PRIVACY NOTICE – DEVICE INTELLIGENCE

1. WHAT DOES THIS PRIVACY NOTICE COVER?

1.1 SEON Technologies Kft. and SEON Technologies US Inc. (each a “SEON Entity”, and together “SEON”, “we”, “us”, or “our”; see Section 2.4) provide fraud prevention & AML compliance services to businesses (“Customers”), such as (without limitation) online retailers, financial service providers, payment providers, iGaming operators and online marketplaces. SEON’s services consist of several modules, which Customers may use separately or in combination, depending on their needs. One of these modules is Device Intelligence, a technology that analyses technical information about the devices used to access a Customer’s services, so that the Customer can recognise those devices and detect signs of fraud, manipulation or automation. To use Device Intelligence, Customers integrate SEON’s code, including the SEON Device Intelligence software development kit (“SDK”), into their own websites and/or mobile applications to protect their services and their users from fraud. This Privacy Notice relates exclusively to the Device Intelligence module.

1.2 If you are reading this Privacy Notice, you are most likely a user or customer of one of these businesses. For example, you may have an account with, or have used the website and/or mobile application of an online service provider that uses SEON. You have not interacted with SEON directly. In light of this, this Privacy Notice (“Privacy Notice”) describes how SEON processes your Personal Data (as defined in Section 5 of this Privacy Notice) in the context of providing and improving its Device Intelligence services on behalf and for the benefit of our Customers, including the online service provider you have an existing relationship with. These services enable our Customers to recognise the devices used to access their services and to detect and prevent fraud, account takeover, abuse of their services and similar unlawful activities. The onlineservice provider you have a relationship with is primarily responsible for the processing of your Personal Data, and its own privacy notice also applies to you (see Section 2).

1.3 This Privacy Notice covers the following mobile application(s), which are published by a SEON Entity (see section 2.4) on Google Play and the Apple App Store:

• SEON Device Intelligence

(the “App”). The App is a business tool intended solely for SEON’s Customers and persons authorised by them, such as their developers, fraud analysts and testers. It can only be used with a valid SEON API key, which SEON issues exclusively to Customers that have entered into an agreement with SEON. The App contains the SDK. When the App is used, the SDK collects the types of data described in this Privacy Notice from the device on which the App is installed.

1.4 This Privacy Notice does not apply to:

• SEON’s processing of personal data as a data controller in connection with its website, events, newsletters and other communications, which is governed by SEON’s general privacy notice, available at https://seon.io/legal-and-security/privacy/;
• SEON’s Identity Verification and AML Screening services, which are covered by their own dedicated privacy notices, available at https://seon.io/legal-and-security/privacy/identity-verification-services/ and https://seon.io/legal-and-security/privacy/aml-screening-service/; and
• the processing of your personal data by the online service provider for its own purposes, which is governed by that provider’s privacy notice.

1.6 At SEON we are committed to protecting your Personal Data and respecting your right to privacy. Please read this Privacy Notice carefully, as it explains how your Personal Data is processed, your rights, and how you can contact us with any questions or concerns.

2. WHO IS THE DATA CONTROLLER?

2.1 In certain jurisdictions, such as the European Economic Area (EEA), the United Kingdom (UK), and certain states of the United States (US) such as Virginia, Utah, California, Connecticut, Colorado, Illinois and Texas, data protection and privacy laws distinguish between (i) “controllers” or “businesses”; and (ii) “processors”, “service providers” or “contractors”. The controller (“Controller”) is the party that determines the purposes and means (why and how) of the processing of Personal Data. The processor (“Processor”) processes Personal Data on behalf of and on the documented instructions of the Controller.

2.2 SEON as Processor. Most of the processing described in this Privacy Notice is carried out on behalf of the Customer whose website or app you used, i.e. the online service provider you have an existing relationship with. In practice, this works as follows: when you use the Customer’s website or app, the SDK built into it collects information about your device and sends it to SEON. SEON then analyses this information using the settings and rules chosen by the Customer, and returns the results to the Customer. In respect of this processing, SEON acts as a Processor under a data processing agreement concluded with the Customer, and the Customer is the Controller. The Controller decides why and how your device data is used, for example which actions are checked and what happens if a risk is detected. 

