Privacy Policy
Last updated: 27 July 2026
Previous versions (2)
Pursuant to EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"), this Privacy Notice describes how we collect and process your personal data when you register and / or access the Kleos application and request the services provided by us (the "Service"), or benefit from this Service. To the extent that you are a customer of our services, or a simple user of this website, this Privacy Notice applies together with any terms of business and other contractual documents, including but not limited to any agreements we may have with you. Regarding the terms used in this Privacy Notice, such as "processing" or "controller" or "personal data", we refer to the definitions of the GDPR.
1. Who is the data controller?
The data controller of personal data processed in connection with the Kleos Services is Kleos Ireland SR Limited, with registered office at The Black Church, St. Mary’s Place, Dublin 7, Ireland D07 P4AX, operating under the brand name Kleos (hereinafter referred to as “Kleos” or “we”).
To the extent that Kleos processes personal data on behalf of and upon the documented instructions of Lightspark Payments Europe AS and/or the relevant card issuer, Kleos acts as a data processor. In all other circumstances where Kleos determines the purposes and means of processing personal data in connection with the Services, Kleos acts as an independent data controller.
Nothing in this Privacy Policy shall be construed as creating a joint controllership relationship between Kleos and any third party unless expressly stated otherwise.
2. How do we obtain your personal data?
We collect your personal data directly from you at the time you (i) register with Kleos (via website or application); (ii) access and/or use; (iii) contact us via the website or our support center.
3. What personal data does Kleos process, what are the legal grounds and the scope of processing?
| Processed Data | Legal Grounds | Scope of Processing |
|---|---|---|
| Identity Data First name, last name, title, date of birth, ID documents (national ID card, passport, driver's licence) |
Art. 6(1)(b) GDPR — Performance of contract Art. 6(1)(c) GDPR — Legal obligation | Registration and onboarding; compliance with Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations |
| Contact Data Residence details, billing and delivery address, email address, telephone number |
Art. 6(1)(b) GDPR — Performance of contract | Delivery of the Services (card) |
| Financial Data Payment card details, amounts associated with accounts, external account details, source of funds and related documentation |
Art. 6(1)(b) GDPR — Performance of contract Art. 6(1)(c) GDPR — Legal obligation | Payment processing; AML/tax compliance; verification of the source of funds |
| Transactional Data Details about incoming and outgoing operations |
Art. 6(1)(b) GDPR — Performance of contract Art. 6(1)(c) GDPR — Legal obligation | Service execution; AML monitoring; regulatory reporting |
| Technical Data IP address, device data, browser type and version, location data, time zone, language, operating system, diagnostics |
Art. 6(1)(f) GDPR — Legitimate interest | Statistical analysis of service usage; technical diagnostics; monitoring of service functioning |
| Access Data Username, password, unique file number (provided when accesing customer support) |
Art. 6(1)(b) GDPR — Performance of contract Art. 6(1)(f) GDPR — Legitimate interest | Account access and security; management of the customer support services |
| Biometric Data Selfie picture |
Art. 6(1)(c) GDPR — Legal obligation Art. 9(2)(g) GDPR — Substantial public interest (AML legislation) | Identity verification as required by AML European regulations - retained only until verification is complete, and no longer than 1 year from the registration date |
| Marketing Data Email address |
Art. 6(1)(a) GDPR — Consent | Sending newsletters, promotional communications and updates regarding Kleos services, as well as analysing the effectiveness of such communications |
4. Is the provision of data mandatory or optional?
The collection and the processing of your personal data above is optional but failing to provide the data would prevent the possibility for you to enter into the Terms of Service and be provided with the Service. The provision of your Biometric Data (selfie picture) is mandatory to the extent required by applicable anti-money laundering legislation. Failure to provide such data will prevent us from completing the legally required identity verification process and, consequently, from providing you with the Service. Also, please note that this biometric data is being processed by a compliant AI system for identity verification. The provision of personal data for marketing purposes is optional and based on your consent. Refusal to provide such data, or withdrawal of consent at any time, will not affect your ability to register for or use the Service.
5. How will the personal data be processed and for how long will they be stored?
Your personal data will be processed using automated and non-automated means. Specific security measures are put in place to prevent data loss, illicit or incorrect use and unauthorized access. Your personal data will be retained for 5 years from the date on which the contract between us has terminated or from the date of the last event interrupting the statutory prescription period. The same retention period applies for data processed through the rejected applications. Notwithstanding the above, your Biometrical Data (selfie picture) is subject to a specific and more limited retention period, in accordance with the principle of storage limitation. Your biometrical data will be retained only for as long as strictly necessary to complete the identity verification process and, in any event, for no longer than the retention period as required by applicable law (which currently does not exceed 12 months from the date of registration with Kleos. Upon expiry of such retention period, biometrical data will be securely deleted or anonymized. Personal data processed for marketing purposes will be retained until you withdraw your consent or, where applicable, for a period of 12 months from your last interaction with a marketing communication, whichever occurs first.
