How and why Avanoro processes your personal data when you use FLIQ — what we collect, why we hold it, and the rights you have over it.
Avanoro AB, reg. no. 559329-1239 (“Avanoro”, “we” or “us”) is committed to protecting your privacy and your right to control your own personal data. We always strive to process your personal data with care. The General Data Protection Regulation (“GDPR”) has applied as law in all EU Member States since 25 May 2018. Among other things, the GDPR is intended to protect individuals’ fundamental rights and freedoms, in particular their right to the protection of personal data.
This privacy policy describes how and why Avanoro processes your personal data, which categories of personal data we process, and what rights you have as a natural person (“you”) when you use Avanoro AB’s payment initiation service FLIQ, via a product, website or mobile app owned by us, or a website belonging to a merchant that offers FLIQ (the “Service”).
Avanoro is the data controller and is therefore responsible for the processing of personal data carried out by us or on our behalf.
Avanoro AB, reg. no. 559329-1239
Avanoro has not appointed a Data Protection Officer.
This section describes the categories of data subjects whose personal data we process. You may belong to more than one category, depending on your relationship with Avanoro.
The personal data we process is collected from:
The personal data we process when you use the Service is:
The personal data we process when you visit our website is:
This section describes the purposes for which we process your personal data, which categories of personal data are used in the processing, and the legal basis on which the processing is carried out.
The purpose of collecting and processing your personal data is to provide the FLIQ mobile app and to offer and provide the Service.
Personal data is collected and processed only for as long as you remain a registered user of the Service, until you withdraw any consents to the processing of personal data, or for such longer period as is required by law or agreement (e.g. currently seven years for personal data linked to accounting records).
We process and use your personal data on the following legal bases (i.e. legal grounds):
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Registering a user account | Identification Data | Performance of contract | For as long as the agreement is in effect, and thereafter 24 months |
| Authentication with BankID | Identification Data | Performance of contract | 5 years after the relationship has ended |
| Carrying out payments | Payment Data, Transaction Data | Performance of contract | 7 years |
| Customer support | Identification Data, Contact Data | Legitimate interest | 24 months after the matter is closed |
| Fraud prevention | Identification Data, Transaction Data, Device Information | Legitimate interest | 5 years after the relationship has ended |
| AML controls | Identification Data, Transaction Data | Legal obligation | 5 years after the customer relationship has ended |
| KYC (Know Your Customer) | Identification Data, Contact Data | Legal obligation | 5 years after the relationship has ended |
| Accounting | Transaction Data | Legal obligation | 7 years |
| Security logs | Device Information, Usage Data | Legal obligation | 12 months |
| Digital platforms | Cookies | Legitimate interest (necessary cookies) and consent (other cookies, e.g. analytics and marketing) | 12 months |
| Sending information | Identification Data, Contact Data | Contract, consent | 5 years after the relationship has ended |
When you download, activate and use the FLIQ mobile app, we process Device Information. This data is used to connect you as a user to the mobile app, to maintain the register of connected users, to terminate your connection, and to provide the functionality included in the mobile app from time to time. Within the mobile app, you may be offered services provided by Avanoro. In order to offer and provide such services, we process the personal data set out in Section 3.
In order to send your payments and receive refunds, we process Transaction Data and Payment Data (without you being a registered user of the Service), as well as Identification Data and Contact Data (as a registered and logged-in user of the Service). Some of this data may be obtained from the bank you have chosen to connect to the Service.
When you use FLIQ as a payment initiation service, we only collect the data required to initiate and verify the payment, or to comply with legal obligations.
When you visit the website www.fliqpayments.com, Avanoro processes cookies, as described in Section 8 below.
When you contact Avanoro by email, telephone or other channels, Avanoro will process the personal data you provide, as set out in Section 3, in order to handle and respond to your queries.
From time to time, we may need to contact you (by email, SMS or via Avanoro’s mobile app, depending on your preference) with information about the Service (such as operational information, security information and information about updates) or your use of the Service. On these occasions, we will process your Identification Data and Contact Data in order to send you such information.
