Klarna Privacy Policy
Klarna Privacy Policy
It is important to us that you feel protected when you pay with Klarna or use one of our other services. That is why we provide all information in this privacy statement about how we use your personal data.
1. Who is responsible for your personal data?
Klarna Bank AB (publ) is registered in the Swedish Trade Register under registration number 556737-0431 with its headquarters at Sveavägen 46, 111 34 Stockholm, Sweden, also operating through its branches. Klarna Bank AB ("Klarna," "we," "us") is the data controller of your personal data in accordance with the EU General Data Protection Regulation "GDPR." If you have questions about the processing of your personal data, you can contact our data protection team by writing to dataprotectie@klarna.nl.
2. Your rights as a data subject in the field of data protection
Under the GDPR, you have the right to control your personal data and to receive direct information from us about how we process your personal data. Below you can read what your rights are. If you want to know more or contact us to exercise your rights, the easiest way is to send us an email at dataprotectie@klarna.nl.
If you wish to receive information through the so-called ‘Subject access’ about which personal data Klarna holds, or if you want certain data to be deleted, you can send us a request by filling out this form , which is available on our homepage. For other types of questions, you can use the contact details in section 12.
Your rights
-
Right to have personal data erased (“Right to be forgotten”).
In some cases, you have the right to request the deletion of your personal data. For example, you can ask us to delete personal data that we (i) no longer need for the purpose for which it was collected, or (ii) process based on your consent and for which you withdraw your consent. However, in certain cases, we cannot delete your personal data; for example, when the data is still necessary to be processed for the purpose for which it was collected, when Klarna's interest in processing the data outweighs your interest in having it deleted, or because we have a legal obligation to retain it. You can read more about our legal obligations to retain data in paragraphs 4 and 9 below. The laws described there prevent us from deleting certain data immediately. You also have the right to object to the use of your personal data for certain purposes, such as direct marketing, which you can read more about in the following list of rights.
-
Right to be informed.
You have the right to be informed about how we process your personal data. We do this through this privacy statement, service-specific FAQs, and by answering your questions.
-
Right to access your personal data (“Data Subject access”).
You have the right to know whether Klarna processes personal data about you and to receive a copy ("data extract") of such data, known as data subject access. Through the data extract, you receive information about which personal data Klarna holds about you and how we process it.
-
Right to access and request the transfer of your personal data to another recipient ("Data portability").
This right means you can request a copy of the personal data Klarna holds about you, which Klarna uses to make an agreement with you, or based on your consent, in a machine-readable format. This allows you to use this data elsewhere, for example, to transfer your personal data to another controller/recipient.
-
Right to rectification.
You have the right to request the correction of inaccurate information about you or to complete information that you believe is incorrect or incomplete.
-
Right to restrict processing.
If you believe your data is incorrect, that our processing is unlawful, or that we do not need the information for a specific purpose, you can ask us to restrict the processing of such personal data. You can also request to stop processing your personal data while the request is being evaluated. If you object to our processing based on the right described directly below, you can also ask us to restrict the processing of that personal data during our review.
-
Right to object to the processing of your personal data.
You have the right to object to our processing of your personal data based on our legitimate interest (Art. 6(1)(f) GDPR), by referring to your personal circumstances. Additionally, you can always object to the use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will disable the marketing option for you and stop sending you marketing communications.
-
Right to object to an automated decision that has significant consequences for you.
You have the right to object to an automated decision made by Klarna if the decision has legal effects for you or significantly affects you in a similar way. See point 6 for how Klarna uses automated decisions.
-
Right to withdraw your consent.
As described below in point 5, where we process your personal data based on your implicit or explicit consent, you have the right to withdraw that consent at any time. When you withdraw your consent, we will stop processing your data for those purposes.
-
Right to file a complaint.
If you have complaints about Klarna's processing of your personal data, you can file a complaint with the Integritetsskyddsmyndigheten, the Swedish supervisory authority for Klarna's processing of personal data. You can contact the Integritetsskyddsmyndigheten here . You can also file a complaint with your national data protection authority, which you can find here .
Settings in the Klarna App: In the Klarna App, Klarna gives you the option to adjust your preferences for certain services, such as ongoing notifications.
3. What types of personal data do we collect?
In this section, we describe the different personal data we use. In point 4, we describe the purposes for which we use this personal data.
-
Contact and identification details - Name, date of birth, social security number, title, occupation, gender, billing and delivery address, email address, mobile phone number, nationality, age, audio recordings, photos and video recordings of you and your identity card, etc.
-
Information about goods/services - Data about the goods/services you have purchased or ordered, such as the type of item or the delivery tracking number.
-
Information about your financial capacity - Information about, for example, your income, any credits, a negative payment history, and previous credit approvals.
-
Payment information - Credit and debit card details (card number, expiration date, and CVV code), bank account number, name of the bank.
-
Information about your use of Klarna's services - Which service(s) and which different features you have used in these services and how you used them. This includes information about outstanding and previous debts, your repayment history, and your personal preferences.
-
Technical information generated by your use of Klarna's services - Technical data such as response time for web pages, download errors, date and time you used the service.
-
Information about your contacts with Klarna's customer service - Recorded phone calls, chat conversations, and email correspondence.
-
Your contacts with the stores you frequent - Information about your interaction with stores, e.g., whether you have received the goods and what type of store you frequent.
-
Device information - Device ID, IP address, language settings, browser settings, time zone, operating system, platform, screen resolution, and similar information about your device and the settings/use of your equipment.
-
Information from external PEP and sanctions lists - Sanctions lists and lists of politically exposed persons ("PEP") contain information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the relevant list.
-
Sensitive personal data - Sensitive personal data are data from which a person's religious, political, or philosophical beliefs, trade union membership, information about a person's health, sexual behavior, or sexual orientation can be derived, as well as biometric data.
-
Service-specific personal data - In the context of our services via the Klarna Shopping Service, Klarna’s savings and payment accounts, Auto-import/Magic import, and Personal Finances, we use additional personal data that does not fall under the categories mentioned below: Information about each service:
-
The Klarna mobile application (the “Klarna App”) and browser extension (under the Klarna Shopping Service): All content you upload or submit (such as photos, receipts, or product and store reviews), location and geolocation data, and websites you visit in the App’s browser or with the installed extension;
-
Klarna's savings and payment accounts: Information about your transactions and deposits, as well as information about where your money comes from or what it will be used for. Klarna will also process data about third parties (such as beneficiaries or payers) for this service;
-
Auto-import/Magic import: Information from your linked email account that we pass on to the Klarna App; this includes your purchases, product, price, and quantity information, delivery tracking numbers, and store information;
-
Personal finances: Information from your other bank accounts and other types of accounts (such as card accounts) that you want to link to the service, as well as information such as account number, bank, previous transactions of your linked accounts, balances, and credits;
-
Membership Connect Service: Information from your added third-party membership or loyalty card account such as membership information and data, status, levels, and balance history.
-
-
Event registration via social media: Information about your social media account profile and business information such as the name, address, and type of your employer’s company.
Detailed information about the relevant personal data for each service can also be found in the terms we have listed here .
4. Which personal data we process, for what purpose, and on what legal basis?
In the tables below we describe:
-
what we will use your personal data for (the purpose),
-
which types of personal data we use for this purpose, and whether the personal data is obtained directly from you or from another source. In cases where we have received your personal data from another source, we specify the source in parentheses,
-
which legal rights we have to process data about you under current data protection legislation, such as the GDPR, and
-
When Klarna stops using the personal data specifically for each purpose.
