v6.0.0
Published on June 9, 2026Klarna’s Privacy Notice
It is important to us that you feel safe when you pay with Klarna or use any of our other services. Therefore, we are providing all the information about how we use your personal data in this privacy notice.
1. Who is responsible for your personal data?
Klarna Bank AB (publ), registered with the Swedish Companies Registration Office under company number 556737-0431 and with registered office at Sveavägen 46, 111 34 Stockholm also active through its branches (“Klarna”, “we”, “our” or “us”), is the data controller of your personal data in accordance with the EU Data Protection Regulation (the “GDPR”). If you have any questions regarding the processing of your personal data, please contact our data protection team by writing to support.eu@klarna.com.
2. Your data protection rights as a data subject
You have several rights under the GDPR related to you having control of your personal data and to receive information directly from us on how we process personal data about you. In the following you can read about your rights. If you want to receive information about the data Klarna holds about you through so-called subject access, have certain data deleted or come in contact with us to exercise your other rights, the easiest way is to log into your Klarna account and make your request from there. You can also find our contact details in section 12 for other questions.
Your rights
Right to have personal data deleted (“Right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. For example, you can request us to delete personal data that we (i) no longer need for the purpose it was collected for, or (ii) process based on your consent and you revoke your consent. There are situations where Klarna is unable to delete your data, for example, when the data is still necessary to process for the purpose for which the data was collected, Klarna’s interest to process the data overrides your interest in having them deleted, or because we have a legal obligation to keep it. You can read more about our legal obligations to keep data in section 4 and 9 in this Privacy Notice. The laws described there prevent us from immediately deleting certain data. You also have the right to object to us using your personal data for certain purposes such as direct marketing, which you can read more about in this list of your rights.Right to be informed.
You have the right to be informed of how we process your personal data. We do this through this privacy notice, by service-specific FAQs, and by answering your questions.Right to receive access to your personal data (“Data Subject access”).
You have the right to know if Klarna processes personal data about you, and to receive a copy (“data extract”) of such data, so-called data subject access. Through the data extract you will receive information about what personal data Klarna holds about you and how we process it.Right to access, and request a transfer, of your personal data to another recipient (“Data portability”). This right means that you can request a copy of the personal data relating to you that Klarna holds for the performance of a contract with you, or based on your consent, in a machine-readable format. This will allow you to use this data somewhere else, for example to transfer your personal data to another controller/recipient.
Right to rectification.
You have the right to request that we rectify inaccurate information or complete information about you that you consider is inaccurate or incomplete.Right to restrict processing.
If you believe that your personal data is inaccurate, that our processing is unlawful or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. You also have the possibility to request that we stop processing your personal data while we assess your request. If you object to our processing per your right described directly below, you may also request us to restrict processing of that personal data while we make our assessment.
Right to object against our processing of your personal data.
You have the right to object to processing of your personal data which is based on our legitimate interest (Article 6(1)(f) GDPR), by referencing your personal circumstances. You can also always object to our use of your personal data for direct marketing purposes. When you let us know that you no longer wish to receive direct marketing from us, we will turn off marketing for you, and stop sending it to you.
Right to object to an automated decision that significantly affects you.
You have the right to object to an automated decision made by Klarna if the decision produces legal effects or significantly affects you in a similar way. See section 6 on how Klarna makes use of automated decisions.Right to withdraw your consent.
As described in section 5 below, where we process your personal data based on your consent or explicit consent, you have the right to revoke that consent at any time. When you revoke your consent we will stop processing your data for such purposes.
Right to lodge a complaint.
If you have complaints about Klarna’s processing of your personal data, you may lodge a complaint with Integritetsskyddsmyndigeten, which is the Swedish supervisory authority for Klarna’s personal data processing. You can reach Integritetsskyddsmyndigeten through the following link. You may also lodge a complaint with your national data protection authority, which you can find listed here.
Settings in the Klarna mobile application: In the Klarna mobile application, Klarna provides you with the functionality to tailor your preferences for certain services, such as current notifications.
3. What types of personal data do we collect?
In this section, we describe the types of personal data that we collect or create. In section 4, we describe for what purposes we use these types of personal data.
Contact and identification data - Name, date of birth, place of birth, social security number, national identity number or similar, title, occupation, gender, billing and delivery address, e-mail address,mobile phone number, Klarna generated identifiers, nationality,, age, audio recordings, photos and video recordings of you and your ID card, electronic ID, qualified electronic signatures, etc.
Information about goods/services - Details concerning the goods/services you have bought or ordered (or plan to buy or order), such as type of item or delivery tracking number.
Information about your financial standing - Information about, for example, your income, any credits, negative payment history and previous credit approvals.
Payment information - Credit and debit card details (card number, expiry date and CVV code), bank account number, bank name, bank account holder name, bank login details.
Information about your use of Klarna’s services - Which service(s) and what different functions in these services you have used and how you have used them. This includes information about outstanding and historical debt, your payment and repayment history, participation in surveys, and your personal preferences or conducted queries, including derived interests as well as loyalty points.
Technical information generated through your use of Klarna’s services - Technical data such as response time for web pages, logs of the way you navigate through our services, download or transaction errors and date and time when you used the service.
Information about your contacts with Klarna’s customer service - Recorded and/or transcribed phone calls, chat conversations and email correspondence.
Your contacts with the stores you shop at or visit - Information about how you interact with stores, such as whether you have received goods and the type of store you shop at.
Device information - Device ID, IP address, language settings, browser settings, time zone, operating system, platform, screen resolution and similar information about your device and device settings/usage.
Information from external sanction lists and PEP lists - Sanction lists and lists of persons constituting politically exposed persons (“PEP”) include information such as name, date of birth, place of birth, occupation or position, and the reason why the person is on the list in question.
Sensitive personal data - Sensitive personal data are data that reveal religious beliefs, political or philosophical views, trade union membership, or constitute information about health, sex life or sexual orientation as well as biometric data.
Service-specific personal data - Within the framework of our services through the Klarna Shopping Service, Klarna’s savings and payment accounts, Auto-Track, Financial Insights, and Open Banking service we use additional personal data that are not covered by the types listed above. Information regarding each service is listed here:
Services under the Klarna User terms: All content you upload or submit (such as queries/searches, photos, receipts, product/store reviews, profile picture or other information uploaded), location information and websites you visit in the application’s browser, or with the extension installed. Klarna also displays product reviews from third party review sites;
Klarna’s savings and payment accounts: Information about your transactions and deposits and information about where your money comes from, or will be used for. Klarna will also process data about third parties (such as payees or payers) for this service;
Auto-track: Data from the connected e-mail account concerning your purchases/orders, deliveries and received promotions/marketing (such as order number, product, price, purchase date, quantity information, seller, payment method used, promotional codes, delivery tracking numbers, carrier, delivery status, shipping address, type of marketing and marketing offers);
Financial Insights: Information from your other bank accounts and other types of accounts (such as card accounts) that you choose to connect to the service, as well as information such as account number, bank, historical transactions from your connected accounts and balances and assets;
Loyalty Cards Feature: Information from your added third-party membership or loyalty card account such as membership information and credentials, points, status, levels, and balance history;
Klarna Cashback: Purchase amounts and dates of purchases that take place through the Klarna Cashback program, regardless of whether you have paid with Klarna or not. We also process information about cashback offer rate per purchase and cashback amount received;
Open Banking service: Information from your third party bank account, such as basic account information (account holder, bank account number, account login data), and information about your transactions, account balance, and overdraft limit; and
Contact list and details: If you choose to upload your phonebook, we will collect phone numbers and email addresses from your contacts list. Depending on your device settings, the Klarna App will periodically collect this data to make sure everything is up to date. If you provide the phone number or email address of non-Klarna customers for the purposes of initiating payments to them, we will also process these details. By providing us with information about your contacts you confirm that you have permission to provide that information to Klarna for the purposes described in this privacy notice.
Event registration on social media: Information about your profile from your social media account and business information such as your employer’s name, address and type of company.
4. What personal data are used for what purposes and with which legal basis?
In the tables below you can read about,
what we will use your personal data for (the purpose),
which types of personal data we use for that purpose, and if the personal data comes directly from you or from another source. In the cases where we have received personal data about you from another source, we provide the source in brackets,
what legal rights we have under current data protection legislation, such as the GDPR, to process the data about you, referred to as our “legal basis”, and
when Klarna stops using the personal data for each purpose.
