Splitit is committed to your right to privacy. Reference to “Splitit” “we,” “us” or the “Company” is a reference to Splitit Ltd. and the relevant affiliates or subsidiaries involved in the data processing activity, including the collection, holding, use and disclosure of Personal Data (defined below).

This Privacy Policy (“Privacy Policy”), is an integral part of our terms and conditions applicable to you, and governs the data collection, processing, use, transfer and disclosure made by us (or by anyone on behalf of us) in connection with: (i) visitors to our website: https://www.splitit.com/ (respectively, “Visitor” and “Website”); (ii) the services provided by Splitit, including a payment solution offered by Splitit to its customers (e.g., merchants and retailers of e-commerce platforms that host or embed Splitit solution) (respectively, “Splitit Solution” “Merchant”); and (iii)  transactions made by Merchant’s consumers via Splitit Solution; and (iv) other related services and applications (collectively, “Services”). 

We also process Personal Data on behalf of Merchants with respect to transactions made by Merchant’s individual customers via the Splitit Solution (“Consumer”).  If you are a Consumer, we are a data processor of your Personal Data on behalf of the Merchant, who is the data controller. 

In addition to the Splitit Solution, Splitit offers a separate lending service for consumers (e.g., consumers to whom Splitit may directly lend money) (respectively, “Splitit Consumer Lending Service” “Lendee”).  Lendees who use the Splitit Lending Service are subject to the Splitit GLBA Privacy Notice.  If you are a Lendee, please carefully review the Splitit GLBA Privacy before using the Splitit Lending Service.

Each of the Visitors, Merchant and Consumer shall also be referred to herein as “you” or “User”.  

If you choose to use the Services, interact with the Website, or provide data to us otherwise, you explicitly agree to the use of such data in accordance with this Privacy Policy. You may not use the Website and/or Services or submit any data through them if you do not agree to any of the terms hereunder. This Privacy Policy shall not be construed in any manner to derogate from the terms and conditions of the Website, or any other agreement or understanding between Splitit and you.

The English language version of this Privacy Policy shall be controlling in all respects and shall prevail in case of any inconsistencies or discrepancies with translated versions of this Privacy Policy (including any related documents).

THE HIGHLIGHTS: 

• Our Website and Services are intended for Users over the age of 16, or equivalent minimum age for either providing consent to processing of Personal Data or using the Services in the relevant jurisdiction. Users under such age are not permitted to use the Services. In certain jurisdictions using the Services may be restricted for Users under the age of 21. 

• In certain jurisdictions, you will be entitled under applicable law to request; review; confirm; access; amendment; correction; erasure; restriction; opt-out of sales or sharing; limit the use of sensitive personal data; or the portability of the Personal Data processed by us. Please note that in case you request to erase, or restrict the processing, or withdraw consent to the processing of your Personal Data, your use of the Services may be restricted or disabled. You may be entitled to exercise additional rights under US State Privacy Laws, please refer to our User Rights Policy.

• We do not sell, trade, or rent Users’ Personal Data to third parties. We only share Personal Data with third parties in connection with the provision of the Services to our Users, or other limited circumstances as specified herein. 

If you have any questions or requests regarding your Personal Data, or would otherwise like to contact us in connection with this Privacy Policy, please send us an email to:  [email protected].

“Personal Data” or “Personal Information” (will be referred together as “Personal Data”), means any information about an identifiable individual or that identifies or can be used to identify a natural person, directly or indirectly, including, but not limited to, first and last name, phone number, email address, online identifiers, IP address or other online identifiers, billing information, information concerning households, devices etc., including Sensitive Personal Data.

“Non-Personal Data”, means non-identifiable aggregated data or anonymized data that falls outside the definition of Personal Data or Sensitive Personal Data. This data is not used to identify individuals.

“Sensitive Personal Data” is defined under applicable federal and state privacy laws and includes information that reveals a consumer’s social security, driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; contents of mail, email, and text messages unless the Company is the recipient of the communication; genetic data; and biometric data.

In general, we may process certain of the Personal Data mentioned herein for the scenarios described below.

In addition, we may use certain of the above-mentioned Personal Data in order to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity theft and any other misuse of the Services and to enforce our rights against you, as well as to protect the security or integrity of our databases and Services. Such use and disclosure is based on our legitimate interests or based on legal obligation. 