4.1 Purposes for which Klarna always uses your personal data, regardless of the service you use.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis for processing according to the GDPR. |
When the purpose of using the personal data ends. See section 9 for information on when Klarna deletes the data. |
|
To manage the interaction with you as a customer as agreed, and this for every service you use. This includes creating and sending information in electronic format (not marketing). |
From you:
From other sources:
|
Data processing is necessary for Klarna to enter into an agreement with you (Art. 6(1)(b) GDPR).
If the service processes sensitive personal data (e.g., material you want to upload), this is done based on your explicit consent (Art. 9(2)(a) GDPR). |
When the agreement between you and Klarna ends. |
|
To conduct customer satisfaction surveys and market research, carry out consumer research, and to request reviews from you via email, SMS, phone, or other communication channels.
If you do not want us to carry out this processing, please contact us to let us know. See point 2 for more information about your rights. See point 12 for our contact details. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing, Klarna has a legitimate interest in processing personal data, that the processing is necessary to achieve the specific purpose, and that our interest outweighs your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the agreement between you and Klarna ends. |
|
To ensure the network and information security of Klarna's services. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing, Klarna has a legitimate interest in ensuring the security of the network and information, that the processing is necessary to achieve the specific purpose, and that its interest outweighs your right to object. It is also in your interest as a customer that we ensure good information security.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing lasts as long as you use a service. |
|
To be able to assist you as a vulnerable customer (i.e., if you contact us for extra support due to special circumstances). This means we can provide you with special assistance, for example, when you contact customer service. |
From you:
From other sources:
|
Based on your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). |
When you inform us that you are no longer a vulnerable customer or when you withdraw your consent. We also stop this processing if and when you inform us that you no longer want to be a Klarna customer. |
|
To be able to perform risk analyses, prevent fraud, and carry out risk management.
We process the data to verify your identity and to check whether the information you provided is correct, as well as to prevent criminal activities.
This processing amounts to profiling and automated decision-making. We use automated decision-making for this purpose to assess whether you are at risk of fraud. See point 6 for more information about profiling and automated decisions. |
From you:
From other sources:
|
The processing is necessary for Klarna to enter into a contract with you (Art. 6(1)(b) GDPR). We are also legally required to verify the identity of our customers (Art. 6(1)(c) GDPR). (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
Sensitive personal data is processed based on your explicit consent. |
This processing takes place while you use a Klarna service.
However, if Klarna has identified a potential risk in the way you use Klarna, we will continue to use your information for this purpose and continuously update our risk assessment as long as there is a risk of fraud. This processing lasts as long as we are legally required to retain your data. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To anonymize your personal data in order to improve our services and products and analyze consumer behavior. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing of interests, Klarna has determined it has a legitimate interest both in anonymizing your personal data for product development purposes and in analyzing consumer behavior to improve service and customer experience. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest outweighs your right to prevent your data from being processed for this purpose. Anonymizing your information also means we use as little personal data as possible.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing continues as long as Klarna must retain the information in its systems, for example, to comply with the agreement made with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To perform data analyses for product development and testing, to improve our risk and credit models, and to design and enhance our services (where possible, we first anonymize the data, meaning that no personal data is processed afterward). |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing of interests, Klarna assumes a legitimate interest in performing data analyses for product development and testing purposes. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest outweighs your right to object. Moreover, our customers benefit from the processing as it helps us deliver flawless and sustainable services.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing continues as long as Klarna must retain the information in its systems, for example, to comply with the agreement made with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To perform data analyses to measure and improve our marketing and advertising channels (if possible, we first anonymize the data, meaning no further processing of personal data takes place afterward). |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing, Klarna assumes a legitimate interest in performing data analyses to measure and improve our marketing and advertising channels. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest outweighs your right not to have your data processed for this purpose.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing continues as long as Klarna must retain the information in its systems, for example, to comply with the agreement made with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To calculate payment commissions to suppliers (if possible, we first anonymize the data, meaning no further processing of personal data takes place afterward). |
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing, Klarna has determined that we have a legitimate interest in calculating potential commissions. We guarantee that the processing involved is necessary to achieve the processing purpose, and that our interest outweighs your right not to have your data processed for this purpose.
You may contact us for more information about how the balancing was made. See section 12 for our contact information. |
The processing takes place up to 90 days after using the service. |
|
To compile statistics and reports for economic analyses or analyses of payment trends or volumes in certain regions or industries (if possible, we first anonymize the data, meaning no further processing of personal data takes place afterward). |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In this balancing, Klarna asserts a legitimate interest in obtaining statistical data and reports for this purpose. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest outweighs your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing continues as long as Klarna must retain the information in its systems, for example, to comply with the agreement made with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To verify and confirm your identity. |
From you:
|
Data processing is necessary for Klarna to enter into an agreement with you (Art. 6(1)(b) GDPR). |
As long as you use any of Klarna's services. |
|
To share your personal data with the various recipients described in point 7.1 (suppliers and subcontractors, companies within the Klarna Group, parties responsible for your financial transactions, authorities, and buyers of debt claims, companies or assets). |
|
Depending on the beneficiary (see point 7.1). |
This processing continues as long as Klarna must retain the information in its systems, e.g., to comply with the agreement concluded with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To decide which type of marketing we will offer you.
If you do not want us to carry out this processing, please contact us. We will then no longer use your data for marketing. Contact information can be found in point 12.
The processing may involve profiling. See point 6 for more information about your rights. |
From you:
From other sources:
|
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna asserts a legitimate interest in determining which type of marketing we should offer you. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. We have also considered that marketing is mentioned in the GDPR as an example of legitimate interest.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the agreement between you and Klarna ends, or when you inform us that you are not interested in this processing. |
|
To deliver marketing materials and offers about other products and services from our package, which are similar to those you have already used and which are part of Klarna as a shopping platform.
If you do not wish to receive marketing from us, please contact us to let us know. We will then stop processing your data for sending marketing. See point 12 for our contact information. |
From you:
From other sources:
|
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna asserts a legitimate interest in sending you marketing about our services and offers. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. We have also considered that marketing is mentioned in the GDPR as an example of legitimate interest.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the agreement between you and Klarna ends, or when you inform us that you are not interested in this processing. |
|
To provide you with direct marketing about offers, products, or services from Klarna and our stores/partners. |
From you:
From other sources:
|
The processing is based on your consent (Article 6(1)(a) GDPR). |
Either when you inform us that you want to withdraw your consent, or when you inform us that you are not interested in this processing / opt-out. |
|
To protect Klarna against legal claims and to safeguard Klarna's legal rights. |
In case of a dispute, Klarna may also collect other types of personal data about you if we need them to exercise our rights. |
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna states it has a legitimate interest in protecting itself against legal claims. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
This processing continues as long as Klarna must retain the information in its systems, for example, to comply with the agreement made with you or to comply with applicable law. See point 9 for more information about our obligations and the right to retain information as legally required. |
4.2 Purposes for which your personal data are used if you use one of Klarna's payment methods in a store, or choose to pay with a debit or credit card at Klarna's checkout in a store.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis for processing according to the GDPR. |
When the purpose of using the personal data ends. See section 9 for information on when Klarna deletes the data. |
|
To transfer the store's right to payment for your purchase to Klarna ("factoring"). |
From you:
From other sources:
|
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna states that it (and the store) has a legitimate interest in buying or selling your outstanding credit. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the purchase takes place. |
|
To share your personal data with the categories of recipients described in article 7.2 (stores, payment service providers and financial institutions, fraud prevention agencies and companies providing identity information, Google, and Billie). |
From you:
From other sources:
|
Depending on the recipient (see art 7.2). |
Primarily when the purchase takes place, but also throughout the entire period that Klarna holds the data in its systems, i.e., until the information is deleted. See point 9 for more details about our obligations and the right to retain information as legally required. |
|
In a store that offers Klarna as a payment method or has Klarna checkout, we evaluate the order in which the different payment methods should be presented to you at the store's checkout. This processing does not affect which of Klarna's payment methods are available to you.
