Orange Money – Personal Data

As part of the operation of the website www.orangemoney.fr (the “OME Website”) and the mobile application Orange Money Europe (the “OME Application”), W-HA collects personal data (“Personal Data” or “Data”). Personal Data is any data relating to an identified or identifiable natural person. This includes all information that directly or indirectly identifies the natural person.

Orange Money Europe services enable W-HA customers to use an electronic wallet to transfer funds from Europe to third countries and to top up their mobile phone credit (“OME Services”). Users can access all OME Services from the OME Application, and they also have the option of signing up to some OME Services at W-HA partner shops (“Points of Sale”).

In this case, W-HA is required to process Personal Data relating to:

Users of the OME Application and OME Services (“Users”) and beneficiaries of fund transfers (“Beneficiaries”)
All visitors to the OME Site, whether or not they are W-HA customers (“Visitors”).

Users and Visitors are hereinafter referred to collectively as “Data Subjects” or “You”.

W-HA undertakes to process such Data in accordance with the applicable regulations, in particular Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation or GDPR) and Act No. 78-17 of 6 January 1978, the French Data Protection Act (hereinafter referred to collectively as the “Regulations”).

This personal data protection policy (the “Policy”) is intended to inform Data Subjects of the conditions under which their Data is processed and of their rights in this regard.

CONTENTS

DATA CONTROLLER AND DATA PROTECTION OFFICER
HOW DO WE COLLECT YOUR DATA?
WHAT DATA IS PROCESSED?
WHY DOES W-HA PROCESS YOUR DATA, ON WHAT BASIS AND FOR HOW LONG?
WHO RECEIVES YOUR DATA?
IS YOUR DATA PROCESSED OUTSIDE THE EU?
WHAT ARE YOUR RIGHTS?
HOW IS YOUR DATA SECURED?
MODIFICATION OF THE DATA PROTECTION POLICY

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The data controller is W-HA, a French PLC with its registered office located at 31 Place Ronde, 92800 Puteaux – France, listed in the Nanterre Trade and Companies Register under no. 433 506 433, (“W-HA” or “We”).

The W-HA Data Protection Officer (“DPO”) is Cabinet Ubiquity Avocats located at 25 rue de Lübeck, 75116 Paris, France, contact email address: dpo@ubiquity-avocats.com.

2. HOW DO WE COLLECT YOUR DATA?

W-HA collects the Data by the following means:

Data regarding Users and Beneficiaries is collected:
- Directly from them when creating their account by signing up on the OME Application or visiting the Points of Sale.
- Indirectly through our partners, in particular to ensure the accuracy of the data.

Data regarding Visitors to the OME Website is collected directly from them via the forms on the Website (contact form) or through links on the Website (support requests, exercise of GDPR rights and complaints).

3. WHAT DATA IS PROCESSED?

W-HA only processes data or categories of data if it is strictly necessary for the stated purpose. W-HA processes the following categories of data:

For Visitors:

Identity details: full name, phone number, email address.
Data voluntarily provided by the Visitor via the free text box in the contact form on the OME Website.

W-HA recommends that Visitors to the OME Website avoid providing Personal Data, particularly sensitive data (relating to health, political, religious or philosophical opinions, sexual orientation, etc.) via the free text box “Write your message giving as much detail as possible (date, amount, country, issue, etc.)” or in any event to limit such data to what is strictly necessary for dealing with the user’s request. However, if W-HA does collect Personal Data in this way, W-HA will ensure that it only uses the data strictly necessary to process the request.

For Users and Beneficiaries:

Identity data: full name , birth name (if different), nationality, date and place of birth, country of birth.
Contact details: email address, postal address, phone number.
Electronic signature data in the event of remote business relations: date and time of the qualified certificate.
Login data for the OME Application: user name, password.
Know Your Customer (KYC) data: identity document, selfie photo, proof of address, proof of income, socio-professional category, politically exposed person (PEP) check: information on the source of wealth, financial sanctions or financial security incidents, risk score (low, medium or high).
Technical data on money transfer operations, top-ups, withdrawals:
- Transaction data: such as transaction amount, date and time, beneficiary country and town/city, reason for transaction, source of funds, IP address
- Credit transfer data: Hidden IBAN
- Payment card data

Biometric data: facial template. Biometric data is only collected with your express consent via the checkbox available when you create your account on the OME application. You may withdraw your consent at any time by completing the form: Exercise your rights regarding your personal data.
Data relating to phone credit transfers: phone number, country, top-up amount.

