Data Protection in the Terminal Service Business
Data Protection in the Terminal Service Business
DATA PROTECTION IN THE TERMINAL SERVICE BUSINESS
DC elektronische Zahlungssysteme GmbH (DCEZ) has been merged into card complete Service Bank AG (card complete). Since the merger, the servicing of complete Terminals (POS terminals) and the sale of related accessories have been provided directly by card complete; existing service contracts continue unchanged.
card complete is the controller (Art. 4 No. 7 GDPR) for the processing of personal data in the terminal service business. This includes, in particular, the procurement, storage, logistics, loading and unloading, parameterisation, configuration and maintenance of complete Terminals, as well as the servicing of cooperation partners, authorised service partners and card organisations that have been granted a right of co-use of the complete Terminal.
Purposes, legal bases and data transfer
For the parameterisation, configuration changes and maintenance of the operational readiness of the terminals, card complete processes the company and business data contained in the service contract and in the service customer’s orders, communications and data sheets, as well as the specification, configuration and parameter data and the product acceptance of the terminals. This data, which is partly personal data, is transmitted to the extent technically necessary to distribution, service, logistics and cooperation partners as well as to credit institutions (acquirers) and card organisations; these parties are also informed of the commencement and termination of a service contract. The processing is necessary for the operation of the terminals and the processing of transactions (Art. 6 Section 1 (b) GDPR; for contact persons of companies, Art. 6 Section 1 (f) GDPR). As a credit institution, card complete is subject to banking secrecy pursuant to § 38 BWG; data is only disclosed on the basis of the consent granted in the service contract or on another legal basis.
No data processing agreement required
The purposes and means of processing for servicing and maintenance are determined by the service contract and lie with card complete. card complete is therefore, as a rule, not a processor (Art. 4 No. 8 GDPR) vis-à-vis service customers; no agreement pursuant to Art. 28 Section 3 GDPR needs to be concluded.
Privacy notice and contact
Detailed information pursuant to Art. 13 and 14 GDPR is provided in card complete’s privacy notice in the section “POS Terminals and Terminal Service”. For any data protection concerns, please contact card complete’s data protection officer via the contact form: https://www.cardcomplete.com/datenschutz/kontakt.