If you do not want us to carry out this processing, please contact us to let us know. Contact information can be found in point 12.
This processing creates profiling. See point 6 for more information about profiling. |
From you:
From other sources:
|
If you have accepted and use the so-called "Shopping Service," as described in more detail under the terms of the service you can here , then the legal basis for processing is the performance of the contract (Art. 6, paragraph 1, point b, GDPR).
If, on the other hand, you have not entered into a "Shopping Service" agreement, the processing is based on a balancing of interests (Art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna asserts a legitimate interest in investigating the order in which the various payment options will be presented to you at checkout in the store. We assure you that the specific processing involved is necessary to achieve the intended purpose and that our interest outweighs your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When payment methods are displayed at checkout. |
|
Preventing Klarna’s activities from being used for money laundering or terrorist financing by verifying your identity, monitoring and evaluating transactions. Klarna also conducts ongoing risk assessments and develops risk models to combat money laundering and terrorist financing.
This processing amounts to profiling and automated decision-making. See point 6 for more information about profiling and automated decisions. |
From you:
From other sources:
|
To comply with the law (Art. 6, paragraph 1, point c, GDPR). (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
The basis for processing sensitive personal data is that it is necessary for reasons of public interest (Art. 9, paragraph 2, point g, GDPR). |
When the agreement between you and Klarna is terminated. See point 9 for more information about our obligations and the right to retain information as required by law. |
|
To conduct a fraud prevention evaluation before a purchase is accepted.
This processing amounts to profiling and automated decision-making. We use automated decision-making for this purpose to assess whether you are at risk of fraud. See point 6 for more information about profiling and automated decisions.
See also section 7.2.3 about our use of fraud prevention agencies to which your data may be disclosed, and our legal basis for that disclosure. If we identify possible fraudulent transactions, we will also report this to our fraud prevention agencies as set out in section 7.2.3. |
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies about whether your information indicates an attempt at fraud. |
To enter into and execute the agreement (Art. 6(1)(b) GDPR). |
When the credit evaluation is performed. |
|
To maintain accounting and administrative processing as required by accounting legislation, and to retain it in compliance with applicable law. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078)) |
For the accounting period, and up to 7 years after the end of the year in which the information was recorded. See section 9 for more information about our obligations and the right to retain information as legally required. |
|
To perform calculations in accordance with capital adequacy requirements. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR). (Capital Requirements Regulation 575/2013, and Capital Requirements Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. See point 9 for more information about our obligations and the right to retain information as legally required. |
4.3 Purposes for which your personal data are processed when you use one of Klarna’s payment methods involving credit, or when you use the Klarna card or the One-Time Card Shopping Service.
The table below describes the services that may provide credit to you: "Pay later" (invoice), "Pay now" (for payment via Direct Debit), "Financing" (payment in installments), as well as the Klarna card and the One-Time Card Shopping Service (both offered in the Klarna App or browser extension).
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis according to the GDPR. |
When the purpose of using the personal data ends. See section 9 for information on when Klarna deletes the data. |
|
To perform a credit assessment before credit is granted.
This involves profiling and decision to approve or reject credit involves an "automated decision". See section 6 for more information about profiling and automated decisions.
See also section 7.3.1 about our use of fraud prevention agencies to which your data may be disclosed, and our legal basis for that disclosure. |
From you:
From other sources:
|
To enter into and execute the credit agreement (Art. 6(1)(b) GDPR). |
When the credit evaluation is performed. |
|
To share your personal data with the various recipients described in point 7.3 (credit bureaus, collection agencies, and other buyers of outstanding claims, as well as VISA, debt-assuming parties, and digital wallet providers). |
From you:
From other sources:
|
Depending on the beneficiary (see point 7.3). |
Primarily when the purchase takes place, but also as long as Klarna retains the data in its systems, i.e., until they are deleted. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To exercise Klarna’s right to transfer the payment of your purchase to a new beneficiary ("factoring"). |
From you:
From other sources:
|
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna asserts a legitimate interest in selling outstanding credits as part of its business policy. We assure you that the processing is necessary to pursue this interest and that our interest prevails over your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
The processing may be carried out even if the debt is unpaid (you will be notified if the debt is transferred). |
|
Performing debt collection services, i.e., collecting and selling overdue debts. |
From you:
From other sources:
|
The processing is based on a balancing of interests (art. 6, paragraph 1, point f, GDPR). In the balancing of interests, Klarna asserts a legitimate interest in collecting and selling debts. We assure you that the specific processing involved is necessary to achieve this purpose, and that our interest prevails over your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the debt has been paid. |
|
To prevent Klarna's activities from being used for money laundering or terrorist financing, by verifying your identity, monitoring and evaluating transactions, conducting risk assessments, and creating risk models.
This processing involves profiling, and a decision that you pose a risk of money laundering is an "automated decision." See point 6 for more information about profiling and automated decisions. |
From you:
From other sources:
|
To comply with the law (art. 6, paragraph 1, point c, GDPR). (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
The condition for processing sensitive personal data is that it is necessary for reasons of public interest (Art. 9(2)(g) GDPR). |
Up to five years after termination of the agreement or after the end of the customer relationship (up to ten years in cases where law enforcement authorities request it). See point 9 for more information about our obligations and the right to retain information as legally required. |
|
Archiving and accounting in accordance with accounting legislation. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078)) |
Seven years after the end of the year in which the information was recorded. See point 9 for more information about our obligations and the right to retain information as legally required. |
4.4 Use of your personal data (and that of third parties) to give you access to the Klarna account service (savings and payment accounts).
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis according to the GDPR. |
When the purpose of using the personal data ends. See point 9 for further information on when the data is deleted. |
|
To offer Klarna's savings and payment accounts. |
From you:
From other sources:
|
Data processing is necessary for Klarna to enter into an agreement with you (Art. 6(1)(b) GDPR).
Information about third parties (such as the payment recipient or payer) is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna has determined that both we and you (and also the payment recipient/payer) have a legitimate interest in processing this data to carry out the transactions in question. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object.
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the agreement between you and Klarna ends. |
|
To pass your personal data to the categories of recipients described in point 7.4 (credit institutions and other financial institutions). |
From you:
From other sources:
|
Data processing is necessary for Klarna to enter into an agreement with you (Art. 6(1)(b) GDPR). The terms of service are here available. |
When the agreement between you and Klarna ends. |
|
To prevent Klarna's activities from being used for money laundering or terrorist financing, by verifying your identity, monitoring and evaluating transactions, conducting risk assessments, and creating risk models.
This processing involves profiling, and a decision that you pose a risk of money laundering is an automated decision. See point 6 for more information about profiling and automated decisions. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR). (Swedish Act (2017:630) on measures against money laundering and terrorist financing).
