1. Introduction

The iDEAL in3 payment method is a service provided by in3 NL B.V. trading under the name ‘iDEAL in3’ (hereinafter: iDEAL in3). Protecting your privacy and personal data is very important to us. This Consumer Privacy Statement explains which personal data we collect from you and how we process such data. This statement also sets out your rights and explains how you can exercise them.

Our Consumer Privacy Statement applies whenever you visit our website, contact us, download our app and/or make use of our services. You are seeing this Privacy Statement because you either (i) have chosen to use the iDEAL in3 payment method yourself as consumer, or (ii) visit our website or (iii) are in contact with us, because you are interested in our services. 

2. Who is responsible?

We, iDEAL in3, are responsible for processing your personal data in accordance with this Consumer Privacy Statement.

Contact details of iDEAL in3:
Name: in3 NL B.V.
Address: Meerenakkerweg 1a, 5652 AR in Eindhoven
Email address: support@in3.ideal.nl 
Chamber of Commerce reg. No.: 59234784

3. Which personal data do we process and for which purpose?

We process your personal data whenever you visit our website, contact us, and/or use any of our services.

3.1 Information you provide to us 

We process any personal data you provide to us. For example, when you:

- purchase a product at a (online) store and choose iDEAL in3 as your payment method;
- set up an account with us;
- contact our customer service team.

The personal data we process includes the following types:

- basic identification, such as your: name, email address, postal address, date of birth, and telephone number;
- order details, such as: ordered products, name of the seller, and the date of your purchase;
- payment details, such as: account number and data relating to your payments to iDEAL in3;
- communications information, such as: information relating to communication with our customer service team.

The processing of this information is necessary for us to be able to provide our services, and for the purposes related to those services, such as customer services and marketing. We also use your email address to send newsletters if you have registered yourself for our newsletter.

3.2 Personal data which we collect from you when you use our service 

When you want to use the iDEAL in3 payment method, we also process your credit score and the criteria on which that score is based. This is explained in more detail in paragraph 4 below. We need this information to assess whether your application to use our services can be approved in accordance with our policies. We take our corporate social responsibility seriously and therefore perform credit checks to make sure the credit provided to our customers is responsible and sustainable.

4. Automated credit check

4.1 When will we perform an automated credit check?

If you choose to pay in installments with iDEAL in3, we assess whether this is a responsible option for you. In our assessment, we use credit information obtained from a credit reference agency. If you are a known customer of ours, we also take your payment history with us into account during the assessment. For the credit assessment, we collaborate with two credit reference agencies, specifically:

- Economic Data Resources (EDR) 
- Experian

Want to know more about how these credit information agencies process your data? Click on the names of the agencies to access their privacy statements. These privacy statements also explain how you can exercise your rights, such as the right to access, object, rectify, and delete your data at these agencies.

4.2 How does the credit check work?

For the credit check, we provide your information, such as your name, address, date of birth, email address, and phone number, to a credit reference agency. In return, we receive credit information and a risk profile associated with you. Using this data, along with other payment information we already have about you, we automatically determine whether you can use iDEAL in3 as a payment method.

In addition to the information from the agency, we also perform our own checks against other registers. For example, we check whether you are listed in the insolvency register or the guardianship and administration register. To prevent excessive borrowing and fraud, we also verify whether there are any outstanding debts associated with your address. Where possible, we also check for other negative registrations, such as late payment with a mobile phone provider or energy company. Finally, we check whether you have made more than two credit applications with iDEAL in3 in the past 30 days, to protect you from over-borrowing.

Please note! It is important that you pay us on time. We share your payment behavior with iDEAL in3 with the mentioned credit information agencies. This helps prevent future payment risks and ensures that you do not accumulate problematic debts. If you fail to pay on time, this may affect your ability to obtain new loans.

