Please note that the Privacy Policy described below only applies to the collection, use and storage of your data for the performance of SHIELD Services. Kindly refer to the Privacy Policy provided by the Merchant to understand how the Merchants collect, use and store your information for purposes other than fraud prevention as outlined in this Policy.

The data outlined below is not aimed at personally identifying a User, but at detecting and grouping devices that may be fraudulent.
‍
Passive Biometric Data. We collect information about User’s passive behaviour in Merchant’s Platforms, for example how cursor moves, the number of words per minute typed on the e-commerce platform/mobile app, the number of mouse clicks, the number and pressure of finger swipes.
‍
Device Information. This includes browser information, operating systems, and connection attributes of User’s device to connect to Merchant’s e-commerce platform or mobile app. Other than the permissions granted by User to the Merchant, SHIELD does not request additional permissions from the User to perform the purpose of detecting fraud in Merchant’s Platforms.

Shopping Cart Information. Upon Merchant’s request, we may collect information submitted on Merchant’s Platforms, such as the amount, description and price of items bought, and shipping information, which may include name, shipping address and e-mail address.

User Information. Upon Merchant’s request, we may collect information of User’s past activity at the Merchant’s Platform such as the number of times User interacts with Merchant’s Platform and basic information about User’s Customer Account at Merchant’s Platform, should there be one.

Payment Information. We may collect basic payment information submitted on Merchant’s Platforms to perform a payment online, such as the type of payment method chosen on Merchant’s Platform, and basic billing information. SHIELD does not collect full credit card numbers.

Geolocation Information. Provided User has given Merchant permission on the Merchant’s Platform, we collect User geo-location based on User’s IP address.

Aggregated Data. We may verify the data outline above using third-party online resources such as search engines, social networks and mapping services, which are all available to the general public.

Cookies. The Merchant website assigns a small piece of information to User’s browser whenever User interacts with the Merchant’s Platform. This small piece of information is called a “cookie”. When a User browses the Merchant’s Platform, Merchant may send us the “session cookie” to help us enhance the accuracy of fraud detection. This “session cookie” will be deleted once the User closes its browsing session.
‍
If User is a data subject in the EEA, cookies can be disabled from the small pop-out window that appears on the screen when browsing the Merchant’s Platform. If User is an individual outside the EEA, cookies’ policies can be modified through the device and browser settings.

Special Categories of Personal Data. SHIELD does not collect information that may be classified as Special Category under Article 9 of GDPR.

Information You Provide for Us to Connect.
When you visit SHIELD’s website and submit your personal information through our contact forms, SHIELD may receive the following details: First Name, Last Name, Company Email, Job Position, Phone Number, and Country. SHIELD processes this information based on your consent, which you provide by submitting your details for us to contact you. This information you provide may be used by SHIELD to contact you regarding your demo request, send updates on our products and services, and deliver relevant marketing communications such as promotions, newsletters, and event invitations. You can choose to stop receiving marketing communications or emails from us by using the unsubscribe option in the emails or by reaching out to us at legal@shield.com.

The data outlined above is collected in the following cases:

SHIELD may at its sole discretion and with the approval of Merchants choose a subprocessor to store the data collected. SHIELD ensures that subprocessors treats data and ensures its security and integrity with the same standards as SHIELD, and that subprocessor complies with all data protection policies, including EU GDPR.

SHIELD has assigned the following companies as subprocessors, for the sole purpose of data storage:

SHIELD generates an automated risk score on the potential fraud in Online Activities. It is the Merchants’ (the Data Controller) own discretion to follow SHIELD’s automated risk score and make an automated decision, in accordance with Article 22 of the GDPR.

Sharing Data
Unless required by Supervisory Authorities or to comply with proceedings by legal authorities, SHIELD does not share, rent or sell your information to any third-parties, including the anonymised information on fraudulent patterns that we may collect from performing the Services.

Retaining Data
SHIELD retains data collected for as long as needed to provide the outlined purpose in this Privacy in fully compliance with applicable regulations. Should the current legislation grant User the right to delete User’s data and should User exercise it, User should send questions regarding User Data rights to legal@shield.com. In such case, we may request User to provide us with additional personal data for the purpose of verifying User’s identity. The deletion of User’s data in SHIELD System may interfere with SHIELD’s ability of detecting fraud in User’s subsequent online activities at Merchant’s Platforms.

Transfer of Data to Third Countries
SHIELD may transfer and process User information outside of User’s country of residence, including any of the Member States of the European Union, the United States and Singapore. We always ensure that adequate level of data protection is granted in all cases, by implementing legally approved mechanisms to allow for such data transfer. Some of these mechanisms include the EU Special Contractual Clauses under EU GDPR, those observed under EU-U.S. Privacy Shield and those observed under Singapore’s Personal Data Protection Act (PDPA) 2012, among others.

SHIELD goes to great lengths to maintain the adequate levels of data protection during collection, transfer and storage. Our security safeguards include but are not limited to audit and risk assessments, periodic reviews, access controls to both physical and cloud data centres, network security controls, and vulnerability and penetration tests.If a User believes that the privacy of data with SHIELD may have been tampered or subject to unauthorised access, we request Users to contact us immediately at legal@shield.com.

Individuals living in the European Union ("Data Subjects") should be aware of the following aspects compiled under the EU GDPR:
SHIELD acts as a data processor and has lawful purpose to collect the data described above, in order to provide the fraud prevention Services. Merchant acts a data controller. SHIELD assumes that User grants consent to Merchants to collect and process the User’s data as described above so User can perform the contract between the User and the Merchant. The contract is the Online Activities performed by User in Merchant’s Platform.

It is the Merchants’ own discretion to follow SHIELD’s automated risk score on the potential fraud in the Online Activities. Users can address to Merchants any questions about the automated decisions of Users’ Online Activities on Merchant’s Platform. 

Data Subjects are granted the right to access, modify and delete their data. Should Users choose to exercise any of these rights, particularly the right to deletion (“right to be forgotten”), SHIELD may retain certain information required by law or by compliance with the online payments industry, even if the rest of the information is deleted. Should the current legislation grant User the right to delete User’s data and should User exercise it, User should send questions regarding User Data rights to legal@shield.com.  In such case, we may request User to provide us with additional personal data for the purpose of verifying User’s identity. The deletion of User’s data in SHIELD System may interfere with SHIELD’s ability of detecting fraud in User’s subsequent online activities at Merchant’s Platforms.
‍
Additionally, Users in the EU are informed of their right to file an official complaint at the corresponding Supervisory Authority, duly appointed by their Member State.

Users outside the EU are encouraged to review the best practices recommended by the Data Protection Authorities in the countries of residence. If a User believes that the privacy of the data with SHIELD may have been tampered or subject to unauthorised access, User should contact us immediately at legal@shield.com. In such case, we may request Users to provide us with additional personal data for the purpose of verifying User’s identity.

SHIELD AI Technologies Pte Ltd – Supervisory Authority in Singapore
Personal Data Protection Commission
‍
SHIELD AI Technologies Pte Ltd – Supervisory Authority in Germany
Berliner Beauftragte für Datenschutz und Informationsfreiheit

For users in the EEA: SHIELD AI Technologies Pte. Ltd., Schönhauser Allee 163, 10435 Berlin, Germany
For users outside the EEA: SHIELD AI Technologies Pte Ltd, 1 Fifth Ave, #04-06 Guthrie House, Singapore 268802