The condition for processing sensitive personal data is that it is necessary for reasons of public interest (Art. 9(2)(g) GDPR). |
Up to five years after termination of the agreement or customer relationship (up to ten years in cases where law enforcement agencies request it). See point 9 for more information about our obligations and the right to retain information as legally required. |
|
Archiving and accounting in accordance with accounting legislation. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078)) |
Seven years after the end of the year in which the information was recorded. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
To perform calculations in accordance with capital adequacy requirements. |
From you:
From other sources:
|
To comply with the law (Art. 6(1)(c) GDPR) (Capital Requirements Regulation 575/2013, and Capital Requirements Directive 2013/36). |
Seven years after the end of the year in which the information was recorded. See point 9 for more information about our obligations and the right to retain information as legally required. |
4.5 Use of your personal data when using Klarna’s Shopping Service.
When you use Klarna's Shopping Service, Klarna will process your personal data for the purposes described in the table below. The terms of the Shopping Services and the description of the features that are part of it are here available.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis according to the GDPR. |
When the purpose of using the personal data ends. See point 9 for further information on when the data is deleted. |
|
To provide Klarna's Shopping Service and the features that are part of it.
The service implies your profiling to personalize the content of the Klarna App and Klarna’s checkout. |
|
Data processing is necessary for Klarna to enter into an agreement with you (terms of use for the shopping service (Art. 6, paragraph 1, letter b, GDPR).
If the shopping service also processes sensitive personal data (if you have uploaded this data, e.g., via receipts for certain purchases/memberships, via product and store reviews, or if you have otherwise given us access to this data), we process this data based on your explicit consent (Art. 9, paragraph 2, point a, GDPR). See section 3 for more information about this type of personal data. |
When the agreement between you and Klarna ends. |
|
You decide whether to share your location and geolocation data with us or not. We use this information to find and suggest stores and offers in your area in the Klarna mobile application.
You can disable sharing of location and geolocation data on your device at any time. |
From you:
|
Data processing is necessary for Klarna to enter into an agreement with you (terms of use for the shopping service (Art. 6, paragraph 1, letter b, GDPR). |
When the agreement between you and Klarna ends. |
|
To offer you a browser via the Klarna App with which you can, for example, visit store websites. Klarna will collect information about how you use the browser to adapt its mobile application. |
From you:
|
Data processing is necessary for Klarna to enter into an agreement with you (terms of use for the shopping service (Art. 6, paragraph 1, letter b, GDPR).
If the service processes sensitive personal data (e.g., from pages you visit), this is done based on your explicit consent (Art. 9, paragraph 2, point a, GDPR). However, this sensitive information will not be used for any other purpose than to show you the current website in the browser. |
When the agreement between you and Klarna ends. |
|
To prevent fraud when using the Klarna Shopping Service.
This processing constitutes profiling and automated decision-making. We use automated decision-making to determine whether you pose a fraud risk. See section 6 for more information about profiling and automated decision-making.
See also section 7.5.6 about our use of fraud prevention agencies to which your data may be disclosed, and our legal basis for that sharing.
|
From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies about whether your information indicates an attempt at fraud.
|
The processing is necessary for Klarna to perform a contract (terms for the Shopping Service) with you (Article 6(1)(b) GDPR). |
When the fraud assessment is carried out. |
|
To pass your personal data to the categories of recipients described in point 7.5 (branch networks, Google, partners within the Personal Finance service and the Offer and Benefit Program, as well as logistics and transport companies, advertising services, third-party apps and services (for SIWK), fraud prevention agencies, and companies conducting identity checks). |
From you:
From other sources:
|
Depending on the recipient (see point 7.5). |
When the agreement between you and Klarna ends. |
|
To show you relevant ads via advertising services from third parties outside the Klarna App and to assess the relevance of such ads. This is based on your user behavior and Klarna profile. You may see such relevant ads delivered to you by these advertising services from third parties when you are on other websites and apps. See section 7.5.5. for information about this data sharing.
The processing may involve profiling, intended to tailor marketing based on what we think you are interested in. You can read more about profiling in section 6. |
From you:
From other sources:
|
This is based on the consent you have given (pursuant to Art. 6(1)(a) GDPR). |
Either when you notify us that you want to withdraw your consent, or when you let us know that you are not interested in this processing.
We will also stop processing your data if and as soon as you inform us that you no longer want to be a Klarna customer. |
|
If you choose to register with Klarna (via “SIWK”) in a third-party application or service, Klarna will share your personal data with that store or online service.
|
From you:
From other sources:
|
Processing is necessary for Klarna to perform a contract (general terms and conditions for the shopping service) with you (Article 6, paragraph 1, letter b of the GDPR). |
When the agreement between you and Klarna ends.
We will also stop processing if and when you inform us that you no longer wish to use this specific functionality.
|
4.6 Additional services you can use, for example, via the Klarna mobile app or Klarna's browser extension.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis according to the GDPR. |
When the purpose of using the personal data ends. See point 9 for further information on when the data is deleted. |
|
If you have linked your email account to Klarna's Auto-import, Klarna will regularly connect to your email account(s) to obtain information about your purchases. You can terminate this service at any time, thereby stopping Klarna's access to your email account. |
From other sources:
|
Data processing is necessary for Klarna to enter into an agreement with you (terms of use for the shopping service (Art. 6, paragraph 1, letter b, GDPR).
If the service processes sensitive personal data (from your transactions), this is done based on your explicit consent (Art. 9, paragraph 2, letter a, GDPR). See point 3 for more information. |
When the agreement between you and Klarna ends. |
|
If you have linked your bank accounts to the Personal Finance service, Klarna will provide you with tools to keep your finances under control based on your specific needs.
With this processing, we perform profiling to tailor the content of the service to what we think interests you. More information about profiling can be found in point 6.
If you want to use the offers and benefits that Klarna provides as part of this service, we will share your personal data with the partner providing them (see point 7.5.3). |
From other sources:
|
Data processing is necessary for Klarna to enter into an agreement with you (terms of use for the shopping service (Art. 6, paragraph 1, letter b, GDPR).
If the service processes sensitive personal data (from your transactions), this is done based on your explicit consent (Art. 9, paragraph 2, letter a, GDPR). See point 3 for more information. |
When the agreement between you and Klarna ends. |
|
If you use our browser extension, Klarna processes your data to provide the service, including processing information about which websites/web domains you visit:
Klarna processes information about the e-commerce websites/web domains you visit to identify deals, offer cash back, and provide you with personalized offers in the Klarna extension and mobile app. This processing is also done to enable you to create one-time cards directly in your browser on websites where this service is enabled.
Information about visited non-ecommerce websites/web domains is not stored by Klarna.
Read more about how your personal data is used in the extension FAQ. |
From you:
From other sources:
|
The processing is necessary for Klarna to conclude a contract (general terms for the Klarna Shopping Service) with you (art. 6, paragraph 1, point b), GDPR).
If the service processes information consisting of sensitive personal data (i.e., this type of data about the websites/web domains you visit), our processing will be based on your explicit consent (art. 9, paragraph 2, point a), GDPR). See point 3 for more information about this type of personal data. |
When the agreement between you and Klarna ends. |
|
If you have added a third-party membership or loyalty card account on Klarna's Membership Connect Service, Klarna processes your data to provide the service.
This means Klarna regularly connects to your third-party card account to import membership points, levels, and balance history.
|
From other sources:
|
The processing is necessary for Klarna to perform an agreement (terms for the shopping service) with you (article 6, paragraph 1, point b) GDPR). |
When the contract between you and Klarna ends. |
4.7 Offers and invitations for events posted on social media, and your interaction with us via social media.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis for processing according to the GDPR. |
When the purpose of using the personal data ends. See point 9 for further information on when the data is deleted. |
|
If you register for an event via social media, we process your personal data to provide the requested service.
You can always unsubscribe from this by contacting us. See point 12 for our contact details. |
From you:
|
Klarna must process your data to be able to conclude an agreement with you (regarding participation in an event) (art. 6, paragraph 1, point b, GDPR).