4.3 How long is the credit information stored?

We retain the data used to calculate your credit score so we can provide an explanation if requested. We also keep this data to review and improve our credit assessment and fraud prevention policies. In section 6, you can read how long we store this data. For more information about how the credit information agencies process your data, please check the privacy statements of EDR and Experian.

4.4 Why are credit checks needed?

We perform an automated credit assessment to establish and execute the agreement for using our payment method, iDEAL in3. This assessment is important because we want to ensure that you can meet your payment obligations. Additionally, we aim to prevent excessive borrowing and ensure that paying in installments is a suitable option for you. The credit assessment is performed automatically because we receive a large number of requests for iDEAL in3 payments and want to ensure that you don’t have to wait too long to complete your purchase. The method we use is regularly tested to ensure it remains fair and accurate. You can always request a manual review of your specific situation by a staff member.

4.5 Access, objection and human review

If we decline your request to use iDEAL in3, you can take the following steps. First, you can request access to the (personal) data and the reasoning behind our decision. If the data is incorrect, you can request correction or deletion. If you believe the rejection was unjustified based on the data, you can object to it. Additionally, you can ask us to perform a manual review of your creditworthiness. You can make these requests by sending an email to support@in3.ideal.nl. We will ask you a few questions to verify your identity before processing your request.

5 With whom do we share your personal data?

5.1 Services

We use services of third parties which allow us to provide the iDEAL in3 payment method. These third parties provide services to us, for example with regards to payment statements, providing collection services, providing fraud prevention services and checking creditworthiness. Enquiries relating to these third parties and their data processing methods can be directed to us at privacy@in3.ideal.nl. Furthermore, we may share data with the authorities if required to do so by law. 

5.2 Financing 

We may share data with third parties to finance our services. In this regard, we assign receivables against consumers who use the iDEAL in3 payment method (the Receivables), to Aion Bank SA/NV (Aion). Aion may pledge the Receivables to third parties or otherwise use the Receivables at it sees fit. Aion may furthermore assign the Receivables for collection purposes to third parties or re-assign them to the (online) store where you placed the order. These parties will obtain your personal data in order to collect the Receivables, manage payment obligations and process payments. The privacy statement of Aion can be found here: https://aion.eu/en/privacy-policy.

5.3 Marketing

We may share personal data with third parties in connection with our marketing activities. More specific, we share personal data with the following third parties (Marketing parties):

- Facebook (Meta Platforms Ireland Limited)
- LinkedIn (LinkedIn Ireland Unlimited Company)
- Google (Google Ireland Limited)

Our main goal is to exclude existing customers from our marketing communications via the Marketing parties. Additionally, this allows the Marketing parties to focus the marketing communications on persons who use Facebook, LinkedIn and Google, but are not yet a customer of iDEAL in3. Specifically, our iDEAL in3 marketing can be aimed towards persons which have similar profile characteristics as our existing customers. This is often referred to as ‘look-a-like audiences’. To this end (hash-codes of) email addresses and/or telephone numbers of our customers are compared with the email addresses and telephone numbers that are known at the Marketing parties. During this process specific security measures are taken to ensure that this happens in a safe and trustworthy way. The Marketing parties do not have access to your email address and telephone number if you do not also have an account with the same email address or telephone number at one of those Marketing parties. If you want to know how the Marketing parties handle your personal data, then you can find the privacy statements of Facebook, LinkedIn and Google here.

5.4 Other

We may share your personal data with third parties in other circumstances insofar we have good reasons for this. For example, in relation to a company merger or acquisition, sharing data with a potential buyer or its advisors. Or to establish, exercise, or defend our legal position or rights.

When we share your personal data as stated here, we take all reasonable legal, technical, and organizational measures to ensure that your data remains secure. In addition, we do not send your personal data to third parties for remote sale or market surveys, unless you have given your consent. 

