mandated communications under consumer credit regulations. Such processing constitutes profiling. Please refer to paragraph 6 for more information on profiling. |
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that it has a legitimate interest (with you) in ensuring that you are contacted efficiently regarding your outstanding debt. We ensure that the processing is necessary for achieving this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
Until you have an outstanding debt to Klarna. |
|
[27] To share your personal data with the types of recipients described in paragraph 7.3 (credit agencies, debt collection companies and other buyers of outstanding debts, as well as VISA, credit purchasers and digital wallet providers). |
From you:
From other sources:
|
Varies depending on the recipient (see paragraph 7.3). |
Mainly when the purchase occurs, but also as long as Klarna retains the data in its systems, i.e., until it is deleted. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[28] To transfer Klarna's credit right related to your purchase to a new holder. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that it has a legitimate interest in the assignment of outstanding debts as part of its business operations. We assure you that the processing is necessary for achieving this interest and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
Processing may be performed until the debt is paid (you will be notified of any assignment of the debt). |
|
[29] To perform debt collection services, i.e., to collect and assign overdue debts. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that it has a legitimate interest in the collection and assignment of debts. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we reached this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the credit has been repaid. |
|
[30] To prevent Klarna’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments, and creating risk models.
This processing constitutes profiling, and the decision that you are exposed to a money laundering risk constitutes an “automated decision”. Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
For the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
Regarding sensitive personal data, the condition is that the processing is necessary for reasons of public interest (Art. 9(2)(g) GDPR). |
Up to five years from the termination of the agreement or the end of the customer relationship (up to ten years in cases where law enforcement authorities request it). Please refer to paragraph 9 for more information on our obligations and right to retain information by law. |
|
[31] Archiving and accounting according to accounting regulations. |
From you:
From other sources:
|
For the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Accounting Act (1999:1078)). |
Seven years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and right to retain information by law. |
4.4 Use of your personal data (and third parties') for access to Klarna account services (Klarna balance, savings and payment accounts).
|
Purpose of processing - what we do and why |
Types of personal data used for the respective purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data expires (See paragraph 9 for when Klarna deletes the data) |
|
[32] Not applicable in the market. |
|
|
|
|
[33] To provide Klarna’s savings and payment accounts, including showing your data to other Klarna Account customers when they make a payment to you or when you make a payment to them. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR).
Information on third parties (such as the payment recipient or payer) is based on a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that we and you (and also the payment recipient/payer) have a legitimate interest in processing such data for the execution of the transactions in question. We assure you that the resulting processing is necessary for achieving the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You can contact us for more information on how we arrived at this determination. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ceases. |
|
[34] To share your personal data with the categories of recipients indicated in paragraph 7.4 (credit institutions and other financial institutions). |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR). The terms of service are available here. |
When the contract between you and Klarna ceases. |
|
[35] To prevent Klarna’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments, and creating risk models.
This processing constitutes profiling, and the decision that you are exposed to a money laundering risk constitutes an “automated decision”. Please refer to paragraph 6 for more information on profiling and automated decisions. |
From you:
From other sources:
|
For the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
Regarding sensitive personal data, the condition is that the processing is necessary for reasons of public interest (Art. 9(2)(g) GDPR). |
Up to five years from the termination of the agreement or the end of the customer relationship (up to ten years in cases where law enforcement authorities request it). Please refer to paragraph 9 for more information on our obligations and right to retain information by law. |
|
[36] Archiving and accounting according to accounting regulations. |
From you:
From other sources:
|
For the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) (Swedish Accounting Act (1999:1078)). |
Seven years after the end of the year in which the information was first recorded. Please refer to paragraph 9 for more information on our obligations and right to retain information by law. |
|
[37] To perform calculations in accordance with capital adequacy regulations. |
From you:
From other sources:
|
Compliance with the law (Art. 6(1)(c) GDPR) (Capital Adequacy Regulation 575/2013, and Capital Adequacy Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. Please refer to paragraph 9 for more information on our obligations and right to retain information by law. |
|
[38] To enable you to import contacts from your address book to populate the contact list with Klarna Account holders to whom you can send instant transfers from your Klarna Account. You can stop this service at any time, thereby revoking Klarna's access to your address book. |
From you:
|
The upload from your address book is based on your consent (under Art. 6(1)(a) GDPR) (to access contacts stored on your phone). Information regarding third parties (i.e. non-Klarna customers in your address book) is processed on the basis of a balancing of interests (Art. 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that we and you have a legitimate interest in processing such data to identify Klarna customer contacts, in order to assist Klarna customers in performing the transactions in question. We assure you that the processing involved is necessary to pursue this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please refer to paragraph 12 for our contact details. |
When the contract between you and Klarna ends, or when you withdraw your consent by changing your device settings. |
4.5 Use of personal data for services provided in the Klarna User Terms, Klarna Subscription Terms and/or Referral Program Terms.
For the services described in Klarna’s User Terms and/or Klarna’s Subscription Terms, Klarna will process your personal data for the purposes described in the table below. Klarna’s User Terms are available here. You can find more information about the functionalities on our website or in our app.
|
Purpose of the processing - what we do and why |
Types of personal data used for the respective purpose and the source from which they originate. Please refer to section 3 for more information on the different types of personal data. |
Legal basis under GDPR. |
When the purpose of the use of personal data ceases. See section 9 for when Klarna deletes data. |
|
[39] To provide the services provided for in Klarna's User Terms and related functionalities, as well as to determine your eligibility for certain services.
|
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR).
If we process data that constitutes sensitive personal data (if you have uploaded this data or otherwise provided us with access to such data or asked us to share it), your processing will be based on your explicit consent (Article 9(2)(a) GDPR). Please refer to section 3 for more information on this type of personal data. |
When the contract between you and Klarna ceases or when you withdraw your consent. |
|
[40] You can choose to share your location information with us. We use this information to find stores and offers near you.
|
From you:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR).
|
When the contract between you and Klarna ceases. |
|
[41] To provide you with a browser through which to visit, for example, merchant websites. Klarna will collect information about how you use the browser to personalize the content of Klarna's services. |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR).
In cases where the service processes information that constitutes sensitive personal data (e.g. from the pages you visit), your processing will be based on your explicit consent (Article 9(2)(a) GDPR). However, such sensitive information will not be used for any other purpose than to display the current website in the browser. |
When the contract between you and Klarna ceases. |
|
[42] To perform fraud prevention assessments when using the services provided for in Klarna's User Terms.