2.3 SEON as Controller. SEON acts as an independent Controller only for the limited processing it carries out for its own purposes as the publisher of the App, namely:

• operating, maintaining and securing the App, including verifying API keys and preventing unauthorised use of the App;
• protecting the security and integrity of SEON’s services, systems and infrastructure;
• improving and developing SEON’s Device Intelligence technology, as further described in Section 4.2;
• responding to your inquiries and requests;
• complying with legal obligations applicable to SEON; and
• establishing, exercising or defending legal claims.

2.4 Which SEON Entity processes your Personal Data? The SEON Entities that may process your Personal Data under this Privacy Notice are:

• SEON Technologies Kft., an entity incorporated and existing under the laws of Hungary (registered seat: Szabadság tér 7. Platina Tower, Floors 8 & 9, 1054 Budapest, Hungary; Company Reg. No. 01-09-292732); and
• SEON Technologies US Inc., an entity incorporated and existing under the laws of Delaware, United States (registered address: SEON Technologies US Inc. 310 Comal Street Suite 270 Austin, TX  78702).

Which of them processes your Personal Data, and in which role, is determined by two factors:

(a) the SEON Entity named as the developer of the App on its store listing in Google Play or the Apple App Store; and

(b) where SEON acts as Processor (see Section 2.2), the SEON Entity that has entered into a contract with the Customer whose website or app you used.

Where the SEON Entity under (a) and the SEON Entity under (b) are the same, only that SEON Entity processes your Personal Data under this Privacy Notice. Where they differ, the two SEON Entities act as joint data controllers for the processing. They have agreed between themselves on their respective responsibilities for complying with applicable data protection law, including for responding to your requests. You may exercise your rights in respect of, and against, each of them. In either case, you can contact our DPO about any processing carried out by either SEON Entity (see Section 2.5).

2.5 SEON has appointed a Data Protection Officer (DPO), who acts as the point of contact for the processing carried out by any SEON Entity. You may contact our DPO at [email protected]. SEON will investigate and attempt to resolve any complaints or disputes regarding the processing of Personal Data within a reasonable timeframe. See Section 3 “EU-U.S. Data Privacy Framework (DPF)” and Section 13 “Remedies” for more information.

2.6 For any inquiries about this Privacy Notice, please contact SEON at the DPO contact outlined in section 2.5.

3. EU-U.S. DATA PRIVACY FRAMEWORK (DPF)

3.1 SEON and its US subsidiaries comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. SEON has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms of this Privacy Notice and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program and to view our certification, please visit https://www.dataprivacyframework.gov/.

3.2 SEON is responsible for the processing of Personal Data it receives under the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and subsequently transfers to a third party acting as an agent on its behalf. SEON complies with the EU-U.S. DPF Principles for all onward transfers of Personal Data from the EU and the UK, including the onward transfer liability provisions. In certain situations, SEON may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

3.3 SEON is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with regard to its compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

3.4 In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SEON commits to resolve DPF Principles-related complaints about our collection and use of your Personal Data. EU and UK individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF should first contact SEON at [email protected].

3.5 In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SEON commits to refer unresolved complaints concerning our handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO).

3.6 For complaints regarding EU-U.S. DPF and UK Extension compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/s/article/C-Pre-Arbitration-Requirements-dpf.

4. WHY DO WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS?

Purposes and legal basis where SEON acts as Processor.

4.1 Where SEON acts as Processor (see Section 2.2), the purposes of the processing are determined by the Customer as Controller. Device Intelligence may be used exclusively for fraud prevention, security and compliance purposes, which typically include (without limitation):

• recognising devices: combining device characteristics into identifiers (such as the device hash, browser hash, cookie hash and the True Device ID), which allow the Customer to recognise a device when it is used again, and to see when several accounts are used from the same device, which may indicate that they are controlled by the same person (multi-accounting);
• spotting inconsistencies and attempts to hide or manipulate a device’s identity, for example where device information appears to have been altered, an emulator is used instead of a real device, the device’s true location is concealed, or the device is being controlled remotely;
• detecting unusual changes in how an account is accessed, for example a login from a new device or from a different country, so that the Customer can decide whether to request additional verification, such as multi-factor authentication, to prevent account takeover;
• analysing contextual device signals – such as the operating system and browser version, device type and, depending on the integration, screen resolution, charging status and system uptime – to assess whether a device setup is consistent with ordinary use or resembles setups typically used for fraud;
• calculating risk scores and evaluating the rules configured by the Customer;
• supporting the Customer’s compliance with its legal and regulatory obligations (for example, location verification requirements applicable to licensed gambling operators); and
• supporting the Customer’s fraud investigations.