We process your data within the European Union as much as possible. Certain activities may involve the processing of personal data outside of the European Union. For example, the processing of data by the Marketing parties. These are global organizations; hence data may be processed outside the borders of the European Union. If this situation occurs, appropriate measures to comply with the privacy laws are ensured. For example, by concluding the necessary standard contractual clauses (so-called Standard Contractual Clauses) which have been approved by the European Commission. Any questions about the transfer of data or the safeguards in place can be directed to privacy@in3.ideal.nl.

6. Purposes, legal basis and retention periods

We process personal data based on the purposes and legal grounds as specified below. In the paragraphs below, you can also read how long we store certain data.

6.1 Purpose: confirming your identity

- Data: name, address, email address and date of birth.
- Legal basis: the execution and performance of the agreement between you and iDEAL in3 (article 6 paragraph 1 subsection b of the General Data Protection Regulation, GDPR).
- Retention period: we retain this data up to two years after your relationship with iDEAL in3 as a customer has ended, unless we are required by law to keep certain data for a longer period. 

6.2 Purpose: to check your creditworthiness and to prevent fraud

- Data: name, address, date of birth, email address, telephone number, negative registrations in registers such as the Central Guardianship and Administration Register, number of credit applications last month, payment history at iDEAL in3, and any outstanding debts at the same address. 
- Legal basis: the legitimate interest of iDEAL in3 (article 6 paragraph 1 subsection f of the GDPR). We have a legitimate interest in protecting ourselves against fraud and against granting credit that cannot be repaid. It is in the interest of iDEAL in3, but also in the interest of the consumer, that consumers are protected against taking on too much credit.
- Retention period: we retain this data for one year from the moment you have made a request to use our payment method.

6.3 Purpose: customer service 

- Data: name, address, email address, telephone number, order and payment history at iDEAL in3. 
- Legal basis: this depends on your request, but customer service may be necessary for the conclusion and execution of our agreement with you (article 6 paragraph 1 subsection b of the GDPR). Customer service may also be necessary to pursue our legitimate interests to help you with questions about our services (article 6 paragraph 1 subsection f of the GDPR).
- Retention period: we retain this data up to two years after your relationship with iDEAL in3 as a customer has ended, unless we are required by law to keep certain data for a longer period.

6.4 Purpose: accounting and bookkeeping 

- Data: name, address, email address, telephone number, bank account number, amounts to be paid, details of your transactions via iDEAL in3.
- Legal basis: our legal administrative obligations (article 6 paragraph 1 subsection c of the GDPR).
- Retention period: we store this data for up to seven years after your transaction via iDEAL in3 unless there is a longer statutory retention obligation. 

6.5 Purpose: to manage accounts and provide our service

- Data: name, address, date of birth, email address, telephone number, bank account number, amounts to be paid, order and payment history at iDEAL in3.
- Legal basis: to be able to provide our service and/or the account you have created (article 6 paragraph 1 subsection b of the GDPR).
- Retention period: we retain this data up to two years after your relationship with iDEAL in3 as a customer has ended, unless we are required by law to keep certain data for a longer period.

6.6 Purpose: financing our services

- Data: name, address, email address, telephone number, bank account number, amounts to be paid, your transactions at iDEAL in3.
- Legal basis: our legitimate interest to finance our company and services (article 6 paragraph 1 subsection f of the GDPR).
- Retention period: we retain this data up to two years after your relationship with iDEAL in3 as a customer has ended, unless we are required by law to keep certain data for a longer period.

6.7 Purpose: to provide a well-functioning website

- Data: your IP address and other technical data of your device. 
- Legal basis: our legitimate interest to provide a well-functioning website (article 6 paragraph 1 subsection f of the GDPR).
- Retention period: 30 days after visiting our website.

6.8 Purpose: marketing

- Data: email address and telephone number. 
- Legal basis: our legitimate interest to advertise our services (article 6 paragraph 1 subsection f of the GDPR).
- Retention period: we retain this data up to two years after your relationship with iDEAL in3 as a customer has ended, unless we are required by law to keep certain data for a longer period.