See also section 7.5.6 on our use of fraud prevention agencies, with whom your information may be shared, and our legal basis for such sharing. |
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies to determine if your information indicates an attempt at fraud. |
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR). |
Upon completion of the fraud assessment. |
|
[43] To share your personal data with the categories of recipients indicated in section 7.5 (affiliate networks, Google, partners in the Financial Details service and the offers and benefits program, logistics and transport companies, advertising services, third-party apps and services (for SIWK), risk detection agencies and companies providing identity verification services, and resale platforms). |
From you:
From other sources:
|
Varies depending on the recipient (see section 7.5). |
When the contract between you and Klarna ceases. |
|
[44] To provide you with more relevant advertising, we share personal data, including audiences created by Klarna, with advertising partners. This includes advertising Klarna products and services on third-party websites and apps, as well as third-party advertising shown within Klarna's website and app; audiences created by Klarna may also be used within third-party advertising platforms to show ads on third-party websites and apps. We also evaluate the relevance of such advertising. This is based on your behavior as a user and your Klarna profile.
|
From you:
From other sources:
|
This is based on your consent (pursuant to Article 6(1)(a) of the GDPR). |
When you notify us that you wish to withdraw your consent or from you: contact and identification data.
We will also cease this processing if and when you notify us that you no longer wish to be a Klarna customer. |
|
[45] If you choose to log in to Klarna (via “SIWK”) through a third-party app or service, Klarna will share your personal data with the store or online service. |
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR). |
When the contract between you and Klarna ceases. We will also cease this processing if and when you notify us that you no longer wish to be a Klarna customer. |
|
[46] To automatically manage purchase disputes or complaints about goods.
This processing constitutes an automated decision-making process. For this purpose, we use an automated decision-making process, which allows disputes or complaints to be resolved in a timely and consistent manner. Please refer to section 6 for more information on automated decisions. |
From you:
From other sources:
Information about your contacts with Klarna customer service. (Klarna) |
If you have accepted Klarna's User Terms, as described in more detail in the service terms and conditions, available here, the legal basis for processing is the performance of the contract (Article 6(1)(b) GDPR). Alternatively, if you have not entered into the Klarna User Terms agreement or have not made the disputed purchase, the processing will be based on your consent (Article 6(1)(a) GDPR). |
When the dispute has been handled, or alternatively, when processing is based on consent and you inform us that you wish to withdraw your consent. |
|
[47] To present you with relevant content, responses to requests, and product recommendations when you use our AI-powered assistants. These assistants base their recommendations on the information we have about you, along with the preferences or questions you have provided to us.
This processing constitutes profiling. Please refer to section 6 for more information on profiling.
|
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR).
|
When the contract between you and Klarna ceases. |
|
[48] If you have linked your email account to Klarna's Auto-Track service, Klarna will regularly connect to your email account(s) to obtain information about your purchases.
You can stop this service at any time and thereby delete Klarna's access to your email account. |
From other sources:
|
Processing is necessary for Klarna to perform a contract (Klarna User Terms) with you (Article 6(1)(b) GDPR).
In cases where the service processes sensitive personal data (from your transactions), your processing will be based on your explicit consent (Article 9(2)(a) GDPR). Please refer to section 3 for more descriptive information. |
When the contract between you and Klarna ceases or when you withdraw your consent. |
|
[49] If you have chosen to link your bank accounts to the Financial Details service, Klarna will show you and give you the tools to control your finances, through tailored offers for your specific needs.
This processing constitutes profiling, the purpose of which is to personalize the content of the service based on what we think may interest you. You can read more about profiling in section 6.
If you choose to use offers and benefits that Klarna provides as part of this service, we will share your personal data with the partner providing them (see section 7.5.3). |
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes sensitive personal data (from your operations), your processing will take place based on your explicit consent (Art. 9(2)(a) GDPR). Please refer to paragraph 3 for more information. |
When the contract between you and Klarna ceases, or when you withdraw your consent. |
|
[50] If you use our browser extension, Klarna processes your data to provide the service, which includes processing information about the websites/web domains you visit:
Klarna processes information about the e-commerce websites/web domains you visit to identify offers, offer cashback, and provide you with personalized offers in the Klarna extension and mobile app. This processing is also done to allow you to create One-Time Cards directly in your browser on websites where this service is enabled.
Information about non-e-commerce websites/web domains visited is not stored by Klarna.
More information on how your personal data is used can be found in the extension's FAQ. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
In the event that the service processes information constituting sensitive personal data (i.e., data related to the websites/web domains you visit), our processing will take place based on your explicit consent (Art. 9(2)(a) GDPR). Please refer to paragraph 3 for more information. |
When the contract between you and Klarna ceases, or when you withdraw your consent. |
|
[51] If you have added a third-party membership or loyalty card account to Klarna’s Loyalty Cards Feature, Klarna will process your data to provide the service.
This includes Klarna regularly connecting to the third-party card account to import membership points, tiers, and balance history.
You can stop this service at any time, thereby revoking Klarna’s access to your membership or loyalty card account. |
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between you and Klarna ceases. |
|
[52] If you have chosen to connect to Klarna's all-cookie acceptance service, Klarna will process your data to provide the service. You can stop this service at any time. |
From you:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
|
When the contract between you and Klarna ends. |
|
[53] If you have chosen to use Klarna's Open Banking service, Klarna will process your data to provide the service. The terms of the Open Banking service and the description of the included features are available here]. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (terms and conditions for the Open Banking service) with you (Article 6(1)(b) of the GDPR).
If the service processes sensitive personal data (from your transactions), the processing will take place based on your explicit consent (Article 9(2)(a) of the GDPR). For more information on this type of personal data, please see section 3]. |
When the contract between you and Klarna ceases to exist. |
|
[54] Display of product reviews from third-party review sites. |
From other sources:
|
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). In the balancing of interests, Klarna has determined that it has a legitimate interest in being able to carry out the processing of personal data, that such processing is necessary to achieve the intended purpose, and that our interest outweighs your right not to have your data processed for that purpose.
|
Until you, as the data subject, request the deletion of your reviews or they are deleted from the third-party review site. |
|
[55] Providing you with membership benefits if you are a Klarna Plus subscriber. This involves sharing your personal data with our partners. This list may change from time to time. See section 7.5.9 for information related to this data sharing. |
From you:
|
The processing is necessary for Klarna to perform a contract (User Terms) with you (Article 6(1)(b) GDPR). |
When your membership is terminated. |
|
[56] Not applicable in the market. |
|
|
|
|
[57] If you participate in the Klarna Referral Program as an Invited Consumer, we will share your data with the Referrer. |
From you:
|
The processing is necessary for Klarna to perform a contract (User Terms and Referral Program Terms) with you (Art. 6(1)(b) GDPR). |
When the contract between you and Klarna ceases.
|
|
[58] If you participate in the Klarna Referral Program as a Referrer, we will share your data with the Invited Consumer. |
From you:
|
The processing is necessary for Klarna to perform a contract (User Terms and Referral Program Terms) with you (Art. 6(1)(b) GDPR). |
When the contract between you and Klarna ceases.
|
4.6 Offers, invitations to events, and participation in sweepstakes communicated via social media, other Klarna channels, or when you contact us via social media or other digital channels.
|
Purpose of processing - What we do and why. |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data ceases. See paragraph 9 for when Klarna deletes the data. |
|
[59] If you sign up for an event published on social media, we will process your personal data to provide the requested service.