4.1 Purposes for which your personal data is always used, regardless of the service you use.
Purpose of the processing - what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis for processing according to the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[1] To manage our customer relationship with you in accordance with our agreements, for each service you use. This includes creating and sending information to you in electronic format (not marketing). | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). If the service processes information that constitutes sensitive personal data (e.g., from materials you choose to upload), our processing takes place based on your explicit consent (Article 9(2)(a) GDPR). | When the contract between you and Klarna terminates, or you withdraw your consent. |
[2] To be able to perform customer satisfaction surveys, conduct consumer research as well as ask for reviews from you, through email, text messages, phone or via other communication channels. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in being able to perform the personal data processing, that the processing is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the contract between you and Klarna terminates. |
[3] To ensure network and information security in Klarna’s services. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in being able to ensure network and information security, that the processing is necessary to realise that purpose, and that our interest outweighs your right not to have your data processed for this purpose. It is also in your interest as a customer that we ensure good information security. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing lasts for as long as you are using a service. |
[4] To be able to help you as a vulnerable customer (i.e. if you need extra support when contacting us due to particular circumstances). This means that we can offer you special support, for example, when you contact customer service. | From you:
From other sources:
| Depending on the circumstances, either:
| When you notify us that you are no longer a vulnerable customer or withdraw your consent (if applicable). We also cease this processing if and when you notify us that you no longer want to be a Klarna customer. |
[5] To process any financial hardship claim you make, whereby we offer you special support, for example, a payment pause. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). If your application includes information that constitutes sensitive personal data (e.g., from materials you choose to upload to support your claim), depending on the circumstances our processing takes place based on your explicit consent (Article 9(2)(a) GDPR) or because it is necessary for substantial public interest reasons (Article 9(2)(g) GDPR). | When the contract between you and Klarna terminates, or you withdraw your consent. |
[6] To be able to perform risk analysis, prevent fraud, and carry out risk management. We perform the processing to confirm your identity and that the data you provide is correct, as well as to counter criminal activities. This processing constitutes profiling and automated decision-making. We use automated decision-making for this purpose, to be able to determine if you constitute a risk of fraud. See section 6 for more information about profiling and automated decisions. | From you:
From other sources:
| The processing is necessary for Klarna to be able to execute and perform a contract with you (Article 6(1)(b) GDPR). Sensitive personal data is processed based on your explicit consent (Article 9(2)(a) GDPR) insofar as this is explained to you when such data is collected. However, for our financial services, we are also required by law to establish the identity of our customers (Article 6(1)(c) GDPR). (Swedish Law (2017:630) on measures against money laundering and terrorist financing | This processing will take place while you use any Klarna service, or you withdraw your consent. However, if Klarna has identified a potential risk in how you use Klarna, we will continue to use your information for this purpose and continuously update our risk assessment if there is a risk of fraud. This processing lasts as long as we are required by law to keep your information. See section 9 for more information on our obligations and right to retain information according to law. |
[7] To anonymise your personal data in order to improve our services and products and to analyse customer behaviour. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in anonymising your personal data for product development purposes and in analysing customer behaviour in order to improve the service and customer experience. We ensure that the particular processing this entails is necessary to achieve the purpose in question, and that our interest outweighs your right not to have your data processed for this purpose. By anonymising information concerning you, we also ensure that we use personal data to the lesser extent possible. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing takes place for the entire period during which Klarna must retain the information in its systems, for example to perform the contract executed with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
[8] To perform data analysis for product development and testing to improve our risk, fraud and credit models and to design and improve our services (if possible, we first anonymise the data, which means that no personal data processing is performed thereafter). | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in performing data analysis for product development and testing purposes. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. Furthermore, our customers benefit from the processing because it helps us deliver error-free and sustainable services. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing takes place for the entire period during which Klarna must retain the information in its systems, for example, to perform the contract executed with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
[9] To perform data analysis to measure and improve our marketing and advertising channels (if possible, we first anonymise the data, which means that no personal data processing is performed thereafter). | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in performing data analysis to measure and improve our marketing and advertising channels. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing takes place for the entire period during which Klarna must retain the information in its systems, for example, to perform the contract executed with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
[10] To calculate payment commissions to suppliers (if possible, we first anonymise the data, which means that no personal data processing takes place thereafter). | From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in calculating potential commissions. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing takes place for up to 90 days after using a service. |
[11] To produce statistics and reports for economic analysis or analysis of payment trends or payment volumes in certain regions or industries (if possible, we first anonymise the data, which means that no personal data processing takes place thereafter). | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in obtaining statistical data and reports for this purpose. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | This processing takes place for the entire period during which Klarna must retain the information in its systems, for example, to perform the contract executed with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
[12] To check and verify your identity. This processing constitutes profiling and automated decision-making. We use automated decision-making for this purpose, to be able to determine if you are who you say you are. See section 6 for more information about profiling and automated decisions. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). Sensitive personal data is processed based on your explicit consent (Article 9(2)(a) GDPR) insofar as this is explained to you when such data is collected. | As long as you use one of Klarna’s services. |
[13] To share your personal data with the categories of recipients described in section 7.1 (suppliers and subcontractors, companies within the Klarna Group, persons with authority over your financial transactions, authorities and buyers of receivables, businesses or assets). |
| Varies depending on the recipient (see section 7.1). | This processing takes place for the entire period during which Klarna must retain the data in its systems, for example, to fulfil the agreement with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
[14] To decide what kind of marketing or marketing surveys we will provide to you. If you do not want us to perform this processing of your data, please contact us. We will then cease to use your data for marketing. Contact information is available in section 12. The processing may constitute profiling. See section 6 for more information about profiling. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in identifying which type of marketing we should provide to you. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. We have also considered the fact that marketing is listed as an example of legitimate interest in the GDPR. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the contract between you and Klarna terminates, or if you notify us that you are not interested in this processing. |
[15] To provide marketing materials, offers and marketing surveys to you about other products and services we offer that are similar to those you have already used and that are part of Klarna’s general consumer offering. If you do not want to receive marketing from us, please contact us to let us know. We will then stop processing your data for sending marketing. See section 12 for our contact information. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in sending you marketing about our services and offers. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your data processed for this purpose. We have also considered the fact that marketing is listed as an example of legitimate interest in the GDPR. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the contract between you and Klarna terminates, or if you notify us that you are not interested in this processing. |
[16] Provide you with direct marketing and marketing surveys about offers, products, or services from Klarna, and our stores/partners. | From you:
From other sources:
| The processing is based on your consent (Article 6(1)(a) GDPR). | Either when you notify us that you want to withdraw your consent or if you notify us that you are not interested in this processing/opt-out. |
[17] To protect Klarna from legal claims and safeguard Klarna’s legal rights. |
In the event of a dispute, Klarna may also collect other types of personal data concerning you if we need them to exercise our rights. | The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in being able to protect ourselves from legal claims. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. Sensitive personal data, if necessary to establish, exercise or defend legal claims, is processed based on Article 9(2)(f) GDPR. | This processing takes place for the entire period during which Klarna must retain the information in its systems, for example to perform the contract executed with you or to comply with applicable law. See section 9 for more information on our obligations and right to retain information according to law. |
4.2 Purposes for which your personal data are used when you use one of Klarna’s payment methods, log in with Klarna at a store, or choose to pay by debit or credit card in Klarna’s check-out at a store.
