Purse offers a payment orchestration platform to merchants who act as data controllers. The management of personal data associated with the service is explained below.
Purse is a technology company that offers online merchants a SaaS-based software solution that optimizes payment management by acting as an intermediary between the merchant's site and the Payment Service Providers the merchant has chosen to activate. Purse is what is known as a "payment orchestration platform," which allows for the dynamic and contextual display of appropriate payment methods on the merchant's checkout page and provides the merchant with secure access to a back-office, the Payment Manager, to monitor the performance of payments processed by the PSPs.
In providing this solution, Purse acts as a data processor, within the meaning of the GDPR, for merchants who choose to use this payment orchestration solution. In this capacity, Purse implements all necessary technical and organizational security measures to ensure the security and confidentiality of the data processed through its service. Purse engages service providers, who act only under its instructions, to process data in order to provide the service (data hosting, database administration, software development, etc.).
The data displayed in the Payment Manager is data associated with a customer's order from a merchant (customer identity, address, cart details, transaction amount, transaction status, shipping status, PSP used for payment). Upstream Pay does not store any bank card data. This is processed solely by the Payment Service Providers (PSPs) to execute the payment. By default, and unless otherwise instructed by a merchant, transaction data is retained by Purse for a period of 15 months from the date of the transaction.
Any customer of a merchant may, as an individual, exercise their rights regarding the processing of their data. This includes the right of access, rectification, portability, erasure of data, and the right to object to and restrict data processing. These rights must be exercised directly with the Merchant. You may also exercise them directly with Purse, which will forward the request to the relevant Merchant.
Purse, SAS collects personal data for the management of its commercial activities on its website https://upstreampay.com and during trade shows or events. The rules for managing personal data are detailed below.
PURSE collects and processes the personal data of its clients for the following purposes: Processing purposes: Management of client contacts (data collection on the website, at trade shows, events, etc.); Sending newsletters and event invitations; Hosting webinars. Legal basis: PURSE's legitimate interest in promoting its business and seeking clients interested in its solution.
Any individual whose data has been collected has the right to exercise the following: - A right of access, rectification, and data portability - A right to object to or restrict processing - A right to provide advance directives regarding the fate of their data after death. These rights can be exercised with PURSE via [the form](#dastra-customer-subject-form) available at the bottom of the page. You may also send your requests to the following postal address: PURSE, Immeuble Eurocentre, 179 boulevard de Turin, Lille (59000). The request must include your last name, first name, postal address, and email. Identity verification may be required. PURSE will respond within one month. In certain cases, due to the complexity of the request or the number of requests, this period may be extended by two months. These rights may be subject to exceptions in certain cases provided for by regulations. The data subject has the right to lodge a complaint with the CNIL (www.cnil.fr).
PURSE uses subcontractors for data hosting, email routing, and software development operations. PURSE ensures that these subcontractors provide sufficient guarantees regarding data security and confidentiality.
For certain operations, personal data may be transmitted to companies located in countries outside the European Union. Prior to any transfer outside the European Union, and in accordance with applicable regulations, Purse ensures the security of these data transfers.
PURSE has established precise rules regarding the retention period for Clients' personal data. In principle, data is kept for the time necessary to fulfill the purposes for which it was collected. The retention periods adopted are as follows: - Prospect data (individuals who have never subscribed to the service) is kept for 3 years after the last contact from the prospect - Client data is kept for 3 years from the end of the contract with the client.
Information regarding your browsing on the site may be saved in "Cookie" files placed on your device, subject to the choices you have expressed regarding Cookies, which you can modify at any time. 1. **Use of cookies on the Site**
The cookies used by Purse on its site are used to: - Establish statistics and volumes of traffic and usage of the various elements of the Site. For this purpose, we use audience measurement cookies. - Adapt the presentation of our Site according to the device used; - Allow you to access reserved and personal areas of our Site, such as your account, using identifiers; - Implement security measures, for example when you are asked to log back into your account after a certain period of time; 2. **Cookie settings on the Site**
You can choose to express and modify your preferences regarding cookies at any time using the methods described below. - Setting cookies with the consent manager
To access the list of cookies placed and configure them, click on the link below: -
Setting your browser software
You can configure your browser software so that cookies are saved on your device or, conversely, that they are rejected, either systematically or depending on their issuer. Cookie configuration differs depending on the browser used: - For Edge: http://windows.microsoft.com/en-us/windows-vista/Block-or-allow-cookies - For Safari: https://support.apple.com/en-us/HT201265 - For Chrome: https://support.google.com/chrome/answer/95647 - For Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences - For Opera: http://help.opera.com/Windows/10.20/en/cookies.html
Opt-out list for managing cookie placement
You also have the option to object to the placement of cookies by accessing the website
Purse collects personal data for the management of recruitment operations, the rules for which are explained below.
Data is processed for the following operations: - Drafting and posting job advertisements on third-party platforms and job boards; - Receiving candidate responses; - Managing the recruitment process (conducting interviews, interview assessments, and any necessary evaluation tests). Data is processed based on Purse's legitimate interest in collecting data to assess an individual's suitability for the relevant position and, if applicable, to proceed with their recruitment.
In providing this solution, Purse acts as a data processor, within the meaning of the GDPR, for merchants who choose to use this payment orchestration solution. In this capacity, Purse implements all necessary technical and organizational security measures to ensure the security and confidentiality of the data processed through its service. Purse engages service providers, who act only under its instructions, to process data in order to provide the service (data hosting, database administration, IT development, etc.).
Candidates whose data has been collected have the right to exercise the following: - A right of access, rectification, and data portability - A right to object to or restrict processing - A right to provide instructions regarding the fate of their data after their death. These rights can be exercised with Purse as follows: The candidate may also send their requests to the following postal address: Purse, Next Now, 67 rue du Luxembourg, 59777 Lille. The request must include the candidate's full name, postal address, and email address. Identity verification may be required. Purse will provide a response within 1 month. In certain cases, due to the complexity of the request or the number of requests, this period may be extended by 2 months. In some cases provided for by regulations, these rights may be subject to exceptions. The data subject has the right to lodge a complaint with the CNIL (www.cnil.fr).
Data is shared with the managers involved in the application process as well as the HR department.
Purse retains application data for a period of 24 months from the date the application is submitted. This period is renewed with each new interaction with the candidate.
Purse has appointed a Data Protection Officer with the CNIL. They can be contacted at the following address: mesdroits@purse.eu