You can always unsubscribe by contacting us. Please refer to paragraph 12 for contact details. |
From you:
|
The processing is necessary for Klarna to perform a contract with you (regarding event participation) (Art. 6(1)(b) GDPR).
You can contact us for more information on how we reached this determination. Please refer to paragraph 12 for our contact details. |
When the event has taken place |
|
[60] If you choose to participate in a sweepstake organized by Klarna and/or its co-organizers and sponsors, we will process your personal data in order to manage the sweepstake, including winner selection and prize delivery. |
From you:
|
The processing is necessary for Klarna to perform a contract with you (Art. 6(1)(b) GDPR). |
We will cease processing your personal data for this purpose once the sweepstake you are participating in has concluded. |
4.7 Processing carried out by Klarna when you contact Klarna's customer service.
|
Purpose of processing - What we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
When the purpose of the use of personal data ceases. See paragraph 9 for when Klarna deletes the data. |
|
[61] To handle all matters submitted to Klarna's customer service. This includes retaining various forms of written conversations to document customer issues, as well as for security purposes and fraud prevention. |
From you:
From other sources:
|
Performance of contracts (Art. 6(1)(b) GDPR). |
Up to ten years, depending on the statute of limitations. Please refer to paragraph 9 for more information on our obligations and the right to retain information by law. |
|
[62] To help you resolve problems related to your purchase when using the customer service assistant.
This processing constitutes profiling. Please refer to paragraph 6 for more information on profiling. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6(1)(b) of the GDPR).
If the service processes information constituting sensitive personal data (e.g., from materials you choose to upload), our processing is based on your explicit consent (Article 9(2)(a) of the GDPR).
|
When the contract between you and Klarna ceases. |
|
[63] Quality and service improvement (to ensure satisfactory customer service). We may record telephone conversations and screen-sharing sessions between you and our employees for quality assurance purposes, to provide you with better products and services. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in improving its services, internal training, and quality control. We ensure that the particular processing this entails is necessary for achieving this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. As customers, you also have an interest in the quality of your interactions with Klarna.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please see contact details in paragraph 12. |
We process recordings of telephone conversations for up to 90 days for quality assurance purposes, and recorded screen-sharing sessions for up to 30 days for quality assurance purposes. |
|
[64] To document what was said when speaking with our customer service (to ensure that we have documented what was agreed or discussed). We use recorded telephone conversations between you and our employees, and manual and automatic annotations to document what was said. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in improving its services, internal training, and quality control, and in documenting communications with Klarna's customer service. We ensure that the particular processing this entails is necessary for achieving this purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. As customers, you also have an interest in ensuring unbiased means of documenting what was discussed.
You can contact us for more information on how we arrived at this determination or if you wish to object to the processing. Please see contact details in paragraph 12.
If there is information that constitutes sensitive personal data, our processing is based on your explicit consent (Article 9, paragraph 2, letter a) of the GDPR). |
90 days from the day the recording was made. |
|
[65] If you contact us via social media such as Facebook, Instagram or Twitter, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The above also applies to the response you receive from us. Klarna processes this information to answer your questions. |
From you:
From other sources:
|
Performance of contracts (Art. 6(1)(b) GDPR). |
When we have answered your question. |
|
[66] To manage voluntary blocks for the use of Klarna's services, for example, if you contact us and ask us to prevent you from using our services. The voluntary block can be revoked at any time by contacting us again. |
From you:
|
Based on your consent (Art. 6(1)(a) GDPR). |
When you inform us that you no longer want your use of our services to be blocked or you revoke your consent. Furthermore, we stop processing if and when you inform us that you no longer wish to be a Klarna customer. |
4.8 Processing performed by Klarna when using Klarna Mobile.
For the activities described in the Klarna Travel eSIM Terms, Klarna will process your personal data for the purposes described in the table below. The Klarna Travel eSIM Terms are available on this page.
|
Purpose of processing - What we do and why |
Types of personal data used for the relevant purpose and source from which they originate. Please refer to paragraph 3 for more information on the different types of personal data. |
Legal basis according to GDPR |
When the purpose for using personal data ceases. See paragraph 9 for when Klarna deletes data. |
|
[67] To provide the Klarna Travel eSIM (as an agent for Gigs Wireless LLC or the affiliated Gigs company with which it has contracted), including managing your plan, data consumption, and billing. |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6, paragraph 1, letter b) of the GDPR). |
When the contract between you and Klarna ceases. |
|
[68] To share your personal data with the categories of recipients described in section 7.7 (Gigs UK Ltd, Gigs Wireless LLC, or the affiliated Gigs company with which it has contracted) |
From you:
From other sources:
|
The processing is necessary for Klarna to perform a contract (Klarna's terms of use) with you (Article 6, paragraph 1, letter b) of the GDPR).
|
When the contract between you and Klarna ceases. |
5. How can you withdraw consent?
When Klarna uses your personal data based on your consent or explicit consent, you can withdraw it at any time. You can do this by sending an email to protezionedati@klarna.it or by using the contact details provided in paragraph 12. You can also delete information uploaded from Klarna's services or stop the functionality where such personal data is processed. In such cases, we will delete the information (or stop using it for the purpose for which consent was based). If you withdraw consent or delete uploaded information, you may not be able to use the service in cases where Klarna's processing of personal data is based on consent.
Finally: As described in paragraph 2 above, you also have the right to object to certain processing of personal data (for example, you can opt out of marketing communications). You also have the right to have certain personal data deleted, as described in paragraph 2.
6. Klarna's profiling and automated decisions that significantly impact you.
6.1 Your profiling as Klarna customers.
“Profiling” means any form of automated processing of personal data to evaluate certain personal aspects, for example, by analysing or predicting your personal preferences, such as shopping interests, or by analysing your financial information. At the same time, we compare your data with that of our other customers who use our services in a similar way and observe what their preferences have been.
The purposes of Klarna's profiling and the types of personal data used on each occasion and for each profiling are described in detail in paragraph 4 above. You can link the descriptions below with the purposes in paragraph 4 by using the numbers in brackets “[x]”. Profiling for these purposes does not significantly impact you as customers.
