Privacy Notice for End Users

In short:

At Vipps, we care about your privacy. We strive to always keep our responsibility front and center when we process your personal data.

This privacy Notice describes why and how we process your personal data, and how you can exercise your rights.

Girl with phone (1).png

1. Vipps products

The primary reason for processing your personal data is to deliver Vipps products to you. Below you can read more about each product. Remember that you can also get an overview of what we process in your Vipps app.

Why and how do we process your personal data?

In order to provide you with a Vipps profile, we process the following information:

  • Information about you (name, telephone number, e-mail, postal address (as registered in Norway's National Population Register, as well as the address you provide) and national identification number)
  • Account and Card Details (bank account number, masked debit or credit card number and expiry date). Our acquirer also process additional card-related information.
  • Usage Data (views, time, frequency, and duration of activities in the app, search history and sign in/log out data)
  • Technical Data (internal IDs, IP address, mobile operating system, mobile device, browser, settings in app, log of technical events, etc.)

In addition, we collect the following information from various registers to ensure that we have the correct information:

  • Contact Details (name and address) and citizenship from Norway's National Population Register.
  • Ownership of the bank account from "Konto- og adresseregisteret" (KAR).
  • Business Roles registered in The Brønnøysund Register.

Remember: As a Vipps user, other Vipps users will be able to see your name by searching your mobile phone number in the Vipps app.

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Why and how do we process your personal data?

To send and receive money through Vipps, we process the following information:

  • Transaction Data (date and time, name and telephone number of recipient or merchant name and number, payment source, receiving account, amount, product/service, text/messages)

In addition, the recipient will see the following information:

  • Transaction Data (date and time, name and telephone number of sender, amount, product/service, text/messages)

What allows us to do this? 

Contract we have with you, see Terms and Conditions

For donations to non-profit organisations

Why and how do we process your personal data?

When you donate a monetary gift to certain non-profit organisations, you can choose to share your national identification number and name with them so that you can receive a tax deduction for the monetary gift.

What allows us to do this? 

Your consent.

Why and how do we process your personal data?

To deliver Vipps Logg Inn, we process the following information with your consent:

  • Your preference (merchants where you use Vipps Logg Inn)

You can choose to share the following information from your Vipps profile to other websites:

  • Information about you (name, telephone number, e-mail, registered address and address you provide, national identification number)

Did you know? You can find an overview of the merchants you have shared this information with in the app: Profile > Personal information > Companies with access. This is also where you can withdraw your consent, at any time.    

What allows us to do this? 

Your consent.

Vipps Hurtigkasse or Vipps Checkout

Why and how do we process your personal data?

To deliver Vipps Hurtigkasse or Vipps Checkout, we process the same personal data that appears in section 1.2 (for payment) and section 1.3 (Vipps Logg Inn). In addition, we process the following information:

  • Your preference (websites/merchant where you use Vipps Hurtigkasse and Vipps Checkout)

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Data Transfer to other merchants

Why and how do we process your personal data?

You can choose to share the following information from your Vipps profile to other websites:

  • Information about you (name, telephone number, e-mail, registered address and address you provide, national identification number)

What allows us to do this? 

Your consent.

Did you know: You can find an overview of merchants you have shared this information with in the app: Profile > Personal information > Companies with access in the app. This is also where you can withdraw your consent, at any time.  

Why and how do we process your personal data?

By using a QR code, we give you the option to pay with Vipps instead of card in the payment terminal. For this service, we process the following personal data:

  • Transaction data (date and time, sender and recipient details, amount)
  • Technical data (URL, IP address, operating system, etc.)

To check if there is a valid BankAxept card linked to one of your payment accounts, the following information is processed and shared with the banks where you hold an account:

  • Account information
  • Norwegian national identity number

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Why and how do we process your personal data?

Vipps scanner

To scan and pay your bills and invoices, we process the following information:

  • Information from the scanned bill (the payee’s account number, KID number, amount, due date)
  • Image of the scanned bill

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Remember that: To use Vipps Bill Scanner, Vipps needs access to the camera and images on your phone, see 1.11.