Purpose of the processing - what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis for processing according to the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[18] To transfer the store’s right to payment for your purchase to Klarna (“factoring”). | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we (and the store) have a legitimate interest in selling or buying your outstanding debt. We ensure that the processing is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the purchase takes place. |
[19] To share your personal information with the categories of recipients described in section 7.2 (stores, payment service providers, checkout providers, card networks and financial institutions, fraud prevention agencies and companies providing identity information, and Google). | From you:
From other sources:
| Varies depending on the recipient (see section 7.2). | Primarily when the purchase takes place, but it also occurs during the entire period that Klarna has the data in its systems, i.e. until the data is deleted. See section 9 for more information on our obligations and right to retain information according to law. |
[20] When you shop in a store that offers Klarna as a payment method or has Klarna checkout, we will assess the order in which different payment methods should be presented to you at the store checkout. This processing constitutes profiling. See section 6 for more information about profiling. | From you:
From other sources:
| If you have accepted and use the Klarna service called “Shopping Service” as described in more detail in the terms and conditions of the service, which you will find here, then the legal basis for the processing is the performance of the contract (Article 6(1)(b) GDPR). Alternatively, if you have not entered into the “Shopping Service” agreement, the processing will be based on a balancing of interests instead (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in examining the order in which different payment options will be presented to you when checking out at the store. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the payment methods are shown at checkout. |
[21] To prevent Klarna’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions. Klarna also conducts ongoing risk assessments and creates risk models to counter money laundering and terrorist financing. This processing constitutes profiling and automated decision making. See section 6 for more information about profiling and automated decisions. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (Swedish Law (2017:630) on measures against money laundering and terrorist financing) As regards sensitive personal data, the basis is that the processing is necessary for reasons of substantial public interest (Article 9(2)(g) GDPR). | When the agreement between you and Klarna is terminated, or you withdraw your consent. See section 9 for more information on our obligations and right to retain information in accordance with the law. |
[22] To perform a fraud prevention assessment before a purchase is accepted. This processing constitutes profiling and automated decision-making. We use automated decision-making for this purpose, to be able to determine if you constitute a risk of fraud. See section 6 for more information about profiling and automated decisions. Also see section 7.2.3 on our use of risk detection agencies to which your information may be shared, and our legal basis for that sharing. If we identify potential fraudulent transactions we will also report this to our fraud prevention bureaus as set out in Section 7.2.3.] | From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies, checkout providers and payment service providers on whether your information indicates an attempt at fraud. | To enter into and perform the agreement (Article 6(1)(b) GDPR). Sensitive personal data are processed based on your explicit consent (Article 9(2)(a) GDPR). | When the fraud assessment is performed, or you withdraw your consent. |
[23] To perform bookkeeping and accounting in accordance with accounting laws and preserve them in compliance with the applicable law. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078, | During the period in which the bookkeeping is recorded and 7 years after the end of the year in which the information was registered. See section 9 for more information on our obligations and right to retain information according to law. |
[24] To perform calculations in accordance with rules on capital adequacy obligations. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (Capital Adequacy Regulation 575/2013, and Capital Adequacy Directive 2013/36) | Seven years after the end of the year in which the information was registered. See section 9 for more information on our obligations and right to retain information according to law. |
4.3 Purposes for which your personal data is used when you use one of Klarna’s payment methods involving the provision of credit or when you use the Klarna card, pay with Instore, pay with Klarna through digital wallets or the One-time Card Shopping Service
The following services involve providing credit to you: “Pay later” (invoice), “Pay in full” (for payment by direct debit), “Financing” (pay in instalments), as well as the Klarna card and the One-time Card Shopping Service (both of which are offered in the Klarna mobile application or browser extension).
Purpose of the processing - what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis according to the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[25] To perform a credit assessment before credit is granted including when you choose to check your purchase power or pre-qualify for credit with Klarna. This constitutes profiling and the decision to approve or reject the credit constitutes an “automated decision”. See section 6 for more information about profiling and automated decisions. Also see section 7.3.1 on our use of credit bureaus to which your information may be shared, and our legal basis for that sharing. | From you:
From other sources:
| To enter into and perform the credit agreement (Article 6(1)(b) GDPR). When you choose to check your purchase power or pre-qualify for credit, the processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). In some circumstances we will seek your consent (Article 6(1)(a) GDPR). | When the credit assessment is performed, or (if applicable) when you withdraw your consent. |
[26] Determining which is the most efficient way to contact you about your outstanding debt. This will not affect communications which are legally required under consumer credit legislation. This processing constitutes profiling. See section 6 for more information about profiling. | From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we (and you) have a legitimate interest in making sure you are contacted in an efficient manner about your outstanding debt. We ensure that the processing is necessary to pursue that interest, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | As long as you have outstanding debt with Klarna. |
[27] To share your personal data with the types of recipients described in section 7.3 (credit bureaus, debt collection companies and other buyers of outstanding receivables, as well as VISA, debt acquirers and digital wallet providers). | From you:
From other sources:
| Varies depending on the recipient (see section 7.3). | Primarily when the purchase takes place, but also as long as Klarna retains the data in its systems, i.e., until it is deleted. See section 9 for more information on our obligations and right to retain information according to law. |
[28] To transfer Klarna’s right to payment for your purchase to a new owner. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in selling outstanding credits as part of conducting our business. We ensure that the processing is necessary to pursue that interest, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | The processing may be performed while the debt is unpaid (you will be notified if the debt is transferred). |
[29] To perform debt collection services, i.e. to collect and sell overdue debts. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in collecting and selling debts. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information. | When the debt has been paid. |
[30] To prevent Klarna’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments and creating risk models. This processing constitutes profiling, and a decision that you imply a money laundering risk constitutes an “automated decision”. See section 6 for more information about profiling and automated decisions. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (Swedish Law (2017:630) on measures against money laundering and terrorist financing).
| Up to five years from the termination of the agreement or after the termination of the customer relationship (up to ten years in cases where law enforcement authorities so request). See section 9 for more information on our obligations and right to retain information according to law. |
[31] Filing and accounting in accordance with accounting laws. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078) | Seven years after the end of the year in which the information was registered. See section 9 for more information on our obligations and right to retain information according to law. |
4.4 Use of your (and third parties’) personal data to give you access to Klarna account services (Klarna balance, savings, and payment accounts).
Purpose of the processing – what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis according to the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[32] Not applicable in your market. | |||
[33] To provide Klarna’s savings and payment accounts, including to show your details to other Klarna Bank Account customers when they make a payment to you, or when you make a payment to them. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). Information about third parties (such as payment recipient or payer) is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we and you (and also the payment recipient/payer) have a legitimate interest in having these data processed to perform the transactions in question. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You may contact us for more information about how the determination was made. See section 12 for our contact information. | When the contract between you and Klarna terminates. |
[34] To share your personal data with the categories of recipients described in section 7.4 (credit institutions and other financial institutions). | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). The service terms are available here. | When the contract between you and Klarna terminates. |
[35] To prevent Klarna’s operations from being used for money laundering or terrorist financing, by verifying your identity, monitoring and reviewing transactions, conducting risk assessments and creating risk models. This processing constitutes profiling, and a decision that you imply a money laundering risk constitutes an automated decision. See section 6 for more information about profiling and automated decisions. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (Swedish Law (2017:630) As regards sensitive personal data, the condition is that the processing is necessary in the public interest (Article 9(2)(g) GDPR). | Up to five years from the termination of the contract or after the termination of the customer relationship (up to ten years in cases where law enforcement authorities so request). See section 9 for more information on our obligations and right to retain information according to law. |
[36] Filing and accounting in accordance with accounting laws. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR). (The Swedish Accounting Act (1999:1078)) | Seven years after the end of the year in which the information first was registered. See section 9 for more information on our obligations and right to retain information according to law. |
[37] To perform calculations in accordance with rules on capital adequacy obligations. | From you:
From other sources:
| To comply with law (Article 6(1)(c) GDPR) (Capital Adequacy Regulation 575/2013, and Capital Adequacy Directive 2013/36). | Seven years after the end of the year in which the information was registered. See section 9 for more information on our obligations and right to retain information according to law. |
[38] To allow you to import contacts from your phonebook to populate the contact list with Klarna Bank Account holders to whom you can send instant credit transfers from your Klarna Bank Account, or otherwise to initiate a transfer to a non-Klarna customer at your request. You can terminate this service at any time and thereby delete Klarna’s access to your phonebook. | From you:
From other sources:
| The upload from your phonebook is based on where you have given your consent (under Article 6(1)(a) GDPR) (to access contacts stored on your phone). Information about third parties (i.e. non-Klarna customers in your phonebook) is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we and you have a legitimate interest in having this data processed to find Klarna customer contacts to assist Klarna customers to perform the transactions in question. We ensure that the processing this entails is necessary to pursue that interest, and that this interest outweighs your right not to have your information processed for this purpose. You may contact us for more information about how the determination was made or if you wish to object to this processing. See section 12 for our contact information.] | When the contract between you and Klarna terminates, or you withdraw your consent by changing your device settings. When you provide contact details to initiate a transfer to non-Klarna customers, we retain those details for seven days unless the transferee sets up their own Klarna Balance account. |
4.5 Use of personal data for the services in the Klarna User terms, Klarna Membership terms and/or Referral Program terms.
