At Devengo we care about your privacy. Here we explain what personal data we process, what for, how long we keep it, who we share it with and how you can exercise your rights.
This policy applies to people who visit devengo.com and its subdomains (the “Website”), to those who contact us, and to the people whose data we process in connection with our payment services, even if they have not provided it through the Website.
Who are we?
The data controller is DEVENGO, S.L. (tax ID B-88353412), with registered office at Calle Barquillo 40, 1º derecha, 28004 Madrid, Spain, registered with the Madrid Commercial Registry (Registro Mercantil de Madrid), volume 39.112, folio 9, sheet M-694.923. We are a payment institution authorised and supervised by the Bank of Spain (registration number 6940).
If you have any questions about this policy or about your data, write to gdpr@devengo.com. If you wish to contact our Data Protection Officer, write to dpo@devengo.com.
What data do we process?
Identification and contact details: name, email address, telephone number and address.
Professional details: job title and the company you represent.
Client and related-person data: company documentation, powers of representation, beneficial ownership, economic activity, source of funds and identity document.
Payments and accounts: bank account, amounts, payment reference, counterparty and the result of payee verification.
Technical and browsing data: IP address, device, browser and cookies, depending on what you choose in the cookie banner.
Communications: your messages, enquiries, complaints and your preferences regarding commercial communications.
If you do not provide the data marked as mandatory in a form, we will not be able to handle your request. In the case of our clients, the law requires us to identify the company and its representatives, authorised representatives and beneficial owners; without that data we cannot provide the service.
Where do we get your data from?
From you: when you browse the Website, write to us, subscribe to the newsletter or enter into a contract with us.
From the client company: when you are its representative, authorised representative, beneficial owner or authorised user. The client company is responsible for informing you, and that is why we include this in our contracts.
From a payment transaction: if you are the payer or the payee of a payment made by a client.
From our suppliers: if you are a supplier, you provide us with the details of your contact persons.
From official lists and specialised providers: to check international sanctions and whether a person is a politically exposed person.
What do we use your data for, and on what basis?
Handling your information and contact requests. Basis: pre-contractual measures at your request.
Providing our payment services and managing the relationship with our clients: opening and managing accounts, executing payments, verifying account ownership and handling incidents and complaints. Basis: performance of the contract.
Complying with the law: prevention of money laundering and terrorist financing (including identification of clients and related persons, also remotely), international sanctions, payment services regulation, tax obligations and requests from authorities. Basis: legal obligation.
Detecting and preventing fraud and checking that transactions respect the limits agreed with the client. Basis: our legitimate interest in protecting funds and the service.
Sending you commercial communications. Basis: your consent. To our clients we send communications about similar services on the basis of legitimate interest, with an unsubscribe option in every email.
Measuring use of the Website and showing marketing content through non-technical cookies. Basis: your consent. See our Cookie Policy.
Managing suppliers and collaborators. Basis: contract, legal obligation and, for contact persons, legitimate interest.
Where processing is based on your consent, you can withdraw it at any time without affecting processing already carried out.
Anti-money-laundering regulations prohibit us from disclosing certain actions. For that reason, your right to information and access may be limited in those cases.
Who do we share your data with?
We do not sell your data. We only share it with:
Our authorised staff, within their duties.
Providers that process data on our behalf (hosting, marketing and analytics tools, identity verification and customer support). We engage them with safeguards and sign data processing agreements with them. You can ask us for more information at gdpr@devengo.com.
Entities involved in payments: banks and payment service providers of the other party, Iberpay, the institution where funds are safeguarded and, if the client has appointed one, its technical partner.
Authorities, such as SEPBLAC (Spain’s financial intelligence unit), the Bank of Spain, the Tax Agency or the courts, when a rule requires it.
Some providers may process data outside the European Economic Area. We only do so with the safeguards required by law, such as a European Commission adequacy decision or standard contractual clauses, and you can ask us for a copy at gdpr@devengo.com.
How long do we keep your data?
Only for as long as necessary for the purpose for which we collected it. After that, we keep it blocked while liabilities may arise and, once that period has passed, we delete it.
Contact form: one year from the last interaction, unless you become a client.
Newsletter: until you unsubscribe.
Clients, related persons and payment transactions: up to ten years from the end of the relationship or from the transaction, as required by anti-money-laundering regulations. Some data, such as certain alerts with no legal relevance, is deleted earlier.
Verification of a payment’s payee: 60 days.
Suppliers: contact details, for the duration of the relationship and one year afterwards. Contracts and accounting records, six years.
Cookies: the period stated in our cookie policy.
Rights requests: three years from our response.
If the law requires us to keep data for longer, or we need it to defend ourselves against a claim, we keep it for that period.
Profiling and automated decisions
To detect fraud and check limits, we compare payment activity with the client’s declared profile. No decision to block or reject is taken solely by automated means: a person reviews every alert before it takes effect.
What rights do you have?
Access: to know what data of yours we process and obtain a copy.
Rectification: to correct inaccurate or incomplete data.
Erasure: to ask us to delete your data when it is no longer necessary or the processing is unlawful.
Restriction: to ask us to stop using your data while a question about its processing is being resolved.
Objection: to object to processing based on our legitimate interest and to commercial communications.
Portability: to receive your data in electronic format and transmit it to another controller.
Withdraw your consent at any time.
You can exercise them free of charge by writing to gdpr@devengo.com or through our rights request form, stating which right you are exercising. We will only ask you to prove your identity if we have reasonable doubts about it. We respond within one month, extendable by two further months if the request is complex. If we act on behalf of a client, you can also contact them.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid; telephone +34 901 100 099 / +34 91 266 35 17; https://sedeagpd.gob.es; www.aepd.es.
Security
We apply technical and organisational measures appropriate to the risk, such as encryption, access controls, backups and training for our staff, who are bound by confidentiality. If a security breach affects your data, we will notify the authority and, where appropriate, you, in accordance with the law.
Links to other websites and cookies
The Website may contain links to third-party sites, which have their own privacy policies. To find out how we use cookies, see our Cookie Policy. If you wish to report an infringement, you can use our whistleblowing channel.
Changes to this policy
We may update this policy. We will publish the current version here with its date and will let you know if the change is significant. You do not need to accept it to keep using the Website.
Last updated: 6 November 2026.