Privacy Policy

1. Introduction

At bunq, we really care about your privacy. This means we will never sell or rent your personal data to third parties without your permission. In this Privacy Statement (“Statement”) you can read what personal data we collect and how we use it. 

The data controller for the processing of your personal data is bunq B.V., registered at the Dutch Chamber of Commerce with registration number 54992060. Our address is Naritaweg 131-133, 1043 BS Amsterdam, the Netherlands.

To make sure bunq only processes personal data in line with the relevant laws and regulations, bunq has appointed a Data Protection Officer (DPO). If you still have any questions about the processing of personal data after reading this Privacy & Cookie Statement, you can contact our DPO via privacy@bunq.com. If you want to cancel your bunq account or have any other questions about your bunq account, please contact our support via the bunq app or support@bunq.com.

2. What data does bunq collect

Full Name, Address, Date of Birth:

• Reason for Collection: Identification

• Legal Basis: Legal obligation

1. Email Address, Phone Number, and Other Personal Details:

   • Reason for Collection: Identification

   • Legal Basis: Legal obligation

2. Bank Account Details (Monetary Account Number, IBAN, Sort Code):

   • Reason for Collection: Provision of banking service

   • Legal Basis: Contract performance

3. Card Details (Card Number, Name on Card, Expiration Date, CVV Code):

   • Reason for Collection: Provision of banking service

   • Legal Basis: Contract performance

4. Identification Documents:

   • Reason for Collection: Identification

   • Legal Basis: Legal obligation

5. Biometric Data (Face Scan):

   • Reason for Collection: Identification

   • Legal Basis: Legal obligation

6. Biometric Data (Fingerprints):

   • Reason for Collection: Security

   • Legal Basis: Consent

7. Preferences Data (Language, Public Nickname, Contact Preferences):

   • Reason for Collection: Fraud prevention

   • Legal Basis: Legitimate interest

8. Device Data:

   • Reason for Collection: Fraud prevention

   • Legal Basis: Legitimate interest

9. Bunq Together Data (Login Name, Posts):

• Reason for Collection: Provision of service

• Legal Basis: Legitimate interest

11. Country of Residence, Tax Residency, Tax Identification Number:

• Reason for Collection: KYC (Know Your Customer)

• Legal Basis: Legal obligation

12. Ticket Data (Information shared via Support Tickets):

• Reason for Collection: Provision of service

• Legal Basis: Legitimate interest

13. Data of Other People Affiliated with Your Account:

• Reason for Collection: Provision of service

• Legal Basis: Legitimate interest

14. Activity Data:

• Reason for Collection: Provision of service

• Legal Basis: Consent

15. Budgeting Data:

• Reason for Collection: Provision of service

• Legal Basis: Consent

16. Social Media Data:

• Reason for Collection: Use of publicly available information

• Legal Basis: Legal obligation

17. Register Data:

• Reason for Collection: Verification of presence on legal or financial registers

• Legal Basis: Legitimate interest

18. Sanctions Check:

• Reason for Collection: Verification against sanctions lists

• Legal Basis: Legal obligation

19. Data from Your Friends:

• Reason for Collection: Friends sharing their contact lists

• Legal Basis: Legitimate interest

You share personal data with us when you open a bunq account; use our products and services; contact us via one of our channels or visit our website.

• From public registers; or third parties such as other financial institutions, or public authorities.

• To execute your payments, we may also collect personal data of non-bunq users.

• You are a user of Tricount. Further information can be found at: tricount.com/en/privacy-policy

Opening a bunq account

To open bunq accounts, we can collect and process the following personal data:

• Identity information: First and last name; date, country and place of birth; nationality; gender; 

• Contact and address details: Residential address; telephone number; email address;

• Social security numbers and/or other tax identification numbers including the type of identification document, the issuing date and the issuing institution;

• Counter IBAN;

• Device data (such as type of device, operating system, IP-addresses and advertising ID’s);

• Cookies and usage data on how you use our products and services;

• Correspondence with bunq and support data (telephone, chat conversations and email);

• Additional documentation related to opening an account;

• Picture of an identification document made in the bunq app;

• Video identification data.

