vebbopay.com - programmable money

At VebboPay, operated by Cibeeo Inc SRL, we are committed to protecting your personal data and upholding your rights as a data subject. This Consumer Data Rights Policy outlines the rights available to you under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable data protection legislation. We encourage you to read this document carefully so that you understand how to exercise your rights in relation to the personal data we process.

1. Your Rights Under the GDPR

As a data subject whose personal data is processed by Cibeeo Inc SRL, you are entitled to the following rights under the GDPR. These rights are not absolute and may be subject to limitations and exceptions as provided by applicable law, including obligations arising from anti-money laundering (AML), know-your-customer (KYC), and other financial regulatory requirements.

1.1 Right to Be Informed (Articles 13 & 14)

You have the right to be informed about the collection and use of your personal data. This includes information about the purposes of processing, the legal basis for processing, retention periods, and your rights as a data subject. We provide this information through our Privacy Policy, this Data Rights Policy, and any supplementary notices presented to you at the point of data collection. Where we obtain personal data from sources other than directly from you, we will provide you with the required information within a reasonable period and no later than one month after obtaining the data.

1.2 Right of Access (Article 15)

You have the right to obtain confirmation as to whether or not your personal data is being processed by Cibeeo Inc SRL, and where that is the case, to access the personal data together with the following information:

The purposes of the processing
The categories of personal data concerned
The recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations
Where possible, the envisaged period for which the personal data will be stored, or if not possible, the criteria used to determine that period
The existence of the right to request rectification, erasure, restriction of processing, or to object to processing
The right to lodge a complaint with a supervisory authority
Where the personal data is not collected directly from you, any available information as to its source
The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you

We will provide a copy of the personal data undergoing processing free of charge. For any further copies requested, we may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, and unless you request otherwise, the information shall be provided in a commonly used electronic format.

1.3 Right to Rectification (Article 16)

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. You may update certain personal information directly through your VebboPay account settings, or you may submit a rectification request to us using the contact methods described in Section 3 below. We will take reasonable steps to verify the accuracy of the corrected data before implementing the change.

1.4 Right to Erasure / Right to Be Forgotten (Article 17)

You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:

The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed
You withdraw your consent on which the processing is based and there is no other legal ground for the processing
You object to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or you object to processing for direct marketing purposes
The personal data has been unlawfully processed
The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which Cibeeo Inc SRL is subject

Important AML/KYC Limitations: Please note that as a regulated financial services provider, Cibeeo Inc SRL is subject to anti-money laundering (AML) and know-your-customer (KYC) obligations under EU Directive 2015/849 (the Fourth Anti-Money Laundering Directive) and its amendments. These obligations require us to retain certain personal data, including identity verification documents, transaction records, and related information, for a minimum period of five (5) years after the end of the business relationship or after the date of an occasional transaction. In such cases, we will not be able to fulfil your erasure request until the applicable retention period has expired. We will inform you of any such limitations when responding to your request.

1.5 Right to Restrict Processing (Article 18)

You have the right to obtain from us the restriction of processing where one of the following applies:

The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data
The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead
We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise, or defence of legal claims
You have objected to processing pursuant to Article 21(1) pending the verification of whether our legitimate grounds override yours

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

1.6 Right to Data Portability (Article 20)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another controller without hindrance from us, where:

The processing is based on your consent or on a contract to which you are a party; and
The processing is carried out by automated means

Where technically feasible, you have the right to have the personal data transmitted directly from Cibeeo Inc SRL to another controller. This right applies to data you have actively provided to us (such as account information and transaction data) and data generated by your use of the VebboPay platform. We will provide your data in JSON or CSV format, as appropriate.