Vipps eFaktura

To show your invoices and pay eFaktura in Vipps, we collect the following information from the invoice issuer, service providers or banks:

  • Invoice information (the payee’s account number, KID number, amount, due date)
  • Link to invoice

Did you know: You can turn on and off functions in the app. Go to Profile > Bills and eFaktura. Remember that if you have chosen “Always Vipps eFaktura”, we will inform invoice issuers that they can send your eFaktura in Vipps.

What allows us to do this? 

Your consent.

Vipps Cover for me

To give you the opportunity to postpone a payment, we process the following information:

  • Billing information (payee's account number, KID number, amount, due date)
  • Postponed bill (If you use Vipps Cover for me, Vipps will only know if you have received a deferred bill from SpareBank 1 Kreditt)

Did you know: For this processing, SpareBank 1 Kreditt AS is the data controller.

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Why and how do we process your personal data?

To deliver payment for a used car with NAF and Finn, we process the following information:

  • Information about the car (registration number and registered owner)
  • Purchase amount

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Why and how do we process your personal data?

When you use Vipps Mobil, we process the following information to manage your customer relationship and to settle mobile phone usage:

  • Subscription information (start date, type of subscription and changes, enlisted new users)
  • Usage data (summary of data usage, usage overview of foreign account, upgrades, blocking/opening of various functionalities)
  • Technical data (SIM card incl. ICCID)
  • Mobile phone information (model, IMEI, name of active devices such as mobile or 4G router)

Your personal data processed by Vipps Mobil can be transferred to the National Reference Database (NRDB) in order to control subscription ownership in the case of phone number porting. As a telecommunications operator, we are also obliged to provide information on a registered telephone number to the various information services such as 1881.

Vipps Mobil will be able to share the following information with Vipps AS:

  • Information about you (name, mobile phone number, e-mail, registered address and address you provide, national identification number)
  • Which services you use

What allows us to do this? 

The Vipps Mobil AS agreement, Vipps Mobil - Abonnementsvilkår.

Did you know: Vipps Mobil uses eRate as mobile service provider and Telenor as network provider.

For children

  • Your guardians have an overview of everything you see in the app. For example, they can see who you send and receive money from, who you chat with, and your full conversations.
  • Vipps saves all the activity on your account, such as your name, mobile phone number of those who send you money, chats, the time you send and receive money.
  • For more information, see Vipps under 15 and remember that you can always contact us via chat at vipps.no, e-mail at personvern@vipps.no or telephone on 22 48 28 00. 

For adults

In addition to the personal data that appears in section 1.2 (for payments between private individuals), we process the following information about both guardians and children:

  • Parent-child relationship, or guardianship, as registered in Norway's National Population Register.
  • Documentation of registered parental or guardian responsibility, submitted by the adult.

What allows us to do this? 

To fulfill the agreement we have with your parents/guardians and you, see Terms and Conditions.

When you use our app, you can consent to the following features on your mobile phone:

  • Location, so you can find a merchant near you.
  • Your contact list, so you can select recipients from your contacts. If you don't want the app to access your contacts, you can manually enter the recipients mobile phone number.
  • Pictures and camera, so you can have a profile picture in Vipps, scan invoice information, save receipts as pictures or add a picture to a settlement group.
  • Notifications, so that Vipps can send you push notifications.
  • Background updates, so you can receive push notifications from Vipps.
  • Mobile data, so you can use Vipps when you don't have wireless internet.
  • For Android, we ask for access to mobile phone status and ID, so that the mobile identifier can be saved and change/delete content on the SD card, and for you to upload a profile picture.

Did you know: You can turn on and off these functions in the mobile phone settings.

What allows us to do this? 

Your consent.

When you use our app, you can consent to the following functions in the app:

  • Balance, for you to see your bank account balance in the app (we obtain this information from your bank).
  • Profile picture, so you can upload a profile picture that other users can see.
  • Chosen name for your accounts or cards, so you can easily differentiate them.
  • Blocked users, users that can no longer send you messages or money.
  • Show Vipps Mobil on the Vipps home screen, provides Vipps Mobil subscribers with an overview in the Vipps App.
  • Suggestions and offers from Vipps, so that you can see tips and recommendations on the Vipps home screen.

Did you know: You can change feature settings in the app under Profile.

What allows us to do this? 

Your consent.

2. Across Vipps services

Some processing is not necessarily linked to a single product. You can read more about it below.

To fulfill our obligations according to laws and regulations, Vipps must process some personal data.

