Nexi Smart Receipt Privacy Note

1. DEFINITIONS

For the purpose of these User Terms and Conditions (“Terms and Conditions”) the following definitions apply:

“Service” means the Nexi Engage Solutions including the Nexi Smart Receipt mobile application, website and related services.

“User” means a person who has registered a Nexi Smart Receipt account.

“Merchant” means a store or online shop integrated with Nexi Smart Receipt that provides digital receipts.

“Registered Card” means a payment card registered by the User in their Nexi Smart Receipt account.

2. SIGN-UP

2.1

The Services offered by the Nexi Group (“Nexi”) on its webpage https://www.nexigroup.com/en/business/consumers/smart-receipt/ or on the Nexi Smart Receipt app may be used by all users with a valid payment card, email and mobile phone number.

2.2

When signing up for the Nexi Smart Receipt, the User will be requested to enter payment card details, mobile phone number and e-mail, which Nexi uses for automatic identification of the User when making a purchase in-store or online in a shop signed up for the Nexi Smart Receipt app. The User must ensure that the payment card details, mobile phone number and e-mail are up to date.

2.3

By creating an account and beginning to use the Service, the User acknowledges that the Service may be provided immediately.

If the User wants to make use of the right to cancellation, the User must send an e-mail to support-engage@nexigroup.com and request the cancellation of the sign-up.

2.4

The User is obliged to treat username and password for the Nexi Smart Receipt as confidential and must not divulge such information to any third parties. It is therefore also specifically prohibited for third-party services to use username and password for web scraping and other automated ways of downloading a User's data.

In case the User has any suspicion of abuse or misuse of a user account, the User must inform Nexi immediately by sending an e-mail to support-engage@nexigroup.com.

If Nexi has a suspicion that a user account is being abused or misused Nexi is entitled to temporarily or permanently close down the account and inform the authorities of such suspicion.

2.5

By signing up to the Nexi Smart Receipt, the User accepts these terms and conditions and that Nexi may e-mail or text information to the User regarding important information about the system (e.g. downtime, maintenance, errors etc.).

3. THE SERVICE

3.1

A sign-up for the Nexi Smart Receipt includes a personal account where the User may provide payment card details, e-mail and mobile phone number which are used for automatic identification of the User and the User's receipts during purchases in-store or online.

Nexi relies on Merchants to transfer receipt data to the Service. Nexi cannot guarantee that all purchases made by the User will result in a digital receipt being available in the Service.

Any complaints regarding the services offered or any other kind of complaints must immediately be sent to support-engage@nexigroup.com.

4. PRICE

4.1

It is free of charge to create an account.

5. PERSONAL DATA

5.1

Nexi will process personal data about the User in order to provide the Service to the User. Please refer to our privacy notice available here.

Personal data collected through cookies or other technologies is processed in accordance with Nexi Privacy Policy available at https://www.nexigroup.com/en/business/consumers/smart-receipt/.

6. USER OBLIGATIONS

6.1

The User must always ensure that the information in the User account especially the card number details, e-mail and mobile phone number are correct and updated.

6.2

The User is not allowed to enter payment card details, e-mail or mobile phone number which do not belong to the User.

Any misuse or abuse will be reported to the authorities.

6.3

In case the User detects any abuse or misuse or experiences any errors, the User is obliged to inform Nexi immediately by sending an e-mail to support-engage@nexigroup.com.

6.4

Information from Nexi to the User will normally be sent to the e-mail or mobile phone number provided by the User.

6.5

The User is responsible for accessing and using the Nexi Smart Receipt app in a secure and reliable computer environment.

7. NEXI OBLIGATIONS

7.1

Nexi is obliged to ensure that the User has the possibility to view and access a digital receipt for those purchases which are made with the payment card, e-mail and/or mobile phone number registered in the User's account and in shops signed up for Nexi.

Nexi will use reasonable efforts to make digital receipts available through the Service but cannot guarantee uninterrupted availability of receipt data.

Access to the digital receipt requires that the shop transfers the receipt to Nexi.

7.2

As long as the User exist in the Nexi Smart Receipt app, Nexi is obliged to store receipt data and make them accessible for the User.

The User can retrieve own receipt data and e-mail them from within the Nexi Smart Receipt app to the User's own e-mail account.

7.3

Nexi is obliged to ensure that the terms and conditions are always up to date on https://www.nexigroup.com/en/business/consumers/smart-receipt/.

Nexi may update these Terms and Conditions from time to time. Users will be notified of material changes via e-mail or through the Service.

If a change is not to the benefit of the User, such a change will take effect one month after the terms and conditions have been updated on https://www.nexigroup.com/en/business/consumers/smart-receipt/.