The legal basis for this processing is determined by the Customer as Controller and is typically the Customer’s legitimate interest in preventing fraud and ensuring security, compliance with a legal obligation, or, for certain data (such as precise location), your consent.

Purposes and legal basis where SEON acts as Controller.

4.2 Where SEON acts as Controller (see Section 2.3), SEON processes Personal Data on the basis of its legitimate interest under Article 6(1)(f) of the GDPR for the following purposes:

• to operate, maintain, troubleshoot and secure the App, to verify API keys and to prevent unauthorised use of the App and of SEON’s services;
• to protect the security and integrity of SEON’s platform, systems and infrastructure, and to investigate, prevent or take action against unlawful activity, suspected misuse of the services, or behaviour that may pose a threat to SEON, its Customers or third parties;
• to develop, test, optimise and improve the accuracy of SEON’s Device Intelligence technology, including its device identification and risk detection models, which may involve automated algorithms and machine learning;
• to create anonymised or aggregated statistics (excluding any data that would permit the identification of an individual) for the purposes of system performance analysis and product development;
• to respond to your inquiries and requests; and
• to establish, exercise or defend legal claims.

SEON also processes Personal Data where this is necessary to comply with its legal obligations under Article 6(1)(c) of the GDPR, including to comply with enforceable requests from authorities, court orders or other legal processes, and to keep records demonstrating compliance with applicable data protection laws.

Where SEON relies on its legitimate interest as a legal basis, SEON performs a Legitimate Interest Assessment (LIA) to ensure that its interests do not override your fundamental rights and freedoms, and implements safeguards to ensure that the data is processed in a manner that is necessary, proportionate and compliant with data protection principles.

Access to information on your device.

4.3 Where applicable law (for example, laws implementing Article 5(3) of the EU ePrivacy Directive) regulates access to information stored on a user’s device, the SDK accesses such information only where this is strictly necessary to provide the service explicitly requested through the App – the sole function of the App being to run the SDK – or on the basis of your consent, such as the location permission requested by your device’s operating system.

What we do not do.

4.4 SEON does not use the data collected through the App or the SDK for advertising or marketing purposes. In particular, SEON:

• does not perform cross-app or cross-site tracking for advertising purposes, retargeting or advertising measurement;
• does not build advertising profiles and does not act as an advertising, attribution or analytics network;
• does not “sell”, “lease”, “share” or “trade” your Personal Data, including for cross-context behavioural advertising purposes, as these terms are defined under applicable data protection laws, and does not share Personal Data with data brokers; and
• does not request tracking authorisation on your device on behalf of anyone.

Data processing activities.

4.5 SEON performs various forms of automated data processing, which include, but are not limited to, collecting, recording, organising, structuring, storing, modifying, enriching, retrieving, consulting, using, transmitting, disclosing or otherwise making available, aligning or combining, restricting, erasing or destroying Personal Data.

Principles for processing your Personal Data at SEON.

4.6 SEON follows the principles of Personal Data protection set out in the GDPR, the United Kingdom General Data Protection Regulation (UK GDPR) and other applicable data protection laws. In line with these principles, SEON ensures that your Personal Data is:

• processed fairly, lawfully and transparently;
• collected and processed solely for specified, explicit and legitimate purposes, and not used in ways that are incompatible with those purposes;
• adequate, relevant and limited to what is necessary for the purposes for which it is processed;
• kept accurate and, where necessary, up to date;
• stored in an identifiable form for no longer than necessary for the purposes of the processing;
• processed in a manner that ensures appropriate security; and
• not transferred outside the chosen data residency (see Section 7.1) without appropriate protection.

5. PERSONAL DATA PROCESSED

5.1 The  Personal Data processed through the App depends on the operating system and version of your device, the permissions granted to the App, the version of the SDK and the features enabled by the Customer. As a result, not all of the categories listed below will be processed in every case.

