Privacy Information: Website

1. Contents of this Privacy Policy

In this Privacy Policy, we (Ratepay GmbH) inform you about the processing of personal data when you use our website.

You can print or save this Privacy Policy by using the standard functions of your browser.

2. Data controller and contact details

The contact person and the so-called data controller responsible for the processing of your personal data when you visit this website, within the meaning of the EU General Data Protection Regulation (GDPR), is

Ratepay GmbH

– Data Protection –

Ritterstr. 12–14

D-10969 Berlin

datenschutz@ratepay.de

If you have any questions regarding data protection in connection with our services or the use of our website, you may also contact our Data Protection Officer at any time. They can be reached at the postal address above and at the email address provided above (please use the subject line: ‘For the attention of the Data Protection Officer’). We expressly point out that when using this email address, the content will not be seen exclusively by our Data Protection Officer. If you wish to exchange confidential information, please therefore first request direct contact via this email address.

3. Data processing on our website

3.1 Visiting our website / access data

Every time you use our website, we collect

• the IP address of the requesting device,

• the date and time of the request,

• the address of the website visited and the requesting website,

• details of the browser and operating system used,

• the version of the HTTP protocol, the HTTP status code, and the size of the file delivered;

• Request information such as language, content type, content encoding, character sets;

• cookies from the accessed domain stored on the end device

The processing of this connection data is absolutely necessary to enable you to visit the website, to ensure the ongoing functionality and security of our systems, and to carry out general administrative maintenance of our website. Furthermore, for the purposes described above, connection data is stored in internal log files for a limited period and restricted to the minimum necessary in terms of content, so that, for example, in the event of repeated or

malicious access attempts that jeopardise the stability and security of our website, the cause can be identified and action taken against it. The legal basis is Article 6(1), first sentence, point (b) of the GDPR, provided that the page is accessed in the course of entering into or performing a contract, and otherwise Article 6(1), first sentence, point (f) of the GDPR on the basis of our legitimate interest in enabling access to the website and ensuring the ongoing functionality and security of our systems.

3.2 Ratepay Portals

Ratepay Merchant Portal: You have the option to use the Merchant Portal if, as a merchant, you offer Ratepay payment methods. Ratepay will provide you with the login details for the Merchant Portal. Further information on the Ratepay Merchant Portal can be found here [https://docs.ratepay.com/docs/legal/b_ratepays_terms_for_merchants/terms_of_use/english_version/]. The legal basis for the processing is Article 6(1)(b) of the GDPR.

Ratepay Buyer Portal: You can view the payment status of your order on our Ratepay Buyer Portal if you have placed an order using a Ratepay payment method. No registration is required for this. We process your personal data, such as your email address, date of birth or order ID, for the purposes of identification and to enable access to the Buyer Portal. Access is not possible without this data. Should you report a problem with your payment, we will also process the data you provide as part of our customer service; see section 3.3 of this Privacy Policy. The legal basis for the processing is Article 6(1)(b) of the GDPR. For all other data, the legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR, to enable you to provide further information, for example to facilitate faster contact. This applies, for instance, to optional details such as your telephone number, so that we can also contact you via these channels should we have any queries.

Further information on the processing of your data in connection with payment transactions can be found here.

3.3 Contact and customer service

As a buyer

You have the option of contacting our customer service team via a contact form, the customer portal or directly via the email address provided on your payment request. In this context, we process data solely for the purpose of communicating with you and resolving your enquiry. The legal basis is Article 6(1)(b) of the GDPR, insofar as the information is required for the initiation or execution of our payment service and customer service.

Depending on the reason for your enquiry, it may be processed automatically by an AI system. This applies in particular to simple enquiries relating to the delivery of goods by our retailers, payment statuses, invoices, etc.

To provide automated responses to your queries, we use the services of ThinkingTech GmbH, Darmstädter Str. 5, 64625 Bensheim. We have a data processing agreement with ThinkingTech GmbH which, amongst other things, prohibits the use of your data to train the AI systems.