8. TERMINATION

8.1

The User may delete the Nexi Smart Receipt account through Nexi Smart Receipt app or by contacting the Storebox support.

8.2

Nexi may delete the User from the Nexi Smart Receipt app with at least one month notice to the end of a month.

Nexi may may delete the User from the Nexi Smart Receipt app with immediate effect if Nexi is required to make costly changes to the solution due to new or existing regulations.

Nexi may also temporarily suspend or restrict access to the Service where necessary for security, maintenance, or legal compliance.

9. BREACH

9.1

If the User is in breach of these terms and conditions, Nexi is entitled to delete the User from the Nexi Smart Receipt app with immediate effect.

9.2

Any attempt to misuse, disrupt, manipulate or fraudulently interact with the Service constitutes a breach of these terms and conditions.

10. DELETION OF DATA

If the User profile is deleted from the Nexi Smart Receipt app by Nexi and this is not due to breach by the User, the User has one month to retrieve information from Nexi.

Nexi is entitled to delete all User data 1 month after the User profile is deleted from the Nexi Smart Receipt app.

Nexi may retain certain information where required by applicable law or for legitimate operational purposes.

11. INTELLECTUAL PROPERTY RIGHTS

Intellectual property rights to the different system and components including names, logos, programming, software, databases, catalogs, design, graphics, pictures and texts belong to Nexi or partners of Nexi and are protected by intellectual property rights.

12. DISCLAIMER / LIMITATION OF LIABILITY

NEXI shall not be liable for indirect, incidental, consequential or special damages including loss of data, loss of profit, or loss resulting from digital receipts not being available.

Nexi’s total liability under these Terms shall not exceed EUR 100.

13. LAW AND VENUE

The Terms and Conditions and any dispute arising out of, in relation to, or in connection with it, shall be governed by the laws of Denmark

In the event that a dispute or disagreement cannot be resolved by cooperation and resolution in good faith, the parties agree that the dispute shall be settled by court resolution and submit to the exclusive jurisdiction of the courts of Denmark with the court in Copenhagen as the court in first instance.

2. The type of personal data we process, our purpose and legal basis

pri

Topic	Nexi Smart Receipt app – eReceipt: Customer	Nexi Smart Receipt app – eReceipt: Merchant	Nexi Loyalty Link (Card Link)
When do we collect personal data?	The Nexi Smart Receipt app lets you see your receipt electronically when you make a purchase in stores, provided that they have signed up to Nexi Smart Receipt. eReceipt is a digital copy of the physical receipt.	Upon signup to Nexi Smart Receipt as a merchant.	Data is processed to enable consumers to receive digitalized receipts.
What kind of personal data?	- Customer number - Customer purchase history - Email address - Log data - Full name - PAN (account number) - Payment information - Time of transaction - Transaction amount - Username/ID	- Merchant name (one man company) - Name of cashier (if shown on eReceipt) - Full name - Email address	- Customer number - Customer purchase history - Email address - Log data - Full name - PAN (account number) - Payment information - Time of transaction - Transaction amount - Username/ID - Merchant name (one man company)
What is the purpose?	The purpose is to provide you with the services you have signed up to offered by Nexi Smart Receipt, i.e., eReceipt. Nets has a legitimate interest in processing personal data pertaining to the cashier only insofar that name is shown on the receipt.	The purpose is to provide your customers (i.e., the end user) with the Nexi Smart Receipt services. Nets has a legitimate interest in processing personal data pertaining to the cashier only insofar that name is shown on the receipt.	In order to provide you with the services offered by Nexi Smart Receipt, i.e., eReceipt, we must enable Loyalty Link to connect your card(s) with the eReceipt solution. Nets has a legitimate interest in processing personal data pertaining to the cashier only insofar that name is shown on the receipt.
What is the legal basis?	GDPR Article 6(1), litra b (performance of a contract). GDPR Article 6(1), litra f (legitimate interest).	GDPR Article 6(1), litra b (performance of a contract). GDPR Article 6(1), litra f (legitimate interest).	GDPR Article 6(1), litra b (performance of a contract). GDPR Article 6(1), litra f (legitimate interest).
Who are the recipients?	We do not share your personal data with third parties. Your personal account in Nexi Smart Receipt is deleted immediately after you confirm the termination. Upon your request, we will delete receipts 90 days after the request.	We do not share your personal data with third parties. Your personal data related to Nexi Smart Receipt as a merchant is deleted three (3) years after you terminate your agreement with us.	Transaction data is sourced from NDS and CAPS. Your personal data in Nexi Smart Receipt is deleted 30 days after you terminate your account at the latest.
What is the storage period?	Account deleted immediately after termination confirmation. Receipts deleted 90 days after request.	Personal data deleted three (3) years after agreement termination.	Personal data deleted 30 days after account termination.

