NOTICE ON THE PROCESSING OF YOUR PERSONAL DATA THROUGH THE “PAYZY” APPLICATION (Data Privacy Notice)

Last update of terms: 15.05.2026
The update concerns the data used for registering a User in the Application.

1.    Introduction
The company under the name COSMOTE PAYMENTS - ELECTRONIC MONEY SERVICES SINGLE-MEMBER SOCIETE ANONYME, which has its registered office in 151 24 Maroussi, Attica (99 Kifissias Avenue), (hereinafter COSMOTE PAYMENTS or Company) considers the protection of your personal data particularly important and complies with the principle of transparency regarding their processing. If you wish to be informed in general about the processing of your personal data by COSMOTE PAYMENTS, please read the text of the Personal Data Privacy Policy, which you can find here.
Through the “payzy” application (hereinafter Application), various services are provided (hereinafter Services), which are described in detail in the corresponding Terms and Conditions of Use of the Application. Prerequisite for the use of the Application is the registration of the User in the Application for the provision of electronic money and payment services provided by COSMOTE PAYMENTS, and the authentication of the User by COSMOTE PAYMENTS.
With this Data Privacy Notice, we would like to inform you on the processing of your personal data during the use of the Application and the Services.
These terms constitute part of the Terms and Conditions of Use of the ‘payzy’ Application and must always be interpreted in conjunction with them and form a single whole.
If the use of a Service, which is provided through the Application, is regulated by separate terms regarding the processing of personal data, the latter shall be considered as a whole with these terms but shall take precedence over them if they regulate differently the same issue.

2.    What are the identity and contact details of the personal data controller?
Personal data controller is COSMOTE PAYMENTS, which you can contact by email at customerprivacy@cosmotepayments.gr.

3.    What categories of personal data do we collect and process during the use of the Application and the Services and for which purpose

3.1    For your registration and use of the Application, as well as for the use of the Services provided through it, we process your personal data with the purpose of execution of the agreement between us (Article 6(b) of GDPR), and specifically:

3.2    
3.2.1    For the User Registration in the App, the following are used: 
a. email address and mobile phone number, and
b. full name, date and place of birth, residential address, employment status, the number and details of the identification document (identity card/passport and residence permit),
c. your answers to a special questionnaire, which includes information regarding the purpose and the estimated annual amount of use within the Application, the declaration of whether you are a Politically Exposed Person (PEP) as this status is defined by law, your main source of income and the amount,
d. in special cases, proof of your income such as a pay slip or profit-loss statement may also be required. 
In order to achieve the electronic remote identification of your data, COSMOTE Payments may process, if you consent, data concerning:
• the recording of your visual and audio communication with our representative in real time via video call.
• the biometric characteristics resulting from recording your dynamic selfie to verify the photo in your identification document using special software without the presence of our representative. In case you do not consent to the use of biometric data, electronic remote identification is carried out via a video call with a representative.

Read the text with which the relevant consent is provided here.

3.2.2    For the execution of transactions through the “Wallet” Service (e.g., cash-in/cash-out of payment account, the execution of card transactions, the display of balance of payments and the display of history of transactions), the Application shall process the following data: 
•    Details such as number of individual payment account at COSMOTE PAYMENTS, bank account number (IBAN) at COSMOTE PAYMENTS and/or with a third bank, time, beneficiary, transaction amount, means of payment.
•    Details of payment cards for cash-in/cash-out of the payment account.
•    Details of payment cards for their use as means of payment on the Application.

3.2.3    For the use of “Chat & Pay” Messages Exchange Service (hereinafter Chat & Pay) and specifically the communication between Users of the Application and the transfer of electronic money from the payment account of a User of the Application to the payment account of another User of the Application (credit):
•    Data for the operation of Chat & Pay: full name, e-mail address, mobile phone number, profile photo, nickname, payment account number (IBAN), User dialogues at COSMOTE PAYMENTS.

3.2.4    For your participation in the “Coins” Loyalty Program: 
•    Number of your personal debit card provided by COSMOTE PAYMENTS, history of payments you have made using your personal debit card provided by COSMOTE PAYMENTS, number of reward points you have collected and redeemed, number and balance of payment account (IBAN) at COSMOTE PAYMENTS.