6. Will the personal data be disclosed to third parties?
Your personal data may be disclosed to third parties belonging to the following categories: companies within our group to the extent required to provide and improve our Services; banks and payment institutions, to the extent necessary to make or receive payments in connection with the Services; taxation public authorities, to the extent required by the law; judicial authorities and/or police forces, when required by the law; lawyers and law firms, where necessary to pursue our legitimate interest in exercising or defending a right in court and out of court; consultants and IT service providers, to the extend required by them to fulfill their contractual obligations towards us.
7. Third Party Data Controllers
In connection with the provision of the Kleos Services, your personal data may be received from, shared with, or otherwise processed by third-party service providers engaged by Kleos for the provision of certain services, including payment, card, and other related services. Such third-party service providers may act as independent data controllers for the processing activities carried out under their responsibility and in accordance with their respective privacy policies and applicable law.
Third-party service providers, including Lightspark Payments Europe AS and any relevant card issuer, process personal data in accordance with their own privacy notices, which are made available to you directly by such providers or through their respective websites.
Through the Kleos website and application, you may also access platforms (e.g. Instagram, LinkedIn, Facebook) provided by third-party service providers acting as independent data controllers for their own purposes. Such providers rely on the legal bases for processing personal data as disclosed in their respective privacy notices.
8. Will the personal data be transferred outside the European Economic Area?
In general, your personal data is processed and stored within the European Union. However, certain personal data may be transferred within our group of companies in the United Kingdom (UK), to the extent necessary for the provision of the Service, or compliance with applicable legal obligations. The United Kingdom, following its withdrawal from the European Union, has been granted an adequacy decision by the European Commission, pursuant to article 45 of the GDPR. This
means that the UK is recognised as providing an equivalent level of protection for personal data as that guaranteed within the EEA, and transfers to the UK may take place without the need for additional safeguards. Certain personal data may be transferred to recipients in the United States of America, in particular IT service providers supporting the provision of the Service. Such transfers shall take place either (i) to recipients certified under the EU–U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023, or (ii) on the basis of appropriate safeguards pursuant to Article 46 of the GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented, where necessary, by additional technical and organisational measures following a transfer impact assessment. Further information on the safeguards applied may be obtained by contacting the Data Protection Officer. In the event that the adequacy decision is suspended, repealed or amended, or in the event that transfers made to UK or US based recipients are not covered by the adequacy decision, Kleos will ensure that appropriate safeguards are in place in accordance with article 46 of the GDPR, including, where applicable, the use of Standard Contractual Clauses adopted by the European Commission.
9. What are your rights in relation to us processing your data?
a) Right of access: You have the right to obtain information from us concerning whether and to what extent we process your data.
b) Right to rectification: If we process data that is incomplete or incorrect, you shall have the right to obtain rectification or completion of this data from us at any time.
c) Right to erasure: You have the right to obtain from us the erasure of your data in the event that we have unlawfully processed this data or if processing this data constitutes a disproportionate infringement of your legitimate interests. Please note that immediate erasure may be barred on some grounds, e.g. statutory retention provisions, legal grounds.
d) Right to restriction of processing: You have the right to obtain restriction of processing your data if:
- you contest the accuracy of the data, for a period enabling us to verify the accuracy of the data,
- the processing is unlawful, and you however oppose the erasure of the data and request the restriction of their use instead,
- we no longer need the data for the intended purposes, but you require these data for the establishment, exercise or defense of legal claims, or
- you have objected to the processing of the data.
e) Right to data portability: You have the right to receive the data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit these data to another responsible party without hindrance from us, provided that the processing is carried out by automated means. If technically feasible, you have the right to have your data transmitted directly to another responsible party by us.
f) Right to object: If we process your data on the basis of legitimate interests, you have the right to object to this processing, on grounds relating to your particular situation, at any time. We shall then no longer process your data unless we can demonstrate compelling, legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
h) Right to file a complaint: Should you deem that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority of the EU Member State where you live or work, or where the alleged breach has occurred (Article 77 of the GDPR), or to take legal action before a court (Article 79 of the GDPR).
g) Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw your consent by contacting us using the details provided in Section 10 or by using the unsubscribe link included in each marketing communication.
10. How can you exercise the above-mentioned rights?
To exercise your rights, please contact us by mail at "Kleos Ireland SR Limited, with registered office at The Black Church, St. Mary's Place, Dublin 7, Ireland D07 P4AX – to the kind attention of Data Protection Officer", or by email at dpo@kleos-capital.com
11. The Data Protection Officer
We have appointed a DPO, who can be contacted directly by email at dpo@kleos-capital.com