We do not knowingly collect or use or disclose any Personal Data included in the category ofSensitive Personal Information. In the event you become aware that such data has been posted to the Website or collected by us, please inform us immediately.

Non-Personal Data is used mainly for click stream analysis in order to constantly improve and maintain our Website and Services, including among others, in order to measure and understand the level of engagement to our Services, for general business analytics and in order to provide a more personalized experience and tailored content, for ensuring the technical functioning of our network, to help prevent fraudulent use of our Services and for developing new services and features.

Yes, we use data files such as cookies, pixel tags, “Flash cookies” or other local storage files provided by your browser or associated applications. We use these technologies for different purposes such as in order to recognize you as a user; customize our Site and Services, content, and advertising; measure promotional effectiveness; help ensure that your account security is not compromised; mitigate risk and prevent fraud; and to promote trust and safety across our Website and Services. These cookies also help us track how visitors use the Site and our Services. Please read our Cookie Policy for more information about the cookies we use. You can allow all cookies or manage them individually by adjusting your preferences.

WE DO NOT SELL OR RENT ANY OF YOUR PERSONAL DATA TO NON-AFFILIATED THIRD PARTIES FOR THEIR MARKETING PURPOSES. 

1. Non-Personal Data, aggregate and statistical or otherwise anonymized data may be shared without limitation with third parties at our discretion. This information does not contain Personal Data and is used to develop content and Services for our Users and Merchants. 
2. We share Personal Data only under the following limited circumstances:
   1. With partners who are an integral part of our Services, such as the Merchant you placed a purchase with, credit card processers, acquirers, banking institutions, payment gateway, lenders etc.
   2. With trusted third parties who assist us in operating the Services and conducting our business. Such as service providers who provide us with fraud prevention services, customer support call center services, debt collection agencies, account maintenance, marketing services, survey services and platforms, and technology services.
   3. With our affiliates and connected companies, such as subsidiaries to provide you with information about products and services that we or they believe may be of interest to you where you have consented to such sharing.
   4. As necessary to help detect and prevent potentially illegal acts and fraud, and to guide decisions about the products, services and communications, b ased on our legitimate interest in avoiding illegal and fraudulent actions.
   5. To comply with a legal requirement, for the administration of justice, to protect your vital interests or the vital interests of others, to protect the security or integrity of our databases or the Services, to take precautions against legal liability, or in the event of a corporate sale, merger, reorganization, dissolution or similar event.
   6. Other third parties with your consent or direction to do so.

Personal Data may be disclosed to an entity in the Splitit corporate group that is incorporated in Israel (“Splitit Israel”). Personal Data will be held on servers located in the U.S.

Therefore, your Personal Data may be stored or processed in countries in which the privacy laws provide for a different level of protection for your Personal Data than that which exists in your country of residence.

If you would like to receive more information about our practices and policies with respect to our use of service providers and the jurisdictions in which they are located, by the contact information provided below.

If you (e.g., a website user) provided us with your consent, we may send information on new products, features, activities, services and periodic announcements or newsletters. You may opt-out any time from such communications by either: (i) using an “unsubscribe” feature available within the message; or (ii) sending us an email to: [email protected] asking to opt-out.

Our Website is a general audience Website, which is not directed to persons under 16 years old. If a parent or guardian becomes aware that his/her child has provided us with Personal Data without their consent, he/she should contact us immediately. We do not knowingly collect or solicit Personal Data from people under 16 years old. If we become aware that a person under 16 years old has provided us with Personal Data, we will delete such data from our databases. Please note, in certain jurisdictions you may be banned from using the Splitit Solution unless you are 21 years old. 

Subject to applicable law requirements, we will provide individuals with the opportunity to exercise their rights regarding their Personal Data. Individuals’ rights under data protection and privacy laws, including:

