What is Swish?
Swish is a mobile payment solution enabling money transfer directly from a bank account to the account of another person or business connected to the service by providing the recipient’s mobile phone or Swish number.
Responsibility, purpose and lawful basis for your personal data
Nordea is responsible for the processing of your personal data in relation to Swish Privat for the purposes of setting up or terminating Swish Privat, as it is necessary for the performance of the contract between you and the bank. Furthermore, Nordea is performing Swish money transfers, authorisation, responding to requests from authorities and product analysis.
Nordea, other banks connected to the Swish platform and Getswish AB are jointly responsible for the processing of your personal data in relation to Swish Privat for the purpose of fraud prevention. The parties have entered into an arrangement to determine their respective responsibilities under the regulation.
For further information on how Getswish AB uses your data, please refer to the Getswish AB Privacy Notice available at https://www.swish.com/dataskydd.
Which personal data is collected and used?
Nordea processes contact, identification, payment and device information. Providing your personal data is voluntary; however, we are unable to provide the Swish service without it.
Recipients of personal data
The categories of recipients that your personal data is shared with are suppliers and authorities.
Contact, identification, payment and device information is transferred from Nordea to Getswish AB and to other banks connected to the Swish platform to fulfil their legitimate interests and legal obligations. In some cases, you may consent to share payment data to Getswish AB, in which you are free to revoke your consent at any time.
Data is also shared with Getswish AB in their role as a processor on behalf of Nordea.
Data is shared with authorities to the extent it follows from legal obligations.
Third country transfers
Google Ireland Ltd may as a subprocessor to Getswish AB process personal data in any country in which Google or its subprocessors maintain facilities. Information about the locations of Google data centers is available at: https://www.google.com/about/datacenters/locations/. The processing only concerns functionality for push messages containing payment data. Standard Contractual Clauses and/or other appropriate measures apply to ensure that personal data is adequately protected when it is transferred out of the EEA.
Retention
Your personal information is kept for as long as needed for the purposes mentioned above and for any additional period that may be required or permitted by law. If you wish to request deletion of your personal information, please contact Nordea.
Information about your privacy rights and how to contact us
Nordea is your contact point if you want further information on how your personal information is processed in connection with Swish.
In the Nordea privacy policy you will find information about your privacy rights, contact information to Nordea and our Data protection Officer, as well as information about the right to lodge a complaint with the local data protection authority.
Getswish AB, whose registered company number is 556913-7382, can be contacted by email at support [at] getswish.se (support[at]getswish[dot]se) or by writing to Getswish AB, Vattugatan 2, 11 52 Stockholm.