You can contact us if you want more information about how this decision was made. See point 12 for our contact details. |
When the event is over |
4.8 Klarna's processing when you contact its customer service.
|
Purpose of processing - what we do and why. |
Types of personal data used for the purpose, and where they come from (the source). See point 3 for more information about the different types of personal data. |
Legal basis for processing according to the GDPR. |
When the purpose of using the personal data ends. See point 9 for further information on when the data is deleted. |
|
To handle all matters received by Klarna's customer service. This means that various forms of written conversations are retained both to document customer issues, for security purposes, and to prevent fraud. |
From you:
From other sources:
|
Performance of contracts (Art. 6, paragraph 1, letter b, GDPR). |
Up to ten years, based on the statute of limitations. See point 9 for more information about our obligations and the right to retain information as legally required. |
|
Quality and service improvement (to ensure satisfactory service). We may record phone calls and screen sharing sessions between you and our employees for quality purposes, to provide better products and services. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6, para. 1, letter f, GDPR). In balancing interests, Klarna has determined it has a legitimate interest in improving its services, internal training, and quality control. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. As a customer, you also have an interest in good interaction quality with Klarna.
You can contact us if you want more information about how this decision was made. You can find the contact information in point 12. |
We process recordings of phone calls for up to 90 days and screen sharing sessions for up to 30 days for quality assurance purposes. |
|
We record what is said when you speak with our customer service (to ensure that we have documented what was agreed or discussed). We use recorded phone calls between you and our employees as well as both handwritten and automated notes to know what was said. |
From you:
From other sources:
|
The processing is based on a balancing of interests (Art. 6, para. 1, letter f, GDPR). In the balancing of interests, Klarna has determined that it has a legitimate interest in documenting communication with its customer service. It guarantees that the specific processing involved is necessary to achieve that purpose, and that its interest outweighs your right not to have your data processed for this purpose. As a customer, you also have an interest in the discussed matters being documented impartially.
You can contact us for more information about how the provision was established. See the contact information in point 12. |
90 days from the day the recording was made. |
|
If you contact us via social media such as Facebook or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy policies. The same applies to the response you receive from us. Klarna processes this information to answer your questions. |
From you:
From other sources:
|
Performance of contracts (Art. 6, paragraph 1, letter b, GDPR). |
Once we have answered your question. |
|
To handle voluntary blocks for the use of Klarna's services, i.e., if you contact us and ask us to prevent you from using our services. You can lift your voluntary block at any time by contacting us again. |
From you:
|
Based on your consent (Article 6, paragraph 1, letter a). |
When you let us know that you no longer want to be blocked from using our services or withdraw your consent. We also stop this processing if and when you let us know that you no longer want to be a Klarna customer at all. |
5. How can you withdraw your consent?
When Klarna processes your personal data based on your consent, you can withdraw this consent at any time. You can do this by sending an email to dataprotectie@klarna.nl or via the contact details you find in point 12.
You can also delete uploaded information from the Klarna App or terminate the service where personal data is processed. We will then delete that information. If you withdraw your consent or delete the uploaded information, you may no longer be able to use the service if Klarna's personal data processing is based on your consent.
Finally: As described in point 2 above, you also have the right to object to certain processing of personal data (for example, you can disable marketing). You also have the right to have certain personal data deleted, which is also described in point 2.
6. Klarna's profiling and automated decision-making that have significant consequences for you.
6.1 Klarna's profiling of you as a customer.
"Profiling" means an automated processing of personal data to evaluate certain personal aspects, e.g., by analyzing or predicting your personal preferences, such as your buying behavior. At the same time, we compare your data with what our other customers, with similar use of our services, preferred.
The purpose of profiling by Klarna and the different types of personal data used for each occasion and each profiling are described in detail in section 4 above. Profiling for these purposes does not have significant consequences for you as a customer.
We use profiling for the following purposes:
-
to deliver tailored services that adapt based on what we think interests you most or is relevant to you (this applies to the Klarna App, its various features, when you have a conversation with the customer service chatbot, and the order in which the different payment methods are shown at Klarna’s checkout), and
-
to offer you personalized marketing through our own and external platforms and services.
our services use machine learning and artificial intelligence models to provide you with the most relevant content possible.
If you have questions about how the profiling process works, you can contact us. Contact information can be found in section 12. You can object to our marketing profiling at any time by contacting us (we will then stop profiling for marketing purposes). You can also end our profiling for our services by discontinuing the service.
6.2 Klarna's automated decisions that have significant consequences for you.
Certain decisions in our services are fully automated, without the involvement of our employees, such as automated decisions with legal effects, or automated decisions that have similarly significant consequences for you. These decisions have a major impact on you as a consumer, comparable to legal consequences. By making such decisions automatically, Klarna increases its objectivity and transparency in decision-making to offer you these services. At the same time, you always have the right to object to these decisions. How you can object to these decisions is explained at the end of this section 6.2.
Automated decisions that have significant consequences for you also involve profiling based on your data before the decision is made. This profiling is done to assess your financial situation (before deciding to grant credit) or to check whether your use of our services involves a risk of fraud or money laundering. We profile your user behavior and financial capacity and compare this data with behavior patterns and circumstances with different risk levels.
The different user behaviors and conditions are evaluated and weighed in our automated decision models, so that we obtain an overall score, which then results either in acceptance or rejection of your use of our Services.
We may also decide to request further identification from you if we are not sure who you are.
When does Klarna make automated decisions that have significant consequences for you?
We use this type of automated decision when we:
-
decide to approve your application to use a credit service.
-
decide not to approve your application to use a credit service not .
These automated credit decisions are based on the data you provide to us, data from external sources such as credit bureaus, credit reports, and Klarna's own internal information about you if we have lent you money for this purpose. In addition to information about you, Klarna's credit model includes many other factors, such as Klarna's internal credit risk levels and our overall repayment rates (based on, for example, the current product category).
-
decide whether there is a risk of fraud, if your processing shows possible fraudulent behavior, that your behavior is inconsistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions where we determine whether you pose a fraud risk are based on information you provide, data from fraud prevention agencies (see point 7.2.3 for details on those we use), as well as Klarna’s own internal information. Klarna continuously develops its fraud models to keep its services secure and to accurately investigate how fraudsters operate in different markets (for example, which trade categories or products are most targeted by fraud attempts).
-
decide whether there is a risk of money laundering, in cases where our processing indicates that your behavior points to money laundering. In relevant cases, Klarna investigates whether certain customers are listed on sanction lists.
The different types of personal data used in each decision are described in section 4. See section 7 for more information about the categories with which we share information regarding profiling during automated decision-making.
If you are not approved under the automated decisions described above, you will not have access to Klarna's services, such as our payment options. Klarna has various security mechanisms to ensure that decisions are accurate and fair. These mechanisms include ongoing monitoring of our decision models and random sampling in individual cases. If you are concerned about the outcome, you can always contact us, and we will check whether the procedure was carried out correctly. You can also appeal according to the following instructions.
Your right to object to automated decisions
You always have the right to object to an automated decision with legal effects or to decisions that may otherwise have significant consequences for you (together with the relevant profiling). In that case, you can send an email to dataprotectie@klarna.nl. A Klarna employee will then review the decision, taking into account any additional information and circumstances you provide us.
7. With whom do we share your personal data?
When we share your personal data, we ensure that the recipient processes it in line with this notice, for example by entering into data transfer or data processing agreements with the recipients. These agreements include all reasonable contractual, legal, technical, and organizational measures to ensure that all your information is processed at an adequate level of protection and in accordance with applicable law.