5.2 When providing Device Intelligence, SEON typically processes the types of data listed below. Not all of this data is personal data. Much of it describes the technical characteristics of a device, its software or the network it uses, for example the device model, the operating system version or the screen resolution, and on its own does not identify any individual. Such data may, however, constitute personal data where it relates to an identified or identifiable natural person. This is the case in particular where it is combined with unique identifiers or an IP address, or where the Customer links the device session to your user account. The data typically processed may include (without limitation):

• Online and technical data, such as your IP address (the address your device uses to connect to the internet), basic information about your device and browser, unique device identifiers, information about the session (for example, when it started) and how you reached the Customer’s website or app (for example, the page you came from);
• Location data, such as your approximate location (for example, country, region or city), which SEON estimates from your IP address. Your precise location (for example, GPS coordinates) is processed only if the Customer has enabled this feature and you have allowed the Customer’s app to access your location;
• Device identifiers, i.e. codes that help recognise a device when it is used again. These include identifiers provided by your device’s operating system for use by apps, and identifiers that SEON creates from the information collected about your device. On iOS, this may include Apple’s advertising identifier, but only if you have already allowed the app concerned to track you; otherwise this value is empty. On older Android devices (Android 9 or earlier), this may also include certain hardware identifiers, but only where the app concerned has been given the relevant permission;
• Information about your device and its settings, such as the device brand and model, operating system and version, screen size, battery status, how long the device has been switched on, and your language, region and time zone settings;
• Network information, such as the type of connection you use (for example, Wi-Fi or mobile data), your mobile network provider, and whether you appear to be using a VPN or proxy. Where the app concerned already has access to your location, this may also include the name of the Wi-Fi network you are connected to;
• Device security signals, i.e. indications that a device or app may have been tampered with or is being misused. Examples include whether the device has been rooted or jailbroken, whether it is an emulator rather than a real device, whether its location is being faked, whether its screen is being shared or it is being remotely controlled, and whether a phone call is ongoing. Where the operating system permits it, this may also include a list of apps installed from outside an official app store;
• Phone number, namely the phone number of the SIM card in the device, only where the app concerned has been given permission to access it;
• Behavioural data, only where the Customer has enabled this feature for a session. This means information about how the device is handled, such as movement and orientation measured by the device’s motion sensors, and [how you interact with the app – for example, the screens you visit, how long you spend on them, and whether information was typed or pasted]. SEON does not record what you type, the information you enter into fields, or what is shown on your screen;
• Risk outputs, such as device risk scores, suspicious flags, matching results and the outcome of the Customer’s rules;
• App technical data, such as the App version, error and crash information and API key validation logs; and

(hereinafter collectively referred to as: “Personal Data”).

5.3 The list above is not exhaustive. It describes the main types of data that SEON’s Device Intelligence services may process, but the exact data processed can differ from Customer to Customer, and even from one use of a website or app to the next. This is because it depends on a number of factors, in particular:

• the features and settings each Customer has chosen to use (for example, whether location or behavioural data is collected) and the steps of its website or app at which data is collected;
• whether you use the Customer’s website or its app, and the type, operating system and version of your device;
• the permissions you have given the Customer’s app on your device;
• the version of the SDK the Customer has integrated, as the data collected may change over time with new versions, including as a result of changes made by operating system providers such as Apple and Google; and
• any additional information the Customer chooses to share with SEON.

What we do not collect.

5.4 The App and the SDK do not collect:

• your contacts, photos, videos, messages, calendar, emails or files;
• the content you type, passwords, payment card numbers or other values you enter into fields, or the content of your screen; or
• special categories of personal data (such as data revealing health, racial or ethnic origin, political opinions, religious beliefs or sexual orientation).

Children.

5.5 The App is a business tool and is not intended for use by, or directed at, children. SEON does not knowingly process Personal Data relating to children through the App. If SEON becomes aware that it holds such Personal Data, it will take appropriate measures to delete it.

6. WHERE DO WE OBTAIN THE DATA FROM?

6.1 From your device. The SDK collects data directly from your device when you use the website or app of a Customer that uses SEON (or the App). Data is collected only at certain points chosen by the Customer, typically at important steps such as registration, login or a payment, and not continuously. Where the Customer has enabled behavioural monitoring, collection continues only for the duration of the relevant step (for example, while you fill in a registration form) and stops once that step is completed. The data is sent in encrypted form only to SEON’s own systems. No other company receives data from the SDK.

6.2 From the Customer. The online service provider you use may share additional information with SEON together with the device data, such as your user ID or account number, so that it can link the results to your account.