For the services described in the Klarna User terms and/or Klarna Membership terms, Klarna will process your personal data for the purposes described in the table below.
The Klarna User terms are available here. You can read more about the functions on our website or in our app.
Purpose of the processing - what we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis according to the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[39] To deliver the services in the Klarna User terms and the functions included in those services as well as determining your eligibility for certain services. The service involves profiling you to personalise the content and query responses in Klarna’s service and at Klarna’s checkout. You can read more about the functionalities of the service on our website or in our app. |
| The processing is necessary for Klarna to perform a contract (Klarna User terms) with you (Article 6(1)(b) GDPR). If we process data that constitutes sensitive personal data (if you have uploaded this data or if you have otherwise given us access to this data or told us to share such data), our processing takes place based on your explicit consent (Article 9(2)(a) GDPR). See section 3 for more information about this kind of personal data. | When the contract between you and Klarna terminates or you withdraw your consent. |
[40] You can choose to share your location and geolocation information with us. We use this information to find stores and offers in your vicinity, to present in the Klarna mobile application or at Klarna.com. You can turn off location and geolocation information sharing on your device at any time. | From you:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[41] To provide a browser, through the Klarna mobile application, for you to visit, for example, stores’ websites. Klarna will collect information about how you use the browser to customise the contents of the Klarna mobile application. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). If the service processes information that constitutes sensitive personal data (e.g. from pages you visit), our processing will take place based on your explicit consent (Article 9(2)(a) GDPR). However, this sensitive information will not be used for any purpose other than to show you the current website in the browser. | When the contract between you and Klarna terminates. |
[42] To perform fraud prevention assessments when using the Klarna Shopping Service. This processing constitutes profiling and automated decision-making. We use automated decision-making for this purpose, to be able to determine if you constitute a risk of fraud. See section 6 for more information about profiling and automated decisions. Also see section 7.5.6 on our use of fraud prevention agencies to which your information may be shared, and our legal basis for that sharing. | From you:
From other sources:
In addition to the above, Klarna receives information from fraud prevention agencies on whether your information indicates an attempt at fraud. | The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the fraud assessment is performed. |
[43] To share your personal data with the categories of recipients described in section 7.5 (affiliate networks, Google, partners within the framework of the Financial Insights service and the offer and benefit program, and logistics and transportation companies, Advertising services, third-party apps and services (for SIWK), risk detection agencies and companies providing identity checks and Resell Platforms). | From you:
From other sources:
| Varies depending on the recipient (see section 7.5). | When the contract between you and Klarna terminates. |
[44] To deliver more relevant advertising, we share personal data, including Klarna-created audience segments, with advertising partners. This includes advertising Klarna products and services on third-party websites and apps, but also for third parties shown within the Klarna website and app; Klarna-created audience segments may also be used within third party advertising platforms to show ads on third-party advertising channels. \ We also assess the relevancy of such advertising. This is based on your user behaviour and Klarna profile. This processing may constitute profiling which aims to customise the marketing based on what we think you may be interested in. You can read more about profiling in section 6. | From you:
From other sources:
| This is based on where you have given your consent (under Article 6(1)(a) GDPR). | Either when you notify us that you want to withdraw your consent or if you notify us that you are not interested in this processing. |
[45] Not applicable in your market. | |||
[46] If you choose to sign in with Klarna (through “SIWK”) at a third-party app or service, Klarna will share your personal data with the store or online service. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[47] To automatically manage purchase disputes or complaints about goods. This processing constitutes automated decision-making. We use automated decision-making for this purpose to be able to ensure timely and consistent outcomes of disputes or complaints. See section 6 for more information about automated decisions. | From you:
From other sources:
| If you have accepted and use the Klarna service called “Shopping Service” as described in more detail in the terms and conditions of the service, which you will find here, then the legal basis for the processing is the performance of the contract (Article 6(1)(b) GDPR). Alternatively, if you have not entered into the “Klarna Shopping Service” agreement, or have not made the disputed purchase, the processing will be based on your consent (Article 6(1)(a) GDPR). | When the dispute has been managed, or alternatively where the processing is based on consent when you notify us that you want to withdraw your consent. |
[48] To present you with relevant content and product recommendations when you use our product expert- and shopping assistant functionality. These assistants base their recommendations on information we have about you, together with preferences or queries you provide. This processing constitutes profiling. See section 6 for more information about profiling. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[49] If you have connected your e-mail account to Klarna’s Auto-Track service, Klarna will regularly connect to your e-mail account(s) to obtain information about your purchases. You can terminate this service at any time and thereby delete Klarna’s access to your e-mail account. | From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). If the service processes sensitive personal data (from your transactions), our processing will take place based on your explicit consent (Article 9(2)(a) GDPR). See section 3 for more descriptive information. | When the contract between you and Klarna terminates or you withdraw your consent. |
[50] If you have chosen to connect your bank accounts to the Financial Insights service, Klarna will display and give you tools to control your finances, by means of offers tailored to your specific needs. This processing constitutes profiling which aims to customise the service’s content based on what we think you may be interested in. You can read more about profiling in section 6. If you choose to take advantage of offers and benefits that Klarna delivers within the framework of this service, we will share your personal information with the partner who delivers these (see section 7.5.3). | From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). If the service processes sensitive personal data (from your transactions), our processing will take place based on your explicit consent (Article 9(2)(a) GDPR). See section 3 for more information. | When the contract between you and Klarna terminates, or you withdraw your consent. |
[51] If you use our browser extension, Klarna will process your data to deliver the service, which includes processing information about which websites/web domains you visit: Klarna processes information about the ecommerce websites/web domains you visit in order to identify deals, offer cash back and provide you with customised offers in the Klarna extension and mobile application. This processing is also done to allow you to create One-time Cards directly in your browser on websites where this service is enabled. Information about non-ecommerce websites/web domains visited will not be stored by Klarna. Read more about how your personal data is used in the extension FAQ. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the Klarna Shopping Service) with you (Article 6(1)(b) GDPR). If the service processes information that constitutes sensitive personal data (i.e. such data about the websites/web domains you visit), our processing will be based on your explicit consent (Article 9(2)(a) GDPR). See section 3 for more information about this kind of personal data. | When the contract between you and Klarna terminates, or you withdraw your consent. |
[52] If you have added a third-party membership or loyalty card account to Klarna’s Loyalty Cards Feature, Klarna will process your data to deliver the service. This includes Klarna regularly connecting to your third-party card account to import membership points, levels, and balance history. You can terminate this service at any time and thereby revoke Klarna’s access to your membership or loyalty card account. | From other sources:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[53] If you have chosen to connect to Klarna’s Accepting All Cookies Service Klarna will process your data to deliver the service. You can terminate this service at any time. | From you:
| The processing is necessary for Klarna to perform a contract (terms and conditions for the shopping service) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[54] Not applicable in your market. | |||
[55] Display product reviews from third party review sites. Klarna displays product reviews from third party review sites, in line with those sites’ own terms and conditions. | From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in being able to perform the personal data processing, that the processing is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. You may contact us for more information about how the determination was made. See section 12 for our contact information. | Until you as a data subject reach out to have your reviews deleted, or they are deleted from the third party review site. |
[56] To provide you membership benefits if you are a subscriber of Klarna Membership. This involves sharing your personal data with our partners. This list may change from time to time. See section 7.5.9 for information about this data sharing. | From you: Contact and identification data. From other sources:
| The processing is necessary for Klarna to perform a contract (User terms) with you (Article 6(1)(b) GDPR). | When your membership is terminated. |
[57] Not applicable in your market. | |||
[58] If you participate in the Klarna Referral Program as a Referred Consumer, we will share your data with your Advocate. | From you:
| The processing is necessary for Klarna to perform a contract (User terms and Referral Terms) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
[59] If you participate in the Klarna Referral Program as an Advocate, we will share your data with the Referred Consumer. | From you:
| The processing is necessary for Klarna to perform a contract (User terms and Referral terms) with you (Article 6(1)(b) GDPR). | When the contract between you and Klarna terminates. |
4.6 Offers, invitations to events, and participation in a prize draw communicated via social media, other Klarna channels, or when you contact us through social media or other digital channels
Purpose of the processing - What we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis for processing in accordance with the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[60] If you sign up for an event posted on social media, we will process your personal data to provide the requested service. You can always unsubscribe from this by contacting us. See section 12 for contact information. | From you:
| The processing is necessary for Klarna to perform a contract with you (as regards the participation in the event) (Article 6(1)(b) GDPR). You may contact us for more information about how the determination was made. See section 12 for our contact information. | When the event has been held. |
[61] If you choose to participate in a prize draw organised by Klarna and/or its co-organisers and sponsors, we will process your personal data for the purpose of administering the prize draw, including selecting a winner and delivering the prize. | From you:
| The processing is necessary for Klarna to perform a contract with you (Article 6(1)(b) GDPR). | We will stop processing your personal data for this purpose once the prize draw in which you participate has ended. |
