Woolsocks AG
Privacy & Cookie Statement
Version 1.7 – March 2024
1. Introduction
This privacy & cookie statement ("Statement") provides information on the processing of personal data by Woolsocks AG, with registered address on Neustadtstrasse 7, 6003 Luzern, Switzerland, registered in the Commercial Register of the Canton of Lucerne under number CHE-328.679.380("Woolsocks"). Further contact details are provided at the bottom of this Statement.
This Statement applies to all personal data processed by Woolsocks and/or on behalf of Woolsocks concerning users ("Users", "You" or "Your") of the Woolsocks Platform ("Woolsocks Platform"), based on which they may be identified or become identifiable ("Personal Data").
This Statement sets out the elements necessary for Woolsocks’ compliance with applicable privacy legislation, principles and practice, including but not limited to the Swiss Data Protection Act and the European General Data Protection Regulation ("Applicable Laws"). Woolsocks reserves the right to review and/or amend the Statement periodically, in order to comply with (local and/or European Union) legislation, and for any other purpose deemed reasonably necessary by Woolsocks.
Please find below an overview of the subjects which will be discussed in this Statement:
• Categories of Personal Data, purpose and legal grounds for processing
• Purpose, legal ground and retention period of data processing
• Retention period of Personal Data
• Security of Personal Data
• Transfer of Personal Data
• Rights in relation to Personal Data
• What are cookies
• Who places what types of cookies
• Questions and inquiries
2. Categories of Personal Data, purpose and legal grounds for processing
Based on the following legal grounds, Woolsocks is processing Personal Data for the following purposes:
• To ensure that You are able to use the Woolsocks Services (performance of contract).
• To improve the Woolsocks Services (legitimate interest). In doing so, Woolsocks ensures that the impact on Your privacy is as limited as possible, by, amongst others, aggregating, pseudonymizing and/or anonymizing Your Personal Data to the extent possible but also ensuring IT security, user experience optimization and preventing criminal activity.
• For direct marketing purposes (legitimate interest and consent).
Woolsocks retains Your Personal Data for these purposes until You withdraw Your consent.
Woolsocks will only process Personal Data to the extent necessary for the described purposes. If there is a need to process Personal Data for other purposes, Woolsocks will only do so if such processing is compatible with the original purposes or if You give consent to such processing. Woolsocks will in any event provide You with further information on such purpose prior to the further processing.
Woolsocks does not share Your Personal Data with partners for purposes other than to provide the Woolsocks Services You have requested.However, Woolsocks may convert Your Personal Data into aggregated and anonymized statistics. These partners will not, at any moment in time, have access to Your Personal Data.
This enables Woolsocks to provide partners with commercial insights into Woolsocks Members' behavior improving the services and user experience of the Woolsocks Platform.
Woolsocks has legitimate interest in producing these statistics for research or business purposes and ensures that the data is fully anonymized and that the data subjects cannot be identified from the information produced.
Additionally, Woolsocks has various business purposes for processing Your Personal Data, including:
Market research: Woolsocks may collect and process Personal Data to gain insights into customer preferences and behavior. This can help Woolsocks improve its products or services.
Improving user experience: Woolsocks may collect and process Personal Data to personalize its interactions with You. This can include recommending products or services based on previous use of the Woolsocks Platform, or tailoring marketing communications to Your individual preferences.
Fraud prevention: Woolsocks may collect and process Personal Data to detect and prevent fraudulent activity.
In the overviews below we set forth per service offered on the Woolsocks Platform what personal data is processed, including the rationale and legal basis thereof.
