GDPR Privacy Policy for UK and European Economic Area (EEA)

VeriFone, Inc. and its direct and indirect parent and subsidiary companies listed here (collectively, "Verifone", "Company", or "We") act as data controllers where they determine the purposes and means of processing personal data. We are committed to safeguarding your personal data.

This Privacy Notice ("Notice") explains what personal data we collect, why we collect it, and your rights.

Scope

This Notice applies to individuals in the European Economic Area (EEA) and the United Kingdom who visit Verifone websites, are merchants or prospective customers, or interact with us in a business capacity.

Processor vs Controller Clarification

If you are a merchant using Verifone services, or a shopper or cardholder making a payment through a merchant that uses Verifone technology, please note that Verifone typically acts as a data processor on the merchant's behalf. You should contact the merchant to exercise your rights. Verifone will assist the merchant in responding to such requests in accordance with applicable law.

However, where payment services are provided by Verifone Payments UK, Verifone Finland Oy, Verifone Payments GmbH, or Verifone Payments B.V., those entities act as independent data controllers. In such cases, the applicable privacy notice for those services is available here.

Personal Data We Collect

Information you provide

We collect personal data when you:

• communicate with us (e.g., by email, phone, or other channels);
• request information, quotations, support, or downloads;
• purchase or use our products, services, or solutions;
• create, access, or manage an account;
• register, activate, or use a device (such as a payment terminal);
• apply for financing, credit, or other commercial services;
• register for or participate in events, webinars, surveys, or promotions;
• subscribe to newsletters or other communications; or
• visit or interact with our websites.

Data categories may include:

• identity data (name);
• contact details (postal address, email address, telephone number);
• professional information (e.g., job title, employer);
• account credentials;
• financial data (e.g., credit or payment card number, bank account number, billing address — limited to what is necessary for the relevant service); and
• identification data (e.g., photo ID, passport, or national ID — where required for legal or compliance purposes such as AML/KYC).

Information we collect automatically

We collect technical data such as:

• IP address;
• browser/device data;
• usage data.

We use cookies and similar technologies to collect and analyse technical and usage data. Where required, we obtain your consent for non-essential cookies via our cookie preference tool. For more detailed information, including the types of cookies used, their purposes, and how to manage your preferences, please see our Cookie Policy here.

Information from third parties

We may receive personal data from resellers, partners, or service providers, where legally permitted. The types of information received may include contact details, billing information, and delivery details.

How and Why We Use your Personal data

We process personal data for the following purposes and on the following legal bases:

Where we rely on legitimate interests as the legal basis for processing, we have conducted a balancing assessment and are satisfied that our interests are not overridden by your rights and freedoms. You may request further information about those assessments by contacting us at privacy@verifone.com.

We may use data in anonymized or aggregated form for analytics and improvement purposes. Such data does not identify individuals.

Information Sharing

We may share personal data with:

• group companies, for the purposes described in this Notice;
• service providers acting as processors under contract (e.g., IT, logistics, fraud prevention, debt collection, couriers, contract manufacturers);
• independent controllers (e.g., resellers, distributors, regulators, or professional advisors); and;
• authorities where required by law (e.g., law enforcement, regulatory agencies, courts), or to exercise, establish, or defend legal claims.

We may also disclose personal data in connection with any proposed or actual purchase, merger, reorganization, acquisition, dissolution, or liquidation of any part of our business, subject to appropriate confidentiality obligations.

Security

We implement appropriate technical and organizational measures, including:

• access controls;
• encryption in transit and, where applicable, at rest; and
• monitoring and incident response procedures.

No transmission over the internet is entirely secure. While we take reasonable steps to protect your personal data, submissions made via the internet are at your own risk.

Data Retention

We retain personal data only as long as necessary for the purposes described above. Retention periods are determined based on:

• contractual requirements;
• legal obligations (e.g., financial records retained for up to seven years); and
• dispute resolution and enforcement needs.

Once the applicable retention period has expired, we will delete or anonymize your data.

Your Rights

You have the right to:

• access your personal data;
• correct inaccuracies;
• request deletion (erasure);
• restrict processing;
• object to processing (including the right to object at any time to processing for direct marketing purposes);
• data portability (where processing is based on contract or consent and carried out by automated means);
• withdraw consent at any time (without affecting the lawfulness of prior processing); and
• lodge a complaint with a supervisory authority.

To unsubscribe from marketing communications, click the "unsubscribe" link in any marketing email we send you, or contact us at privacy@verifone.com.

To exercise any of the above rights, please contact us at privacy@verifone.com or complete the online request form available here. We may verify your identity before processing your request.

Complaints

If you believe your data protection rights have not been observed, you have the right to lodge a complaint with your local Supervisory Authority. For example:

• UK: Information Commissioner's Office (ICO)
• EU: your local Data Protection Authority

We would, however, welcome the opportunity to address your concerns directly before you approach a supervisory authority. Please contact us at privacy@verifone.com in the first instance.

International Transfers

Your personal data may be transferred to, and processed in, countries outside the EEA or UK that may have different data protection standards. Where this occurs, we rely on one or more of the following safeguards:

• European Commission adequacy decisions;
• Standard Contractual Clauses (SCCs) adopted by the European Commission;
• UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs; or
• other lawful transfer mechanisms as permitted under applicable law.

We implement appropriate safeguards to ensure your personal data remains protected. Further details can be provided upon request.

Third-Party Links

Our websites may contain links to third-party sites not operated by Verifone. We are not responsible for the content or privacy practices of those sites and encourage you to review their privacy notices.

Updates

We may update this Notice from time to time. You can see when this Notice was last updated by checking the "Last Updated" date at the top.

Contact

If you have any questions about this Privacy Notice or how your data is handled, please contact:

VeriFone, Inc.

c/o Corporation Service Company

251 Little Falls Drive

Wilmington, DE 19808

USA

Attn: General Counsel

Email: legalnotices@verifone.com

Privacy inquiries: Privacy@verifone.com