We use profiling for the following purposes:
-
to provide our personalised services, capable of adapting their content and recommendations based on what we believe is most interesting or relevant to you (this applies to Klarna's various functionalities, such as the product expert and shopping assistants, in interaction with our customer service assistant and the order in which different payment methods appear in Klarna's checkout), (Purposes [20, 39, 47, 49 and 62] in paragraph 4)
-
to determine the most efficient way to contact you regarding your outstanding debt (considering different channels, for example via SMS or email, or the timing of such communication), (Purpose [26] in paragraph 4) and
-
to provide you with personalised marketing on both our own and external platforms and services. (Purposes [14 and 44] in paragraph 4)
Our services employ machine learning and artificial intelligence models to ensure you receive the most relevant content possible.
If you have questions about how the profiling process works, please contact us. Contact details are available in paragraph 12. You can object to our marketing profiling at any time by contacting us (and we will stop profiling for marketing purposes). You can also stop profiling for our services by discontinuing the service.
6.2 Klarna's automated decisions that significantly impact you.
Automated decisions with legal effects, or automated decisions that significantly impact you, mean that some decisions in our services are fully automated, without our employees being involved. Such decisions have a significant impact on you as customers, comparable to legal effects. By making such decisions automatically, Klarna increases its objectivity and transparency in deciding whether to offer you such services. At the same time, you have the right to object to such decisions at any time. For more information on how to object to such decisions, please refer to the end of this paragraph 6.2. For these evaluations, we use machine learning and artificial intelligence models to ensure the highest possible quality in our decisions.
Automated decisions that significantly impact you also imply that profiling is carried out based on your data before the decision is made. This profiling is carried out to assess your financial situation (before deciding whether to offer or grant credit, or to initiate a payment) or to identify whether your use of our services involves a risk of fraud or money laundering, or to decide whether you are responsible for a purchase. We profile your behaviour and financial situation and compare this data with behaviours and conditions that indicate different risk levels to us.
Different user behaviours and conditions are evaluated and weighted through our automated decision models to obtain an overall score that results in the acceptance or rejection of your use of our Services. We may also decide to request further identification from you if we are unsure of your identity.
When does Klarna make automated decisions that significantly impact you?
The types of personal data used for each decision are described in paragraph 4. You can link the descriptions below with the purposes in paragraph 4 by using the numbers in brackets “[x]”.
We make this type of automated decision when:
-
We decide to approve your application, or to offer you, to use a credit service.
-
We decide not to approve your application, or not to offer you, to use a credit service.
Such automated credit decisions are based on data provided by you, data from external sources, such as credit reports from credit bureaux, and internal Klarna information relating to you, in case we have lent you money before. Klarna's credit model includes, in addition to information about you, numerous other factors, such as Klarna's internal credit risk level and the general repayment rates of our customers (based, for example, on the current product category). (Purposes [25 and 32] in paragraph 4). -
We decide whether you represent a fraud risk, if our processing shows that your behaviour indicates potential fraudulent conduct, that your behaviour is inconsistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions where we assess whether you represent a fraud risk are based on information provided by you, data from fraud prevention agencies (for details on those used, please refer to paragraph 7.2.3) and Klarna's internal information. Klarna continuously develops its fraud models to keep its services secure and closely studies how fraudsters operate in different markets (for example, which merchant or product categories are most subject to fraud attempts). (Purposes [6, 22 and 42] in paragraph 4).
-
We decide whether there is a money laundering risk, if our processing reveals that your behaviour indicates money laundering. In specific cases, Klarna also checks whether certain customers are listed on sanction lists. (Purposes [21, 30 and 35] in paragraph 4).
-
We decide whether you are responsible for a purchase you have disputed as “unauthorised” based on whether the information you provided, or that we have, indicates potential fraudulent behaviour or not. This is done by comparing what happened in your case with other transactions that indicate fraudulent behaviour. (Purpose [46] in paragraph 4).
Please refer to paragraph 7 for more information on whom we share information with regarding profiling during automated decisions.
If you are not approved based on the automated decisions described above, you will not have access to, or be able to use, Klarna's services, including our payment methods. Klarna has various security mechanisms to ensure that decisions are appropriate and correct. Such mechanisms include continuous overview of our decision models and random sampling in individual situations. If you have concerns about the outcome, you can always contact us, and we will assess whether the procedure was performed appropriately. You can also object according to the following instructions.
Your right to object to such automated decisions
You always have the right to object to an automated decision with legal consequences or to decisions that may otherwise significantly impact you (together with related profiling) by sending an e-mail to protezionedati@klarna.it. A Klarna representative will review the decision, taking into account any additional information and circumstances you provide to us.
7. With whom do we share your personal data?
When we share your personal data, we ensure that the recipient processes it in accordance with this privacy policy, for example by entering into data transfer or processing agreements with the recipients. Such agreements include all reasonable contractual, legal, technical and organisational measures to ensure that your data is processed with an adequate level of protection and in compliance with applicable law.
7.1 Categories of recipients with whom Klarna will always share your personal data, regardless of the service used.
7.1.1 Suppliers and sub-suppliers.
Description of recipient: Suppliers and sub-suppliers are companies that have the right to process personal data received from Klarna solely on Klarna's behalf, i.e. as data processors. Examples of such suppliers and sub-suppliers are software and data storage service providers, payment service providers, and business consultants, machine learning/artificial intelligence functionality providers, identity verification service providers, market research providers or Klarna Group companies.
Purpose and legal basis: Klarna needs access to services and functionalities from other companies when it cannot provide them itself. Klarna has a legitimate interest in being able to access such services and functionalities (Art. 6(1)(f) GDPR). We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.1.2 Klarna Group.
Description of recipient: Klarna Group companies.
Purpose and legal basis: This is necessary for Klarna to be able to provide you with services and functionalities. Klarna has a legitimate interest in being able to access and provide such services and functionalities (Art. 6(1)(f) GDPR). We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
When you shop at a foreign store (i.e. a store located outside the EU/EEA area) that has an agreement with another Klarna group company, the communication of your personal data between Klarna companies is necessary for the two Klarna companies to manage your payment and allow the foreign store to manage your purchase. The legal basis for such processing is the performance of a contract (Article 6 (1) (b) GDPR).
The receiving Klarna Group will process your personal data in accordance with the applicable privacy policy in your country (see list). More information on how Klarna protects your personal data when transferred outside the EU/EEA is provided in paragraph 8.
7.1.3 Proxies for your financial affairs.
Description of recipient: Klarna may share your personal data with a person who has the right to access it by virtue of a power of attorney.
Purpose and legal basis: Such processing is carried out to facilitate your contact with us (through agents), and is based on your consent (Art. 6(1)(a) GDPR).
7.1.4 Authorities.
Description of recipient: Klarna may provide necessary information to police, financial, tax or other authorities and courts.