7.1 Categories of recipients with whom Klarna will always share your personal data, regardless of the service you use.
7.1.1 Suppliers and subcontractors.
Description of the recipient: Suppliers and subcontractors are companies that only have the right to process the personal data they receive from Klarna on behalf of Klarna, meaning: the data processors. Examples of such suppliers and subcontractors are providers of software and data storage, payment service providers, business consultants, providers of machine learning/artificial intelligence functionalities, and companies within the Klarna Group.
Purpose and legal basis: Klarna needs access to services and functionalities of other companies where it cannot perform them itself. Klarna has a legitimate interest in having access to these services and functionalities (Art. 6, paragraph 1, point f, GDPR). We assure you that the specific processing involved is necessary to achieve the relevant purpose, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.1.2 Klarna Group
Description of the recipient: Companies within the Klarna Group.
Purpose and legal basis: This is necessary to enable Klarna to provide you with its services and functionalities. Klarna has a legitimate interest in accessing and providing these services and functionalities (Art. 6(1)(f) GDPR). We assure you that the specific processing involved is necessary to achieve the purpose in question and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See section 2 for more information about your rights.
When you shop in a foreign store (i.e., a store located outside the EU/EEA area) that has an agreement with another company within the Klarna Group, the disclosure of your personal data between the Klarna companies is required to enable both to manage your payment and to allow the foreign store to administer your purchase. The legal basis for this processing is the performance of a contract (Art. 6(1)(b) GDPR).
The receiving company of the Klarna Group will process your personal data in accordance with the privacy statement applicable in your country (see list). You can read more about how Klarna secures your personal data when it is transferred outside the EU/EEA in section 8.
7.1.3 A person who has power of attorney for your financial affairs.
Description of the recipient: Klarna may share your personal data with a person who has access rights under a power of attorney.
Purpose and legal basis: This processing is carried out to facilitate your contact with us (via agents) and takes place based on your consent (Art. 6(1)(a) GDPR).
7.1.4 Authorities.
Description of the recipient: Klarna may provide information to authorities such as the police, financial institutions, tax authorities, or other authorities and courts.
Purpose and legal basis: Personal data is shared with authorities if we are legally required to do so, if you request it, or if necessary for tax deduction or to combat crime. An example of a legal obligation to provide information is when it is necessary to take measures against money laundering and terrorist financing. Depending on the authority and purpose, Klarna's legal basis consists of the obligation to comply with the law (Art. 6(1)(c) GDPR), to fulfill the contract with you (Art. 6(1)(b) GDPR), and to lawfully protect itself against crime (Art. 6(1)(f) GDPR).
7.1.5 Divestment of companies or assets.
Description of the recipient: In the event that Klarna sells companies or assets, it may transfer your personal data to the potential buyer of such companies or assets. If Klarna or a large part of Klarna's assets is acquired by a third party, Klarna may also share the personal data of its customers.
Purpose and legal basis: Klarna has a legitimate interest in being able to carry out these transactions (Art. 6(1)(f) GDPR). We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.2 Categories of recipients with whom Klarna shares your personal data when you use its payment methods in a store, or choose to pay with a debit or credit card at Klarna's checkout in a store.
7.2.1 Stores.
Description of the recipient: By stores, we mean the stores you visit or shop at (including the store's affiliated companies, if you have been informed of this by the store).
Purpose and legal basis: To enable the store to process and manage your purchase and your interaction with the store or its affiliated companies, e.g., by verifying your identity, sending goods, handling questions and disputes, preventing fraud, and possibly sending relevant marketing. The store's privacy statement applies to the processing of your personal data shared with the store and processed by the store. Normally, you will find a link to the store's privacy policy on the store's website. The legal basis for sharing data with stores is partly the performance of a contract between you and the store (Art. 6(1)(b) GDPR) insofar as the sharing takes place within the framework of this contract, and partly based on the legitimate interest of Klarna and the store (Art. 6(1)(f) GDPR), or on your consent (Art. 6(1)(a) GDPR). We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.2.2 Payment service providers and financial institutions.
Description of the recipient: Payment service providers and financial institutions provide services to you, the stores, and Klarna to execute and manage electronic payments through a variety of payment methods, such as credit cards and bank payment methods like direct debit and bank transfer.
Purpose and legal basis: Some stores use payment service providers with whom they share your data to manage your payment. This sharing takes place in accordance with the stores' own privacy policies. The store may also allow Klarna to share your data with the payment service provider they use to process your payment. Some payment service providers also collect and use your information independently, in accordance with their own privacy policies. This is the case, for example, for providers of electronic wallets. Additionally, Klarna may also share your information with other financial institutions when it carries out transactions with your account to complete the transactions. Sharing with payment service providers and financial institutions occurs to execute a transaction initiated by you as agreed with you (Art. 6, paragraph 1, point b, GDPR).
7.2.3 Fraud prevention agencies and companies that perform identity checks.
Description of the recipient: Your personal data is shared with fraud prevention agencies and companies that perform identity checks.
Purpose and legal basis: Klarna shares your information to verify your identity and the accuracy of the data you have provided to us and to prevent fraudulent and criminal activities. The companies we cooperate with are listed here . We point out that these companies process your data in accordance with their own privacy policies.
Klarna shares your information and information about whether a particular transaction may constitute fraud based on its legitimate interest in conducting its activities (Art. 6, paragraph 1, point f, GDPR), because fraud prevention agencies and companies that provide identity checks have information about fraudulent activities and identity verification, which is important for Klarna to reduce the amount of fraudulent transactions. It is also in your interest that this information is shared as it helps prevent your information from being used for fraudulent purchases. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights. You can also contact the organizations mentioned in the link above to exercise your rights as specified in point 2, possibly also against these organizations.
7.2.4 Google.
Description of the recipient: If you use Google Maps at checkout or in the Klarna App (for example, by searching for your address in the address bar, viewing “stores near me,” or requesting information about local offers and promotions), your personal data will be shared with Google. Google will process your data in accordance with the terms and conditions and the privacy policy of Google Maps/Google Earth.
Purpose and legal basis: Klarna shares this information based on its legitimate interest in conducting its business (Art. 6, paragraph 1, point f, GDPR), as Google Maps enables the address functionality at checkout and to display maps and deals in the Klarna App, which are relevant to your current location. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest outweighs your right to object. You have the right to object to this processing due to circumstances specific to your case. See point 2 for more information about your rights.
7.2.5 Billie, if you pay with Billie
Description of the recipient: When you choose to pay with Billie at Klarna's checkout, Klarna shares information about the ongoing payment and contact and identification details with Billie. Billie will process your data in accordance with its own data protection policy.
Purpose and legal basis: Klarna shares information about your Billie payment with Billie because Billie manages payments for Klarna. Data is shared with Billie to execute a Billie payment initiated by you (Article 6, paragraph 1, point b) GDPR).
7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna's payment methods that provide credit or when you use the Klarna card or the One-Time Card Shopping Service.
7.3.1 Credit bureaus.
Description of the recipient: If you request a Klarna service that involves us granting credit (see point 4.3 about which Klarna services imply credit), we will share your personal data with credit bureaus. Exchange does not take place in case of small amounts or when we already have sufficient information.
Purpose and legal basis: Your personal data is shared with credit bureaus to evaluate your creditworthiness, to verify your identity and contact details, and to protect you and other customers against fraud. Sharing this data results in a credit report.
In the Netherlands, Klarna sends the credit bureau your name, address, and phone number to perform a lookup on you. This credit check does not affect your creditworthiness.
The credit bureaus will process your information in accordance with their own privacy policies and you can here find out who we cooperate with.