Use of the bunq app, websites and other services

While using our app, websites and other services, we can collect and use the following personal data:

• First and last names, phone numbers and email addresses of the contacts in your phone’s address book; 

• Location data via GPS;

• Uploaded images/content;

• Device data of added devices and API-keys;

• Added aliases (bunq.me pages, telephone numbers and email addresses);

• Financial and banking data, product subscriptions and transaction history;

• Cookies and usage data on how you use our products and services;

• Marketing data (statistics related to our marketing campaigns and data to measure this);

• Correspondence with bunq and support data (telephone, chat conversations, email, voice and screen recordings);

• Activity on bunq Together;

• Background location data, if you choose to use our Card Protection feature or Travel Assistant;

• If you enable Finn for activities, we will provide recommendations for your future activities based on your and your friends’ past activities;

• If you enable Finn for budgeting, it will process your transactional and activity data and provide you with personalized insights about you spending habits

• Transactions: If you are a student and you receive a DUO ('studiefinanciering') on your bunq account, we will apply a discount to your Easy Bank Pro account.Background location data is collected only with your active consent, for the purpose of enabling the Card Protection feature (feature that determines whether your card is within a 100km radius of you, allowing you to determine if your card has been stolen) or for enabling a Travel assistant (Localized tips, assisting you in your travel destination).

• Authentication methods based on biometrical data, such as fingerprint scans, are not stored, used or shared in a format that allows us to reproduce the biometrical data.

Minors

We collect and process personal data from minors only with parental consent when they become a bunq user and use our services.

Finn

bunq’s AI bot, Finn,  is involved in processing customer support queries: it can respond directly to questions submitted by users, as well as provide suggestions that bunq support can review and use as a basis for response to the user.  Finn will also answer the bunq user’s questions on their spending, accounts, group expenses, and app activity.

Finn can provide insights in your Activities and Budgeting tabs, if you enable it. Enabling Finn insights leads to processing of your data available in those tabs, as well as data from your bunq account.

Open Banking

You can integrate transaction data and the account balance of your accounts held with (third party) banks or payment institutions into the bunq app. To integrate account data from your other banks with your bunq app, you must give us explicit consent to retrieve your account data from other banks or payment institutions for this purpose, specifying the account(s) to which your request relates. You have to renew this consent periodically. We will then collect the relevant account data on periodic intervals from your other bank(s) or payment institution(s) via electronic transfer during the day and make them available to you in the bunq app. 

You may withdraw your consent to this processing of account data at any time by using the online tool that we provide for this purpose. We will then stop collecting account data with respect to the third party accounts specified by you and delete account data already collected with respect to such accounts as soon as possible. 

3. What is the lawful basis for the processing of my personal data? 

bunq processes your personal data in accordance with the relevant laws and regulations based on several legal grounds.

Legal obligations

We process your personal data to comply with our legal obligations, for example to verify your identity and to share certain data with governmental institutions.

Contract performance

To keep our agreement with you and to provide our services in a well and secure manner, we process your personal data. For example, we need your contact information to keep you informed about relevant developments, and we store correspondence data to improve our customer service.

Consent

Because we value your privacy and we want you to have a choice, we will ask your explicit consent for various features. For example, while using the app you can choose to provide access to your contact list, to upload images/content or to create a public bunq.me link. If you have given consent for a specific feature, you have the right to withdraw consent at any time in the app.

Legitimate interests

We can also process certain data when we have a legitimate interest to do so, for example, to prevent and combat misuse, fraud and crimes, to analyze the use of our products and services for the purpose of improving them, for information and system security purposes or for offering you a better user experience.

4. For what purposes does bunq use my personal data?

We use your personal data to:

• Comply with our legal obligations that follow from any relevant applicable legislation and any provisions issued by the supervisory authorities or judicial institutions;

• Execute agreements with our users, for example for processing payments, production of bunq cards, securing bunq accounts, identification purposes and customer support;

• Learn more about the use of our products and services by conducting analyses for statistical and strategic purposes so we can improve them;

• Carry out and personalize (targeted) marketing activities through different channels and measure their effectiveness, based on your personal circumstances and use of our products and services;

• Prevent and combat misuse, fraud and crimes;

• Enable you to create a Stocks account in your bunq account, if you open one;

• Enable you to open a Credit line in your bunq account, if you open one and if you are eligible for it;

• Ensure the safety and integrity of the financial sector, bunq and our users;

• Training and coaching purposes; 

• Improve our current and future products.