General use of the Woolsocks App | ||
What personal data? | Why? | On what basis? |
Identification details: Salutation, first name, last name, gender, e-mail address, telephone number, date of birth, language, location, device ID | Identification & to provide the Woolsocks Services | Performance of contract |
Form data: Personal data that You entered through a form in the Woolsocks App | To pre-fill forms You need to fill in to use different Woolsocks Services | Consent |
Usage data: Device brand, operating system, location details, cookies, user data, actions undertaken in the Woolsocks App, crash log | Providing and improving services | Legitimate interest |
Communication: All communication between you and us | To provide our services | Performance of contract |
Advertising data: Data needed to address You with respect to Woolsocks Services including name and e-mail address, domicile and geo-location, date of birth, gender, performance data of the app, IP address and bank account information | To share information on the Woolsocks Services with You and to improve our ads and our direct marketing | Consent & Legitimate interest |
Profiling and Automated Decision Making: Contact and identification information, payment information, information about your use of Woolsocks’ services, technical information generated by your use of Woolsocks’ services | To perform fraud prevention assessments when using the Instant Payout and/or the Pay Later function. | Performance of contract & Legitimate interest |
Account Information Services provided by BudetBakers | ||
What personal data? | Why? | On what basis? |
Identification details: Woolsocks user ID, country of user | Identification & to provide the Account Information Services | Performance of contract |
Bank account data: Account name, IBAN, payment data aggregation of the payment data of different connected bank accounts | To enable You to use the Account Information Services
| Performance of contract |
Cancellation Services provided by GoCanel | ||
What personal data? | Why? | On what basis? |
Identification details: Woolsocks user ID, country of user | Identification & to provide the Cancellation Services | Performance of contract |
Data to identify you towards the service provider's service that you want cancelled: Name, address, date of birth, phone number, e-mail address, IBAN, card number, policy/client number, product name, branch, Tax ID, ID number copy of ID and invoice number | To enable You to use the Cancellation Services. Woolsocks only asks for a Tax ID, ID number or copy of ID (and all other Personal Data) if this is required by the service provider You want to cancel. Woolsocks will immediately delete Your ID copy after passing on that information to GoCancel | Performance of contract & Explicit consent |
Cashback and other Services | ||
What personal data? | Why? | On what basis? |
Identification details: Woolsocks user ID, country of user | Identification & to provide the Cashback Services | Performance of contract |
Data for pay-out of Cashback: Bank account holder name, IBAN, date of birth, user IP address, country of user, amount of Cashback | Pay-out an approved Cashback, AML/CFT purposes, fraud detection and administrative bookkeeping | Performance of contract & Legal obligation |
Data for personalized deals Cashback suggestions: Payment data received from BudgetBakers | To offer You Cashback deals at stores where You have shopped before | Explicit consent |
Data for transaction-based rewards: Payment data received from BudgetBakers | To offer and grant You rewards based on Your payment data | Explicit consent |
Data for Instant Pay-out: SEPA Direct Debit mandate data (e.g. name, last name, domicile), Cashback profile of the Woolsocks Member, probability of default of the Woolsocks Member calculated based on the Payment Data received from BudgetBakers | The direct debit mandate will enable OrangeBuddies to debit Your bank account if Your Cashback Sock balance is negative. Woolsocks uses payment data and the Cashback profile to calculate the maximum amount of Instant Pay-out and assess whether Instant Pay-out is available to You for a certain Cashback deal | Performance of contract & Explicit consent |
Data for Pay Later: SEPA Direct Debit mandate data (e.g. name, last name, domicile), Cashback profile of the Woolsocks Member, probability of default of the Woolsocks Member calculated based on the Payment Data received from BudgetBakers | Woolsocks uses payment data to calculate the maximum amount available to You in the Pay Later function as well as to assess whether Pay Later is available to You | Performance of contract & Explicit consent |
Data for donation: Amount donated, name of donator, goal/fundraiser donated to (charity organization and/or local club) | To process the donation | Performance of contract |
Investment Services provided by BROKR Ltd. | ||
What personal data? | Why? | On what basis? |
KYC Identification details:Woolsocks user ID, country of user, location, name, date and place of birth, citizenship, Tax Identification Number, address, e-mail address, mobile number, employment status, annual net income and language | To complete BROKR Ltd.'s Know-Your-Customer ("KYC") process | Performance of contract |
Account data: Account name, IBAN, transaction history, portfolio information and other relevant information on your investment account with BROKR Ltd. | To enable You to use the Investment Services provided by BROKR Ltd. | Performance of contract |
3. Profiling and Automated Decision Making
The term "automated decision making” means that certain decisions in our Services are fully automated without the involvement of our employees. These decisions have a significant impact on You as a Woolsocks Member. By making such decisions automatically, Woolsocks increases its objectivity and transparency in deciding to offer You these Services. At the same time, You have the right to object to these decisions at any time.
Automated decisions that affect You in a significant way also mean that profiling based on Your data is carried out before the decision is made. This profiling is done to assess your financial situation (prior to making a decision to offer You Services such as the Pay Later or Instant Payout Service) or to determine whether Your use of our services poses any risk (e.g. of fraud). We profile Your user behavior and financial situation and compare this data with behaviors and circumstances based on which we differentiate the risk.
We make such automated decisions when we:
· decide that Your application to use the Instant Payout and/or Pay Later function will be approved.
· decide that Your application to use the Instant Payout and/or Pay Later function will not be approved.
· decide whether You pose a fraud risk if our processing shows that Your behavior indicates possible fraudulent behavior, that Your behavior is inconsistent with Your prior use of our Services, or that you have attempted to conceal Your true identity. Automated decisions we use to assess whether You pose a fraud risk are based on information You have provided to us and Woolsocks’ own internal information.
These automated decisions are based on data You provide to us, data from external sources received with Your consent, and Woolsocks’ own internal information. In addition to information about You, Woolsocks’ model includes a variety of other factors, such as Woolsocks’ internal classification of risk.