4.7 Klarna’s processing when you contact Klarna’s customer service.
Purpose of the processing - What we do and why. | Type of personal data used for the purpose, and where they come from (the source). See section 3 to read more about the different types of personal data. | Legal basis for processing in accordance with the GDPR. | When the purpose of using the personal data ends. See section 9 for when Klarna deletes the data. |
[62] To handle all matters that come to Klarna’s customer service. This includes retaining various forms of written conversations to document customer issues, as well as for security purposes and to counter fraud. | From you:
From other sources:
| Performance of contracts (Article 6(1)(b) GDPR). | Up to ten years, based on the statute of limitations. See section 9 for more information on our obligations and right to retain information according to law. |
[63] To help you solve issues related to your purchases when you use our customer service assistant. This processing constitutes profiling. See section 6 for more information about profiling. | From you:
From other sources:
| The processing is necessary for Klarna to perform a contract (Klarna User terms with you (Article 6(1)(b) GDPR). If the service processes information that constitutes sensitive personal data (e.g., from materials you choose to upload), our processing takes place based on your explicit consent (Article 9(2)(a) GDPR). | When the contract between you and Klarna terminates. |
[64] Quality and service improvement (to ensure satisfactory customer service). We may record telephone conversations as well as screen sharing sessions between you and our employees for quality purposes in order to deliver better products and services to you. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in improving our services, our internal training and quality control. We ensure that the particular processing this involves is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. As a customer, you also have an interest in the quality of your interactions with Klarna. You may contact us for more information about how the determination was made or if you wish to object to this processing. Please see the contact information in section 12. | We process the recordings of telephone conversations for up to 90 days for quality assurance purposes, and the recorded screen sharing sessions for up to 30 days for quality assurance purposes. |
[65]Documenting what has been said when talking to our customer service (to ensure we have documented what has been agreed or discussed). We use recorded telephone conversations between you and our employees, as well as manual and automated notations to document what has been said. | From you:
From other sources:
| The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest to document communications with Klarna’s customer service. We ensure that the particular processing this entails is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. As a customer, you also have an interest in ensuring impartial means of documenting what has been discussed. You may contact us for more information about how the determination was made or if you wish to object to this processing. Please see the contact information in section 12. If there is information that constitutes sensitive personal data, our processing takes place based on your explicit consent (Article 9(2)(a) GDPR). | 90 days from the day when the recording was made. |
[66] If you contact us via social media such as Facebook, Instagram or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy notices. The same is true for the answer you get from us. Klarna processes this information to answer your questions. | From you:
From other sources:
| Performance of contracts (Article 6(1)(b) GDPR). | When we have answered your question. |
[67] To handle voluntary blocks for using Klarna’s services, i.e. if you contact us and ask us to prevent you from being able to use our services. Your voluntary block can be lifted by you at any time by contacting us again. | From you:
| Based on your consent (Article 6(1)(a). | When you notify us that you no longer want to be blocked from using our services or withdraw your consent. We also cease this processing if and when you notify us that you no longer want to be a Klarna customer at all. |
5. How do you withdraw your consent?
When Klarna uses your personal data based on your consent or explicit consent, you can withdraw that consent at any time. You can do this by sending an e-mail to support.eu@klarna.com. or via the contact information you find in section 12. You can also delete uploaded information from Klarna’s services, or end the functionality in which such personal data is processed. We will then delete the information (or stop using it for the purpose consent is relied on). If you withdraw your consent or delete the uploaded information, you may be unable to use the service in cases where Klarna’s processing of personal data takes place based on your consent.
Lastly: As described in section 2 above you also have the right to object against certain personal data processing (for example you may turn off marketing). You also have a right to have certain personal data erased, which is also described in section 2.
6. Klarna’s profiling and automated decisions that significantly affect you.
6.1 Klarna’s profiling of you as a customer.
“Profiling” means an automated processing of personal data to evaluate certain personal matters, for example, by analysing or predicting your personal preferences, such as buying interests. At the same time, we compare your data with what our other customers, with similar use of our services, have preferred.
The purpose of Klarna’s profiling and the personal data types used for each occasion and for each profiling are described in detail in section 4 above. You can match the below descriptions with the purposes in section 4 above using the numbers in brackets “[x]”. The profiling for these purposes does not have a significant impact on you as a customer.
We use profiling for the following purposes:
to deliver our customised services, which customise their content and recommendations based on what we think is most interesting or relevant to you (this applies to Klarna’s various functions such as the product expert and shopping assistants, when you interact with our customer service assistant and the order different payment methods appear at Klarna’s checkout), (Purposes [20, 39, 48, 49, 50 and 63] in section 4)
to determine which is the most efficient way to contact you about your outstanding debt (looking at different channels, for example by sms or email, or the timing of such communication), (Purpose [26] in section 4) and
to deliver customised marketing to you across both our own and external platforms and services. (Purposes [44 and 45] in section 4)
Our services utilise machine learning models and artificial intelligence models in order to provide you with as relevant content as possible.
If you have any questions about how the profiling process works, please contact us. Contact information is available in section 12. You may object to our marketing profiling at any time by contacting us (and we will then cease profiling for marketing purposes). You may also end our profiling for our services by terminating the service.
6.2 Klarna’s automated decisions that significantly affect you
Automated decisions with legal effect, or automated decisions that similarly significantly affect you, means that certain decisions in our services are completely automated, without our employees being involved. These decisions have a significant effect on you as a customer, comparable to legal effects. By making such decisions automatically, Klarna increases its objectivity and transparency in the decision to offer you these services. At the same time, you have the right to object to these decisions at all times. You can read about how to object to these decisions at the end of this section 6.2. When doing these assessments we utilise machine learning models and artificial intelligence models in order to ensure as high quality as possible in our decisions.
Automated decisions that significantly affect you also mean that profiling is performed based on your data before the decision is made. This profiling is made to assess your financial situation (before the decision to offer or grant credit, or initiate a payment), to verify if you are who you say you are, to identify whether your use of our services involves a risk of fraud or money laundering or to decide whether you are liable for a purchase. We profile your user behaviour and financial standing and compare this data with behaviours and conditions that indicate different risk levels for us.
The different user behaviour and conditions are evaluated and weighted into our automated decision-models, so that we end up with a totalling score, which then results in either accepting or rejecting your use of our Services. We can also choose to request further identification from you, if we are not sure who you are.
When does Klarna take automated decisions that significantly affect you?
The personal data types used in each decision are described in section 4. You can match the below descriptions with the purposes in section 4 above using the numbers in brackets “[x]”.
We make this kind of automated decision when we:
decide to approve your application, or to offer you, to use a credit service.
decide not to approve your application, or not to offer you, to use a credit service.
These automated credit decisions are based on the data you provide to us, data from external sources such as credit bureaus' credit worthiness reports, and Klarna’s own internal information about you if we have lent you money before. In addition to information about you, Klarna’s credit model includes a large number of other factors, such as Klarna’s internal credit risk levels and our customers’ general repayment rates (based on, for example, the current product category). (Purposes [25 and 32] in section 4).decide whether you pose a risk of fraud, if our processing shows that your behaviour indicates possible fraudulent conduct, that your behaviour is not consistent with previous use of our services, or that you have attempted to conceal your true identity. Automated decisions whereby we assess whether you constitute a fraud risk are based on information you have provided yourself, data from fraud prevention agencies (see section 7.2.3. for details of which ones we use), and Klarna’s own internal information. Klarna continuously develops our fraud models to keep our services secure, and closely investigate how fraudsters operate on different markets (for example which merchant categories or products are mostly subject to fraud attempts). (Purposes [6 22 and 42] in section 4).
decide that you are who you say you are when we verify your identity. (Purpose [12] in section 4).
decide whether there is a risk of money laundering, if our processing shows that your behaviour indicates money laundering. In relevant cases, Klarna also investigates whether specific customers are listed on sanction lists. (Purposes [21, 30 and 35] in section 4).
decide whether you are liable for a purchase that you have disputed as “unauthorised” based on whether the information you provide, or we have about the purchase, point towards potential fraudulent behaviour or not. This by comparing what has happened in your case to other transactions indicating fraudulent behaviour. (Purpose [47] in section 4).