Purpose and legal basis: Personal data is shared with the authority if required by law, in some cases at your request, or if necessary for the management of tax deductions or for combating crime. An example of a legal obligation to provide information is when it is necessary to take measures against money laundering and terrorist financing. Depending on the authority and the purpose, the legal bases are the fulfillment of a legal obligation (Art. 6(1)(c) GDPR), the performance of a contract with you (Art. 6(1)(b) GDPR) or Klarna's legitimate interest in protecting itself against possible crimes (Art. 6(1)(f) GDPR).
7.1.5 Sale of assets or undertakings.
Description of recipient: In the event that Klarna sells assets or undertakings, it may transfer your personal data to a potential buyer. If Klarna or a significant part of Klarna's assets are acquired by a third party, Klarna's customer personal data may also be shared.
Purpose and legal basis: Klarna has a legitimate interest in being able to carry out such transactions (Art. 6(1)(f) GDPR). We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.2 Categories of recipients with whom Klarna shares your personal data when you use Klarna's payment methods, Klarna in a store, or choose to pay by debit or credit card at the Klarna checkout in a store.
7.2.1 Stores.
Description of recipient: By stores, we mean the stores you have visited or where you make purchases (which may include the related group companies if you have been informed of this by the store).
Purpose and legal basis: To enable the store to execute and manage your purchase and your relationship with the store itself or its group companies, e.g. by confirming your identity, sending you products, managing inquiries and disputes, to prevent fraud and, where appropriate, to send relevant marketing. The store's privacy policy applies to the processing of your personal data shared with and processed by the store. You will generally find a link to the store's privacy policy on its website. The legal basis for sharing data with stores is partly the performance of a contract (Art. 6(1)(b) GDPR), insofar as the data sharing takes place for the performance of the contract between you and the store, and partly the legitimate interest of Klarna and the store (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.2.2 Payment service providers, cash service providers, card networks and financial institutions.
Description of recipient: Payment service providers (including digital wallets), cash service providers, card networks and financial institutions provide services to you, stores and/or Klarna for the implementation, facilitation and administration of electronic payments through different payment methods, such as credit cards and bank-backed payment methods (e.g. direct debit and bank transfer).
Purpose and legal basis: Some stores use payment service providers and cash service providers with whom they share your information for payment and purchase management. This sharing takes place in accordance with the privacy policies of the stores or cash service providers. The store may also allow Klarna to share your information with the payment service provider responsible for processing your payment. Some payment service providers also receive your information from Klarna, or collect and use your information independently, in accordance with their privacy policies or to prevent fraud. This is the case, for example, for digital wallet providers. In addition, Klarna may share your information with your card scheme and other financial institutions it relies on to manage the payment method or to execute transactions on your account, in order to complete transactions, prevent fraud or money laundering activities. Sharing with payment service providers, cash service providers, card schemes and financial institutions is done to enable a payment method or to execute transactions initiated by you and is done to fulfill the contract with you (Article 6(1)(b) GDPR).
When sharing takes place with financial institutions on which Klarna relies to process your payment, or otherwise with payment service providers, Klarna also shares your data on the basis of Klarna's and the recipient's legitimate interest in preventing abusive activities, including fraud (Art. 6(1)(f) GDPR). We guarantee that the processing involved is necessary to pursue this interest and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights.
7.2.3 Risk detection agencies and identity verification service companies
Description of recipient: Your personal data is shared with risk detection agencies and companies that provide identity verification services.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent or abusive activities. The companies we work with are listed here. Please note that these companies process your data in accordance with their privacy policies.
Klarna shares your information, as well as information about whether a particular transaction may constitute potential fraud, on the basis of Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as risk detection agencies and identity verification service companies have information about fraudulent activities and identity confirmation that are important to Klarna, as they can be used as input to reduce the level of unauthorized operations.
This sharing is also in your interest, as it helps prevent your information from being used to make unauthorized purchases. We guarantee that the processing involved is necessary to pursue this interest and that our interest outweighs your right to prevent your information from being processed for this purpose. You have the right to object to such processing for reasons related to the circumstances of your particular case. Please refer to paragraph 2 for more information on your rights. You may also contact the entities listed in the link above to exercise the same rights described in paragraph 2 with respect to them.
7.2.4 Google.
Description of recipient: When you use Google Maps in the checkout or on the Klarna app (e.g. when searching for your address in the address bar, viewing "stores near me" or asking about nearby promotions and offers), your personal information will be shared with Google. Google will process your data in accordance with the terms of service and privacy policy of Google Maps/Google Earth.
Purpose and legal basis: Klarna shares this information on the basis of its legitimate interest in conducting its business (Art. 6(1)(f) GDPR), as Google Maps allows you to find the address functionality at checkout and to show maps and promotions related to your current location on the Klarna App. We assure you that the resulting processing is necessary for the achievement of the processing purpose and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, for reasons relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.2.4 pagoPA.
Description of the recipient: If you choose to make payments to public entities via pagoPA, Klarna will share certain information with pagoPA S.p.A. Klarna will share the information you provide, including invoice details and, if you choose to pay vehicle tax via this functionality, vehicle data and license plate number. pagoPA will use this information to settle payments to the competent public entities.
Purpose and legal basis: for pagoPA to be able to execute and manage the payment to public entities on your behalf. The pagoPA privacy policy applies to the processing of your personal data shared with and processed by this entity. For more information, please visit the pagoPA website here. The legal basis for sharing data with pagoPA is the performance of a contract (Art. 6(1)(b) GDPR), insofar as the data sharing takes place for the performance of the contract between you and pagoPA or the competent public entity.
7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna's credit-granting payment methods, the Klarna card, pay with Instore, pay with Klarna via digital wallets, or the Shopping Service with a one-time card.
7.3.1 Credit reporting agencies.
Description of recipient: If you request to use a Klarna service that involves credit granting (see paragraph 4.3 on which Klarna services involve credit), we will share your personal data with credit reporting agencies. Sharing does not occur for small amounts or when we already have sufficient information.
Purpose and legal basis: Your personal information is shared with credit agencies to assess your creditworthiness in relation to your credit application, to confirm your identity and contact information, and to protect you and other customers from fraud. This data sharing constitutes a credit relationship.
In Italy, Klarna sends your address, date of birth and tax code to the credit agency to receive the result of the search conducted on you.
Our credit search will affect your credit rating with the credit agency. Klarna will also share information about your repayments (including undisputed arrears and defaults) with the credit agency, and such data may be reported in default registers, which may also affect your credit score with the credit agency, and be consulted by third parties. The credit agency will process your information in accordance with its privacy policies. You can view the agencies we work with here.