3.2.5    For the use of the “Split It” Expenses Sharing Service (hereinafter Split It): 
•    Data for your participation in a Split It Expenses Sharing Group: full name, e-mail address, mobile phone number, profile photo, nickname.
•    Data for the settlement of transactions in the context of your participation in a Split It Expenses Sharing Group: payment account number (IBAN) at COSMOTE PAYMENTS.

3.1.6    For the use of the “Piggys” Personal Safe Service (hereinafter Piggys): 
•    Payment account number (IBAN) at COSMOTE PAYMENTS, myVault payment account number at COSMOTE PAYMENTS, number of your personal debit card provided by COSMOTE PAYMENTS, history of payments you have made using your personal debit card provided by COSMOTE PAYMENTS.

3.1.7    For the use of the “Cards” Card Issue and Use Service, and specifically for the application for the issue and dispatch of payzy debit card in virtual form: 
•    Identity card details, payment account number (IBAN) at COSMOTE PAYMENTS, number of your personal debit card provided by COSMOTE PAYMENTS, history of payments you have made using your personal debit card provided by COSMOTE PAYMENTS.

3.1.8    For the Verification of Payee – VoP: name, surname, Payment Account number (IBAN).

Moreover, aiming at your best service and the resolution of problems you might face while using the Services and the Application, we shall process: data resulting from the registration, activation and use of the Services and the Application, identity details, type, model and features of your device, connection details, details from your communication with us (e.g. contact telephone number and availability for your communication with a representative, recording of your conversation with our representative, detailed recording of the problem, etc.), transaction details, as well as other details that you disclose to us in order to investigate queries, complaints, challenges of charges, etc.

3.3    Based on your consent (Article 6(1) (a) of GDPR), we shall process your personal data with the purpose of providing specific functionalities of the Application. Specifically, based on your consent, we shall process:

3.3.1    Data with the purpose of identifying who of your contacts are holders of a payment account at COSMOTE PAYMENTS: Data of your contacts on the terminal device on which the Application is installed. Provided that you have given your consent, the other users of the Application and holders of a payment account at COSMOTE PAYMENTS will be able to search you in order to communicate with you through the Application. Depending on your preference, there shall be three alternative choices based on which other users of the Application may search you. In any case, you will be able at any time to select the choice you wish through the Application in the account settings and specifically settings -> security settings -> who will be able to search for my profile?
•    Available for search by all users of the Application: all users of the Application and holders of a payment account at COSMOTE PAYMENTS will be able to search you either by your full name or by e-mail address, nickname, or mobile phone number you have submitted during your registration and authentication at COSMOTE PAYMENTS.
•    Available for search only by users of the Application who have the contact number you have submitted during your registration and authentication at COSMOTE PAYMENTS stored in the contact data of their terminal device: only the users who, at the same time, have the contact telephone number you have submitted during your registration and authentication at COSMOTE PAYMENTS stored in the contact data of their terminal device will be able to search you, either by your full name or by e-mail address, nickname, or mobile phone number you have submitted during your registration and authentication at COSMOTE PAYMENTS.
•    Not available for search: your account shall remain hidden from all other users of the application and no user will be able to search you in order to communicate with you through the Application.

3.3.2    For your participation in the “Bring Along Friends” promotional action: 
•    Data for checking the conditions of your participation in the “Bring Along Friends” promotional action: full name, identity card details, number and statement of account (IBAN) at COSMOTE PAYMENTS.
•    Data resulting from the participation in individual promotional actions: history of participation, total reward amount, details of your success (e.g. list of friends registered in the application), number and balance of payment account (IBAN) at COSMOTE PAYMENTS.

3.3.3    The application enables the storage of your payment card (debit / credit / prepaid), so that a new entry of the card is not required for each transaction. For the protection of payment cards data and for the security of transactions, a tokenization process of payment card numbers is applied. Payment card data are stored in a secure environment of COSMOTE PAYMENTS.