• the right to confirm whether or not we hold your Personal Data, unless such confirmation or access would require us to reveal a trade secret;
• the right to access your Personal Data and being provided with a copy of the Personal Data that we hold in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another party without hindrance. Colorado residents may exercise this right no more than two times per calendar year. We are not required to provide such information to Connecticut, Colorado, Delaware, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Tennessee, and Oregon residents if doing so would require us to reveal a trade secret;
  • List of specific third parties: Oregon, Minnesota, and Delaware consumers may request a list of specific third parties to whom we have disclosed your Personal Data.
• the right to rectification of your Personal Data where it is inaccurate, incomplete or out of date, considering the nature of information and purposes of processing the Personal Data;
• the right to erasure of your Personal Data. We may limit or deny your deletion request in certain instances, to comply with applicable laws;
• the right to restrict the use and disclosure of your Personal Data;
• the right to object to collection, use or disclosure of your Personal Data;
• the right to opt-out of the “sale” or “sharing” of your Personal Data for the purposes of (i) targeted advertising, (ii) “sale” of PII; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. To opt-out of the sale or sharing, please visit, “Do Not Sell or Share My Personal Information” by submitting a form here or by emailing us at [email protected]. Opt-out preference signals will be processed in accordance with applicable laws.
  • Minnesota-specific disclosure: If a Minnesota resident’s Personal Data is profiled in furtherance of decisions that product legal effects concerning them, the Minnesota consumer has a right to question the result of such profiling, view their Personal Data used in the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer may take to secure a different decision in the future. If the decision is determined to have been based on inaccurate Personal Data, the Minnesota consumer may request to have the data corrected and profiling decision reevaluated based on the corrected Personal Data;
• The right to non-discrimination if you exercise any of your individual user rights under the applicable laws; and
• the right to withdraw consent.

For Virginia, New Hampshire, Colorado, Connecticut, Delaware, Maryland, Minnesota, Nebraska, Oregon, Tennessee, Texas, and Utah consumers, we will not process your Sensitive Personal Data without obtaining your consent. California consumers will have the right, at any time, to limit the use of their Sensitive Personal Data. For California consumers, please visit “Limit the Use of My Sensitive Personal Information” by submitting a form here or emailing us at [email protected] to exercise this right. These requests will be processed in accordance with the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020.

For California, Virginia, Colorado, Connecticut, Utah, Texas, Florida, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland residents (collectively known as “US Residents”), please review our User Rights Policy regarding your rights under applicable laws. 

You may exercise any or all of your above rights in relation to your Personal Data (including to request access to and/or correct your Personal Data held by us) by filling out the Data Subject Request Form (“DSR”) and send it to our privacy team at: [email protected].   

We may request additional information from you when you contact us with a DSR in order to: (i) verify your identity; (ii) determine the applicable laws apply to you; (iii) and locate your data.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of a minor child. To designate an authorized agent, provide written authorization provided by you and your designated agent and contact [email protected].

To protect your privacy, we will take steps to reasonably verify your identity before fulfilling your request. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative, or to answer questions regarding your account and use of our Services.

It may take time to process requests in a way that is consistent with applicable privacy law.

Splitit implements measures to reduce the risks of loss of information and unauthorized access or use of information. We adopt appropriate and generally accepted data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your Personal Data. In particular, your payment information is secured in accordance with the PCI-DSS standard. However, these measures are unable to provide absolute information security. Therefore, although efforts are made to secure your personal information, it is not guaranteed and you cannot reasonably expect that the Service and its related databases will be immune from any wrongdoings, malfunctions, unauthorized interceptions or access, or other kinds of abuse and misuse.

Unless you instruct us otherwise and subject to applicable laws, we retain the information we collect for as long as needed to provide our services and to comply with our legal obligations, resolve disputes and enforce our agreements if applicable.

The provisions included in this Privacy Policy relating to matters that may be regulated under the Canadian privacy laws or the US State Privacy Laws (as defined below) and therefore will apply only to the processing of Personal Data (or Personal Information) which is subject to the Canadian privacy laws or the US State Privacy Laws in accordance with the applicability provisions contained therein. Additionally, collection and processing of certain Personal Data by Splitit may be regulated under Federal laws or other applicable laws, in such case this data may be exempted from US State Privacy Laws’ requirements. 

If you have any questions or concerns regarding privacy issues, please send us a detailed message to [email protected] and we will make every effort to resolve your concerns without delay. 

For Australian residents, if you feel that your complaint has not been adequately resolved, you are able to contact the Office of the Australian Information Commissioner on the details below:

• Online: www.oaic.gov.au/privacy
• Phone: 1300 363 992
• Email: [email protected]

Splitit may, at any time and from time to time, modify this Privacy Policy. Modifications to this Privacy Policy will be posted on the Website, you will be informed about them and shall be effective as of the date in which they are posted on the Website.