In Italy, Klarna sends your address, date of birth and social security number to the credit agency to receive the result of the search conducted on you. In addition, on a monthly basis, Klarna shares with the credit agency information relating to your solvency, your credit commitment, credit status (i.e. active, paid, defaulted, overdue) and related supporting data.
Klarna shares your information based on Klarna's legitimate interest in conducting its business (Art. 6(1)(f) GDPR), as credit bureaus have information about your financial situation, which is important for Klarna to ensure a proper credit assessment and to avoid granting credit to consumers who are unable to repay it. We assure you that the resulting processing is necessary for the pursuit of this interest and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights. You may also contact the parties listed in the aforementioned link to exercise the same rights as described in paragraph 2 with respect to those parties.
Klarna retains your credit information received from a credit agency only in the form of written data. To receive a readable version, we suggest you contact the credit bureau directly from which you learned that Klarna requested a credit report.
7.3.2 Debt collection companies (for overdue debts).
Recipient description: Klarna may need to share your data when selling or outsourcing the collection of overdue and unpaid debts to third parties, such as a debt collection company.
Purpose and legal basis: This data is shared for the collection of your overdue debts. Debt collection companies process personal data in accordance with their own privacy policies or solely on behalf of Klarna as data processors. Debt collection companies may report your unpaid debts to credit bureaus or authorities, which may affect your creditworthiness and your ability to obtain credit in the future. This data is shared based on our legitimate interest in collecting and assigning debts (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in the collection and assignment of debts. We assure you that the resulting processing is necessary for the fulfillment of the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose. You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.3.3 VISA and digital wallet providers.
Recipient description: We share information about you and your purchases when you use your Klarna card with VISA and with members of the VISA card network. If you add your Klarna card or an Instore card to your digital wallet, or choose to pay with Klarna through your digital wallet, we may need to share your information with the provider of that wallet. In such a case, the data will be processed in accordance with that provider's privacy policy.
Purpose and legal basis: Sharing occurs to the extent necessary for the execution of card transactions, fraud prevention, and compliance with VISA card network rules. If you renew your Klarna card or receive a new one, we will transmit this information to VISA, so that VISA can inform third parties with whom you have chosen to save your Klarna card details (e.g., for recurring transactions). Sharing is carried out for the performance of the contract with you (Art. 6(1)(b) GDPR).
7.3.4 Debt buyers (for open debts).
Recipient description: Klarna may assign your open debt to debt buyers.
Purpose and legal basis: Upon the assignment of your debt to a buyer, and continuously until the debt is extinguished, Klarna will share your contact and identification information (name, date of birth, social security number, address, and phone number), information about your financial situation (such as outstanding credit, repayments, and any negative payment history in relation to the current credit), as well as information about the goods or services associated with the credit. The buyer will process your personal data in accordance with its own privacy policy, about which you will receive information upon the assignment of the debt.
The sharing of personal data with different buyers is based on our legitimate interest in assigning outstanding debts as part of our business operations (Art. 6(1)(f) GDPR). We assure you that the resulting processing is necessary for the pursuit of this interest and that our interest outweighs your right to prevent the processing of your personal data for this purpose. You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.4 Categories of recipients when using Klarna's account services (Klarna Balance, savings, and payment accounts).
7.4.1 Credit institutions and other financial institutions.
Recipient description: We share your information with credit institutions and other financial institutions (such as other banks) when you make transactions or payments to other accounts.
Purpose and legal basis: If you have made payments to a Klarna account, Klarna will process the information received from the bank you used for the transaction, such as contact and identification data and payment information. If you make transactions or payments to accounts at other banks, Klarna will transmit some of your contact and identification data, as well as payment information, to the recipient, as well as to the recipient's credit or financial institution. Sharing is carried out for the performance of the contract with you (Art. 6(1)(b) GDPR).
7.4.2 Other Klarna customers
Recipient description: We share your information with other Klarna customers when they make an instant transfer to you from their Klarna Account, when you request a payment from such customers, when you make a payment to them, or when both you and another Klarna customer choose to upload your address book to the Klarna App.
Purpose and legal basis: When someone makes an instant transfer to you, they will see that you are a Klarna user. This sharing is necessary to fulfill the contract with you (Art. 6(1)(b) GDPR), allowing you to make and receive payments. If you have not deactivated in-app discoverability features in the Klarna App settings, the other customer will also see your name and profile picture. This is based on our legitimate interest (Art. 6(1)(f) GDPR) in showing such information. You can control what information is shown to other users through your app settings. By default, your name is visible to those who make a payment to you.
You can give your consent for us to synchronize your phone contacts with Klarna. However, to see which of your contacts are Klarna customers, both you and the other Klarna customers must (a) appear in each other's address books, and (b) have synchronized your respective address books.
If you are not a Klarna user, your phone number will be uploaded to our systems, but it will be double-hashed. If you later become a Klarna user and choose to synchronize your address book, you will appear as a Klarna user in the contact lists of your contacts who are Klarna users and who have synchronized their respective address books, provided that you are also in their address book.
7.5 Categories of recipients with whom Klarna shares your personal data when you use the services provided by Klarna's terms of use.
You can find Klarna's terms of use here.
7.5.1 Affiliate Networks.
Recipient description: When you choose to click on a sponsored link or make a purchase through a cashback offer within Klarna's services, including on our website, that leads to a store, product, or service, you will be redirected to another company's website via a third party, known as an affiliate network. Here you can check which affiliate networks Klarna collaborates with (presented in the left column). Affiliate networks will process your device information in accordance with their privacy policies (you will find these privacy policies in the right column at the same link above). The store you visit through a sponsored link determines which affiliate network processes your information. Typically, a store only works with one affiliate network. You can get more information about which network by contacting us (or the store).
Purpose and legal basis: The affiliate network may install tracking technology on your device that contains information about the fact that you clicked on that link; this information is then used to document your visit to the store in order to calculate a potential commission due to Klarna. This processing is based on a balancing of interests (Article 6(1)(f) of the GDPR). In balancing interests, Klarna has determined that it has a legitimate interest in providing you with sponsored links to promote stores within its services, including on its website. We assure you that the resulting processing is necessary for the fulfillment of the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
Additionally, we need to share information with our affiliate networks to determine your eligibility for cashback under the Klarna Cashback Program. This includes confirming that you have met the criteria specified in our cashback offers. The shared data also serves to determine the amount of cashback potentially due. Processing for our cashback service is based on the performance of a contract (Art. 6(1)(b) GDPR).
7.5.2 Google.
7.5.2.1 reCAPTCHA
Recipient description: When you use Klarna's mobile application (including through our web portal), Google will collect device information through Google's reCAPTCHA service implemented therein (in some cases along with additional information you choose to enter into the reCAPTCHA service), and Klarna will share the phone number used during verification.