If Your application is not approved as a result of the automated decisions described above, You will not have access to Woolsocks Services, such as the Instant Payout and/or Pay Later function. Woolsocks has several safeguards in place to ensure that decisions are appropriate. These mechanisms include ongoing monitoring of our decision models as well as random sampling on a case-by-case basis. If You have any concerns about the outcome, You can contact us. We will review whether the process was conducted appropriately. You may also appeal by contacting support@woolsocks.eu.
4. Retention period of Personal Data
Woolsocks will, in principle, retain Your Personal Data in relation to the purposes mentioned above for one year after termination of the relationship between You and Woolsocks in accordance with the Woolsocks General Terms and Conditions. Please note Woolsocks may need to keep certain Personal Data for more than one year. This is because of compliance with legal obligations such as to comply with a law enforcement request or because such information is needed for the exercise of legal claims.
5. Security of Personal Data
Woolsocks handles Personal Data carefully and uses appropriate technical and organizational measures to preserve the integrity and security of Your Personal Data. Our implemented technical and organizational include, amongst others:
• access controls, on a ‘need to know’-basis;
• pseudonymization and aggregation;
• encryption; and
• other measures that prevent reading, copying, changing or removing during the storing, processing and transporting of Personal Data.
6. Transfer of Personal Data
Woolsocks transfers Your Personal Data – as necessary in view of the listed legal grounds – to the following recipients:
Partner | What data | Purpose | Privacy Statement |
ASK-Opinions B.V | Data needed to perform the contract, such as your name and email address, telephone number or place of residence, among others. | Participation in the ASK-Opinions Panel. | |
e-Village B.V. | Data needed to contact you, such as your name, email, telephone number, domicile your user and/or device ID | To contact you via email, telephone and/or notification (both on the Web and/or App), as well as any other established method | |
BudgetBakers | Data needed to provide the Account Information Services | Account Information Services | https://www.woolsocks.eu/legal/bb/BudgetBakers_Privacy-Policy_EN_v1.0.pdf |
Debt Collector | Data needed to have debt related to Your OrangeBuddies products collected, as well as the Instant Payout or Paylater function | To collect Your debt related to the use of OrangeBuddies services or other products | Please see the privacy statement of the relevant Debt Collector |
GoCancel B.V. | Data needed to provide the Cancellation Services | Cancellation Services | https://www.woolsocks.eu/legal/gc/GoCancel_Privacy-Statement_EN_v1.0.pdf |
Google Ireland | All the Data processed on the Woolsocks Platform and to send push notifications related to the Woolsocks Services | Storage of Woolsocks data and to send push notifications | |
Merchants | Data pertaining to Your purchase to receive Your Cashback after completion of the Beta Testing/Feedback Program | To match your purchase with the Merchant's administration | Please see the privacy statement of the Merchant You selected |
OrangeBuddies Media B.V. | Data needed to provide the Cashback Services you selected | Cashback Services | |
Scoupy Nederland B.V. | Uploaded pictures of receipts, personal data such as your name and last name or date of birth. | Data to provide some of the Services on the Woolsocks Platform, such as the Grocery Cashback, Win Promotions and other games or Product Packages and other savings promotions | https://scoupy.com/privacy-statement |
Sisense Ltd. (Cloud Hosting Data Center: EU Paris) | All the data processed on the Woolsocks Platform. | Datawarehouse: Anonymized and aggregated statistical analysis. | |
Snippet Technologies Operations | Data to provide the Account Information Services and to provide Customer Services to Woolsocks Members pertaining to the general use of the App and Banking Services | To provide the Account Information Services, to provide Customer Services to Woolsocks Members pertaining to the general use of the App and Banking Services | |
Twilio | All Data to provide in-app notifications and included in such notifications | To communicate with you |
Woolsocks does transfer certain Personal Data to a third country outside of the European Union/European Economic Area ("EU/EEA"), to countries such as the United States and Switzerland. These transfers of Personal Data only take place in compliance with the Applicable Laws and where appropriate safeguards are in place that ensure the level of protection of Data Subjects as required by these Applicable Laws (e.g. transfers on the basis of EU Model clauses).
7. Evaluation of the effectiveness of advertisements
Woolsocks may share data with certain service providers, advertising companies and ad networks like Google or Meta, in order to optimize its marketing campaigns. The data concerns, for example, the channel through which You onboarded and the services that you chose to use on the Woolsocks Platform. This information helps Woolsocks make sure it shows its advertisements to people who may actually be interested in using the platform.
Woolsocks will never share data obtained through the Account Information Service for this purpose.
8. Rights in relation to Personal Data
You have the right of information, access, rectification, addition and erasure of Personal Data, and the right to object against or restrict the processing of Personal Data (or withdraw an earlier given consent), as well as the right to data portability. The procedure of Woolsocks that enables You to exercise these rights, is described below.