If you require a copy of this Privacy Policy in a different format, such as a PDF or hard copy, please contact us at [email protected] and we will take reasonable steps to comply with your request.

This section (“Privacy Notice”)  only applies to our processing of Personal Data subject to the CCPA, Colorado Privacy Act and Colorado Privacy Act Rules (“CPA”), Connecticut Data Privacy Act (“CTDPA”), Delaware Personal Data Privacy Act (“DPDPA”), Florida Digital Bill of Rights (“FDBR”), Iowa Consumer Data Protection Act (“IACDPA”), Maryland Online Data Privacy Act (“MODPA”), Minnesota Consumer Data Privacy Act (“MNCDPA”), Montana Consumer Data Privacy Act (“MCDPA”), Nebraska Data Privacy Act (“NDPA”), New Hampshire Privacy Act (“NHPA”), New Jersey Data Privacy Law (“NJDPL”), Oregon Consumer Privacy Act (“OCPA”), Tennessee Information Protection Act (“TIPA”), Texas Data Privacy and Security Act (“TDPSA”), Utah Consumer Privacy Act (“UCPA”), and Virginia Consumer Data Protection Act (“VCDPA”)  (individually known as a “US State Privacy Law” and collectively known as the “US State Privacy Laws”) and supplements the information contained in our general Privacy Policy and applies solely to all US residents who are visitors and users, (“consumers” or “you”), as defined under the US State Privacy Laws. Any terms defined in the US State Privacy Laws have the same meaning when used in this Privacy Policy. Further, this Privacy Notice is an integral part of our Privacy Policy and thus, definitions used herein but not defined herein shall have the meaning ascribed to them in our Privacy Policy.

We will update this Privacy Notice every 12 months. The last revision date will be reflected in the “Recently Updated” heading located at the top of the Privacy Policy. 

TYPES OF PERSONAL INFORMATION WE COLLECT 

Under the US State Privacy Laws, “Personal Information” is generally defined as any information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device. The categories of Personal Information that we collect (and has collected within the last 12 months) or process, are detailed in the table below. 

Depending on the nature of your interaction with us, we may collect the above detailed information from you, as follows: (i) directly from you, for example, when you place an order via Splitit Solution on Merchant’s platform; (ii) automatically when you visit our Website; (iii) from third-party business partners such as analytics providers.

We may use, or disclose the Personal Information we collect for one or more of the following business purposes:

• To fulfill or meet the reason you provided the information. For example, if you contact us with an inquiry and share your name and contact information, we will use that Personal Information to respond to your inquiry. 
• To provide, support, personalize, and develop our Website and Services, as well as improve our Website and Services. 
• For security and fraud detection purposes, and to maintain the safety, security, and integrity of our Site Services.
• For testing, research, analysis, and product development, including to develop and improve our Website and Services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

We may disclose your Personal Information to a third party for a business purpose. When we disclose Personal Information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract.

We share your Personal Information with the following categories of third parties:

In the preceding twelve (12) months, the Company has disclosed the following categories of Personal Information for a business purpose:

Category A: Identifiers.

Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

Category D: Commercial information: Commercial Information 

Category F: Internet or other similar network activity. 

Category G: Geolocation data.

In the preceding twelve (12) months, Company has not sold Personal Information. 

The US State Privacy Laws provides consumers with specific rights regarding their Personal Information. Please review our User Rights Policy regarding your rights under applicable law. 

You may exercise any or all of your above rights in relation to your Personal Information by filling out the DSR Form and send it to our privacy team at: [email protected].  

RIGHT TO APPEAL

You may also appeal our refusal to act on a consumer request. Within 45 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written application of the reasons for the decision. 

Under the CPA and MNCDPA, we may extend the 45-day period to respond to an appeal by another 60 days, where reasonably necessary, considering the complexity and number of requests serving as the basis of appeal. We will inform Colorado and Minnesota consumers of any extension within 45 days after receipt of an appeal, together with the reasons for delay.

If the appeal is denied, Virginia, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Tennessee, and Texas consumers may contact their state Attorney General or relevant state authority and submit a complaint. 

If you have any questions about this Privacy Policy, you may contact us as follows:

By sending us email at: [email protected].  

By regular mail at: Splitit USA Inc. 211 Perimeter Center Parkway, Suite 240, Atlanta, GA 30328.