5. Does bunq make automatic decisions based on my personal data?

When you use bunq’s services, automated decisions can be made about you, which will include profiling.

You have the right to request a manual review of automatic decisions. For more information, please take a look at the ‘What are my rights?’ section of this statement.

Automated decisions are made in the following processes:

• Opening an account

Our 5-minute rule is enabled by your application being reviewed and approved/rejected by bunq’s automated system. 

• Fraud detection

Monitoring how our services are used to detect fraud, money laundering, and other crimes and prevent the continuation of misuse of bunq’s services.

• Determining your eligibility to open a a credit line

Opening a credit line requires a check of your credit score via relevant credit bureaus. If you are unable to receive credit as a result of the decision-making based on credit bureau information, you will be informed of that via the bunq app. You can find more information in our Terms & Conditions.

6. Does bunq share my personal data with third parties?

To be able to provide our services, we share certain personal data with third parties. We keep the sharing to a minimum and ensure that these third parties will handle your personal data with the same care as we do. In particular, third parties are required to take appropriate technical and organizational measures to protect your data. This means, among other things, that we sign Data Processing Agreements and that we use the standard contract clauses adopted by the European Commission for personal data protection.

Business Partners

We may share your personal data with our business partners who act on our behalf, or which jointly offer products and services with us. An overview of the third parties or categories of third parties with whom we share data can be found below. Next to this privacy statement, additional privacy statements or policies from these third parties may apply.

• Onfido Limited

To verify your identification document and identity, we use the services of third-party supplier Onfido Limited (Finsbury Avenue 3, EC2M 2PA London, United Kingdom).

• Wise

Wise makes it possible for you to perform one time FX-transactions without having to open a local currency account. If you wish to use the services of Wise in the bunq app, we share your personal data with Wise (56 Shoreditch High St, E1 6JJ London, United Kingdom). 

• TeleSign

In order to verify your identity, we use the services of third-party supplier TeleSign (13274 Fiji Way Suite 600, Marina del Rey, CA 90292, United States). 

• adjust GmbH

To analyze the use of our websites, products and services, and to measure the effectiveness of our (personalized) marketing campaigns, we use technology from adjust GmbH (Saarbrücker Strasse, 10405 Berlin, Germany).

• Mixpanel Inc., Braze Inc. and Looker Data Sciences Inc.

For bringing together and analyzing the personal usage data from various sources, including your use of our websites, products and services and to carry out and measure the effectiveness of our (personalized) marketing campaigns, we use technology from Mixpanel Inc. (405 Howard Street, San Francisco, CA 94105, USA), Braze Inc. (330 W 34th Street, NY 10001, New York, USA) and Looker Data Sciences Inc. (1600 Amphitheatre Parkway, CA 94043, Mountain View, USA).

• AskNicely

In order to receive your feedback and to analyze and improve the usage of our services, we use the technology and services of AskNicely (63 Ponsonby Road, Ponsonby 1011, Auckland, New Zealand). For these purposes, personal data is shared to provide AskNicely’s services.

• Google LLC

To offer you smooth translations (on your request) and OCR related features (such as invoice and attachment scanning), we use the Cloud Translation and Cloud Vision API's from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). We also use Google’s G Suite services, in order to improve the services we offer to you, by enhancing our information security and efficiency. Content will only be stored by Google temporarily (before being deleted) to provide the services, and Google does not claim any ownership of the content nor do they use it for any other purposes except for providing the requested services.

To verify your address, assure your bunq cards arrive at the correct address and for fraud prevention, we also use the services of Google Places API from Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). For these purposes, location and usage data is shared to provide and help improve the services. Further information regarding Google’s data privacy policy can be found at policies.google.com/privacy.

• Google Gemini

To make certain processes more efficient, bunq uses the services of Google Gemini, a generative artificial intelligence chatbot developed by Google. The vendor’s API is used for: document review, transaction monitoring, onboarding, customer support, and allows Finn to be accessible to our users. For more information, see here.

