This notice explains how we collect and use your personal data. The General Data Protection Regulation (GDPR) applies to our merchants in the EU and the EEA. The revised Swiss Data Protection Act (DSG) applies to our merchants in Switzerland.
Who this notice covers
Our services are aimed at businesses. This notice is for the individuals behind the businesses we work with and those we approach as prospective merchants. It covers directors, legal representatives, beneficial owners, authorised signatories, and the commercial, technical, finance and support contacts we deal with. We process their data where they act in a professional or business capacity.
Where a merchant is a corporate entity, the company itself is not a data subject and only data about the individuals behind it is personal data. Where a merchant trades as a sole trader, business data is also personal data.
Buyers who use Mondu as a payment method at a merchant’s checkout are covered by a separate notice, available at https://www.mondu.ai/gdpr-notification-for-buyers/.
Responsible entity
Mondu GmbH (Unter den Linden 16, 10117 Berlin, Germany) is an independent controller for the platform service agreement and the commercial relationship. This covers merchant onboarding, technical integration and account management, the creditworthiness assessment, commercial correspondence and support, and merchant acquisition and marketing.
Mondu Financial Services B.V. (Herengracht 168, 1016 BP Amsterdam, Netherlands) is an electronic money institution supervised by De Nederlandsche Bank. It is an independent controller for payment services, for merchant billing and invoicing, and for the customer due diligence, identity and beneficial ownership verification, screening and ongoing monitoring required of it under anti-money laundering law.
The two companies disclose your data to each other where a purpose requires it. Mondu GmbH carries out the anti-money laundering checks as Mondu Financial Services B.V.’s processor and on its instructions.
You can contact us at contact@mondu.ai. We will coordinate your request with the relevant controller.
Data we process
a) For the fulfilment of contractual obligations (Art. 6 para. 1 p. 1 lit. b GDPR, or Art. 31 para. 2 lit. a DSG for Swiss merchants)
We collect the personal data needed to prepare and perform the platform service agreement and to communicate with you about our services. Alongside your company data and ownership structure, this includes the name, address, e-mail address, telephone number, date of birth, place of birth and tax identification number of your management and owners. Without this data we cannot conclude the contract.
We process the contact and account data of your technical staff to provision credentials, support your integration with our checkout and activate your account. We process billing contact details and account information to issue and collect invoices for our platform services. We retain executed contracts, contractual documents and the records of our commercial correspondence with you, including support interactions and any disputes or complaints.
b) To protect our legitimate interests (Art. 6 para. 1 p. 1 lit. f GDPR, or Art. 31 para. 1 DSG for Swiss merchants)
Where necessary, we process your data beyond the performance of the contract to safeguard Mondu’s legitimate interests. This includes handling your enquiries and establishing, exercising or defending legal claims.
Before we enter into the platform service agreement we assess the creditworthiness and default risk of your business. Our interest is in avoiding credit losses and in extending credit responsibly. To do this we may consult a credit reference or business information agency, using your company data together with the contact details of a representative.
We identify and approach prospective merchants. Our interest is in growing our merchant base and reaching the businesses our services suit. We use professional contact data obtained from public professional platforms and from contact-data and lead-generation providers. We make contact by e-mail and by telephone. One of the tools we use is an AI-assisted sales engagement platform that also scores and segments prospects. We record the contact history and progression of every prospect and merchant relationship in our customer relationship management system.
We record and transcribe sales calls with prospective and existing merchant representatives, and analyse them for sales coaching, performance review and deal review. You are told that the call is being recorded before any recording begins.
We use your e-mail address to send advertising for Mondu’s own similar products or services. You can object at any time, free of charge beyond your own basic transmission costs.
Our employees use generative AI tools in their day-to-day work, for example to draft, summarise, analyse or translate. Where a document or message containing your data is handled in this way, we rely on our legitimate interest in efficient business operations.
c) Based on your consent (Art. 6 para. 1 p. 1 lit. a GDPR, or Art. 31 para. 1 DSG for Swiss merchants)
If you have given us your consent to do so, we will process your contact data as well as data about your position in the company for advertising, including to send you advertising relevant to you by e-mail or telephone or for advertising campaigns on social media.
d) For compliance with legal obligations (Art. 6 para. 1 p. 1 lit. c GDPR, or Art. 31 para. 1 DSG for Swiss merchants)
We process identification and ownership information about your management and beneficial owners. This includes their identification and contact details, date and place of birth, tax identification number, proof of identity documents, and information about ownership and control. We process it to meet obligations under applicable financial services and anti-money laundering laws, in particular the Dutch Anti-Money Laundering and Counter-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft). Those obligations cover customer due diligence, sanctions and politically exposed person screening, ongoing monitoring, record keeping and reporting to competent authorities.
We verify identity documents and ownership information with the support of a specialist identity verification provider.
We re-screen representatives and beneficial owners periodically throughout the business relationship and monitor for changes in ownership structure and sanctions exposure. Re-screening is risk-based and may also be triggered by a change in your profile or ownership.
We process correspondence and identity data to receive, verify and answer requests to exercise data protection rights.
If you do not provide the data required for these checks we may be unable to enter into or maintain our business relationship.
Automated decision-making
We do not take decisions about you that are based solely on automated processing and produce legal effects concerning you or similarly significantly affect you. A person makes the creditworthiness assessment. The identity and document checks required for anti-money laundering purposes run by automated means, and a person reviews their outcome before any decision on your business relationship is taken.