6.3 Generated by SEON. SEON generates some data itself from the information collected. Examples are device identifiers, your approximate location estimated from your IP address, and risk scores and warning signals. To recognise whether a device has been used before, SEON compares the newly collected information only with information previously collected for the same Customer, not across different Customers.

6.4 From you. If you contact us, we process the information you provide to us.

7. LOCATION, DURATION OF THE PROCESSING; DATA RETENTION

7.1 SEON’s entire production infrastructure is hosted on secure cloud servers provided by Amazon Web Services (AWS). The location where your data is stored and processed is chosen by the Customer, as the Controller, from the following options:

• Ireland, European Union (AWS eu-west-1) – this is the default location;
• Northern Virginia, United States (AWS us-east-1);
• Singapore (AWS ap-southeast-1); or
• Jakarta, Indonesia (AWS ap-southeast-3).

7.2 Apart from storage, your Personal Data may be processed in other countries where SEON, its affiliates and their service providers maintain servers and facilities, including but not limited to Hungary, the United States, the United Kingdom, Brazil and Indonesia. We take steps, including through contracts, intended to ensure that the information continues to be protected wherever it is located in a manner consistent with the standards of protection required under applicable law.

7.3 Where SEON acts as Processor, Personal Data is retained in accordance with the Customer’s agreement with SEON and the Customer’s instructions. The data collected by the SDK is processed and stored as part of SEON’s Fraud API, which is the service through which SEON analyses the data and returns the results to the Customer. As a result, it is subject to the same retention period as all other Fraud API transaction data. Unless otherwise agreed with the Customer, this retention period is 1 year. The Customer may instruct SEON to delete data before the end of this period. 

Notwithstanding the foregoing, the value of the True Device ID stored by SEON expires if the device is not seen again within 20 days, unless the Customer has configured a longer period.

7.4 Where SEON acts as Controller, SEON retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law or is necessary for the establishment, exercise or defence of legal claims. When determining how long to retain Personal Data, SEON takes into account the volume, type and sensitivity of the data, the potential impact on individuals in case of unauthorised use or disclosure, the purposes of the processing and whether those purposes could be achieved through less data-intensive means.

7.5 At the end of the applicable retention period, SEON deletes or irreversibly anonymises the Personal Data.

8. HOW DO WE SHARE YOUR PERSONAL DATA?

Recipients.

8.1 SEON may share or make available Personal Data processed through the App with the following categories of recipients, strictly in accordance with data protection principles and appropriate contractual safeguards:

• The Customer: SEON processes your Personal Data on behalf of the Customer whose website or app you used, so the results of SEON’s analysis are made available to that Customer. This includes, for example, information about your device, device identifiers, risk scores and warning signals. The Customer uses these results to decide, for example, whether to allow an action, request additional verification or review an activity. Each Customer can access only the results relating to its own website or app; results are not made available to other Customers, except as described in Section 8.2.
• Sub-processors and infrastructure providers: SEON engages trusted third-party service providers to support its infrastructure and operations, such as cloud hosting providers (e.g. Amazon Web Services) and customer support tools. Such providers act on SEON’s instructions and are bound by data protection obligations consistent with Article 28 of the GDPR. Our up-to-date sub-processor list is available in our Trust Center at https://trust.seon.io/.
• SEON group personnel and affiliates: access to Personal Data within SEON is restricted to authorised personnel who require it for legitimate purposes, such as system maintenance, customer support and compliance. All such staff are subject to confidentiality obligations and appropriate data protection training. Where necessary, SEON may share Personal Data between entities within the SEON group (which currently includes entities in Hungary, the United Kingdom, the United States, Brazil and Indonesia) for the purposes described in this Privacy Notice.

8.2 Additionally, SEON may share your Personal Data in the following limited circumstances:

• with legal and professional advisors (e.g. law firms, consultants);
• with auditors performing regulatory or contractual assessments;
• with competent supervisory authorities, regulators, law enforcement bodies or courts, when required by law or in response to valid legal processes; and
• in the context of a corporate transaction (e.g. merger, acquisition or restructuring), where your Personal Data may form part of the transferred assets, subject to appropriate safeguards and notice.

8.4 SEON does not sell your Personal Data and does not share it with advertisers, advertising networks or data brokers.

International data transfers.

8.5 SEON is a global organisation and provides global services. Therefore, SEON may transfer your Personal Data to SEON group entities located outside the European Economic Area (EEA), including to the United Kingdom, which is subject to an adequacy decision of the European Commission.