Furthermore, if you have submitted a financing application, the following applies: Klarna shares your name, date of birth, address, and possibly your email address, as well as information about your financing debt and repayments on that debt (including late repayments), with the Dutch credit registry (Bureau Krediet Registratie-BKR), in accordance with Dutch credit legislation. The information shared with the credit registry may affect your future creditworthiness and your ability to obtain credit.
Klarna shares your information based on its legitimate interest in conducting its activities (Art. 6, para. 1, point f, GDPR), if the credit bureaus have information about your financial capacity which is important for Klarna to ensure a proper credit evaluation and to avoid granting credit to consumers who are unable to repay it. We ensure that the processing involved is necessary to pursue that interest and that our interest outweighs your right to prevent this information from being processed for this purpose. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights. You can also contact the organizations mentioned in the link above to exercise your rights as specified in point 2, including possibly against these organizations.
Klarna stores the credit information about you that we have received from a credit reporting agency only in a script data format. If you want a readable version, we recommend that you contact the credit bureau directly that informed you that Klarna requested a credit report.
7.3.2 Collection agencies (for debts that are overdue).
Description of the recipient: Klarna may be required to share your information when we sell or outsource the collection of unpaid overdue debts to a third party, such as a collection agency.
Purpose and legal basis: This data is shared to collect your overdue debts. Collection agencies process personal data in accordance with their own privacy policies, or only on behalf of Klarna in their capacity as Klarna's data processors. Collection agencies may report your unpaid debts to credit reporting agencies or authorities, which can affect your creditworthiness and your ability to apply for credit in the future. This data is shared based on our legitimate interest in collecting and selling debts (art. 6, paragraph 1, point f, GDPR). When balancing interests, Klarna considers it has a legitimate interest in collecting and selling debts. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.3.3. VISA and digital wallet providers.
Description of the recipient: We share information about you and your purchases when you use the Klarna card with VISA and with members of the VISA card network. If you also add the Klarna card to your digital wallet, it may be necessary for us to share your data with the provider of that wallet. In that case, the data is processed in accordance with the privacy policy of that provider.
Purpose and legal basis: Sharing takes place to the extent necessary to execute card transactions, prevent fraud, and comply with the rules of the VISA card network. If you renew your Klarna card or receive a new card, we will pass this information on to VISA so that VISA can inform third parties where you have previously stored your card details (for example, for recurring transactions). The sharing is done in agreement with you (art. 6, paragraph 1, point b, GDPR).
7.3.4 Debt buyers (for outstanding debts).
Description of the recipient: Klarna may transfer your outstanding debts to debt buyers.
Purpose and legal basis: When transferring your debt to a purchasing party and for the entire period until you have repaid the debt, Klarna shares your contact and identification details (name, date of birth, social security number, address, and phone number), information about your financial status (such as remaining balance, repayments, and any negative payment history related to the current debt), as well as information about the goods or services related to the debt. The buyer will process your personal data in accordance with their own privacy policy, which you will be informed about once the debt is transferred.
The sharing of personal data with various buyers is based on our legitimate interest in selling outstanding debts as part of our business operations (Art. 6(1)(f) GDPR). We assure you that the personal data processing involved is necessary to pursue that interest and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances specific to your case. See point 2 for more information about your rights.
7.4 Categories of recipients when using the Klarna account service (savings and payment accounts).
7.4.1 Credit institutions and other financial institutions.
Description of the recipient: We share your information with credit institutions and other financial institutions (such as other banks) when you carry out transactions or make payments to other accounts.
Purpose and legal basis: If you have made payments on a Klarna account, Klarna processes the information we receive from the bank you used for the transaction, such as contact and identification details and payment information. If you make transactions or payments to accounts at other banks, Klarna also shares your contact and identification details and payment information with both the recipient and the recipient’s credit institution or financial institution. This sharing is done in agreement with you (Art. 6(1)(b) GDPR).
7.5 Categories of recipients with whom Klarna shares your personal data when you use the Klarna's Shopping Service.
You can find the terms for the Klarna Shopping Service here .
7.5.1 Affiliate networks.
Description of the recipient: If you click on a sponsored link in the Klarna App or on our website that refers to a store, product, or service, you will be redirected to another company's website via a third party, the so-called affiliate network. Here you can see which affiliates Klarna works with (presented in the left column). The affiliate networks will process your device information in accordance with their own privacy policies (you can find the relevant privacy statements in the right column via the same link referred to above). The store you visit via a sponsored link determines which affiliate network processes your information. Usually, a store only works with one specific affiliate network. You can get more information about which network that is by contacting us (or the store).
Purpose and legal basis: The affiliate network can place tracking technology on your device that contains information about the fact that you clicked on that link in the Klarna App, which is then used to document your visit to the store in order to calculate a possible commission for Klarna.
The processing is based on a balancing of interests (Art. 6(1)(f) GDPR). In balancing interests, Klarna asserts a legitimate interest in offering you sponsored links to promote stores in the Klarna App and website. We assure you that the specific processing involved is necessary to achieve this purpose, and that our interest outweighs your right to object.
You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.5.2 Google.
7.5.2.1 reCAPTCHA
Description of the recipient: If you use the Klarna App (also via our web portal), Google collects your device information through Google's reCAPTCHA service implemented there, possibly along with additional information you choose to enter into the reCAPTCHA service, and Klarna will share the phone number used for verification.
Purpose and legal basis: Klarna processes this information based on its legitimate interest in conducting its activities (Art. 6, para. 1, letter f, GDPR), as the reCAPTCHA service prevents abuse of our services (e.g., by preventing bots from attempting to log in, or by fraud via SMS). Google will process your data in accordance with the terms and conditions and the privacy policy. We assure you that the specific processing involved is necessary to achieve the intended purpose, and that our interest prevails over your right to object.
You have the right to object to this processing due to circumstances in your specific case. See point 2 for more information about your rights.
7.5.2.2 Google Maps
Description of the recipient: To display on an integrated map in the Klarna mobile App where your package will be delivered, we share the relevant delivery address with Google. Google will process your data in accordance with the terms of service and the privacy policy of Google Maps/ Google Earth.
Purpose and legal basis: Klarna shares this information based on Klarna's legitimate interest in conducting its activities (Art. 6, para. 1, letter f, GDPR). By using Google Maps, we can show you the delivery address on an integrated map in the Klarna mobile App. We assure you that this processing is necessary to pursue that interest, and that our interest outweighs your right to object to the processing of your data for this purpose. You have the right to object to this processing for reasons related to your specific situation. See point 2 for more information about your rights and how to exercise them.
7.5.3 Partners within the framework of the Personal Finance service and the Offer and Benefit program.
Description of the recipient: Partners within the framework of the Personal Finance service and the Offers and Benefits program.
Purpose and legal basis: If you choose to use the offers and benefits of Klarna within the framework of the Personal Finance service or the Offers and Benefits program, Klarna shares the personal data necessary to use the offer with our business partners (including the fact that you are a Klarna customer). Each offer specifies the data that will be shared. Data is shared under the agreement between you and Klarna (Art. 6(1)(b) GDPR).
7.5.4 Logistics and transport companies.
Description of the recipient: Logistics and transport companies.
Purpose and legal basis: Klarna shares your personal data with logistics and transport companies that deliver the goods you order, if you have signed up for package tracking. Examples of information we share include contact and identification details and tracking numbers.
We point out that these companies process your data in accordance with their own privacy policies. The sharing takes place in agreement with you (Art. 6(1)(b) GDPR).
7.5.5. Advertising services.
Description of the recipient: Advertising services from third parties
Purpose and legal basis: Klarna shares your personal data with external advertising services to show you more relevant ads outside the Klarna App, based on your interaction with Klarna’s products and services and your Klarna profile. Klarna will also share this data to assess the relevance of some external advertising services. Some advertising services from third parties use your data for their own purposes and in accordance with their own privacy policies, which are available here. You can also get more information about this sharing or how to exercise your rights regarding these companies by contacting us.