• Mobile payments

To offer you Apple Pay and Google Pay services, we use the technology from Apple Inc (One Apple Park Way, Cupertino, CA 95014, USA) and Google LLC (600 Amphitheatre Parkway, CA 94043, Mountain View, USA). When you decide to use these services, please take notice of the separate terms and conditions with regard to data sharing.

• MaxMind

To verify your location, assure your bunq cards arrive at the correct address and for fraud prevention, we use the technology of MaxMind (14 Spring Street, MA 02451, Waltham, USA). For these purposes, location, usage data and your e-mail address is shared to provide and help improve the services.

• Cash Payment Solutions

To offer you the services of Cash Payment Solutions to be able to deposit and withdraw cash at various locations where available, we use the services of Cash Payment Solutions GmbH (Wallstr. 14a 10179 Berlin, Germany). For these purposes, data is shared such as location data in order to show you their nearest locations.

• Currence

For the use of the online identification tool 'iDIN' we use the services of Currence (Gustav Mahlerplein 33-35, 1082 MS Amsterdam, The Netherlands). Certain personal information is shared for the purpose of verifying your identity.

• TapiX

In order to offer you the bunq features Insights and Subscriptions, we make use of the services of Tapix (Dateio s.r.o., Impact Hub Praha, Drtinova 10, Praha 5 – Smichov, Czech Republic). For these purposes, anonymized payment information is shared, for TapiX to enrich your transactions with details about your payment and to offer you with an overview of all your subscriptions.

• Vonage

In order to offer you the ‘SOS’ feature, which can be found on bunq.com/contact,  we need to record and transcribe your conversation with us. To help us with this, we use the services of Vonage (Nexmo Inc., 23 Main Street, Holmdel, NJ 07733 USA). Your personal data is only processed if you make use of this service.

• Birdee

When you make use of Easy Investments, you are making use of the services of Birdee (Birdee S.A., 59 Boulevard Royal, L-2449 Luxembourg, birdee.co). In order to offer you our and their services, we are required to share certain data with Birdee.

• Externe Verwijzingsregister (EVR)

When you want to open a bunq account, we check your details against the EVR. We may also include your details in this register in case we have a reasonable ground to believe that your bunq account is being used for fraudulent activities. More information about the EVR can be found here: together.bunq.com/d/55920 

• Incode

To verify your identification document and identity, we use the services of third-party supplier Incode (221 Main St Ste 520 San Francisco, CA, 94105-1983 United States). The party process biometric information, allowing bunq to meet its customer identification obligations under Anti-Money Laundering law. 

Furthermore, bunq has engaged Incode agents for purposes of user review at onboarding. Their privacy policy can be found here: incode.com/privacy-policy/. 

• CHEQ

To ensure that bots and other forms of fake traffic do not affect your experience of using our website, we use the services of CHEQ AI Technologies Ltd (23 Yehuda HaLevi Street, Tel Aviv 65136) to block such traffic. The Privacy Policy of CHEQ can be found here: cheq.ai/privacy-policy/. 

• Sardine

To counter fraud and money laundering, as well as to conduct risk checks, we use the services provider Sardine (382 North East 191st Street, Miami, sardine.ai/). By sharing your behavioral data with Sardine, we strengthen our efforts to counter money laundering and fraud. 

For fraud prevention purposes only,  Sardine will:

(1) collect your Battery Usage, Device Identifier, Device Storage, MAC Address, and SIM information; 

(2) collect enough information to determine if you are trying to fake your current location by using a VPN, VPN apps with location spoofing, or other related tools.

• Microsoft Azure

To make certain processes more efficient, bunq uses the services of Microsoft Azure OpenAI (Redmond, One Microsoft Way, United States, azure.microsoft.com). The vendor’s API is used for: document review, transaction monitoring, onboarding, customer support, and allows Finn to be accessible to our users.

• Checkout.com

To allow you to top up your bunq account using debit and credit cards, bunq has partnered with Checkout.com (London, N1, 1 Shepherdess Walk, United Kingdom). You can access the privacy policy of Checkout.com here: enterprise.craft.co/privacy. 