8.6 SEON may also transfer your Personal Data to third-party service providers located in jurisdictions outside the EEA, Switzerland or the UK, such as the United States or other third countries.

8.7 To ensure that your Personal Data remains protected, SEON implements appropriate safeguards for international data transfers, including:

• the use of Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner’s Office;
• reliance on adequacy decisions, including the EU-U.S. Data Privacy Framework, where applicable; and
• conducting transfer impact assessments to evaluate potential data protection risks and adopting necessary supplementary measures.

9. HOW DO WE ENSURE DATA SECURITY?

9.1 Before any data leaves your device, the SDK encrypts it, so that it cannot be read by anyone other than SEON. It is then sent to SEON over a secure, encrypted internet connection. The SDK sends data only to SEON’s own systems and not to any other company.

9.2 To protect the Personal Data it processes, SEON maintains a robust security framework. This includes internationally recognised certifications (such as ISO/IEC 27001 & 27017), regular independent audits (such as SOC 2 Type II), and a range of technical and organisational safeguards designed to prevent unauthorised access, ensure data integrity and support overall data protection compliance.

9.3 For further information on SEON’s security framework, please visit our Trust Center at https://trust.seon.io/.

10. DO WE ENGAGE IN AUTOMATED DECISION-MAKING?

10.1 SEON does not engage in automated decision-making within the meaning of Article 22(1) of the GDPR that would produce legal effects concerning you or similarly significantly affect you.

10.2 Where SEON acts as Processor, SEON analyses the device data and returns risk signals, such as risk scores and suspicious flags, to the Customer based on the rules configured by the Customer. SEON does not decide whether to approve, decline or take any other action in relation to you. Any such decision is made by the Customer, which is responsible, as Controller, for ensuring that its decision-making complies with applicable law, including Article 22 of the GDPR where it applies.

11. WHAT ARE YOUR RIGHTS?

11.1 Depending on where you reside (and therefore which data protection laws apply to you), you may have the following rights regarding the processing of your Personal Data:

Right to access.

11.2 You may have the right to request access to your Personal Data and to obtain information regarding (among others): the purposes of the processing; the categories of Personal Data processed; the recipients to whom your Personal Data is disclosed; the period for which your Personal Data is processed (data retention period); your rights in connection with the processing; your right to lodge a complaint with a supervisory authority; where your Personal Data is not collected from you, any available information as to its source; the existence of automated decision-making and related information; and whether your Personal Data is transferred outside the EEA and the safeguards applicable to such transfers.

Right to rectification.

11.3 You may have the right to request the rectification of inaccurate Personal Data and the completion of incomplete Personal Data, including by means of providing a supplementary statement.

Right to erasure.

11.4 You may have the right to request the erasure of your Personal Data, in particular where:

• your Personal Data is no longer necessary for the purposes for which it was collected;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• your Personal Data has been processed unlawfully; or
• your Personal Data has to be erased in order to comply with a legal obligation.

11.5 Please note that we may not be required to erase your Personal Data where its processing is necessary, among others, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to restriction of processing.

11.6 You may have the right to obtain the restriction of processing where: (i) you contest the accuracy of your Personal Data, for a period enabling us to verify its accuracy; (ii) the processing is unlawful and you oppose the erasure of your Personal Data and request the restriction of its use instead; (iii) we no longer need your Personal Data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or (iv) you have objected to the processing, pending verification of whether our legitimate grounds override yours. Where processing has been restricted, Personal Data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of an EU Member State.

Right to object to processing.

11.7 You may have the right to object, on grounds relating to your particular situation, to the processing of your Personal Data where the legal basis of the processing is a legitimate interest. In that case, your Personal Data will no longer be processed unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Right to data portability.

11.8 Where certain conditions apply, you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance, where technically feasible.

Right to withdraw consent.

11.9 Where the processing is based on your consent (for example, a location permission), you may withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal (see Section 11.2).

Right not to be subject to automated decision-making.

11.10 You may have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. For more information, please see Section 10 of this Privacy Notice.

How can you exercise your rights? 

11.10 Please refer to section 13 below.

Your rights – California residents.