In this context, and in general, we process your data on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our legitimate interests lie in communicating with users quickly and cost-effectively and in handling customer enquiries. This applies, for example, to optional details such as your telephone number, so that we can contact you via these channels should we have any further queries.

Furthermore, we carry out random checks on our customer communications to improve the quality of our customer service. To this end, we analyse how our customer service agents resolve issues using predefined criteria. In this context, your personal data, in particular the content of your communications, may also be processed.

To carry out the automated quality analysis, we use the AI services of Snowflake Computing Netherlands B.V., Gustav Mahlerlaan 300–314, 1082 ME Amsterdam, The Netherlands. We have entered into a data processing agreement with Snowflake which, amongst other things, excludes the training of AI systems using your data.

In this context, we process your data on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our legitimate interests in this regard consist of the automated assessment of our service quality and the targeted training of our service staff.

As a retailer or prospective retailer

As a retailer or prospective retailer, you have the option to contact us via the contact form on this website or by email, or to book a demo. We process your data in order to deal with your enquiry. The legal basis is Article 6(1)(b) of the GDPR, insofar as the information is required for the initiation or performance of our payment service. In all other respects, your data is processed on the basis of our legitimate interests pursuant to Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interests in this regard consist of communicating with users and processing customer enquiries.

The data we collect when you use the contact form will be automatically deleted once your enquiry has been fully processed, unless we still require your enquiry to fulfil contractual or legal obligations (see the ‘Retention period’ section). In addition, you will receive information about attractive payment solutions from our partners (Nets A/S, Denmark, www.nets.eu), provided you have given your consent to this, in accordance with Article 6(1)(a) of the GDPR.

3.4 Customer satisfaction survey

If you take part in one of our customer satisfaction surveys, we use your data for market and opinion research. The legal basis for data processing when you take part in the survey is your consent under Article 6(1)(a) of the GDPR. We generally analyse the results anonymously; however, we also use your feedback to resolve your concerns, to evaluate them in the context of the specific case and, where appropriate, to contact you with a solution. We base the sending of the surveys on your consent under Article 6(1)(a) of the GDPR, provided you have given us this consent, and otherwise on Article 6(1)(f) of the GDPR in conjunction Section 7(3) of the German Unfair Competition Act (UWG), based on our legitimate interest in tailoring our services to your needs and continuously improving them.

You may object to the sending of a satisfaction survey and the use of your data for marketing purposes at any time by clicking on the relevant link in the emails or by notifying us via the contact details provided above (e.g. by email or letter), or you may withdraw your consent with future effect, without incurring any costs other than the transmission costs in accordance with standard rates.

To conduct surveys, we use the services of Qualtrics Ireland Limited (hereinafter ‘Qualtrics’), Costello House, 1 Clarendon Row, Dublin 2, D02 TA43. We have entered into a data processing agreement with Qualtrics.

3.5 Use of tools on the website

Information on the use of cookies and similar technologies can be found in our consent banner, which you can access via the ‘Cookie Settings’ link in the footer of this website.

3.6 Online Presence on Social Media

We maintain online presences on social media platforms in order, amongst other things, to communicate with customers and prospective customers and to provide information about our products and services.

3.6.1 Processing for advertising purposes by social media providers

Users’ data is generally processed for market research and advertising purposes. This enables usage profiles to be created based on users’ interests. For this purpose, cookies and other identifiers are stored on users’ devices. Based on these usage profiles, advertisements are then displayed, for example, within the social media platforms as well as on third-party websites.

Please refer to the privacy policy of the respective social network for the legal basis of the data processing carried out by the social networks under their own responsibility. You can also find further information on the respective data processing activities and the options for objecting via the links below.

3.6.2 Processing for statistical purposes

As part of the operation of our online platforms, we may have access to information such as statistics on the use of our online platforms, which are provided by social media platforms. These statistics are aggregated and may include, in particular, demographic information (e.g. age, gender, region, country) as well as data on interaction with our online platforms (e.g. likes, subscriptions, shares, viewing of images and videos) and the posts and content shared via these platforms. This information may also provide insights into users’ interests and which content and topics are particularly relevant to them. We may also use this information to adapt the design, activities and content on our online presence and to optimise them for our audience. Please refer to the list below for details and links to the data from social networks that we, as operators of the online presence, can access. The collection and use of these statistics are generally subject to joint responsibility. Where this applies, the relevant agreement is set out below. The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR, based on our legitimate interest in effectively informing users and communicating with them, or Article 6(1), point b) of the GDPR, in order to stay in contact

with our customers and keep them informed, as well as to carry out pre-contractual measures with prospective customers.