Avanoro will process the personal data you have provided, as set out in Section 3, in order to counter money laundering and terrorist financing, and to comply with our bookkeeping obligations.
In order to meet the requirements of anti-money laundering and counter-terrorist financing legislation, Avanoro may, among other things, carry out:
Avanoro processes and discloses the personal data set out in Section 3 when responding to requests from authorities, where we are legally required to do so.
We may share your personal data with others to the extent we have a legal obligation to do so, and in order to perform services and fulfil agreements we have with you or our suppliers. We disclose personal data to our external business partners, or to the suppliers that need the data in order to provide FLIQ as a payment option to you.
Avanoro uses suppliers that process your personal data on our behalf. Such processing takes place, where applicable, under data processing agreements with the supplier, to ensure that the processing is carried out in accordance with law and Avanoro’s own rules for the processing of personal data. A list of current data processing agreements can be obtained by contacting us. Examples of suppliers include:
Avanoro may further disclose your personal data to law enforcement authorities, tax authorities or supervisory authorities, where required by law, regulation or other legislation. In the event of a dispute, or to protect the legitimate interests of Avanoro or a third party, Avanoro may transfer personal data to an authority or an advisor.
Avanoro takes technical and organisational security measures to protect your data against unauthorised disclosure, alteration or destruction. Avanoro’s employees and subcontractors are instructed to handle all personal data in accordance with applicable laws and regulations on personal data.
Your personal data is processed primarily within the EU/EEA.
In certain exceptional cases, Avanoro may transfer personal data to data processors located outside the EU/EEA. Such transfers may only be made after we have, in the individual case, implemented appropriate safeguards to ensure that your privacy and your rights are protected. In connection with such transfers, Avanoro ensures that appropriate safeguards have been implemented on the basis of an adequacy decision by the European Commission, the EU Standard Contractual Clauses (SCCs), or another valid transfer mechanism under the GDPR. Personal data may also be transferred where the European Commission has decided that an adequate level of protection exists in the country concerned (information on which countries this applies to is available on the website of the Swedish Authority for Privacy Protection (IMY) here).
Avanoro uses cookies and similar tracking technologies to provide you with the best possible user experience when you visit our digital platforms, such as www.fliqpayments.com.
There are two types of cookies:
The first time you visit www.fliqpayments.com we ask how you want us to handle cookies. Necessary cookies are always set: without them the site cannot remember your language, keep you signed in, or record the choice you just made. We do not need your consent for those.
Analytics cookies are only set if you choose “Accept analytics”. If you choose “Necessary only”, no analytics cookies are placed on your device, and any that were already there are deleted. Declining does not limit your use of the site in any way.
You can change your mind at any time via the “Cookies” link at the bottom of any page. Withdrawing your consent is as easy as giving it, and takes effect immediately.
| Name | Purpose | Type | Retention |
|---|---|---|---|
| fliq.consent | Remembers your cookie choice so we do not ask again on every page. | Necessary | 180 days |
| fliq-app-session | Keeps you signed in to FLIQ. Set only when you sign in, and readable only by our servers. | Necessary | 400 days |
| fliq.lang | Remembers whether you are reading the site in English or Swedish. Stored in your browser, not sent to us. | Necessary (browser storage) | Until you clear your browser storage |
| _ga | Google Analytics: tells one visitor apart from another so we can count how many people use the site. | Analytics — requires your consent | 2 years |
| _ga_VZJCYPJBPX | Google Analytics: keeps track of a single visit to the site. | Analytics — requires your consent | 2 years |
The analytics cookies are set by Google, which acts as our data processor for this purpose. Data collected through them may be transferred outside the EU/EEA; see section 7 on transfers to third countries. We use analytics only to understand how the site is used in aggregate — we do not use it to advertise to you, and we set no marketing or advertising cookies.
You can also block or delete cookies in your browser settings, independently of the choice you make here. Blocking necessary cookies may affect your ability to use the Service.
Under the GDPR, you have a number of rights in relation to your personal data. Below is a description of your rights and how to exercise them. You can read more about your rights on the website of the Swedish Authority for Privacy Protection (IMY) here. You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you consider that our processing of your personal data infringes the GDPR.