This processing is based on your consent (Art. 6, paragraph 1, point a, GDPR). You can withdraw your consent at any time in the Tracking Technology settings in the Klarna App. You can also object to this processing – with the same effect as withdrawing your consent. See section 2 for more information about your rights.
This processing may involve profiling to tailor the marketing content based on what we believe interests you. You can read more about profiling in section 6.
7.5.6 SIWK third-party applications and services
Description of the recipient: When you sign up with Klarna (via “SIWK”) in a third-party application store or service, Klarna will share your personal data with the third-party application or service.
Purpose and legal basis: In order to execute the agreement with you (Article 6(1)(b) GDPR).
7.5.7 Fraud prevention agencies and companies that perform identity checks.
Description of the recipient: Your personal data is shared with fraud prevention agencies and companies that perform identity checks.
Purpose and legal basis: Klarna shares your information to verify your identity and the accuracy of the data you have provided to us and to prevent fraudulent and criminal activities. The companies we cooperate with are listed here . We point out that these companies process your data in accordance with their own privacy policies.
Klarna shares your information and information about whether a particular transaction may be fraudulent based on its legitimate interest in conducting its business (Art. 6, paragraph 1, point f, GDPR), because fraud prevention agencies and companies that provide identity checks have information about fraudulent activities and identity verification, which is important for Klarna to reduce the number of fraudulent transactions. It is also in your interest that this information is shared as it helps prevent your information from being used for fraudulent purchases. We assure you that the specific processing involved is necessary to achieve the purpose in question, and that our interest prevails over your right to object. You have the right to object to this processing due to circumstances in your specific case. See section 2 for more information about your rights. You can also contact the organizations mentioned in the link above to exercise your rights as specified in section 2, including possibly against these organizations.
7.6 Categories of recipients with whom Klarna shares your personal data when you contact our customer service via social media.
7.6.1 Social media.
Description of the recipient: Social media companies such as Facebook, Instagram, or Twitter.
Purpose and legal basis: If you contact us via social media such as Facebook or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy policies. The sharing takes place with your consent (Art. 6, paragraph 1, point b, GDPR).
8. When can we transfer your personal data outside the EU/EEA, and how do we protect it then?
We always strive to process your personal data within the EU/EEA area. However, in certain situations, for example when we share your data within the Klarna Group or with a supplier, subcontractor, or store operating outside the EU/EEA, your personal data may also be transferred outside the EU/EEA. Klarna always ensures that the same high level of protection applies to your personal data in accordance with the GDPR, even when the data is transferred outside the EU/EEA. Your rights regarding your personal data (detailed in section 2) are not affected when data is transferred outside the EU/EEA. More information about the recipients with whom Klarna shares your data can be found in section 7.
When you shop at a store in a country outside the EU/EEA area, sharing your personal data with that store means your personal data will be transferred to that country outside the EU/EEA area.
Certain Klarna suppliers use internal corporate rules or “binding corporate rules” (BCR) when transferring personal data within their own corporate group outside the EU/EEA. Such BCR have been approved by an EU data protection authority and guarantee that the same high level of protection applies to your personal data when it is transferred.
If you want more information about our security measures, you can always contact us. You can find our contact details in section 12. More information about which countries are considered to have an “adequate level of protection” can be found on the website of the European Commission. Here you can read more about the European Commission’s standard clauses and here about “binding corporate rules” (BCR).
Security measures Klarna takes when transferring personal data outside the EU/EEA.
Countries outside the EU/EEA zone may have laws that allow government authorities to request access to personal data stored there for the purpose of crime prevention or national security protection. Regardless of whether we or any of our suppliers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate safeguards are in place, in accordance with applicable data protection requirements (such as the GDPR). Such appropriate safeguards include, but are not limited to, ensuring that
-
if the European Commission has decided that the country outside the EU/EEA to which your personal data is transferred provides an adequate level of protection that corresponds to the level of protection offered by the GDPR. This means, for example, that the personal data is still protected against unauthorized disclosure, and that you can still exercise your rights regarding your personal data, or
-
the European Commission’s standard contractual clauses are concluded between Klarna and the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection of your personal data provided by the GDPR still applies and that your rights are still protected. In such cases, we also check whether there are laws in the receiving country that affect the protection of your personal data. Where necessary, we take technical and organizational measures to ensure that your data remains protected during the transfer to the relevant country outside the EU/EEA.
Despite what is stated above, if the store where you shop is located in a country outside the EU/EEA, the data sharing with that store (and with the Klarna entity that has a contract with the store) means that your personal data will be transferred to and processed in this country outside the EU/EEA. Click here to access the privacy statements of other Klarna entities within the Klarna Group. Otherwise, it would not be possible to manage your purchase. Klarna primarily relies on the European Commission’s standard contractual clauses to ensure the protection of your personal data for such data transfers, but as explained above, countries where the foreign store is located may have laws that prevent effective protection through the standard clauses. Even if this is the case, your personal data will still be transferred to the foreign store (or to the local Klarna entity of the foreign store) as long as the data transfer is necessary to manage your specific purchase.
9. How long do we keep your personal data?
How long Klarna retains your personal data depends on the purposes for which Klarna uses the personal data:
-
Personal data used for the contractual relationship between you and Klarna is generally kept for the duration of the contractual relationship and thereafter for up to 10 years based on limitation laws.
-
Personal data that Klarna is legally required to retain, for example under anti-money laundering laws or accounting legislation, is generally kept for 5 and 7 years respectively.
-
Personal data that is not used for your contractual relationship with Klarna or for which Klarna has no legal retention obligation is only kept as long as necessary to achieve the specific purpose of our data processing (usually 3 months). More information can be found in the table under point 4.
In a limited number of cases, personal data may need to be retained longer due to capital adequacy legislation that Klarna must comply with.
The legal obligations mentioned above mean that Klarna cannot delete your personal data, even at your request, as described in section 2. If we do not have a legal obligation to retain the personal data, we must instead assess whether we may need the personal data to protect Klarna against legal claims.
We point out that even though we have a legal obligation to store your personal data, this does not mean that we may use this data for other purposes. Klarna will assess for each specific purpose how long we may use your personal data. You can read more about this in section 4.
10. How do we use cookies and similar tracking technologies?
To provide a tailored and smooth experience, Klarna uses cookies and similar tracking technologies in our various interfaces, such as our website, the Klarna App, and at the checkout of stores partnering with Klarna. You can find information about the tracking technology Klarna uses in each interface, as well as information on how to accept or reject that tracking technology.
11. Updates to this Privacy Policy.
We are continuously working to improve our service offering so you get an even better user experience. This may involve changes to existing and future services. If such improvement requires notification or consent according to applicable law, you will be informed or given the opportunity to give your consent. It is also important that you read this privacy statement each time you use one of our services, as the processing of your personal data may have changed since your last use of the service in question.
12. Klarna’s contact details.
Klarna Bank AB (publ) is registered with the Swedish Companies Registration Office under number 556737-0431 and its registered office is located at Sveavägen 46, 111 34 Stockholm.
Klarna has a Data Protection Officer and a team of data protection specialists. We also have several customer service teams that handle data protection issues. You can reach all these people at dataprotectie@klarna.nl. If you want to specifically contact Klarna's Data Protection Officer, please mention this in the subject line.
Klarna Bank AB (publ) complies with Swedish data protection legislation. Go to www.klarna.nl for more information about Klarna.