11.11 If you are a resident of California, the California Consumer Privacy Act, as amended (“CCPA”), may grant you additional rights regarding your Personal Information (as defined under the CCPA). In respect of the processing described in Section 2.2, SEON acts as a service provider to the Customer, and requests concerning that processing should be directed to the Customer. In respect of the processing described in Section 2.3, and subject to certain exceptions, you have the right to: (i) know and access the Personal Information we have collected about you; (ii) request the deletion of your Personal Information; and (iii) request the correction of inaccurate Personal Information.

11.12 We do not sell or share Personal Information (as these terms are defined under California law), including for cross-context behavioural advertising. We will not discriminate against you for exercising any of your rights.

11.13 To exercise your rights, please contact us as described in Section 12.12. We may need information such as your name and email address to verify your identity, and we will use this information only for that purpose. You may also designate an authorised agent to submit a request on your behalf, in which case we may ask for evidence that the agent has been authorised by you.

12. REMEDIES

12.1 If you do not agree with our response or action, or if you consider that your rights have been infringed, you may lodge a complaint with the data protection supervisory authority in the UK or in the EU Member State of your habitual residence, place of work or place of the alleged infringement, in particular with the following authorities:

• Hungarian National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11; mailing address: 1363 Budapest, Pf.: 9.; tel.: +36-1-391-1400; email: [email protected]; website: naih.hu);
• Information Commissioner’s Office (address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; online contact form: https://ico.org.uk/global/contact-us/).

12.2 A list of the data protection supervisory authorities of the EU Member States is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

12.3 If you are a resident of the United States, you may submit a complaint to the privacy or consumer protection authority of your state of residence, such as the office of your state Attorney General. If you are a resident of California, you may also submit a complaint to the California Privacy Protection Agency (CalPrivacy) at https://privacy.ca.gov/complaints/. Complaints concerning SEON’s compliance with the EU-U.S. Data Privacy Framework fall within the jurisdiction of the U.S. Federal Trade Commission (see Section 3.3).

12.4 You may also seek a judicial remedy before the competent court.

12.5 In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SEON commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

12.6 You may, subject to its terms, invoke binding arbitration in accordance with Annex I of the DPF Principles (https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf) by delivering notice to SEON and following the procedures and subject to the conditions set forth in Annex I.

13. FURTHER INFORMATION; CONTACT

13.1 Where SEON acts as Processor (see Section 2.2), SEON works in the background on behalf of the online service provider whose website or app you use, that provider is your main point of contact for questions about how your Personal Data is used. Its own privacy notice explains, among other things, why it uses fraud prevention services such as SEON, what data it shares with its service providers, and how you can exercise your rights.

You can usually find the provider’s privacy notice: on its website, typically linked at the bottom of the page; within its app, typically in the settings, account or “About” menu; or on the app’s page in Google Play or the Apple App Store, under “Privacy Policy”.

13.2 Where SEON acts as Controller (see Section 2.3), or if you are unsure which provider’s website or app your request relates to, you may submit your request to our Data Protection Officer (DPO) at [email protected]. This applies regardless of which SEON Entity your request concerns 

13.3 If you are unsure which provider’s website or app your request relates to, or if you have a question about SEON’s own processing as described in Section 2.3, you can contact our Data Protection Officer at [email protected] (see also Section 13).

13.4 Because the data SEON processes relates primarily to a device, we may need additional information to locate your Personal Data, such as the name of the provider whose website or app you used, the approximate date and time of use, and the device concerned. If we have reasonable doubts as to the identity of the person making the request, we may ask for additional information necessary to confirm it. Where we are not in a position to identify you, we will inform you accordingly.

13.5 We will respond to requests submitted to us without undue delay and in any event within one month of receipt (or sooner if required by applicable law). This period may be extended by two further months where necessary, taking into account the complexity and number of requests; in that case, we will inform you of the extension and the reasons for it. If we do not take action on your request, we will inform you within the same one-month period of the reasons, and of your right to lodge a complaint with a data protection supervisory authority and to seek a judicial remedy.

13.6 We will act on your request free of charge, unless it is manifestly unfounded or excessive. We will communicate any rectification, erasure or restriction of processing to each recipient to whom your Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort.

14. UPDATES TO THIS APP PRIVACY NOTICE

We review this Privacy Notice from time to time and reserve the right to amend it as necessary, for example where the data processed by the App or the SDK changes. When we amend this Privacy Notice, we will publish the updated version on our website and indicate the date from which it is effective. We encourage you to review this Privacy Notice regularly.