7. Who do we share your personal data with?
When we share your personal data, we ensure that the recipient processes it in accordance with this notice, such as by entering into data transfer agreements or data processor agreements with the recipients. Those agreements include all reasonable contractual, legal, technical and organizational measures to ensure that your information is processed with an adequate level of protection and in accordance with applicable law.
7.1 Categories of recipients with whom Klarna will always share your personal information, regardless of the service you use.
7.1.1 Suppliers and subcontractors.
Description of the recipient: Suppliers and subcontractors are companies that only have the right to process the personal data they receive from Klarna on behalf of Klarna, i.e. data processors. Examples of such suppliers and subcontractors are software and data storage providers, payment service providers and business consultants.
Purpose and legal basis: Klarna needs access to services and functionality from other companies where it cannot perform them itself. Klarna has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.1.2 Klarna Group.
Description of the recipient: Companies in the Klarna Group.
Purpose and legal basis: This is required for Klarna to be able to provide you with services and functionality. Klarna has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
When you shop in a foreign store (meaning a store located outside of the EU/EEA area) that has an agreement with another company within the Klarna Group, the disclosure of your personal information between Klarna companies is required in order for the two Klarna companies to manage your payment and enable the foreign store to administer your purchase. The legal basis for this processing is the performance of a contract (Article 6 (1) (b) UK GDPR). The receiving Klarna company will handle your personal data in accordance with the privacy notice that applies in your country (see list). You can read more about how Klarna safeguards your personal data when transferred outside of the EU/EEA in Section 8.
7.1.3 A person who holds a power of attorney for your financial affairs.
Description of the recipient: Klarna may share your personal information with a person who has the right to access it under a power of attorney.
Purpose and legal basis: This processing is carried out to facilitate your contact with us (through agents), and takes place based on your consent (Article 6(1)(a) UK GDPR).
7.1.4 Authorities.
Description of the recipient: Klarna may provide necessary information to authorities such as the police, financial authorities, tax authorities or other authorities and courts of law.
Purpose and legal basis: Personal data is shared with the authority when we are required by law to do so, or in some cases if you have asked us to do so, or if required to manage tax deductions or counter crime. An example of a legal obligation to provide information is when it is necessary to take measures against money laundering and terrorist financing. Depending on the authority and purpose, the legal bases are the obligation to comply with the law (Article 6(1)(c) UK GDPR), to fulfil the agreement with you (Article 6(1)(b) UK GDPR), or Klarna’s legitimate interest in protecting itself from crime (Article 6(1)(f) UK GDPR).
There is also a requirement under UK law to withhold tax due on the payments. You will not need to do so, or take any action based on the agreement we have with the UK tax office (the HMRC), as we will disclose the necessary information to the UK tax office to support this agreement. If you have any questions regarding these arrangements, please contact the tax office.
7.1.5 Divestment of business or assets.
Description of the recipient: In the event that Klarna sells business or assets, Klarna may hand over your personal information to a potential buyer of such business or assets. If Klarna or a significant part of Klarna’s assets is acquired by a third party, personal information about Klarna’s customers may also be shared.
Purpose and legal basis: Klarna has a legitimate interest in being able to perform these transactions (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.2 Categories of recipients with whom Klarna shares your personal information when you use Klarna’s payment methods, log in with Klarna at a store, or choose to pay by debit or credit card in Klarna’s check-out at a store.
7.2.1 Stores.
Description of the recipient: By stores we mean the stores you visit or shop at (which may include the store’s group companies if you have been informed thereof by the store).
Purpose and legal basis: In order for the store to be able to perform and manage your purchase and your relationship with the store or its group companies, e.g. by confirming your identity, sending goods, handling questions and disputes, in order to prevent fraud and, where appropriate, send relevant marketing. The store’s privacy notice applies to the processing of your personal data that has been shared with the store and that the store processes. Normally, you will find a link to the store’s privacy notice on the store’s website. The legal basis for sharing data with stores is partly the performance of a contract (Article 6(1)(b) UK GDPR), insofar as the data sharing takes place to perform the contract between you and the store, and partly based on Klarna’s and the store’s legitimate interest (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.2.2 Payment service providers and financial institutions.
Description of the recipient: Payment service providers and financial institutions provide services to you, stores and Klarna to implement and administer electronic payments through a variety of payment methods, such as credit cards and bank-based payment methods such as direct debit and bank transfer.
Purpose and legal basis: Some stores use payment service providers with whom they share your information for managing your payment. This sharing takes place in accordance with the stores’ own privacy notices. The store may also let Klarna share your information with the payment service provider they use for processing your payment. Some payment service providers also collect and use your information independently, in accordance with their own privacy notices. This is the case, for example, for electronic wallet suppliers. In addition, Klarna may share your information with other financial institutions when conducting transactions with your account to complete the transactions. Sharing with payment service providers and financial institutions is performed to make a transaction initiated by you and it is done to fulfil the agreement with you (Article 6(1)(b) UK GDPR).
7.2.3 Fraud prevention agencies and companies providing identity checks.
Description of the recipient: Your personal data are shared with fraud prevention agencies and companies that provide identity checks.
Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided, and to combat fraudulent and criminal activities. The companies with which we work are listed here. Please note that these companies may process your data in accordance with their own data privacy notices.
Klarna shares your information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), as the fraud prevention agencies and the companies providing identity checks have information on fraud activities and identity confirmation which are important for Klarna to use as input to decrease its level of fraudulent transactions. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. You can also contact the entities listed in the link above, to exercise the same rights as stated in section 2 also against those entities.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details in Section 12 below.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
7.2.4 Google.
Description of the recipient: When you use Google Maps at checkout (for example, by searching your address in the address bar), your personal information will be shared with Google. Google will process your data in accordance with Google Maps/Google Earths terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), as Google Maps makes it possible to find the address functionality at checkout. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna’s payment methods involving the provision of credit or when you use the Klarna card or the one-time card.
7.3.1 Credit information bureaus.
Description of the recipient: If you apply to use a service from Klarna that involves us providing credit (see section 4.3 on which services from Klarna involve credit), we will share your personal data with credit information bureaus. Sharing does not take place in the event of small amounts or where we already have sufficient information.
Purpose and legal basis: Your personal information is shared with credit bureaus in order to assess your creditworthiness, to confirm your identity and your contact information, and to protect you and other customers from fraud. This data sharing constitutes a credit report.
If you apply to use a credit Service (see Section 4.1 above for a specification of our credit Services), your personal data may be shared with Credit Reference Agencies (“CRAs”) to assess your creditworthiness in connection with your application, to confirm your identity and your contact information, and to protect you and other customers from fraud.
For Pay Later in 30 days or Pay in 3, this sharing constitutes soft credit searches (or “soft credit lookups”) which does not affect your credit file nor credit score. The search is only visible to you and Klarna. In order to perform these credit searches, Klarna will send the CRAs your name, address, date of birth, phone number, as well as bank account number and sort code if relevant, in order to receive the lookups on you.
However, if you apply for one of our Financing products, a hard credit search (or “a hard credit lookup”) is performed in addition to soft searches. This is due to our Financing product constituting a regulated credit product under UK credit legislation. This hard credit search will be recorded on your credit file and may impact your credit score as follows:
The CRA will keep a record of our enquiry against your name and which may be linked to your representatives (“associated records”). For the purposes of any application for Services from us, you may be assessed with reference to “associated records”. Where any search or application is completed, or agreement entered into, involving joint parties, we may record details about this at the CRAs. As a result an “association” will be created that will link your financial records.
Details of which CRA we have used for a specific search are available on request.
In addition, if you open an agreement with one of our Financing products, we will share further information on your agreement with the CRAs. This will occur on a monthly basis until the agreement is closed. This will include details of your outstanding balance, payments made and any default or failure to meet the terms of your agreement. These records will remain on the CRAs’ files for 6 years after our agreement with you is settled or terminated, whether settled by you or, if applicable, your business or by way of default. This and other information about you (or, if applicable, your business and those with whom you are linked financially) may be used to make credit decisions about you in the future.
The ways in which CRAs use and share personal data are explained in more detail at; https://www.transunion.co.uk/crainand https://www.experian.co.uk/crain. The CRAs will process your information in accordance with their own privacy notices and you can find out which ones we cooperate with here.
Klarna shares your information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), as the credit information bureaus have information on your financial standing which is important for Klarna to use as input to ensure a correct credit assessment, and not grant credit to consumers who is unable to repay it. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights. You can also contact the entities listed in the link above, to exercise the same rights as stated in section 2 also against those entities.
Klarna retains credit information about you that we have received from a credit information bureaus only in script data format. If you would like to have a readable version, we recommend that you directly contact the credit bureau that informed you that Klarna requested a credit report.
7.3.2 Debt collection companies (for debts that are overdue).
Description of the recipient: Klarna may need to share your information when we sell or outsource collection of unpaid overdue debts through a third party, such as a debt collection company.
Purpose and legal basis: This data is shared to collect your overdue debts. Debt collection companies process personal data in accordance with their own privacy notices, or only on behalf of Klarna in their capacity as Klarna’s data processors. Debt collection companies may report your unpaid debts to credit information bureaus or authorities, which may affect your creditworthiness and your ability to apply for future credit. This data is shared based on our legitimate interest in collecting and selling debt (Article 6(1)(f) UK GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in collecting and selling debts. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.3.3 VISA and digital wallet suppliers.
Description of the recipient: We share information about you and your purchases when you use the Klarna card with VISA and with members of VISA’s card network. If you also add the Klarna card to your digital wallet, we may need to share your information with the supplier of that wallet. In such case, data will be processed in accordance with that supplier’s privacy notice.
Purpose and legal basis: The sharing takes place to the extent necessary to carry out card transactions, prevent fraud and follow the rules for VISA’s card network. If you renew your Klarna card or receive a new card, we will transfer this information to VISA so that VISA can inform third parties with whom you have previously chosen to save your card information (for example, for recurring transactions). Sharing is performed to fulfil the agreement with you (Article 6(1)(b) UK GDPR).