3.4    Based on our legitimate interest (Article 6(1) (f) of GDPR), we shall process your personal data with the purpose of:
Receipt of news and notifications: for direct marketing of our products and services, COSMOTE PAYMENTS may process a limited range of your data, and those data included in your agreement, aggregated details of use and/or requests that you have submitted to us. Such processing shall be limited and shall aim exclusively to the submission of proposals, offers, news and notifications on related products and/or services. You have the right to object to communication from the settings of the Application and specifically settings -> terms of use and personal data -> individual profile and personalization -> news and notifications.
COSMOTE Payments may process your data for the purpose of conducting surveys to assess customer satisfaction or to evaluate our specific products or services. These surveys are usually in questionnaire form and may be provided to you by email, SMS, the Company’s applications, an Interactive Voice Response (IVR) system or by phone. They may also be carried out by an external partner. Your participation in these surveys is particularly important to us, as your responses help us improve our products and services. You nevertheless have the right to object to being contacted for surveys as mentioned in Chapter 10 below.

4.    Trackers / Cookies
Cookies are small files stored on the user’s computer or mobile device and are placed by websites that they visit and/or mobile applications they use, in order to recognise them. In addition to cookies, there are other trackers, such as pixels (e.g. Facebook Pixel), local storage, third-party SDKs included in mobile applications, etc. Trackers store or acquire information or gain access to information which is stored in the user’s terminal equipment (computer, mobile phone, etc.). Such trackers are used by COSMOTE PAYMENTS for better operation and improvement of Yzy Bot, acquiring access to search details in Yzy Bot (questions, tags, keywords, etc.), feedback details (e.g. navigation to service articles).
You can be informed on the categories of cookies / trackers we use and manage your choices through the application and specifically from the menu settings -> terms of use and personal data -> management of trackers.

5.    Permissions of the Application
The operation of the Application and the provision of the Services through the Application presupposes the installation and use of the Application, which, depending on the operating system in which it is installed, may require, or request optional permission to the following data of your terminal device:
•    Data of your contacts: with the purpose of identifying which of your contacts are also Users of the Application and holders of a payment account at COSMOTE PAYMENTS.
•    Location data (GPS): with the purpose of indication of your location on the map and your information on offers in stores near you.
•    Camera: use of camera for creating your profile photo, as well as of the profile photo of groups you create within the Application (e.g. within the provision of the Split It Service).
•    Storage space: permission shall be required for the storage of PDFs of quarterly settlement statements regarding the transactions and payment acts of your payment account, including those through your card, analyses, receipts of payment, for the alternative method of selecting your profile photo, as well as for the alternative method of selecting the profile photo of the groups you create within the Application (e.g. within the provision of the Split It Service).
•    Internet: the application requires access to the internet in order to communicate with the systems of COSMOTE PAYMENTS and display the information concerning you (e.g. connection details, account details and others).

6.    Display of push notifications
The payzy Application sends notifications to your device in order to:
•    inform you or/and complete the transactions (e.g. for the execution of payment services),
•    notify you on messages you receive through the Chat & Pay Service,
•    receive promotional messages and news, provided that you have not requested to be exempted from them either upon registration or through the settings in section “Communication Settings”,
•    receive personalized suggestions and offers based on your personal profile, provided that you have given your consent (section “Communication Settings”).
If you wish to opt out of receiving any notifications, you can change your selections in the device settings.

7.    For how long do we retain your personal data?
If you delete your account in the Application, your data (e.g. interactions with other Users, chat discussions) will be deleted within 90 days in a manner that their retrieval will not be technically feasible or they will be anonymized.

8.    Will COSMOTE PAYMENTS process your personal data for other purposes as well?
COSMOTE PAYMENTS will not process your personal data for other purposes except for those mentioned above. In case COSMOTE PAYMENTS wishes to use your personal details for other purposes, it will do so only after you have been informed, and it has received your explicit consent.

9.    Who are the recipients and why are personal data transferred to them?
Recipients of your personal data can be:
Third-party companies with which we are cooperating for the provision and support of the Application, as well as of the Services provided through it. Specifically:
•    the company COGNITY S.A. with registered office in Greece, which supports the operation of the Application.
•    the company OGILVY ONE WORLDWIDE - ATHENS PROMOTION, ADVERTISING AND DIRECT MARKETING S.A. with registered office in Greece, which provides advertising and supporting services.
•    NEXI GREECE PROCESSING SERVICES SINGLE-MEMBERS.A. with registered office in Greece, which provides payment processing and card issuing services.
•    NETCOMPANY-INTRASOFT S.A. with registered office in Greece, which provides and supports the operation of the banking systems of COSMOTE PAYMENTS.

