Privacy Policy

Data Accessed

• Account holder name and address
• Bank account number (IBAN) and bank details
• Account balance information
• Transaction history including:
• Transaction amounts and currencies
• Booking and value dates
• Counterparty names (payer/payee)
• Payment references and QR codes
• Transaction descriptions

Legal Basis and Consent

We process your banking data based on your explicit consent (Art. 6 para. 1 lit. a GDPR, Art. 31 para. 1 DSG). Consent is obtained through Strong Customer Authentication (SCA) directly with your bank during the connection process.

How It Works

1. You initiate the bank connection in your PayMatch account
2. You are redirected to bLink (SIX Group) for authentication
3. You authenticate with your bank using your online banking credentials
4. Your bank grants PayMatch read-only access to your account data
5. PayMatch fetches transactions via bLink's secure API
6. We never see or store your banking login credentials

Data Security for Banking Information

• OAuth 2.0 authentication (no credential storage)
• TLS 1.3 encrypted communication
• Access tokens encrypted with AES-256
• Automatic token expiration and refresh
• Client certificate authentication
• Read-only access (no payment initiation)
• Compliance with Swiss banking secrecy laws

Third-Party Service Provider

Banking transaction data is transmitted from your bank to PayMatch via the bLink platform (SIX Group AG, Zurich, Switzerland). SIX Group acts as a technical intermediary and is bound by Swiss banking secrecy and data protection laws. bLink is registered as an Account Information Service Provider under Swiss Open Banking standards.

We do not sell, rent, or share your banking data with any third parties except as required by law.

Your Rights and Control

• Disconnect at any time: You can disconnect your bank account immediately through your account settings
• Withdraw consent: Disconnecting revokes our access to future transactions (historical data retained per legal requirements)
• View connected accounts: See which accounts are connected and last sync time
• Data portability: Export your transaction data in machine-readable format
• Consent validity: Bank connections expire after 90 days and require re-authentication

Technical Security Measures

• Encryption:
  • TLS 1.2+ for all data in transit
  • AES-256 encryption for sensitive data at rest
  • Encrypted database backups
• Authentication & Access Control:
  • Multi-factor authentication (MFA) available
  • Role-based access control (RBAC)
  • Secure password hashing (bcrypt)
  • Session management with automatic timeout
• Infrastructure Security:
  • Regular security patches and updates
  • Automated vulnerability scanning
  • DDoS protection
  • Firewall and intrusion detection
• Monitoring & Response:
  • 24/7 security monitoring
  • Automated anomaly detection
  • Incident response procedures
  • Regular security audits

Additional Security for Bank Connections

• OAuth 2.0 authentication (no credential storage)
• Client certificate authentication for API access
• Access tokens encrypted and automatically rotated
• Read-only access to bank accounts (no payment initiation)
• Compliance with Swiss banking secrecy laws
• PSD2/Strong Customer Authentication (SCA) compliant

Organizational Security Measures

• Background checks for employees with data access
• Confidentiality agreements with all staff
• Regular security training and awareness programs
• Principle of least privilege for data access
• Documented incident response and breach notification procedures
• Regular security assessments and penetration testing

Data Backup and Recovery

We maintain automated daily backups of all data, stored in geographically distributed locations with encryption. Our disaster recovery plan ensures business continuity and data availability with a Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 24 hours.