1.7 Right to Object (Article 21)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on legitimate interests pursued by Cibeeo Inc SRL (Article 6(1)(f)) or on the performance of a task carried out in the public interest (Article 6(1)(e)), including profiling based on those provisions. Upon receiving your objection, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

1.8 Rights Related to Automated Decision-Making and Profiling (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. VebboPay uses automated systems for fraud detection, risk assessment, transaction monitoring, and AI agent oversight. Where such automated processing results in a decision that produces legal effects or similarly significantly affects you, you have the right to:

Obtain human intervention on the part of Cibeeo Inc SRL
Express your point of view regarding the automated decision
Contest the decision made by the automated system

This right does not apply where the decision is necessary for entering into, or performance of, a contract between you and Cibeeo Inc SRL; is authorised by Union or Member State law to which Cibeeo Inc SRL is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or is based on your explicit consent.

1.9 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw your consent by adjusting your preferences in your VebboPay account settings, by contacting us at privacy@vebbopay.com, or by using the specific opt-out mechanisms provided in our communications to you. We will process your withdrawal request promptly, and in any event within 30 days of receipt.

1.10 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. For users based in Romania, the relevant supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP). Contact information for the ANSPDCP:

Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336, Bucharest, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

If you are located in another EU/EEA Member State, you may lodge a complaint with your local data protection authority.

2. Rights for California Residents (CCPA/CPRA)

If you are a resident of California, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). While Cibeeo Inc SRL is a European entity, if you are a California resident and our processing of your personal information falls within the scope of the CCPA/CPRA, you may exercise the following rights:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting or selling the information, and the categories of third parties with whom we share the information.
Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions, including our legal and regulatory retention obligations.
Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information as those terms are defined under the CCPA/CPRA. VebboPay does not sell personal information in the traditional sense. However, certain data sharing arrangements may qualify as a "sale" or "sharing" under the CCPA/CPRA, and you have the right to opt out of such arrangements.
Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information to purposes necessary for providing you with the VebboPay services.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, or provide a different level or quality of service because you exercised your rights.

To exercise your CCPA/CPRA rights, please contact us using the methods described in Section 3 below. We will verify your identity before processing your request.

3. How to Exercise Your Rights

You may exercise any of the rights described in this policy through the following channels:

Email: Submit your request to privacy@vebbopay.com with the subject line "Data Rights Request." Please include your full name, the email address associated with your VebboPay account, and a clear description of the right you wish to exercise.
In-App Settings: Certain rights, such as updating your personal information, adjusting consent preferences, and downloading your data, can be exercised directly through the settings section of your VebboPay account.
Written Request: You may send a written request by post to: Cibeeo Inc SRL, Data Protection Office, Romania. Please include your full name, account email address, and the specific right you wish to exercise.

4. Response Timeframes

Upon receiving your request, we will acknowledge receipt and begin processing it. Under the GDPR, we are required to respond to your request without undue delay and in any event within one (1) month (approximately 30 days) of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. In such cases, we will inform you of the extension within the first month, together with the reasons for the delay. The total maximum response time is therefore three (3) months (approximately 90 days).

For requests made under the CCPA/CPRA, we will respond within 45 calendar days, which may be extended by an additional 45 days where reasonably necessary, provided we notify you of the extension.

Where we are unable to fulfil your request, either in whole or in part, we will provide you with a clear explanation of the reasons for our inability to comply, along with information about your right to lodge a complaint with the relevant supervisory authority.

5. Identity Verification

To protect the security of your personal data, we are required to verify your identity before processing any data rights request. The level of verification required will depend on the nature of the request and the sensitivity of the data involved. Verification methods may include:

Confirmation of the email address associated with your VebboPay account
Multi-factor authentication through the VebboPay platform
Submission of a government-issued photo identification document
Matching specific account details known only to the account holder

If you are submitting a request on behalf of another person (as an authorised agent), we may require you to provide a signed authorisation letter, power of attorney, or other evidence of your authority to act on behalf of the data subject. We reserve the right to refuse requests where we are unable to adequately verify the identity of the requestor.

6. Contact Us

If you have any questions about this Consumer Data Rights Policy or wish to exercise your rights, please contact our Data Protection Officer:

Email: privacy@vebbopay.com
Entity: Cibeeo Inc SRL
Jurisdiction: Romania, European Union