In3 Merchant Privacy Statement


1. Introduction

The in3 Garant payment method is a service provided by Capayable B.V. trading as in3 (hereinafter: in3). in3 processes your personal data as part of its activities because you are employed by the Merchant. It is also possible that you are an ultimate beneficial owner, managing director or representative of the Merchant. Through this Merchant privacy statement in3 informs you about the use of your personal data. in3 is obliged to do so pursuant to the General data protection regulation (GDPR).

2. Data Controller

in3 is responsible for processing your personal data.

Contact details for in3:

Capayable B.V.
Meerenakkerweg 1a
5652 AR Eindhoven
Chamber of Commerce reg. no.: 59234784

3. What personal data does in3 process, and for what purpose?

You are employed by the Merchant or are its name giver
When entering into a business relationship, in3 records your personal data starting from the request for information to the implementation of the in3 Garant payment method. in3 records the following data: name of the Merchant, name of contact person, job title, e-mail address, direct (cell)phone number. in3 uses these data to perform its agreement with the Merchant and for the internal administration and management of the organisation. in3 receives this information from you or other contact persons of the Merchant

You are ultimate beneficial owner, director or representative of the Merchant
For the purposes of the Dutch Anti-money laundering Act and for the purposes of sanction regulations, in3 records your name, date of birth, country of birth, address, postal code and place of residence, as well as your direct or indirect interest in the Merchant. in3 also records a copy of your passport or ID to verify your identity. in3 receives this information from the relevant Payment Services Provider.

4. With whom does in3 share your personal data?

in3 uses third parties who facilitate in3. These third parties provide assistance to in3 e.g. by sending payment statements and providing collection services and in that context receive names of Merchants.

in3 may also share data with third parties to finance its services. In connection with this, it assigns receivables against consum-ers who use the in3 Garant payment method and receivables against Merchants in relation to the fees for the use of in3 Garant (together the Receivables), to in3 Finance I B.V. (in3 Finance I). in3 Finance I may pledge the Receivables to third parties for the purpose of the financing. in3 Finance I may furthermore assign the Receivables to third parties for collection purposes. These parties will obtain names and addresses of the Merchants in order to dispose of the Receivables, and to collect and process payments. In addition, in3 may provide data to in3 Finance I in relation to ultimate beneficial owners, directors and representatives of Merchants to comply with statutory sanction regulations. The in3 Finance I merchant privacy statement can be found here

in3 may furthermore provide your personal data to third parties as part of a company takeover, such as to a potential buyer or its advisors, or to establish, exercise or defend its legal position or rights.

Finally, in3 may share your data with the authorities if required to do so by law. However, in3 will only agree to do this where the authorities demonstrate that in3 is legally required to cooperate.

When in3 shares your personal data as stated here, it takes all legal, technical and organisational measures to ensure that your data remain secure.

in3 does not sell personal data to third parties.

in3 does not process (or transfer) personal data to countries outside the EU

5. Purposes, legal basis and retention periods

DepartmentPersonal dataPurpose (why does in3 process your personal data?)Legal basis (why is in3 per-mitted to process your data)Retention period
Conducting businessName and address Merchant, name contact person, job title, email address and phone number.To provide and manage the in3 services and for internal processes, including sending payment statements and debt collection servicesJustified interest (art. 6 f GDPR). in3 has a justified interest to carry out its services
Legal retention obligation (art 6 c GDPR).
2 years after the last contact, unless a longer period is required by law.
Fraud pre-vention, anti-money laun-dering and compliance with sanction regulations.Name, address, email ad-dress, telephone number, interest in the Merchant and data to verify identity.To comply with applicable guidelines and legislation, such as the Act on the pre-vention of money laundering and terrorism.Legal (retention)obligation (art 6 c GDPR).5 years after the termination of the business relationship.
Internal management and financingName and address Merchant, name contact person, job title, email address and phone number.To finance in3’s services and in the event of a full or par-tial acquisition of in3 by a third party.Legitimate interest (art. 6 f GDPR). in3 has a legitimate interest in financing its services and in being able to transfer its business. Third party financiers and acquirers have an interest in obtaining the data to exercise their rights.2 years after the last contact
Defending/ establishing rightsName, address, email ad-dress, telephone number, name contact person, job title, email address, phone number, interest in Mer-chant and data to verify identity.To establish, exercise or defend in3’s legal position or rights.Legitimate interest (art. 6 f GDPR). in3 has a legitimate interest in being able to establish, exercise and defend its legal position and rights.During the dispute and for 5 years thereafter.

6. How in3 protects your data

in3 takes appropriate security measures to protect your data. In doing so, in3 predominantly ensures that your data do not become available to unauthorised persons and access to its systems is shielded.

7. Your rights

Access: you have the right to access your personal data which in3 is processing.

Rectification: in3 ensures that the personal data in3 holds relating to you are accurate and up-to-date. You can ask in3 to rectify or delete information if anything is incorrect in your data.

Erasure: You have the right to request your data to be deleted if those data are incorrect or irrelevant. It is not always possible for in3 to delete all data immediately due to statutory retention periods or performance of the payment agreement.

Objection: You can also object to any processing based on in3’s legitimate interest in line with the table in paragraph 5, in connection with your specific circumstances.

Requests to exercise the above rights can be sent to in3 may ask questions to verify your identity before processing your request.

Data portability: Where your personal data are processed automatically in performing an agreement, you have the right to request a machine-readable format for transfer to another party.

Complaints: You can raise a complaint regarding data protection via or with the Dutch regulatory authority at

8. Revisions to this Merchant Privacy Statement

in3 may revise this Privacy Statement if it changes its processing of personal data. Revisions might also be made owing to changes in law. You may request a copy of the most recent version of this Merchant Privacy Statement through You may also find this on the in3 website.

This Merchant Privacy Statement was last amended in June 2022.