7.3.4 Debt acquirers (for open debts).
Description of the recipient: Klarna can transfer your open debt to debt acquirers.
Purpose and legal basis: Upon transfer of your debt to an acquirer and continuously until you pay off the debt, Klarna will share your contact and identification information (name, date of birth, social security number, address, and phone number), information about your financial standing (such as residual credit, repayments and any negative payment history in relation to the current debt), as well as information about the goods or services associated with the debt. The buyer will process your personal data in accordance with its own privacy notice, which you will receive information about when the debt is transferred.
The sharing of personal data with different acquirers is based on our legitimate interest in selling outstanding debts as part of our business operations (Article 6(1)(f) UK GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your personal data processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights.
7.4 Categories of recipients when using the Klarna accounts service (savings and payment accounts).
7.4.1 Credit institutions and other financial institutions.
Description of the recipient: We share your information with credit institutions and other financial institutions (such as other banks) when you make transactions or payments to other accounts.
Purpose and legal basis: If you have made payments to a Klarna account, Klarna will process the information we receive from the bank you used for the transaction, such as contact and identification data and payment information. If you make transactions or payments to accounts in other banks, Klarna will also pass on some of your contact and identification data as well as payment information to the recipient and also to the recipient’s credit institution or financial institution. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) UK GDPR).
7.5 Categories of recipients with whom Klarna shares your personal information when you use Klarna’s Shopping Service.
You may find the terms for the Klarna Shopping Service here.
7.5.1 Affiliate Networks.
Description of the recipient: When you choose to click on a sponsored link in the Klarna mobile application or on our website that links to a store, product or service, you will be redirected to another company’s website through a third party, known as an affiliate network. Here you can learn which affiliate networks Klarna cooperates with (presented in the left column). The affiliate networks will process your device information in accordance with their own privacy notices (you will find these privacy notices in the right column in the same link as referenced above). The store you visit through a sponsored link determines which affiliate network processes your information. Usually a store only cooperates with one affiliate network. You can get more information about which network by contacting us (or the store).
Purpose and legal basis: The affiliate network may place tracking technology on your device that contains information about you clicking on that link in the Klarna mobile application, and which is then used to document your visit to the store to calculate a potential commission due to Klarna.
The processing is based on a balancing of interests (Article 6(1)(f) UK GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in supplying you with sponsored links in order to market shops in the Klarna mobile application and on our website. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.
You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2for more information about your rights.
7.5.2 Google.
7.5.2.1 reCAPTCHA
Description of the recipient: When you use the Klarna mobile application through our web portal, Google will collect your device information through Google’s reCAPTCHA service which is implemented there, in some cases together with additional information that you choose to enter into the reCAPTCHA service.
Purpose and legal basis: Klarna processes this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR), since the reCAPTCHA service prevents misuse of our services (for example by preventing bots from trying to log in). Google will process this information in accordance with its terms of service and privacy policy. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.
You are entitled to object to this processing, for reasons connected to the circumstances in your particular case. See section 2for more information about your rights.
7.5.2.2 Google Maps
Description of the recipient: In order to show where your parcel will be delivered on an integrated map in the Klarna mobile application, we share the relevant delivery address with Google. Google will process your data in accordance with Google Maps’/Google Earth’s terms of service and privacy policy.
Purpose and legal basis: Klarna shares this information based on Klarna’s legitimate interest in conducting its business (Article 6(1)(f) UK GDPR). By using Google Maps we are able to show you the delivery address on an integrated map in the Klarna mobile application. We ensure that this processing is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You have the right to object to this processing, for reasons connected to the circumstances in your particular case. See section 2 for more information about your rights and how to use them.
7.5.3 Partners within the framework of the Personal Finance service and the offer and benefit program.
Description of the recipient: Partners within the framework of the Personal Finance service and the offer and benefit program.
Purpose and legal basis: If you choose to take advantage of Klarna’s offers and benefits within the framework of the Personal Finance service or the offer and benefits program, Klarna will share the personal information required for you to take advantage of the offer with our business partners (which includes the fact that you are a Klarna customer). Each offer specifies the data that will be shared. Data is shared to perform the agreement between yourself and Klarna (Article 6(1)(b) UK GDPR).
7.5.4 Logistics and transport companies.
Description of the recipient: Logistics and transport companies.
Purpose and legal basis: Klarna will share your personal information with logistics and transport companies that deliver the goods you order if you have signed up for parcel tracking. Examples of information we share are contact and identification data and tracking numbers.
Logistics and transport companies process your data in accordance with their own privacy notices. Sharing is performed to fulfil the agreement between you and Klarna (Article 6(1)(b) UK GDPR).
7.6 Categories of recipients with which Klarna shares your personal information if you contact our customer service through social media.
7.6.1 Social media.
Description of the recipient: Social media companies such as Facebook, Instagram or Twitter.
Purpose and legal basis: If you contact us via social media such as Facebook or Twitter, your personal data will also be collected and processed by these companies, in accordance with their privacy notices. Sharing is performed to fulfil the agreement with you (Article 6(1)(b) UK GDPR).