• Barzahlen

Users residing in Austria or Germany have an option in the bunq app called “Withdraw & Deposit” provided through bunq’s partnership with Barzahlen. You can find Barzahlen’s privacy policy here: barzahlen.de/privacy-notice

• Adyen

Adyen (Simon Carmiggeltstraat 6-50, Amsterdam, Noord-Holland, 1011DJ) is a Payment Service Provider that processes payment transactions of bunq users. Adyen’s privacy policy can be accessed here: adyen.com/policies-and-disclaimer/privacy-policy.

• Stocks services

To provide bunq users with the ability to invest in stocks and exchange-traded funds (ETFs), we use the services of Ginmon (broker) and Upvest (custodian). When you choose to use the Stocks product, you will accept the privacy statements of these parties and be subject to both processing and controllership of these parties. bunq will share your data with Ginmon and Upvest to facilitate the creation of your account, transactions to purchase stocks, and other functionalities.

• Algoan

To check your eligibility for opening a credit line, we share your data with Algoan (Morning, Laffitte, 34 Rue Laffitte, 75009 Paris, France), a credit decision-making platform. They perform automatic decision-making using your data, if you apply for a credit line, to determine your eligibility for the credit limit you are applying for.

• Taktile

To determine your eligibility for opening a credit line, we share your data with Taktile (Schönhauser Allee 9, 10119 Berlin, Germany), a credit decision-making platform. The platform allows bunq to determine if you are eligible to receive credit and to pull data from credit bureaus.

• Experian

The German credit bureau collects German user’s personal data and shares it with bunq upon their onboarding, to determine the user's debt and bankruptcy status. The API connection is performed through Taktile, described above.

• Other parties

  • Parties for producing and delivering bunq cards;

  • Email, marketing and ad services and social media platforms for managing and executing service emails, direct marketing emails, setting up marketing campaigns and helping us track usage of our website;

  • If you grant bunq access to your phonebook, the existing bunq users in your phonebook will receive a notification that you became a bunq user;

  • SMS providers for sending SMS messages;

  • (Outsourced) customer support services;

  • Financial institutions for processing transactions and safeguarding the safety and integrity of the financial sector;

  • Notaries for helping you set up your company;

  • Legal consultants or auditors for complying with our own legal obligations and for any legal claims;

  • We may share your personal data with other bunq entities and branches. We may do so to provide and improve our services to you and to enable us to comply more efficiently with the applicable laws.

A data processing agreement or equivalent agreements has been signed with each of the ‘Other parties’ listed above. If they are located outside the EU, the standard contractual clauses provided by the European Commission have been signed.

Governmental, supervisory and judicial institutions and authorities 

To comply with laws and regulations or based on legitimate interest we can share data with public authorities, regulators, tax authorities and judicial or investigative authorities. For example, we may have to submit anti-money laundering reports to the FIU and the Tax Authorities can request financial data and we can share data with the Dutch Central Bank for participating in the Deposit Guarantee Scheme. Next to this, bunq can have a statutory or legal obligation to share personal data with investigating authorities to prevent and combat misuse, fraud and crimes. 

To help protect the banking system and to assist you in filing your tax returns, we also share your tax information number and the description of your sub accounts with the Tax Authorities.

What is scraping and how can I protect myself?

While we take extensive measures to safeguard your personal information, please note that data transmission over the internet is not completely secure. Although we strive to protect your data, we cannot guarantee the absolute security of any information transmitted to or stored on our systems, and you share your data at your own risk. Once we receive your data, we implement strict protocols and security measures to help prevent unauthorized access.

Additionally, depending on your account settings, certain personal information—such as your username, profile photo, and contact details—may be visible to other users or third parties to facilitate services. Always review and update your settings to control the information you share.

7. How long does bunq store my data? 

We process and store your data as long as you remain a bunq user. ​​We only keep your data for the time necessary to fulfill the purpose of collection. You may request us to close your account at any time and delete your data after account closure. We may retain certain data after account closure due to legal or regulatory requirements. 

We are able to store personal data for longer periods with a valid legal ground, or when the data is sufficiently pseudonymised or anonymised.

8. What are my rights?  

Below we have outlined the rights the GDPR grants you and what this means for you in the context of your activities with bunq. If you would like to invoke any of these rights, please send the request to privacy@bunq.com.