See section 7 for more information about whom we share information with as regards profiling during automated decisions.
If you are not approved under the automated decisions described above, you will not have access to, or will not be able to use Klarna’s services, such as our payment methods. Klarna has several safety mechanisms to ensure the decisions are appropriate and fair. These mechanisms include ongoing overviews of our decision models and random sampling in individual cases. If you have any concern about the outcome, you can always contact us, and we will determine whether the procedure was performed appropriately. You can also object in accordance with the following instructions.
Your right to object to these automated decisions
You always have the right to object to an automated decision with legal consequences or decisions which can otherwise significantly affect you (together with the relevant profiling) by sending an e-mail message to support.eu@klarna.com. A Klarna employee will then review the decision, taking into account any additional information and circumstances that you provide to us.
7. Who do we share your personal data with?
When we share your personal data, we ensure that the recipient processes it in accordance with this notice, such as by entering into data transfer agreements or data processor agreements with the recipients. Those agreements include all reasonable contractual, legal, technical and organisational measures to ensure that your information is processed with an adequate level of protection and in accordance with applicable law.
7.1 Categories of recipients with whom Klarna will always share your personal information, regardless of the service you use.
7.1.1 Suppliers and subcontractors.
Description of the recipient: Suppliers and subcontractors are companies that only have the right to process the personal data they receive from Klarna on behalf of Klarna, i.e. data processors. Examples of such suppliers and subcontractors are software and data storage providers, payment service providers and business consultants, providers of machine learning/artificial intelligence functionality, identity verification providers, consumer research suppliers, or Klarna Group companies.
Purpose and legal basis: Klarna needs access to services and functionality from other companies where it cannot perform them itself. Klarna has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.1.2 Klarna Group.
Description of the recipient: Companies in the Klarna Group.
Purpose and legal basis: This is required for Klarna to be able to provide you with its services and functionalities. Klarna has a legitimate interest in being able to access and provide these services and functionalities (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
When you shop in a foreign store (meaning a store located outside of the EU/EEA area) that has an agreement with another company within the Klarna Group, the disclosure of your personal information between Klarna companies is required in order for the two Klarna companies to manage your payment and enable the foreign store to administer your purchase. The legal basis for this processing is the performance of a contract (Article 6 (1)(b) GDPR).
The receiving Klarna Group company will handle your personal data in accordance with the privacy notice that applies in your country (see list). You can read more about how Klarna safeguards your personal data when transferred outside of the EU/EEA in Section 8.
7.1.3 A person who holds a power of attorney for your financial affairs.
Description of the recipient: Klarna may share your personal information with a person who has the right to access it under a power of attorney.
Purpose and legal basis: This processing is carried out to facilitate your contact with us (through agents), and takes place based on your consent (Article 6(1)(a) GDPR).
7.1.4 Authorities.
Description of the recipient: Klarna may provide necessary information to authorities such as the police, financial authorities, tax authorities or other authorities and courts of law.
Purpose and legal basis: Personal data is shared with the authority when we are required by law to do so, or in some cases if you have asked us to do so, or if required to manage tax deductions or counter crime. An example of a legal obligation to provide information is when it is necessary to take measures against money laundering and terrorist financing. Depending on the authority and purpose, the legal bases are the obligation to comply with the law (Article 6(1)(c) GDPR), to fulfil the agreement with you (Article 6(1)(b) GDPR), or Klarna’s legitimate interest in protecting itself from crime (Article 6(1)(f) GDPR).
7.1.5 Divestment of business or assets.
Description of the recipient: In the event that Klarna sells business or assets, Klarna may hand over your personal information to a potential buyer of such business or assets. If Klarna or a significant part of Klarna’s assets is acquired by a third party, personal information about Klarna’s customers may also be shared.
Purpose and legal basis: Klarna has a legitimate interest in being able to perform these transactions (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.2 Categories of recipients with whom Klarna shares your personal information when you use Klarna’s payment methods, Klarna at a store, or choose to pay by debit or credit card in Klarna’s check-out at a store.
7.2.1 Stores.
Description of the recipient: By stores we mean the stores you visit or shop at (which may include the store’s group companies if you have been informed thereof by the store).
Purpose and legal basis: In order for the store to be able to perform and manage your purchase and your relationship with the store or its group companies, e.g. by confirming your identity, sending goods, handling questions and disputes, in order to prevent fraud and, where appropriate, send relevant marketing. The store’s privacy notice applies to the processing of your personal data that has been shared with the store and that the store processes. Normally, you will find a link to the store’s privacy notice on the store’s website. The legal basis for sharing data with stores is partly the performance of a contract (Article 6(1)(b) GDPR) insofar as the data sharing takes place to perform the contract between you and the store, and partly based on Klarna’s and the store’s legitimate interest (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.2.2 Payment service providers, checkout providers, card networks and financial institutions.
Description of the recipient: Payment service providers (including digital wallets), checkout providers, card networks and financial institutions provide services to you, stores and Klarna to implement, facilitate and administer electronic payments through a variety of payment methods, such as credit cards and bank-based payment methods (e.g. direct debit and bank transfer).
Purpose and legal basis: Some stores use payment service providers and checkout providers with whom they share your information for managing your payment and purchase. This sharing takes place in accordance with the stores’ or the checkout providers’ own privacy notices. The store may also let Klarna share your information with the payment service provider they use for processing your payment. Some payment service providers also receive your information from Klarna, or collect and use your information independently, in accordance with their own privacy notices or to prevent fraud. This is the case, for example, for digital wallet suppliers. In addition, Klarna may share your information with your card network and with other financial institutions when managing your payment method or conducting transactions with your account to complete the transactions. Sharing with payment service providers, checkout providers, card networks and financial institutions is performed to enable a payment method or to conduct transactions initiated by you and it is done to fulfil the agreement with you (Article 6(1)(b) GDPR).
When the sharing is made with financial institutions that Klarna rely on to process your payment, or otherwise with payment service providers, Klarna also shares your information based on Klarna’s and the recipient’s legitimate interest to prevent abusive activities, including fraud (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.2.3 Risk detection agencies and companies providing identity checks.
Description of the recipient: Your personal data are shared with risk detection agencies and companies that provide identity checks.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent and criminal activities. Please note that these companies process your data in accordance with their own data privacy notices.
LexisNexis Risk Solutions Group
80 Harcourt Street, Dublin Ireland
Emailage and ThreatMetrix services:
Processing Notices | LexisNexis Risk Solutions
Klarna shares your information and information whether a certain transaction constitutes potential fraud based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR), as the risk detection agencies and the companies providing identity checks have information on fraud activities and identity confirmation which are important for Klarna to use as input to decrease its level of unauthorized transactions. This sharing is also in your interest as it helps to prevent that your information is used to make unauthorized purchases. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. You can also contact the entities listed in the link above, to exercise the same rights as stated in section 2 also against those entities.
7.2.4 Google.
Description of the recipient: When you use Google Maps at checkout or in the Klarna App (for example, by searching your address in the address bar, viewing “stores near me” or requesting information on nearby deals and offers), your personal information will be shared with Google. Google will process your data in accordance with Google Maps/Google Earths terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR), as Google Maps makes it possible to find the address functionality at checkout and to show maps and deals relevant to your current location in the Klarna App. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna’s payment methods involving the provision of credit or when you use the Klarna card, pay with Instore, pay with Klarna through digital wallets, or the One-time Card Shopping Service
7.3.1 Credit information bureaus.
Klarna does not use any credit information bureaus in your market.
7.3.2 Debt collection companies (for debts that are overdue).
Description of the recipient: Klarna may need to share your information when we sell or outsource collection of unpaid overdue debts through a third party, such as a debt collection company.