Purpose and legal basis: Klarna processes this information based on Klarna's legitimate interest in conducting its business (Art. 6(1)(f) GDPR), as the reCAPTCHA service prevents misuse of our services (e.g., preventing bots from attempting to log in, or skyrocketing SMS traffic). Google will process this information in accordance with its own terms of service and its own privacy policy. We assure you that the resulting processing is necessary for the fulfillment of the purpose of the processing and that our interest outweighs your right to prevent the processing of your data for this purpose.
You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.5.2.2 Google Maps
Recipient description: To show where your package will be delivered on an integrated map, we share the relevant delivery address with Google. Google processes your data in accordance with Google Maps/Google Earth terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR). By using Google Maps, we are able to show the delivery address on an integrated map. We ensure that this processing is necessary to pursue this interest and that our interest outweighs your right not to have your data processed for this purpose. You have the right to object to such processing, on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights and how to exercise them.
7.5.2.3 Youtube
Recipient description: When you use Klarna's various search features where we display content from YouTube, YouTube and Google will process your device information through YouTube's API services. YouTube/Google will process this information in accordance with their respective terms of service and their privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna's legitimate interest in conducting its business (Article 6(1)(f) of the GDPR). By using YouTube, we can show you additional content. We ensure that the processing involved is necessary to pursue this interest and that our interest outweighs your right not to have your information processed for this purpose.
You have the right to object to such processing on grounds relating to your particular situation. Please refer to paragraph 2 for more information on your rights.
7.5.3 Partners within the Financial Details service and the offers and benefits program.
Recipient description: Partners within the Financial Details service and the offers and benefits program.
Purpose and legal basis: In the event that you choose to take advantage of Klarna's offers and benefits within the Financial Details service or the offers and benefits program, Klarna will share with its business partners the personal data necessary to access the offer (including the fact that you are a Klarna customer). Each offer specifies the data that will be shared. Data is shared for the performance of the contract between you and Klarna (Art. 6(1)(b) GDPR).
7.5.4 Logistics and transport companies.
Recipient description: Logistics and transport companies.
Purpose and legal basis: Klarna will share your personal data with logistics and transport companies that deliver the ordered goods, if you have subscribed to the shipment tracking service. Examples of the information we share are contact and identification data and tracking numbers.
Logistics and transport companies process your data in accordance with their privacy policies. Data is shared for the performance of the contract between you and Klarna (Art. 6(1)(b) GDPR).
7.5.5 Advertising partners.
Recipient description: Third-party advertising partners.
Purpose and legal basis: Klarna will share your personal data with third-party advertising partners to show you more relevant Klarna ads on sites other than Klarna and non-Klarna ads in the Klarna App, marketing channels, and on third-party sites. This is based on your interaction with Klarna’s products and services and your Klarna profile and includes audience segmentation and activation. Klarna will also share such data to measure the performance of advertising. Some third-party advertising services and digital advertising platforms will use your data for their own purposes and in accordance with their respective privacy policies, which are available here, where you can also see a list of the third parties we use. Klarna acts as joint controller with some of these third parties. You can find more information about such agreements and how to exercise your rights here. You can also obtain further information regarding this sharing or how to exercise your rights toward these companies by contacting us.
The processing is based on your consent (in accordance with Article 6, paragraph 1, letter a), of the GDPR). You can withdraw your consent at any time via the tracking technology settings in the Klarna App. You can also object to the processing – with the same effect as withdrawing consent. You can refer to section 2 for more information about your rights.
This processing may constitute profiling, with the aim of personalizing the service content based on what we believe may be of interest to you. For more information on profiling, please refer to section 6.
7.5.6 SIWK third-party apps and services
Description of recipient: When you sign in with Klarna (via “SIWK”) to a third-party app store or online service, Klarna shares your personal data with the third-party app or service.
Purpose and legal basis: Your personal data is shared to enable the SIWK functionality. This data sharing is performed to fulfill the contract with you (Article 6, paragraph 1, letter b) of the GDPR).
7.5.7 Risk detection agencies and identity verification service providers
Description of recipient: Your personal data is shared with risk detection agencies and companies that provide identity verification services.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent or abusive activities. The companies we work with are listed here. Please note that these companies process your data in accordance with their privacy policies.
Klarna shares your information, as well as information regarding whether a particular transaction may constitute potential fraud, based on Klarna's legitimate interest in carrying out its business (Article 6, paragraph 1, letter f) of the GDPR), as risk detection agencies and identity verification service providers have information about fraudulent activities and identity confirmation that is important for Klarna, as it can be used as input to reduce the level of fraudulent transactions.
This sharing is also in your interest, as it helps prevent your information from being used to make unauthorized purchases. We ensure that the processing involved is necessary to pursue this interest and that our interest outweighs your right not to have your information processed for this purpose. You have the right to object to this processing on grounds relating to your particular situation. Please refer to paragraph 2 for more information about your rights. You can also contact the parties listed in the link above to exercise the same rights described in paragraph 2 with them.
7.5.8 Resale Platforms.
Description of recipient: Marketplaces and market platforms that enable the resale of products and with which Klarna has partnered from time to time ("Resale Platforms"). A list of currently available Resale Platforms can be found here. We share information about the goods/services you wish to resell.
Purpose and legal basis: If you choose to resell a product via the Klarna App, Klarna will redirect you to the Resale Platform and pre-fill your listing by sharing information about the purchased product with the Resale Platform. Resale Platforms will process this information in accordance with their terms of service and privacy policies. The sharing is carried out to fulfill the agreement between you and Klarna (Article 6(1)(b) GDPR).
7.5.9 Klarna Subscription Partners
Description of recipient: When you become a Klarna Subscription subscriber, we may share your personal data with our partners as necessary to provide you with the intended benefits. A list of current Klarna Subscription Partners is available here.
Purpose and legal basis: If you choose to become a Klarna Subscription subscriber, to provide you with specific benefits under the Klarna Subscription. The sharing is carried out to fulfill the agreement between you and Klarna (Article 6, paragraph 1, letter b) GDPR).
7.6 Categories of recipients with whom Klarna shares your personal data if you contact our customer service through social media or participate in a sweepstakes co-organized by Klarna.
7.6.1 Social media.
Description of recipient: Social media companies such as Facebook, Instagram, or Twitter.
Purpose and legal basis: If you contact us through social media such as Facebook, Instagram, or Twitter, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The sharing is carried out for the performance of the contract with you (Article 6(1)(b) GDPR).
7.6.2 Sweepstakes co-organizers and sponsors
Description of recipient: Sweepstakes co-organizers and sponsors – third-party partners who organize, sponsor, or otherwise support a sweepstakes you choose to participate in and with whom personal data is shared, where necessary, to manage the sweepstakes and deliver prizes.