Sources of data
Most of the data we hold about you is provided by you or by your colleagues at the merchant. We also receive personal data from the following sources:
- Credit reference and business information agencies, providing information on the financial standing and payment history of your business.
- Contact-data and lead-generation providers, public professional platforms and business directories, providing the professional contact details of prospective merchant representatives.
- Public commercial registers and beneficial ownership registers, providing ownership and control information.
- Publicly available sanctions lists, politically exposed person databases and adverse media sources, used in our screening checks.
- Our identity verification provider, providing the results of document and identity checks.
Data deletion
If there is no legal retention period, the data will be deleted as soon as storage is no longer necessary or the legitimate interest in storage has expired. The duration of storage depends, among other things, on the statutory retention obligations, e.g. from the German Fiscal Code, the German Commercial Code, the Dutch State Taxes Act and applicable anti-money laundering legislation.
Recipients of your data
We share your data with the following recipients to the extent necessary to provide our services and to meet legal obligations:
- Financial institutions and insurers that support financing or risk cover.
- Payment service partners and custodians.
- Cloud hosting and infrastructure providers.
- Customer relationship management, sales engagement and marketing platforms.
- Customer support, e-mail and communication delivery providers.
- Identity verification, KYC, AML and sanctions screening providers.
- Contract lifecycle management, electronic signature, document archiving and secure destruction providers.
- Generative AI providers supporting our employees’ day-to-day work.
- Professional advisers such as auditors and legal counsel.
- Competent authorities, where we are required to report or disclose.
Service providers act on our instructions as processors under a data processing agreement. Where a recipient determines the purposes of its own processing, it acts as an independent controller under its own privacy notice.
Credit reference agencies
We obtain business and risk information about your company from Dun and Bradstreet B.V. (Netherlands). To obtain a report we disclose the identifiers needed to locate your business, together with the name and business contact details of a representative where required. Dun and Bradstreet acts as an independent controller. Further information and your rights are available here.
AI-assisted sales outreach
We use Artisan AI, Inc. (San Francisco, United States) to draft, sequence and send outbound e-mail communications to prospective merchant representatives. It also scores and segments those prospects for further outreach. This involves profiling within the meaning of Art. 4(4) GDPR. Artisan is our processor. It holds no EU-US Data Privacy Framework certification, so its transfers to the United States rely on Standard Contractual Clauses approved by the European Commission.
Identity verification
We use an identity verification service provider to carry out the identity and document checks required under anti-money laundering law. This involves processing a copy of your identity document and, where applicable, a facial image compared against that document by automated means. Comparing a facial image against an identity document produces biometric data. We process that data on grounds of substantial public interest under Art. 9(2)(g) GDPR, in connection with our obligations under the Wwft. Biometric data is not retained beyond the period necessary to complete the verification.
Generative AI tooling
The generative AI tools our employees use are Gemini, provided by Google Cloud Emea Ltd., and Claude, provided by Anthropic Ireland, Limited. Both act as processors on our instructions and neither is permitted to use your data to train its models. Both host their processing in the United States. The transfer to Google relies on the EU-US Data Privacy Framework adequacy decision. The transfer to Anthropic relies on Standard Contractual Clauses approved by the European Commission.
International transfers
Some recipients process data outside the European Union and Switzerland. Several of the platforms we use for customer relationship management, sales engagement and customer support are established in the United States. Where data leaves the European Union or Switzerland we rely on an adequacy decision by the European Commission, on recognition by the Swiss Federal Council for Swiss data, or on Standard Contractual Clauses with supplementary measures where required. You can obtain a copy of the Standard Contractual Clauses from dataprotection@mondu.ai.
Your data protection rights
You have the following rights over your personal data:
-
Access: You can ask what personal data we hold about you and obtain a copy of it.
-
Rectification: You can ask us to correct data that is inaccurate and to complete data that is incomplete.
-
Erasure: You can ask us to delete your data. A legitimate reason must exist, and no rule requiring us to retain the data must apply.
-
Restriction: You can ask us to restrict our processing of your data. A legitimate ground must exist.
-
Portability: In certain cases you can receive your data in a structured, commonly used and machine-readable format, or ask us to transmit it to a third party.
-
Withdrawal of consent: Where we process your data on the basis of your consent, you can withdraw it at any time and without giving reasons. Processing carried out before the withdrawal remains lawful.
-
Objection: You can object to processing we carry out on the basis of our legitimate interests, on grounds relating to your particular situation.
Your right to object to direct marketing is absolute, applies at any time, and covers any related profiling. If you object, we stop using your data for that purpose across every channel. You can object by e-mailing unsubscribe@mondu.ai, by using the unsubscribe link in any marketing e-mail, or by telling us during a call.
Every data subject has the right to file a complaint with a supervisory authority if they believe that the processing of data concerning them violates data protection regulations. For Mondu GmbH this is the Berlin Commissioner for Data Protection and Freedom of Information. For Mondu Financial Services B.V. this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Merchants in Switzerland may also contact the Federal Data Protection and Information Commissioner (FDPIC).
Our Data Protection Officer
Our Data Protection Officer will be happy to provide you with more information about data protection under the following contact details:
Name: Jan Hagen Dip AML, CDPO, F.I.C.A
Email: dataprotection@mondu.ai
Address: Mondu Financial Services B.V., Attn: Jan Hagen, Herengracht 168, 1016 BP Amsterdam, Netherlands