Purpose and legal basis: This data is shared to collect your overdue debts. Debt collection companies process personal data in accordance with their own privacy notices, or only on behalf of Klarna in their capacity as Klarna’s data processors. Debt collection companies may report your unpaid debts to credit information bureaus or authorities, which may affect your creditworthiness and your ability to apply for future credit. This data is shared based on our legitimate interest in collecting and selling debt (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in collecting and selling debts. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.3.3 VISA and digital wallet suppliers.
Description of the recipient: We share information about you and your purchases when you use the Klarna card with VISA and with members of VISA’s card network.
If you add your Klarna card or an Instore card to your digital wallet or choose to pay with Klarna through your digital wallet, we may need to share your information with the supplier of that wallet. In such case, data will be processed in accordance with that supplier’s privacy notice.
Purpose and legal basis: The sharing takes place to the extent necessary to carry out card transactions, prevent fraud and follow the rules for VISA’s card network. If you renew your Klarna card or receive a new Klarna card, we will transfer this information to VISA so that VISA can inform third parties with whom you have previously chosen to save your Klarna card information (for example, for recurring transactions). Sharing is performed to fulfil the agreement with you (Article 6(1)(b) GDPR).
7.3.4 Debt acquirers (for open debts).
Description of the recipient: Klarna can transfer your open debt to debt acquirers.
Purpose and legal basis: Upon transfer of your debt to an acquirer and continuously until you pay off the debt, Klarna will share your contact and identification information (name, date of birth, social security number, address, and phone number), information about your financial standing (such as residual credit, repayments and any negative payment history in relation to the current debt), as well as information about the goods or services associated with the debt. The buyer will process your personal data in accordance with its own privacy notice, which you will receive information about when the debt is transferred.
The sharing of personal data with different acquirers is based on our legitimate interest in selling outstanding debts as part of our business operations (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your personal data processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.4 Categories of recipients when using Klarna accounts services (Klarna balance, savings, and payment accounts).
7.4.1 Credit institutions and other financial institutions.
Description of the recipient: We share your information with credit institutions and other financial institutions (such as other banks) when you make transactions or payments to other accounts.
Purpose and legal basis: If you have made payments to a Klarna account, Klarna will process the information we receive from the bank you used for the transaction, such as contact and identification data and payment information. If you make transactions or payments to accounts in other banks, Klarna will also pass on some of your contact and identification data as well as payment information to the recipient and also to the recipient’s credit institution or financial institution. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) GDPR).
7.4.2 Other Klarna customers
Description of the recipient: We share your information with other Klarna customers when they make an instant credit transfer to you from their Klarna Bank Account, when you request payment from them, when you make a payment to them, or when both you and another Klarna customer chooses to upload their phonebook onto the Klarna App.
Purpose and legal basis: When someone makes an instant credit transfer to you, they will see that you are a Klarna user. This sharing is to fulfil the agreement with you (Article 6(1)(b) GDPR), to allow you to make and receive payments. If you have not turned off your in-app discoverability features in the Klarna App settings, they will also see your name and profile photo. It is in our legitimate interests (Article 6(1)(e) GDPR) to show this information. You can control what others see about you in your app settings. Your name is shown to those making a payment to you by default. You may give your consent to allow us to sync your mobile phone contacts with Klarna. In order to see which of your contacts are Klarna customers however, both you and those other Klarna customers need to (a) appear in each others’ phone books, and (b) have synced their phone books.
If you are a non-Klarna user, your phone number will be uploaded to our systems but will be double hashed. If you then become a Klarna user, and choose to sync your phonebook, you will appear as a Klarna user in the Klarna contact lists of your contacts who are Klarna users and have also synced their phonebooks, as long as you are also a contact in their phonebooks.
7.5 Categories of recipients with whom Klarna shares your personal information when you use the services in the Klarna User terms.
You may find the terms for the Klarna Shopping Service here.
7.5.1 Affiliate Networks.
Description of the recipient: When you choose to click on a sponsored link or make a purchase on a cashback offer in the Klarna mobile application or on our website that links to a store, product or service, you will be redirected to another company’s website through a third party, known as an affiliate network. Here you can learn which affiliate networks Klarna cooperates with (presented in the left column). The affiliate networks will process your device information in accordance with their own privacy notices (you will find these privacy notices in the right column in the same link as referenced above). The store you visit through a sponsored link determines which affiliate network processes your information. Usually a store only cooperates with one affiliate network. You can get more information about which network by contacting us (or the store).
Purpose and legal basis: The affiliate network may place tracking technology on your device that contains information about you clicking on that link in the Klarna mobile application, and which is then used to document your visit to the store to calculate a potential commission due to Klarna. This processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in supplying you with sponsored links in order to market shops in the Klarna mobile application and on our website. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
In addition, we need to share information with our affiliate networks to determine your eligibility for cashback under the Klarna Cashback programme. This includes confirming that you have met the specified criteria established in our cashback offers. The data shared also serves to determine the cashback amount potentially due to you. The processing for our cashback service is based on the performance of a contract (Article 6(1)(b) GDPR).
7.5.2 Google.
7.5.2.1 reCAPTCHA
Description of the recipient: When you use the Klarna mobile application (also through our web portal), Google will collect your device information through Google’s reCAPTCHA service which is implemented there (in some cases together with additional information that you choose to enter into the reCAPTCHA service), and Klarna will share the phone number used for verification.
Purpose and legal basis: Klarna processes this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR), since the reCAPTCHA service prevents misuse of our services (for example by preventing bots from trying to log in, or SMS toll fraud). Google will process this information in accordance with its terms of service and privacy policy. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.
You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.5.2.2. Google Maps
Description of the recipient: In order to show where your parcel will be delivered on an integrated map in the Klarna mobile application, we share the relevant delivery address with Google. Google will process your data in accordance with Google Maps’/Google Earth’s terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR). By using Google Maps we are able to show you the delivery address on an integrated map in the Klarna mobile application. We ensure that this processing is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You have the right to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights and how to use them.
7.5.2.2. Youtube
Description of the recipient: When you use Klarna’s various search features where we show content from Youtube, Youtube and Google will process your device information through its YouTube API services. Youtube/Google will process this information in accordance with its terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR). By using YouTube we are able to show you more content. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.5.3 Partners within the framework of the Financial Insights service and the offer and benefit program.
Description of the recipient: Partners within the framework of the Financial Insights service and the offer and benefit program.
Purpose and legal basis: If you choose to take advantage of Klarna’s offers and benefits within the framework of the Financial Insights service or the offer and benefits program, Klarna will share the personal information required for you to take advantage of the offer with our business partners (which includes the fact that you are a Klarna customer). Each offer specifies the data that will be shared. Data is shared to perform the agreement between yourself and Klarna (Article 6(1)(b) UK GDPR).
7.5.4 Logistics and transport companies.
Description of the recipient: Logistics and transport companies.
Purpose and legal basis: Klarna will share your personal data with logistics and transport companies that deliver the goods you order if you have signed up for parcel tracking. Examples of information we share are contact and identification data and tracking numbers.
Logistics and transport companies process your data in accordance with their own privacy notices. Sharing is performed to fulfil the agreement between you and Klarna (Article 6(1)(b) UK GDPR).
7.5.5 Advertising partners.
Description of the recipient: Third party advertising partners.
Purpose and legal basis: Klarna will share your personal data with third party advertising partners in order to show you more relevant Klarna advertising on non-Klarna sites and non-Klarna advertising, provide vouchers, offers, rewards and, digital gift cards, in the Klarna App and marketing channels, and on third party sites. This is based on your interaction with Klarna’s products and services and your Klarna profile. The processing includes audience segmentation and activation, analysing user behaviour and service performance, optimising product delivery and offer recommendations, personalising the presentation of offers, integrating and measuring the performance of affiliate networks. Klarna will also share this data to measure the performance of the advertising. Some third party advertising partners will use your data for their own purposes and in accordance with their own privacy policies, available here, where you can also see which third parties we use. Klarna acts as joint controllers with certain of these third parties. You can see more information on these arrangements and how to exercise your rights here. You can also get more information about this sharing or how to exercise your rights in regards to these companies by contacting us.
This processing is based on your consent (under Article 6(1)(a) GDPR). You can revoke your consent at any time in the Tracking Technology settings in the Klarna App. You can also object to this processing - to the same effect as revoking your consent. See section 2 for more information about your rights.