6.9 Purpose: to send newsletters

- Data: email address. 
- Legal basis: consent (article 6 paragraph 1 subsection a of the GDPR).
- Retention period: as long as you have given your consent and have not withdrawn the consent.

6.10 Purpose: to defend or establish our rights

- Data: name, address, e-mail address, telephone number, bank account number, amounts to be paid, transactions at iDEAL in3.
- Legal basis: we have a legitimate interest in being able to establish, exercise and defend our legal position and rights (article 6 paragraph 1 subsection f of the GDPR).
- Retention period: during the dispute and for five years thereafter.

7. Your rights

Requests to exercise the rights stated below can be sent to privacy@in3.ideal.nl. We may ask security questions to verify your identity before processing your request. 

7.1 Access: you have the right to access your personal data which we are processing.

7.2 Rectification: we take measures to keep your data accurate and up to date in our systems. You can ask us to rectify or delete information if anything is incorrect in your data.

7.3 Erasure: you have the right to request that your data be deleted if that data is incorrect or irrelevant. You can also request us to delete your account at any time. It is not always possible for us to delete all data immediately due to statutory retention periods or performance of the credit agreement.

7.4 Objection and human review: you have the right to object to your personal data being processed, and to request a human review where the automated credit check is concerned. See paragraph 4 above for more information about the credit check.

7.5 Objection: you may object to any processing based on our legitimate interest as stated in paragraph 6 above, where you believe this is being done incorrectly or unjustly or in connection with your specific circumstances.

7.6 Data portability: where your personal data is processed automatically in the performance of our agreement with you, you have the right to request a machine-readable format of such data for transfer to another party.

7.7 Revoke consent: where we process personal data based on your consent, such as the newsletter, you have the right to withdraw your consent at any time. You can do this via our website, via the link at the bottom of the newsletter, or by sending an email to support@in3.ideal.nl.

7.8 Questions or complaints: your privacy and customer satisfaction are of great importance to iDEAL in3. If you have any requests or complaints regarding the processing of your personal data, please feel free to contact us via privacy@in3.ideal.nl. We will use our best efforts to help you with your request and/or to resolve your complaint. You also always have the right to submit a complaint with the local Data Protection Authority via https://autoriteitpersoonsgegevens.nl/.

8. How do we keep your personal data secure?

We take appropriate technical and organizational measures to protect your data against unauthorized access, transfer, destruction, or other unauthorized processing. These security measures include firewalls, encryption, use of secure IT environments, access control, training for staff who process your data and the careful selection of any third parties who process personal data on our behalf. Access to your information is also limited to just those employees of iDEAL in3 who need this access as part of doing their job.

9. Third-party websites

Our website might include links to third-party websites. We are not responsible for the privacy policies or content of those third-party websites. We advise you to carefully read the privacy policies and terms and conditions for those websites before using such websites. 

10. Use of cookies and similar technology

When you visit one of our websites, we automatically receive and store certain information. For example, the date and time of your visit to our website, as well as how you landed on our homepage (for example via a search engine such as Google). This may be done by using cookies or similar technologies. Want to know more about which information we process when you visit our website? Please see our general Privacy & Cookie Statement here:https://ideal.nl/en/ideal-privacy-cookiestatement. 

11. Revisions to this Consumer Privacy Statement

We are constantly working to improve our website and payment service. For this reason, we reserve the right to revise our Consumer Privacy Statement by posting the changed version on our website. Revisions might also be made due to changes in the GDPR or other applicable (privacy) regulations or case-law. We recommend you check the content of the latest version of our Consumer Privacy Statement regularly on our website https://ideal.nl/en/customer-privacy-statement-ideal-in3.

12. Enquiries regarding data protection

iDEAL in3 has a data protection officer, who works constantly to protect your data. If you have any questions regarding this Consumer Privacy Statement or the protection of personal data at iDEAL in3, then please contact us on privacy@in3.ideal.nl.

This Consumer Privacy Statement was last updated in November 2024.