3. Where does your personal data come from?

The personal data what we process are mainly obtained from you, but it depends on the facts and the specific circumstances. For instance, we may verify your national identification number against the central national CPR register in Denmark or similar national registers in other countries than Denmark.

Generally, we will not use your personal data for other purposes, which are not compatible with the original purpose for which the personal information was collected, without your explicit consent. Compilation or anonymisation for statistical purposes is considered compatible with the original purpose.

4. Who is engaged when we are processing your personal data?

We make use of service suppliers for our IT operation(s) and IT operational support. Such suppliers provide the following services relating to the Nexi Smart Receipt products:

Hosting of the platform Development of the services Technical support

In the event such suppliers have access to personal data collected or processed by us, the supplier acts as data processor and acts in accordance with a written agreement and under the instructions from us.

5. Transfers to countries outside EU/EEA

In some cases, we will transfer personal data to countries outside the EU/EEA. Such transfers will only take place subject to appropriate safeguards are in place for the transfer including:

The country has been deemed by the Commission of the European Union to have an adequate level of protection of personal data. Personal data can without further measures be transferred to such third countries

The country has not been deemed by the Commission of the European Union to have an adequate level of protection of personal data, but we provide appropriate safeguards for the transfer through the use of "Standard Contractual Clauses”, as published by the Commission of the European Union, EU-US Data Privacy Framework or any other contractual agreement approved by the competent authorities or any other legal basis, including the use of supplementary measures if deemed necessary.

Where no appropriate safeguards are provided, such as the above mentioned, transfer of personal data to "unsafe" third countries can take place based on specific legal basis for the transfer. For instance, the transfer can take place based (i) if you have consented hereto, (ii) for the performance of a contract with a company established in such third country and (iii) if necessary in relation to legal claims. The specific legal bases are stated in Article 49(1) of the General Data Protection Regulation ('GDPR').

You can always obtain a copy of the relevant legal basis for the transfer, or information about where it can be accessed, by contacting our Data Protection Officer. You will find the contact details under Section 8.

6. Security

We are dedicated to protecting your personal data.

As part of this dedication, we have adopted internal security policies and instructed our employees accordingly to comply with applicable legislation, e.g., the GDPR.

We have implemented appropriate procedures and security measures to protect your personal data from being destroyed, lost or altered, publicised unlawfully and against being disclosed to unauthorised persons or otherwise processed contrary to applicable data protection legislation.

7. Your rights as a data subject

As a data subject you have several rights available to you, which you may exercise by contacting us.

You can exercise your rights by submitting your request here: dpo.nets@nexigroup.com.

According to the GDPR, you have the following rights:

The right to request information about what personal data we process about you.

The right to have rectified your personal data.

The right to erase your personal data. Please note that exercising this right might be limited according to national law, i.e., we might not be able to delete and/or modify all personal data.

The right to object to the processing of your personal data and have the processing of your personal data restricted.

An unconditional right to object to the processing of your personal data for direct marketing purposes.

If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent for a specific service by following the instructions for the specific service, please refer to the website for the specific service offered by us.

The right to receive your personal information in a structured, commonly used and machine-readable format (known as data portability), subject to fulfilment of specific conditions set by data protection law.

Please note, we may decline disclosure to you if you are in possession of the information already or if disclosing them to you is impossible or if would involve a disproportionate effort or would impair the achievement of the objectives of the processing.

If you have any concerns about the manner in which we process your personal data, you can contact the Danish Data Protection Agency (in Danish: "Datatilsynet"): www.datatilsynet.dk (website in Danish and English).

You can also lodge a complaint with a data protection supervisory authority in the EU/EEA member state of your habitual residence, place of work or where the alleged infringement has taken place.As a data subject you have several rights available to you, which you may exercise by contacting us.

7.1 Deletion of account

To delete your account and all your data, please follow these four steps:

Sign in to your account in your Nexi Smart Receipt app.

Go to Profile at the top.
Tap Delete profile at the bottom.
Click Yes, I am sure.

Please note: All your data will be deleted permanently once you confirm the deletion of your account. After your confirmation of deletion, Nets will not be able to recover any data as we will delete your personal data immediately. Hence, please make sure that you have downloaded all the data you need before deleting your profile.

If you experience any issues with erasing the profile from your Nexi Smart Receipt application or have any further questions, please do not hesitate to contact us via email dpo.nets@nexigroup.com.

8. Contact us

You are welcome to contact our Nordic Data Protection Officer if you have any questions, complaints or other concerns related to data protection and privacy on the following email address: dpo.nets@nexigroup.com

For questions to us of a more general character not concerning personal data, you can write to us here.

Nets Denmark A/S
CVR-nr. 20016175
Klausdalsbrovej 601
DK-2750 Ballerup