Purpose and legal basis: If you decide to participate in a sweepstakes organized by Klarna and/or its co-organizers and sponsors, your personal data will also be collected and processed by these companies, in accordance with their respective privacy policies. The sharing is carried out for the performance of the contract with you (Article 6(1)(b) GDPR).
7.7 Categories of recipients with whom Klarna shares your personal data if you use Klarna Mobile.
7.7.1 Gigs Wireless LLC.
Description of recipient: Gigs Wireless LLC (or the Gigs affiliate with which you have contracted) is Klarna's network partner for providing the Travel eSIM. Klarna acts as an agent for Gigs to market the Travel eSIM, facilitate registration and billing, and also acts on behalf of Gigs to provide administrative and customer support, such as plan activation, billing, and assistance.
Purpose and legal basis: To provide you with the Travel eSIM, Klarna shares your contact and identification data, payment information, and customer service contact information with Gigs. This sharing is necessary for the fulfillment of the contract between you and Klarna (Article 6(1)(b) GDPR).
8. When can we transfer your personal data outside the EU/EEA, and how do we protect it?
To provide our services and carry out our activities, it is necessary to transfer your personal data outside the EU/EEA. This occurs when we share your information within the Klarna Group or with a provider, sub-supplier, or store operating outside the EU/EEA. Klarna always ensures that the same high level of protection provided by the GDPR is applied to your personal data, even when data is transferred outside the EU/EEA. Your rights relating to personal data (described in detail in paragraph 2) are not affected when data is transferred outside the EU/EEA. Further information about the recipients with whom Klarna shares your data can be found in paragraph 7.
If the store where you shop is located outside the EU/EEA, sharing with that store means that your data will also be transferred to that country outside the EU/EEA.
Some Klarna providers use Binding Corporate Rules (“BCRs”) when transferring personal data outside the EU/EEA within their corporate group. BCRs have been approved by an EU data protection authority and ensure the same high level of protection for your personal data when transferred.
You can contact us for more information on our security measures. Contact details are available in paragraph 12. You can find more information on which countries are deemed to have an "adequate level of protection" on the European Commission website. You can obtain more information on European Commission standard contractual clauses here and more information on Binding Corporate Rules (“BCRs”) here.
Security measures employed by Klarna in transferring personal data outside the EU/EEA
Countries outside the EU/EEA may have laws that allow public authorities to request access to personal data stored in the country for law enforcement or national security purposes. Regardless of whether your personal data is processed by us or our providers, we will ensure that a high level of protection is guaranteed during such data transfers and that appropriate safeguards have been adopted, in accordance with applicable data protection requirements (such as the GDPR). Such appropriate safeguards are intended, by way of example only, to ensure:
-
that the European Commission has determined that the country outside the EU/EEA to which your personal data is transferred has an adequate level of protection, corresponding to the level of protection guaranteed by the GDPR. This means, for example, that personal data is protected from unauthorized disclosure, and that you can still exercise your rights in relation to your personal data, or
-
that the European Commission's standard contractual clauses have been entered into between Klarna and the recipient of personal data outside the EU/EEA. This means that the recipient guarantees the application of the level of protection of your personal data guaranteed by the GDPR, and that your rights are protected. In such cases, we also assess whether there are laws in force in the receiving country that affect the protection of your personal data. If necessary, we take technical and organizational measures so that your data remains protected during transfer to the country concerned outside the EU/EEA.
-
that the transfer is covered by the EU-US Data Privacy Framework. This is an opt-in certification system for US companies, administered by the US Department of Commerce. The Data Privacy Framework includes a set of applicable principles and requirements that must be certified by the US company, ensuring that your data is still adequately protected.
Notwithstanding the foregoing, if the store where you choose to shop is located in a country outside the EU/EEA, our sharing of data with that store (and with the Klarna entity with which that store has contracted) means that your personal data will be transferred and processed in this country outside the EU/EEA. Click here to access the privacy policies of other Klarna entities in the Klarna Group. Otherwise, it would not be possible to manage your purchase. Klarna primarily relies on the European Commission's standard contractual clauses to ensure the protection of user personal data for such data transfers, but, as indicated above, the countries where the foreign store is located may have laws that prevent effective protection through standard clauses. Even in this case, your personal data will still be transferred to the foreign store (or the local Klarna entity of the foreign store), to the extent that the data transfer is necessary to manage your specific purchase.
9. How long do we keep your personal data
The time Klarna retains your personal data depends on the purpose for which Klarna uses such personal data:
-
Personal data used for the contractual relationship between you and Klarna is generally kept for the duration of the contractual relationship and thereafter for a maximum of 10 years based on limitation periods.
-
Personal data that Klarna is legally obliged to retain, for example under anti-money laundering laws or accounting laws, is generally kept for 5 and 7 years respectively.
-
Personal data not used for the contractual relationship with Klarna or for which Klarna has no legal obligation to retain is kept only for as long as necessary to fulfill the respective purpose of the data processing (normally, 3 months). More information can be found in the table in paragraph 4.
In some limited cases, it may be necessary to retain personal data for a longer period due to capital adequacy laws that Klarna must comply with.
The above legal obligations mean that Klarna cannot delete your personal data, even if you request it, as described in paragraph 2. In the absence of a legal obligation to retain personal data, we must instead assess whether we may need the personal data to protect Klarna from legal claims.
The fact that we have a legal obligation to retain your personal data does not mean that we are also allowed to use such data for other purposes. Klarna will assess for each specific purpose how long we may use your personal data. More information can be found in paragraph 4.
10. How we use cookies and other types of tracking technologies
To provide you with a personalized and smooth experience, Klarna uses cookies and similar tracking technologies across its multiple interfaces, such as its website, Klarna mobile application, and a store's checkout that uses Klarna. Information on the tracking technology used by Klarna and how to accept or reject it in each interface is available.
11. Updates to this privacy policy
We are constantly working to improve our services so that you can enjoy a smooth user experience. This may require changes to existing and future services. If such improvement requires notice or consent in accordance with applicable law, you will be informed or given the opportunity to express your consent. It is also important that you refer to this privacy policy each time you use one of our services, as the processing of your personal data may differ from a previous use of the service in question.
12. Klarna's contact details
Klarna Bank AB (publ) is registered in the Swedish companies register under no. 556737-0431 and has its registered office at Sveavägen 46, 111 34 Stockholm.
Klarna has appointed a data protection officer and a team of data protection specialists. We also have a number of customer service teams that deal with data protection issues. You can contact all of them at protezionedati@klarna.it. If you wish to specifically contact Klarna's data protection officer, please indicate this in the subject line.
Klarna Bank AB (publ) operates in compliance with Swedish data protection legislation. Please visit www.klarna.it for more information about Klarna.