In these cases, such third-party companies are processors on behalf of COSMOTE PAYMENTS, that is, partners of COSMOTE PAYMENTS who undertake the performance of a specific project following our instructions and applying the strict procedures of OTE Group regarding the processing of your personal data. In these cases, COSMOTE PAYMENTS shall continue to be responsible regarding the processing of your personal data.
The processing of your personal data for the above purposes by our partners shall be conducted mainly within Greece and the European Union (EU). In case we cooperate with companies outside the EU, they will process your data only by our order and if there is an adequacy decision of the European Commission or appropriate clauses that ensure high level of security in relation to the processing of your personal data are agreed.
Except for the abovementioned companies, COSMOTE PAYMENTS shall not process and shall not disclose your personal data to third parties except in the cases where their disclosure/transfer is imposed by the applicable legislation.

10.    What are your rights as user of the Service regarding the processing of your personal data?
The rights you can exercise include:
•    Right of access: You have the right to be informed in relation to your personal data being processed by us (e.g. the purposes of processing, types of data, recipients to whom they are disclosed, the period for which they are retained) and to provide you with copies thereof.
•    Right to rectification: You have the right to request the rectification of your data (e.g. correction of address, contact details).
•    Right to erasure: You have the right to request the erasure of your personal data in case they are no longer necessary in relation to the purposes for which they were processed or in case you have withdrawn the basis on which we collected and processed them.
•    Right to restriction of processing: You have the right to request the restriction of processing for a specific reason (e.g. in case you do not wish to receive notifications in your e-mail for marketing purposes).
•    Right to data portability: You have the right to receive your personal data you have provided to the company, in a structured, commonly used format which has also a readable form.
•    Right to object the processing of your personal data in the cases you do not wish the processing of your personal data.

In order to exercise your rights, you can:
•    Send an email to customerprivacy@cosmotepayments.gr accompanied by a copy of your identity card and indicating your full name and the connection number of your mobile or fixed-line phone.

In case you consider that we have not adequately satisfied your request and that the protection of your personal data is affected in any way, you can file a complaint through a special web portal to the Hellenic Data Protection Authority (Athens, 1-3 Kifissias Avenue, PC 115 23, phone +30 210 6475600). Detailed instructions for the filing of a complaint are provided on the website of the Authority.
COSMOTE PAYMENTS will reply free of charge to your requests, within one month from the receipt of the request. In exceptional cases, such deadline may be extended for two (2) months if this is required due to the complexity of your request. In any case we will inform you on such extension and on the reason of delay.
If we find that your request is manifestly unfounded or excessive, we retain the right to request the payment of a reasonable fee for its satisfaction, considering the administrative costs for its execution, or even to refuse to further process your request.
If you wish to address a question regarding the processing of your personal data to COSMOTE PAYMENTS or exercise any of your rights, please consult the Data Protection Policy of COSMOTE PAYMENTS, which is available here.

11.    What kind of measures are applied for the protection of your personal data?
At COSMOTE PAYMENTS we provide for the appropriate technical and organizational measures in our corporate procedures, and we apply them in information systems and platforms used for the collection, processing, or use of data.
These are, without limitation:
•    Measures for the prevention of access to data processing systems by unauthorized persons (check of login authorization).
•    Measures ensuring that unauthorized persons cannot use data processing systems (check of denial of access).
•    Measures ensuring that the persons who are authorized to use the data processing systems have access exclusively to data for which they have been authorized, and that personal data cannot be transferred, copied, modified, or deleted by unauthorized persons during their processing, use or following their recording (check of access to data).
•    Measures ensuring that during electronic transfer, or during transfer or recording, personal data cannot be transferred, copied, modified, or removed by unauthorized persons and that the processors to whom personal data have been transferred through data transmission equipment may be determined (check of data transfer).
•    Measures ensuring that it is possible to examine and determine retroactively if and by whom personal data has been entered, altered, or deleted in the data processing systems (check of data entry).
•    Measures ensuring that personal data processed by third parties/contractors shall be processed only according to our instructions (check of contractor).
•    Measures ensuring that data collected for different purposes can be processed separately (separation rule).