Right to Be Informed (Article 13 & 14 of GDPR):

• What it means: You will be provided with all necessary information about the collection and processing of your personal data, as required by the GDPR.

1. Right to Access Your Personal Data (Article 15 of GDPR):

   • What it means: If you file a data access request, the company will provide you with a copy of your personal data that is being processed.

2. Right to Request Deletion of Your Data (Article 17 of GDPR):

   • What it means: Upon request, the company will delete the personal data it has collected about you, unless there are legal reasons to retain it.

3. Right to Rectify Incorrect Data (Article 16 of GDPR):

   • What it means: You can request corrections to any incorrect or incomplete personal data the company holds about you.

4. Right to Object to Processing of Your Data (Article 21 of GDPR):

   • What it means: You can object to the processing of your personal data when it's based on legitimate interest or public interest. The company will then stop processing unless there are compelling legitimate grounds.

5. Right to Restrict the Processing of Your Data (Article 18 of GDPR):

   • What it means: You can request a restriction on the processing of your data. This means the company will store your data but stop processing it under certain circumstances.

6. Right Not to Be Subject to Automated Decisions (Article 22 of GDPR):

   • What it means: You have the right to avoid being subject to decisions made solely by automated processes, including profiling. A manual review of such decisions can be requested.

7. Right to Lodge a Complaint with a Data Protection Authority (Article 77 of GDPR):

   • What it means: You can file a complaint with the relevant data protection authority, such as the Dutch Supervisory Authority (Dutch DPA), if you believe your data rights have been violated.

9. Revoking consent & limiting access  

Direct marketing

If you do not want your data to be used for direct marketing activities, you can let us know via the bunq app anytime. Additionally, our communication via email also always contains the possibility to unsubscribe from these messages.

GPS and access to your contact list

While using the bunq app, you can provide permission to your contact list and to process location data (for the car protection function). If you no longer want us to use location data, or if you no longer want to provide access to your contact list in the bunq app, you can easily revoke these permissions by going to Settings in your bunq app. You will find the settings for the bunq app at the settings for installed apps on your device. You can revoke provided permissions at any given moment.

Uploaded images/content

Images and content that you use to personalize your bunq account or improve your app experience are processed by bunq and can be easily changed within the bunq app.

Public bunq.me profile

When you create a public bunq.me profile, your nickname and IBAN are visible for anyone that visits your public bunq.me profile for making payments. You can deactivate your bunq.me page with the accompanying data at any given time via the bunq app.

Phone number, email aliases and Easy Bank Pro XL Plan

At signup we connect your phone number and email address to your bunq account as aliases. This allows other bunq users to easily and safely transfer money to your bank account(s), as your bunq account (and IBAN) will show up in their contact list if they have added you to their phone contact list with your phone number and/or email address. The processing of your aliases for these purposes is based upon bunq’s legitimate interest since this feature makes banking easier and helps to prevent fraud and misuse. Furthermore, it gives bunq users certainty that money is transferred into the correct account. You can easily disconnect aliases from your bank account(s) and thereby opt-out from the processing of your aliases for these purposes via the settings of the selected bank account.

We will also show other bunq users on Together and in the app that you are on an Easy Bank Pro XL Plan. You can turn this feature off in the settings section of your account.

Cookies

For more information on how to block cookies, please see our Cookie Statement.

Recommendations and Activities

To offer you bunq Recommendations, we will share certain information with other bunq users who have you in their contact list.

Users who have your alias (see above) in their contact list will be able to see your recommended places, public nicknames and public avatars.

Sharing these data under Places will only take place after you’ve given us your consent to do so. You can revoke your consent at any moment via the bunq app.

10. Changes to the Privacy & Cookie Statement

We are always improving and expanding our products and services. This might cause our data processing to change. When we change something, we will adjust our Privacy & Cookie Statement accordingly. You can always find the latest version on our website and in the app.

11. Complaints 

If you have a complaint about the data processing by bunq, you can contact our Data Protection Officer via privacy@bunq.com. 

In case you disagree with the handling of your complaint, you can file a complaint at the Autoriteit Persoonsgegevens.