You have the right to be informed when we collect personal data about you and how your personal data is processed by Avanoro. Such information is provided through this privacy policy, through our terms and conditions, when we obtain your consent, and on specific occasions in the event of a personal data breach at Avanoro affecting your personal data, where it is likely that the breach would result in a risk to your rights or freedoms.
You have the right to obtain a summary of the personal data Avanoro stores about you, in the form of an extract from our register, by submitting a written request to us. Through this extract, you can verify the accuracy and lawfulness of the data. Avanoro may be prevented from disclosing data, for example due to provisions in other legislation. Avanoro may further refuse to provide the data in the case of manifestly unfounded or excessive requests.
You have the right to have inaccurate data about you corrected, and the right to supplement any personal data that is missing and relevant, having regard to the purpose of the processing.
If your Contact Data needs to be changed, you can update this information directly in the mobile app.
You have the right to request that Avanoro erase your personal data when it is no longer necessary for the purposes for which it was collected. If Avanoro is required to retain your personal data under law or under an agreement you have entered into with Avanoro, we will ensure that the personal data is processed only for the specific purpose set out in the law or the agreement.
Your right to request erasure of your personal data may affect your ability to use the Service.
In certain cases, you have the right to request that the processing of your personal data be restricted, including while the accuracy of your personal data is being investigated, if you have requested rectification. Restriction means that the data is marked so that, in the future, it may only be processed for certain limited purposes.
Your right to request restriction of the processing of your personal data may affect your ability to use the Service.
In certain cases, you have the right to object to our processing of your personal data. If the legal basis for our processing of personal data is based on a public interest, the exercise of official authority, or a legitimate interest assessment, you have the right to object at any time to the processing of your personal data. If you object to the processing of your personal data, the processing may only continue if there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing is carried out for the establishment, exercise or defence of legal claims.
You always have the right to object to your personal data being used for direct marketing purposes. If you object to your personal data being used for direct marketing, you will be unsubscribed from such communications.
In certain cases, you have the right to obtain and reuse your personal data elsewhere. Personal data processed on the basis of your consent or for the performance of a contract with you, and which you have provided, can be requested in a commonly used and machine-readable format that you can transfer to another data controller, where this is technically feasible. Avanoro is obliged to facilitate such a transfer of personal data.
If you have consented to one or more specific processing activities involving your personal data, you have the right to withdraw your consent at any time, and thereby request that we cease the processing immediately. You can withdraw your consent by contacting us at info@fliqpayments.com.
Your right to withdraw consent to the processing of personal data may affect your ability to use the Service.
Avanoro may use automated systems to carry out transaction controls, detect fraud, comply with the requirements of anti-money laundering legislation, and ensure the security of the Service. Such controls may, in certain cases, result in a transaction being declined or in additional verification being required. Decisions based on these controls are necessary for entering into and performing the agreement between you and us.
Where Avanoro uses automated decision-making that falls within the scope of Article 22 of the GDPR, you have, to the extent provided by applicable law, the right to request a human review of the decision. Certain information may, however, not be disclosed where this would be contrary to law or would undermine measures to prevent money laundering, terrorist financing, fraud, or other security risks.
Avanoro works continuously to improve and develop our services and our business. We may, from time to time, make changes to this privacy policy. The latest, current version of this privacy policy is always available at www.fliqpayments.com. If Avanoro makes significant changes that may affect your privacy or your rights, and that, by law, require you to be notified or to provide your consent, Avanoro will notify you (by email, SMS or via Avanoro’s mobile app, depending on your preference) and, where applicable, give you the opportunity to provide your consent.
You can exercise your rights by sending your request to us at info@fliqpayments.com.
If you have any questions about this privacy policy or our handling of personal data, or would like further information, please feel free to contact us in one of the following ways:
You can also submit a complaint about the processing of your personal data to, or contact, the Swedish Authority for Privacy Protection (IMY) by email at imy@imy.se, or visit IMY’s website here.