You may file a request to access Personal Data processed by Woolsocks and Woolsocks shall respond as soon as possible, and in any event within one (1) month, about:
a) whether Woolsocks holds any Personal Data relating to You; and,
b) if so, information is provided on the purposes of the processing, the categories, the recipients (if applicable) the envisaged period for which the Personal Data will be stored, or the criteria used, the existence of the right to request rectification, erasure, restriction or to object to such processing, the right to lodge a complaint with a supervisory authority, the existence of automated decision-making, where the data is transferred to a third country, the appropriate safeguards and the source(s) of the Personal Data.
Woolsocks will comply with a legitimate request for rectification, addition and erasure, if the Personal Data is factually incorrect, incomplete, or irrelevant for the purpose(s) of the data processing, or otherwise processed in violation with the Applicable Laws.
Woolsocks will inform You within one (1) month after receiving the request whether the request shall be complied with (in time), and if not, accompanied with the reasons for the delay or rejection. Information provided shall be free of charge. You can exercise these rights at reasonable intervals. You can exercise their rights by contacting the Privacy contact person in writing or per email at privacy@woolsocks.eu.
Please note that Woolsocks may at times be unable to fully comply with a request to erase Personal Data. This is because of compliance with legal obligations such as to comply with a law enforcement request or because such information is needed for the exercise of legal claims.
9. What are cookies?
By using the Woolsocks Platform, cookies are placed on Your device. Cookies are small text files that enable tracking information about Your use of the platform. For example, if You use the same device as before, cookies remember Your preferences and the content You see is loaded faster. There are different types of cookies; functional, analytical and tracking cookies.
10. Who places what types of cookies?
Woolsocks places functional and analytical cookies on Your device when You register at the Woolsocks Platform – as further set out below.
10.1.Functional and analytical cookies
These cookies are necessary to allow You to use the Woolsocks Platform, or to collect (aggregated) statistics about such use. More specifically, functional and analytical cookies are used in order to:
• remember Your selected currency, language settings and other preferences so You can use the Woolsocks website efficiently; and
• help Woolsocks understand how You use the Woolsocks Platform and improve the platform.
10.2.Tracking cookies
Woolsocks does not use any tracking cookies.
10.3.Permanent and session cookies
Two types of cookies are used on the Woolsocks Platform: session and permanent cookies. Session cookies are temporary cookies that remain on Your device until You leave the Woolsocks Platform. A permanent cookie remains on Your device for a longer period of time.
For the specifications of the cookies used by Woolsocks, see Annex 1.
Woolsocks sub-processor Snippet Technologies Operations B.V. places cookies when You register on the Woolsocks platform.
10.4.Does Woolsocks also process Personal Data?
Cookies may involve the collection of Personal Data, as further set out in this Statement. Woolsocks collects the following Personal Data when You sign up for the newsletter:
• First name
• Last name
• Email address
10.5.How long is this Personal Data stored?
The data will be kept as short as possible, and the retention period varies per type of cookie (please refer to Annex 1). After the expiry of this retention period, the data will be deleted.
10.6.How can you disable or delete cookies?
Woolsocks does not use tracking cookies, so there is no need for withdrawing or disabling previous consent.
11. Questions and inquiries
For queries and inquiries about this Statement, please contact the privacy point of contact: privacy@woolsocks.eu. Alternatively you may also contact our EU representative, Woolsocks A.G. French branch, 38 rue des Mathurins, 75008 Paris, France, RCS Paris / SIREN: 903 859 809 or send our EU representative an e-mail to eurepresentative@woolsocks.eu.
If you are unhappy with the way Woolsocks treats your complaint you may file a complaint with the relevant Data Protection Authority.
Data Protection Authority | Website | |
Belgium | Autorité de protection des données Gegevensbeschermingsautoriteit | https://www.dataprotectionauthority.be/citizen |
France | Commission Nationale de l'Informatique et des Libertés | |
Germany | Der Bundesbeauftragte für den Datenschutz und die Infromationsfreiheit | http://www.bfdi.bund.de/ |
Ireland | Data Protection Commission | |
Italy | Garante per la protezione dei dati personali | |
The Netherlands | Autoriteit Persoonsgegevens | https://www.autoriteitpersoonsgegevens.nl/ |
Spain | Agencia Española de Protección de Datos | |
Switzerland | Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte | https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/links/datenschutz---schweiz.html |
12. Annex 1 – Cookie details
12.1.First Party Cookies – Functional and Analytical Cookies (consent not required)
Name of the Cookie | Purpose of the Cookie | Permanent/session | Retention period |
Language and Country cookie | With this cookie, Woolsocks remembers Your preferred language and country for the woolsocks.eu website | Permanent | 6 months |
Google Analytics | Distinguish unique Users and
| Permanent | 12 months |
Personal Data | To remember who signed up for the newsletter | Session | Woolsocks processes the data but does not store it. That data is transported to the Newsletter service of e-Village B.V. |