3.6.3 Access to publicly available information

If you have an account on a social network, we may be able to view information you have made publicly available (e.g. your username) and media (e.g. images and videos) when we visit your profile. Furthermore, the social network may, under certain circumstances, enable us to contact you. This may take place, for example, via direct messages or through posted content. The content of communications via the social network and the processing of such content are the responsibility of the social network as a messaging and platform service. For this processing, please refer to the privacy policy of the relevant social network.

3.6.4 Processing of publicly available information

As soon as we transfer your personal data into our own systems or process it further, we are solely responsible for this. The processing is then carried out for the purpose of taking pre-contractual measures and for the performance of a contract in accordance with Article 6(1)(b) of the GDPR, or to safeguard our legitimate interests in accordance with Article 6(1)(f) of the GDPR, in order to contact customers.

3.6.5 Data protection rights

Please note that data protection enquiries can most efficiently be addressed to the relevant social media provider, as only these providers have access to the data and can take appropriate action directly. You are, of course, also welcome to contact us with your enquiry. In this case, we will process your enquiry and forward it to the social media provider.

Please refer to the privacy policy of the relevant social network for the legal basis of the data processing carried out by the social networks under their own responsibility. You can also find further information on the respective data processing activities and your options for objecting via the links below. Please note that data protection enquiries are most effectively addressed to the relevant social media provider, as only these providers have access to the data and can take appropriate action directly.

3.6.6 Online platforms used

Below is a list of information regarding the social networks on which we maintain an online presence:

3.6.6.1 Instagram (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland)

• Instagram Business account based on an agreement on joint processing of personal data (the so-called Page Insights Addendum regarding the data controller): https://www.facebook.com/legal/terms/page_controller_addendum

• Information on the Page Insights data processed and how to contact us regarding data protection enquiries: https://www.facebook.com/legal/terms/information_about_page_insights_data

• Privacy policy: https://privacycenter.instagram.com/policy/

• Opt-out (statement): https://de-de.facebook.com/help/instagram/2885653514995517?locale=de_DE

3.6.6.2 X (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland)

• Privacy Policy: https://x.com/de/privacy

• Opt-out: https://x.com/personalization

3.6.6.3 LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)

• Operation of the LinkedIn company page under joint responsibility based on an agreement on the joint processing of personal data (known as the Page Insights Joint Controller Addendum): https://legal.linkedin.com/pages-joint-controller-addendum

• Information on the Page Insights data processed and how to contact us regarding data protection enquiries: https://legal.linkedin.com/pages-joint-controller-addendum

• https://www.linkedin.com/legal/privacy-policy Privacy Policy

• Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

3.6.6.4 Xing/Kununu (New Work SE, Dammtorstraße 30, 20354 Hamburg)

• Privacy policy/opt-out: https://privacy.xing.com/de/datenschutzerklaerung

3.6.6.5 Glassdoor (Glassdoor, Inc., 100 Shoreline Highway, Building A, Mill Valley, California, 94941, USA)

• Privacy policyhttps://hrtechprivacy.com/de/brands/glassdoor#privacypolicy

3.7 Job applications

For our careers page https://career.ratepay.com/ (powered by talentsconnect), we use the services of talentsconnect AG, Niehler Straße 104, 50733 Cologne (“talentsconnect”). There, you can, in particular, find out about vacancies, search for jobs and apply for vacancies. In doing so, talentsconnect processes personal data (e.g. connection data generated automatically, log files, data relating to searching for and saving job vacancies) under its own responsibility.