  • Bookkeeping: Accounting material, which may also contain personal data, is processed, and stored in accordance with the requirements in the Bookkeeping Act.
  • Prevention and detection of criminal activities: Vipps must process some personal data for the purpose of preventing, detecting, investigating and handling fraud and other criminal activities. This includes the duty to examine and report suspicious activities and transactions under the Anti-Money Laundering Act. Vipps also obtains information from various registers to fulfill legal requirements, for example related to politically exposed persons and sanctions.
  • Disclosure of personal data to public authorities: We must disclose personal data when there is a court order, law enforcement request or otherwise to fulfill legal requirements, such as The Penal Code, The Statistics Act, The Taxation Act or The Labour and Welfare Administration Act.
  • Disclosure of personal data to banks and other financial institutions: We also disclose personal data to comply with The Anti-Money Laundering Act when it is part of conducting due diligence of suspicious activities or transactions, and in accordance with the Financial Institutions Act regarding fraud.
  • Security monitoring: To detect and resolve suspicious activities and security incidents, Vipps processes personal data when logging and monitoring Vipps' services. Ensuring information security is, among other things, anchored in the Personal Data Act and the ICT Regulation.

What allows us to do this? 

Our legal obligation.

Vipps processes personal data to help you if you have issues with our services, such as:

  • Information about you (name, telephone number, e-mail, registered address and address you provide, national identification number)
  • Information about your issue
  • Information about the customer relationship (which services you use, for how long, etc.)

Depending on the issue, it may also include:

  • Transaction Data
  • Account and card details (bank account number, masked debit or credit card number and expiry date)
  • Usage data (views in the app, time and clicks in our surfaces, searches, logins and logouts)
  • Technical data (internal IDs, IP address, operating system, mobile device, browser, settings in app, log of technical events, etc.)

What allows us to do this? 

Contract we have with you, see Terms and Conditions

Basic customised marketing on our platforms

Vipps carries out basic profiling to adapt marketing in our app or websites to you and to ensure that end users under 18 are excluded from our marketing activities. For this, we use the following personal data:

  • Age group range 
  • Geographic area
  • Activity level

What allows us to do this? 

Our legitimate interest.

Advanced customised marketing on our platforms

If you consent, we adapt marketing in the app or websites to ensure that the content is as relevant to you as possible. We base our marketing activities on customer analysis and the information we have about you:

  • Contact details
  • Which Vipps services you use
  • Usage data (pages visited, time and clicks on our platforms, search history, logins and logouts)
  • Bank account and payment card information
  • Overall transaction data (when and where you shop, but not what you buy and the amount)

What allows us to do this? 

Your consent.

Marketing via e-mail or SMS

If you consent, we may send you suggestions and offers via e-mail or SMS. For this, we process:

  • Information about you (name, telephone number, e-mail)

What allows us to do this? 

Your consent.

Marketing activities outside our platforms

If you consent, we provide you with relevant suggestions and offers outside our platform, such as social platforms and websites. To do this, we need to know who you are when you use the relevant social platforms and websites. We connect the personal data that you have provided to us, with information that you have provided in an external channel. By doing this, we can share messages and information that we assume to be of interest to you. In such cases, Vipps transfers personal data that has been masked to the individual third party. You can find more information on Cookies (vipps.no).

  • Information about you (name, telephone number, e-mail)
  • Usage data (pages visited, time and clicks on our platforms, search history, logins and logouts)

What allows us to do this? 

Your consent.

Did you know: An overview of your consents to marketing activities is available in the app under Profile > Settings. You can withdraw your consent at any time.

Internal development of our services

We process personal data for service development, maintenance and to improve customer experience. To do this, we analyse how our products and services are used. For this type of processing, we do not identify the end users, but use aggregated, pseudonymized or anonymized data. The following information may be processed to generate such analyses:

  • Demographic data (age, gender, geographic area)
  • Which Vipps services/products you use
  • Technical data (Customer ID, Cookies, user agent, etc.)
  • Usage data (views in the app, time and clicks in our platforms, search history, logins, and logouts)
  • Aggregated Transaction Data
  • Profile information (number of payment cards and bank accounts)

What allows us to do this? 

Our legitimate interest.