This processing may constitute profiling which aims to customise the marketing based on what we think you may be interested in. You can read more about profiling in section 6.
7.5.6 SIWK third-party apps and services.
Description of the recipient: When you sign in with Klarna (through “SIWK”) at a third-party app store or service, Klarna will share your personal data with the third-party app or service.
Purpose and legal basis: Your personal data is shared to carry out the SIWK functionality. This data sharing is performed to fulfil the agreement with you (Article 6(1)(b) GDPR).
7.5.7 Risk detection agencies and companies providing identity checks.
Description of the recipient: Your personal data are shared with risk detection agencies and companies that provide identity checks.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent and criminal activities. Please note that these companies process your data in accordance with their own data privacy notices.
LexisNexis Risk Solutions Group
80 Harcourt Street, Dublin Ireland
Emailage and ThreatMetrix services:
Processing Notices | LexisNexis Risk Solutions
Klarna shares your information and information whether a certain transaction constitutes potential fraud based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) GDPR), as the risk detection agencies and the companies providing identity checks have information on fraud activities and identity confirmation which are important for Klarna to use as input to decrease its level of fraudulent transactions. This sharing is also in your interest as it helps to prevent that your information is used to make unauthorized purchases. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. You can also contact the entities listed in the link above, to exercise the same rights as stated in section 2 also against those entities.
7.5.8 Resell Platforms.
Description of the recipient: Marketplaces and market platforms that enable resale of products and that Klarna has partnered with from time to time (“Resell Platforms”). The list of currently available Resell Platforms can be found here. We share information about goods/services that you wish to resale.
Purpose and legal basis: If you choose to resell a product via the Klarna App, Klarna will redirect you to the Resell Platform and prefill your listing by sharing information about the purchased product with the Resell Platform. The Resell Platforms will process this information in accordance with their terms of services and privacy policies. Sharing is performed to fulfil the agreement between you and Klarna (Article 6(1)(b) GDPR).
7.5.9 Klarna Membership Partners
Description of the recipient: When you become a Klarna Membership subscriber, we may share your personal data with our partners as needed in order to provide benefits to you. A list of the current Klarna Membership Partners can be found here.
Purpose and legal basis: If you choose to become a Klarna Membership subscriber, to provide specific benefits to you under Klarna Membership. Sharing is performed to fulfil the agreement between you and Klarna (Article 6(1)(b) GDPR).
7.6 Categories of recipients with which Klarna shares your personal information if you contact our customer service through social media, or participate in a prize draw co-organised by Klarna.
7.6.1 Social media
Description of the recipient: Social media companies such as Facebook, Instagram or Twitter.
Purpose and legal basis: If you contact us via social media such as Facebook, Instagram or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy notices. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) UK GDPR).
7.6.2 Prize draw co-organisers and sponsors
Description of the recipient: Prize draw co-organisers and sponsors – third-party partners that organise, sponsor, or otherwise support a prize draw in which you choose to participate, and with whom personal data is shared where necessary to administer the prize draw and deliver prizes.
Purpose and legal basis: If you decide to participate in a prize draw organised by Klarna and/or its co-organisers and sponsors, your personal data will also be collected and processed by these companies, in accordance with their privacy notices. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) GDPR).
8. When can we transfer your personal data outside of the EU/EEA, and how do we protect it then?
In order to provide our services and conduct our business operations we need to transfer your personal data outside of the EU/EEA. This happens when we share your information within the Klarna Group or with a supplier, subcontractor, or store which operates outside the EU/EEA. Klarna always ensures that the same high level of protection applies to your personal data according to the GDPR, even when the data is transferred outside of the EU/EEA. Your rights in respect to your personal data (described in detail in section 2), are not affected when data is transferred outside of the EU/EEA. More information about the recipients Klarna shares your data with you can find in section 7.
When you shop with a store placed in a country outside of the EU/EEA area, our sharing of your personal data with that store means that your personal data will be transferred to this country outside of the EU/EEA area.
Certain suppliers of Klarna use Binding Corporate Rules (“BCR”) when they transfer personal data outside of the EU/EEA area within their own company group. Such BCR have been approved by an EU data protection authority and ensures that the same high level of protection applies to your personal data when it is transferred.
If you want more information about our safety measures you can always contact us. You can find our contact information in section 12. You find more information about which countries are deemed to have an “adequate level of protection” on the European Commission’s website. You can read more about the European Commission’s standard clauses here, and about binding corporate rules (“BCR”) here.
Safety measures which Klarna uses when transferring personal data outside of the EU/EEA
Countries outside of the EU/EEA may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the GDPR). Such appropriate safeguards include, but are not limited to, ensuring:
if the European Commission has decided that the country outside of the EU/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. This means for example that the personal data is still protected from unauthorized disclosure, and that you may still exercise your rights in regards to your personal data, or
the European Commission’s standard clauses have been entered into between Klarna and the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affect the protection of your personal data. Where necessary, we take technical and organizational measures so that your data remain protected during the transfer to the relevant country outside the EU/EEA.
that the transfer is covered by the EU-US Data Privacy Framework. This is an opt-in certification scheme for US companies, administered by the US Department of Commerce. This Privacy Framework includes a set of enforceable principles and requirements that must be certified to by the US company, ensuring that your data is still being sufficiently protected.
Despite the above, if the store where you choose to shop is located in a country outside the EU/EEA, our data sharing with that store (and with the Klarna entity that store has contracted with) means that your personal data will be transferred to and processed in this country outside the EU/EEA. Click here to access the privacy notices for other Klarna entities in the Klarna Group. Otherwise it would not be possible to administer your purchase. Klarna primarily relies on the European Commission’s standard clauses to ensure the protection of your personal data for such data transfers, but as set out above, countries where the foreign store is located may have laws preventing the efficient protection by the standard clauses. Even if this is the case, your personal data will still be transferred to the foreign store (or the foreign store’s local Klarna entity), as long as the data transfer is necessary to administer your specific purchase.
9. How long we store your personal data
How long Klarna stores your personal data depends on the purposes for which Klarna uses the personal data:
Personal data used for the contractual relationship between you and Klarna is generally stored for the duration of the contractual relationship and thereafter for a maximum of 10 years based on statutes of limitations.
Personal data that Klarna is under a legal obligation to retain, for example under anti-money laundering laws or bookkeeping laws, is generally retained for 5 and 7 years respectively.
Personal data which is not used for the purposes of your contractual relationship with Klarna or where Klarna does not have a legal obligation to retain the data is only retained as long as necessary to fulfill the respective purpose for our data processing (usually 3 months). More information can be found in the table in section 4.
In some limited cases, the personal data may need to be stored for a longer period because of capital adequacy laws which Klarna has to comply with.
The legal obligations referred to above means that Klarna can not delete your personal data, even if you request us to delete it, as described in section 2. If we don’t have a legal obligation to retain the personal data, we instead have to make an assessment if we may require the personal data in order to protect Klarna from legal claims.
Please note that just because we have a legal obligation to store your personal data, this does not mean that we are also permitted to use this data for any other purpose. Klarna will make an assessment for each specific purpose of how long we may use your personal data. You can read more about this in section 4.
10. How we use cookies and other types of tracking technology
To provide a tailored and smoooth experience, Klarna uses cookies and similar tracking technologies in our multiple interfaces, such as our website, the Klarna mobile application and at the checkout of a store that uses Klarna. You can find information about the tracking technology that Klarna uses, and information about how you accept or decline the tracking technology, in each interface.
11. Updates to this privacy notice
We are constantly working to improve our services so that you have a smoooth user experience. This may involve modifications of existing and future services. If that improvement requires a notice or consent in accordance with applicable law, you will be notified or given the opportunity to give your consent. It is also important that you read this privacy notice every time you use any of our services, as the processing of your personal data may differ from your previous use of the service in question.
12. Klarna contact information
Klarna Bank AB (publ) is registered with the Swedish Companies Registration Office with company number 556737-0431 and its registered office is located at Sveavägen 46, 111 34 Stockholm.
Klarna has a data protection officer and a team of data protection specialists. We also have a number of customer service teams that handle data protection issues. You can reach out via email to support.eu@klarna.com. If you specifically wish to contact Klarna’s data protection officer, enter this on the subject line.
Klarna Bank AB (publ) complies with Swedish data protection laws. Please visit www.klarna.com for more information about Klarna.