Ratepay uses the Personio applicant tracking system, provided by Personio GmbH, Rundfunkplatz 4, 80335 Munich (“Personio”), to manage applications. If you apply for a vacancy at Ratepay via our careers page (powered by talentsconnect) and enter your application details on the careers page (e.g. title, first name/surname, email address, earliest possible start date, salary expectations, date of birth, application documents such as a cover letter, CV and references), talentsconnect transmits this data to Ratepay and, acting on Ratepay’s behalf and in accordance with our instructions as a data processor, forwards it via a programming interface to our applicant tracking system, Personio (“talentsconnect Fast Application”). Further information on data processing at talentsconnect, in particular regarding the

allocation of responsibility for individual processing steps, is available at: https://

www.talentsconnect.com/privacy . We have entered into data processing agreements with both talentsconnect and Personio. Your data is processed and stored within the European Union. The purpose of data processing is the selection of candidates with a view to potentially establishing an employment relationship. The legal basis for the processing of your application documents is Article 6(1)(b) of the GDPR and Article 88(1) of the GDPR in conjunction with Section 26(1), first sentence, of the Federal Data Protection Act (BDSG).

We store your personal data upon receipt of your application. If we accept your application and an employment relationship is established, we will store your application data for as long as it is necessary for the employment relationship and to the extent that statutory provisions impose a retention obligation.

Where applicable, as part of the application process, interviews with applicants may be recorded and transcribed on the basis of their consent in accordance with Article 6(1)(a) of the GDPR. The recordings are stored in the cloud by Metaview Global Limited. Metaview’s privacy policy can be found here: https://www.metaview.ai/privacy-policy .

4. Disclosure of data

As a general rule, the data we collect will only be disclosed if:

you have given your explicit consent in accordance with Article 6(1), first sentence, point (a) of the GDPR,
the disclosure is necessary, in accordance with Article 6(1)(f) of the GDPR, for the establishment, exercise or defence of legal claims, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
we are legally obliged to disclose the data under Article 6(1), first sentence, point (c) of the GDPR, or
this is permitted by law and necessary, in accordance with Article 6(1), first sentence, point (b) of the GDPR, for the performance of contractual relationships with you or for the implementation of pre-contractual measures taken at your request.

Some of the data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, these may include, in particular, data centres that host our website and databases, IT service providers that maintain our systems, and consultancy firms. Where we disclose data to our service providers, they may use the data solely for the purpose of fulfilling their tasks. We have carefully selected and commissioned these service providers. They are contractually bound by our instructions, have appropriate technical and organisational measures in place to protect the rights of data subjects, and are regularly monitored by us.

In addition, we may transfer your personal data to other recipients who process your personal data under their own responsibility. These may include, in particular:

banks and payment service providers;
Tax advisers, solicitors or auditors;
Credit reference agencies;
Public bodies such as government authorities and courts.

5. Data transfers to third countries

As explained in this privacy policy, we use services whose providers are in some cases based in so-called third countries (outside the European Union or the European Economic Area) or process personal data there – that is, countries whose level of data protection does not correspond to that of the European Union.

Where an adequacy decision by the European Commission (Art. 45 GDPR) exists for these countries, we base the data transfer on this decision. In the case of the USA, this applies only insofar as the US recipient has been certified under the EU-US Data Privacy Framework.

Where this is the case and the European Commission has not adopted an adequacy decision (Article 45 of the GDPR) for these countries, we have taken appropriate measures to ensure an adequate level of data protection for any data transfers. These include, amongst other things, the European Union’s Standard Contractual Clauses or binding internal data protection regulations.

Where this is not possible, we base the data transfer on the exceptions set out in Article 49 of the GDPR, in particular your explicit consent or the necessity of the transfer for the performance of a contract or for the implementation of pre-contractual measures.

Where a transfer to a third country is envisaged and there is no adequacy decision or suitable safeguards in place, it is possible – and there is a risk – that authorities in the relevant third country (e.g. intelligence services) may gain access to the transferred data in order to collect and analyse it, and that the enforceability of your data subject rights cannot be guaranteed. You will also be informed of this when your consent is obtained via the consent banner.