Statistics

We further process this information to develop user surveys, user analyses, market analyses, and reports based on usage patterns and demographics. We use statistical data to group users into similar usage patterns and this helps us understand how our services are used. The results cannot be linked back to you as we use aggregated data for this purpose. In some situations, we forward the results of the analyses to merchants that use Vipps. This information cannot be linked back to you. Vipps shares aggregated statistics with certain partners, such as banks and the Ministry of Finance. 

What allows us to do this? 

Our legitimate interest.

Vipps uses several suppliers who process personal data on our behalf (Data Processors). In these cases, Vipps enters into a Data Processing Agreement with the supplier to ensure that the processing is carried out in accordance with the GDPR. Relevant data processors we use are:

  • Cloud service providers
  • Software providers
  • Service providers
  • Consulting firms
  • Banks

When we transfer personal data outside the European Union (EU) or the European Economic Area (EEA)

In some cases, Vipps may transfer personal data to Data Processors in countries outside the EEA. Such transfers can only be made if the Data Processor has provided assurance that your privacy and rights are protected. This may be a transfer basis approved by the European Commission e.g., to an approved country, through Standard Contractual Clauses, or through valid Binding Corporate Rules. In special situations, another valid transfer basis, such as agreement or consent, may be used if the level of protection corresponds to the level in the EEA.

Information security is fundamental to delivering safe and simple solutions. Through effective security measures and processes, we therefore ensure that your personal data is protected against unauthorized access and alterations and is available when needed. For this, we have implemented measures such as:

  • Identity and Access Management
  • Secure Software Development and Security Testing
  • Encryption
  • Network Security
  • Security Monitoring and Incident Management
  • Safety training and knowledge sharing among employees
  • Security requirements and follow-up of Data Processor and suppliers

Security measures are implemented, monitored, and continuously improved based on a risk-based approach to ensure that personal data is adequately protected over time.

Personal data will not be stored longer than is necessary and according to the following rules:

  • The main rule is that we store personal data for as long as your customer relationship is ongoing. This allows you to have an overview of your history that you can see in the app.
  • When you terminate your customer relationship, certain information will be stored by Vipps for another 3 and half years, 5 or 10 years in accordance with the Money Laundering Act or the Bookkeeping Act.
  • Personal data that we process based upon your consent will be deleted if you withdraw your consent, unless there is another legal basis for further processing.
  • In some situations, we may have a legitimate interest in retaining the information for a longer period, for example for back-up.

3. Your rights

If you wish to exercise your rights, you can send your request to our Data Protection Officer in personvern@vipps.no.

You have the right to access the information stored about you. Remember that you can find most of this information about you in your profile and your history in the Vipps app.

You have the right to demand that incorrect information about you be corrected. You can change your e-mail, address, picture, account, and card information in the app.

You have the right to demand to delete information about you if Vipps does not have a legal basis for storing it further. Do you want to delete your profile? See Hvordan sletter jeg alt om meg og min profil? (vipps.no)

You may withdraw your consents at any time.

  • If you have shared your information in Vipps with companies, you can withdraw this consent: under Profile > Personal information > Companies with access and Browsers that remember you
  • Vipps Regninger and eFaktura: under Profile > Bills and eFaktura
  • Marketing: under Profile > Settings
  • Settings on your phone: under settings on your phone
  • Settings in the app: for example under Profile > Settings or Profile > Accounts and cards

You have the right to be informed about how we process your personal data. We do this in this Privacy Notice, in our Terms and Conditions, and when obtaining consent.

If we process information about you based on our legitimate interest, you have the right to object to our processing of information about you. This can be for example for analysis purposes or for compiling personal data across our services.

In special situations, you have the right to request a restriction of the processing of personal data.

You have the right to have your data transferred in a machine-readable format to a new Data Controller.

You also have the right to complain to the Norwegian Data Protection Authority.

Changes in this Privacy Notice

Vipps continuously works to improve and develop our services. We will change information in this Privacy Notice in the event of any changes in the law, services we provide or in our own personal data processing practices. If Vipps makes major changes that may affect your privacy or rights, you will be notified in the app or by email. 

Version 1.12. Updated 05.10.2022

Vipps Confirm.png

Do you have any questions?

If you have questions about privacy, contact us on our chat here at vipps.no or send an e-mail to personvern@vipps.no

You will also find some answers under help: Privacy and security - questions and answers (this is in Norwegian).

Hjelp_2x.png