Privacy Notice for Alevate
The protection of your personal data is important to us at Serrala Group GmbH, and its affiliates (henceforth referred to interchangeably as "Serrala ", "we" or "us") as well as for your company, and we strictly adhere to the applicable privacy laws.
When using Serrala's Alevate diverse solutions (henceforth referred to interchangeably as "Alevate" or "Alevate Solutions"), personal data is processed at various points. Information is collected when necessary to enable the Alevate Solutions and to comply with legal obligations. If processing of personal data would be necessary and there is no legal basis for such processing, we will ask for your consent. The information is treated as strictly confidential and is used exclusively for the communicated purpose. Under no circumstances is the information collected sold, used for other purposes or passed on to third parties for other reasons.
In this privacy notice, we would like to inform you about the nature, scope and purpose of the personal data we collect, use and process. In addition, this privacy notice informs you of your rights.
1. General Topics
The provider of the Alevate Solutions is Serrala with its registered office in Hamburg, Germany.
The Alevate Solutions are a set of diverse cloud solutions which enable financial automation and global B2B payments for your company. While using the Alevate Solutions, your personal data and is collected, stored or processed by Serrala, on behalf of your company, for the purposes of providing the services to your company; in addition, your personal data may also be processed in case you contact our Global Support team.
2. Type of Information
In the context of using the Alevate Solutions, we process the following information from you:
1. Last name, first name (possibly in the User ID)
2. Email address (if used in User ID)
3. Phone details (if included)
4. Device ID
5. Time of log-in
6. IP Address.
Note: In addition to the above, personal data from data subjects, which your company includes in the Alevate Solutions (e.g., customers, suppliers, etc.) may also be available to you; hence, kindly recall the need to observe the applicable privacy rules, as well as the instructions of your company on how to handle such data.
3. Use of Information
4. Deletion Periods
Serrala and, where applicable, your company will process and store your personal data only for the time necessary to achieve the purposes for which it was collected, or as otherwise provided by law or regulation to which either Serrala or your company are subject.
If the retention purpose no longer applies, or if a retention period prescribed by the applicable legislation expires, the personal data will be deleted in accordance with the relevant provisions.
5. Transfer of your Information to Third Parties and Third Countries
Personal data collected from you shall not be transferred to third parties for other purposes; personal data shall be accessible to us and to your company for the purposes of providing and managing the payments portal.
Please be informed that your personal data may be transferred to the United Kingdom and Switzerland, on the basis of the relevant Adequacy Decisions, as well as to India and the United States, based on the approved Standard Contract Clauses, as per Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
6. Technical Security
We continuously check and update our technical and organizational security measures to protect your information. The measures are intended to prevent unauthorized access, unlawful deletion or manipulation and the accidental loss of data in the best possible way.
7. Rights of Data Subjects
7.1. Right to Confirmation
Any data subject has the right, granted by the European Directives and Regulations, to obtain confirmation from the controller as to whether personal data relating to them is being processed. If a data subject would like to exercise this right of confirmation, they may, at any time, contact the controller.
7.2. Right to Information
Any data subject has the right, granted by the European Directives and Regulations, to obtain from the controller, at any time and free of charge, information about the personal data relating to them that has been stored and a copy of that information.
Furthermore, they have the right to know whether personal data has been transferred to a third country or to an international organization. If this is the case, they also have the right to obtain information about the appropriate safeguards in connection with the transfer. If they would like to exercise this right of information, they may, at any time, contact the controller.
7.3. Right to Correction
Any data subject can request the immediate rectification of any inaccurate personal data as granted to them by the European Directives and Regulations. Considering the purposes of processing, they have the right to request the completion of incomplete personal data - including by means of a supplementary declaration. If they would like to exercise this right of correction, they may, at any time, contact the controller.
7.4. Right to Deletion ("Right to be Forgotten")
Any data subject has the right granted by the European Directives and Regulations to obtain from the controller the deletion without delay of personal data relating to them, where processing is no longer necessary, when consent is withdrawn, when there is no legal basis for the processing or when the data have been processed unlawfully.
If one of the aforementioned reasons applies, and they want to arrange for the deletion of personal data stored in the Alevate Solutions, they may, at any time, contact the controller.
7.5. Right to Restriction of Processing
Any data subject has the right, granted by the European Directives and Regulations, to obtain from the controller the restriction of processing if one of the following conditions is met:
If one of the prerequisites applies, and they want to request the restriction of personal data stored in the Alevate Solutions, they may, at any time, contact the controller.
7.6. Right to Data Portability
Any data subject has the right, granted by the European Directives and Regulations, to receive the personal data relating to them, which
has been provided by them to the controller, in a structured, commonly used and machine-readable format. They also have the right to
transmit this information to another controller without hindrance from the controller party to whom the personal data was provided, provided
that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR
and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, when exercising their right to data portability pursuant to Article 20(1) GDPR, they have the right to obtain that the
personal data is transferred directly from one controller to another, to the extent that this is technically feasible and provided that this
does not adversely affect the rights and freedoms of other individuals. In order to assert the right to data portability, they may at any
time contact the controller.
7.7. Right to Object
Any data subject has the right, granted by the European Directives and Regulations, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) GDPR. In order to exercise the right to object, they may contact the controller.
7.8. Right to Revoke Consent under Data Protection Law
Any data subject has the right to withdraw their consent to the processing of their personal data at any time, as granted by the European Union. If they want to exercise their right to revoke consent, they may, at any time, contact the controller.
7.9. Automated Decisions in individual Cases including Profiling
Personal Data processed within the Alevate Solutions is not used for automated decision-making or profiling.
8. Legal Basis of Processing
The processing of personal data, for the purposes of the Alevate Solutions, is necessary for the performance of a contract, such as in the case of processing operations necessary for the delivery of goods or the provision of any other service or consideration, the processing is based on Article 6(1)(b) GDPR.
9. Controller of personal data
The controller, within the terms of Art. 4(7) GDPR, is your company; for clarity, Serrala operates the Alevate Solutions as a processor on behalf of your company.
10. Contact
In case of any inquiries, clarifications, and/or questions pertain to the processing of your personal data, as included in the Alevate Solutions by you or your company, please contact your company's point of contact for data protection or privacy issues
Requests on the above sent to [email protected], which concern the processing of your personal data for which your company is responsible, in the terms of Art. 4(7) GDPR, will be forwarded to your company's relevant point of contact, insofar as sufficient information is present to allow the identification of your company. The foregoing does not extend to the exercise of data rights from data subjects, for which your company is the Controller, in the terms of Art. 4(7) GDPR; in this case, your company shall use the relevant modules, included in the Alevate Solutions, to address such requests.