6. Retention period

As a general rule, we only store personal data for as long as is necessary to fulfil the purposes for which we collected the data. Thereafter, we delete the data without delay, unless we still require the data until the expiry of the statutory limitation period for the purposes of providing evidence in civil law claims or due to statutory retention obligations, or unless there is another legal basis under data protection law for the continued processing of your data in a specific individual case.

As we are a regulated financial institution and are subject to the associated regulatory requirements, we must retain contractual data for a further five years from the end of the year in which our business relationship with you ends. Data not covered by the regulatory retention periods is retained for evidential purposes for three years during the limitation

period. Any claims will become time-barred at the earliest at this point, in accordance with the statutory limitation period.

Even after that, we may still need to retain some of your data for accounting purposes. We are obliged to do so due to statutory documentation requirements arising from the German Commercial Code, the German Fiscal Code, the German Banking Act, the Money Laundering Act and the German Securities Trading Act. The retention periods for documents specified in these laws range from two to ten years.

7. Your rights

Provided the relevant legal conditions are met, you are entitled at any time to the data subject rights set out in Article 7(3) and Articles 15–22 of the GDPR:

Right to withdraw your consent (Article 7(3) of the GDPR);
Right to object to the processing of your personal data (Article 21 of the GDPR);
Right to access your personal data processed by us (Article 15 of the GDPR);
The right to rectification of any personal data held by us that is inaccurate (Article 16 of the GDPR);
Right to erasure of your personal data (Article 17 of the GDPR);
Right to restriction of processing of your personal data (Article 18 of the GDPR);
Right to data portability of your personal data (Art. 20 GDPR);
The right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, including, where applicable, the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision (Article 22 of the GDPR).

To exercise the rights described here, you may contact us at any time using the contact details provided above. This also applies if you wish to receive copies of guarantees demonstrating an adequate level of data protection. Your requests to exercise data protection rights and our responses to them will be retained for documentation purposes for a period of three years and, in individual cases, for a longer period where necessary to establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) of the GDPR, based on our interest in defending ourselves against any civil law claims under Article 82 of the GDPR, avoiding administrative fines under Article 83 of the GDPR, and fulfilling our accountability obligations under Article 5 of the GDPR.

You have the right to withdraw any consent you have given at any time. As a result, we will no longer continue the data processing that was based on this consent in future. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.

Where we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time on grounds relating to your particular situation. Where the objection relates to data processing for direct marketing purposes, you have a general right to object, which we will honour even without you providing reasons. If you wish to exercise your right to withdraw consent or to object, an informal notification sent to the contact details provided above will suffice.

Finally, you have the right to lodge a complaint with a data protection supervisory authority. You may exercise this right, in particular, with a supervisory authority in the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred, or with any other data protection authority. In Berlin, where Ratepay GmbH is based, the competent supervisory authority is: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin.

8. Obligation to provide your data

There is generally no obligation to provide your data.

Where the provision of your data is necessary for the conclusion of a contract (for example, to register an account or to order goods or services), to fulfil legal obligations (for example, in the case of registration forms), to establish contact or to use other services and functions (for example, to subscribe to the newsletter), the relevant input fields are marked as mandatory (usually with an asterisk (*)). In such cases, without the provision of this data, any contract cannot be concluded, the specific service cannot be provided, or the function cannot be used.

Other details not marked as mandatory fields, however, are voluntary. The provision of such data is not required for the conclusion of any contract, the provision of the service or the use of the function, and has no bearing on the performance of the contract.

9. Automated decision-making

No automated decision-making, including profiling, in accordance with Article 22 of the GDPR, which has legal or similarly significant adverse effects, takes place. This applies in particular to our payment services. Further information on this can also be found in the privacy policy for payment processing in section 5.3.

However, when using technologies to personalise our services, automated decisions may be made regarding the personalised content and advertising that is displayed or sent. These decisions are then based on usage data collected automatically beforehand or on information you have provided yourself, for example via form fields. We use this data to create a profile, which helps us select the most relevant content and advertising. Personalised advertising is only displayed with your prior consent.

10. Changes to the Privacy Policy

We occasionally update this Privacy Policy, for example, when we make changes to our website or when legal or regulatory requirements change. The most recent update took place in June 2026.