4. WHY DOES W-HA PROCESS YOUR DATA, ON WHAT BASIS AND FOR HOW LONG?

PURPOSE	DATA SUBJECTS	LEGAL BASIS	RETENTION TIME
Processing related to the features of the OME Website
Processing contact requests	Visitors	Visitors who are not Users: Implementation of pre-contractual and contractual measures taken at the request of the Data Subject Visitors who are also Users: Performance of the contract	Visitors who are not OME Services Users: Active basis: the time taken to process the request or no more than 3 months from the date of the request Interim archiving: 5 years from the end of the active basis period Visitors who are also OME Services Users: Active basis: 3 months Interim archiving: 5 years from the end of the active basis period
Processing enquiries and complaints submitted via the OME Website	Visitors	W-HA’s legitimate interest in enabling Visitors/Users to report malfunctions and in offering effective processing of requests	Active basis: 3 months Interim archiving: 5 years from the end of the active basis period
Processing related to the features of the OME Application
Processing enquiries and complaints submitted via the Application	Users	W-HA’s legitimate interest in enabling Users to report malfunctions and in offering effective processing of requests	Active basis: 3 months Interim archiving: 5 years from the end of the active basis period
Processing related to the provision of OME Services
Creation of the customer file during pre-registration on the OME Application	Users	Implementation of pre-contractual and contractual measures taken at the request of the Data Subject	Users who complete registration: Active basis: as long as the account remains open Interim archiving: 5 years from the end of the business relationship (final closure of the account) Users who do not complete registration: Active basis: 2 months from pre-registration (No interim archiving)
Provision of OME Services (transfers, top-ups, withdrawals, phone credits)	Users	Performance of the contract	Active basis: as long as the account remains open Interim archiving: 5 years from the end of the business relationship or the execution of the transaction (final closure of the account)
OME Services billing management	Users	Performance of the contract	Active basis: as long as the account remains open Interim archiving: 10 years from the end of the financial year
Managing inactive accounts	Users	Legal obligation	If an account is inactive: Active basis: 10 years from last transaction (or last contact) Interim archiving: 20 years after transfer of any remaining funds to the Caisse des dépôts et consignations In the event of death: Active basis: 3 years from death Interim archiving: 27 years after transfer of any remaining funds to the Caisse des dépôts et consignations
Processing related to marketing operations
Sending news about OME Services (new features, studies, surveys) and/or promotions (marketing communications, newsletters) via SMS and/or email and/or push notification.	Users	Consent of the Data Subjects	Active basis: Active account: for as long as the account remains open and the data subject has not withdrawn consent Inactive account: up to 3 years from the last transaction on the account Interim archiving: 5 years from closure of the account or withdrawal of consent
Processing related to W-HA’s legal obligations, the protection of its interests and the defence of its rights
Ensure compliance with anti-money laundering and combating the financing of terrorism (AML/CFT) due diligence obligations incumbent on W-HA when establishing the business relationship and throughout its course: identity check.	Users	Compliance with legal obligations to which W-HA is subject	Active basis: as long as the account remains open Interim archiving: 5 years from the end of the business relationship (closure of the account) Biometric data: Active basis: 30 days then deletion
Combating fraud (prevention, investigation and detection of payment fraud and identity theft)	Users	W-HA’s legitimate interest in combating fraud	Active basis: as long as the account remains open Interim archiving: 5 years from the end of the business relationship (closure of the account)
Managing requests to exercise GDPR rights	All Data Subjects	Compliance with legal obligations to which W-HA is subject	Active basis: 3 months from closure of the relevant ticket. Where applicable, identity documents are kept only for the time necessary for the identity check and are then deleted. Interim archiving: 5 years from the end of the active basis period

5. WHO RECEIVES YOUR DATA?

The Data is processed by the following recipients:

Authorised W-HA personnel
W-HA subcontractors: electronic money distributors, wholesalers, physical Points of Sale, providers of tools for screening individuals against risk lists (e.g. PEPs or financial sanctions), KYC scoring platform providers, AML/CFT risk mapping tool providers, providers of document scanning and verification tools when establishing business relationships, CRM tool providers, transfer initiation service providers, data and website hosts, other IT service providers.
W-HA banking partners acting on their own behalf as independent data controllers for the purposes of providing OME Services (transfers, top-ups, withdrawals, phone credit).
Orange S.A. acting on its own behalf as an independent data controller when you accept the use of cookies on the OME Website. More information on the Orange Cookies Policy is available here.
Relevant authorities, at their request, in the context of legal proceedings, judicial investigations and requests for information from the authorities, or in order to comply with other legal obligations.

6. IS YOUR DATA PROCESSED OUTSIDE THE EU?

The Data regarding Data Subjects is hosted on servers located in France.

Within the framework of the tools we use, Data Subjects’ Data may also be processed outside the European Union.

If your Personal Data is transferred to a country outside the European Union or the European Economic Area, W-HA will ensure that the country in question has been deemed adequate by the European Commission. Failing this, W-HA undertakes to supervise the transfer using appropriate legal instruments, in particular the European Commission’s Standard Contractual Clauses or binding corporate rules, provided that the conditions for using such instruments are met.

For more information on how W-HA protects Data or for a copy of the legal instruments implemented, Data Subjects may submit a request using the form Exercise your rights over your personal data, available on the OME Website and in the OME Application.

7. WHAT ARE YOUR RIGHTS?

You may exercise the rights set out below at any time by contacting us by any of the following means:

By post: W-HA, Gestion des données personnelles, 31 place Ronde, 92800 Puteaux

By email: dpo@ubiquity-avocats.com

From the Website: By filling in the form Exercise your rights over your personal data

You have the following rights:

Right of access: this right allows you (i) to obtain confirmation that Data is being processed by W-HA, (ii) to access the said Data (right to copy) and (iii) to obtain information relating to the characteristics of the processing operations.

Right to rectification: request the rectification of your Data if it is inaccurate or incomplete. Users may also modify some of their Data at any time from their account within the OME Application.
Right to erasure: request W-HA to erase your Data when it is no longer needed, in particular when you have withdrawn your consent or exercised your right to object, and for all the reasons set out in Article 17 of the GDPR. However, this right may be restricted if processing is necessary for compliance with a legal obligation.
Right to restrict processing: you have the right restrict processing of your Personal Data in certain cases defined in Article 18 of the GDPR.
General right to object: you have the right to object, at any time and for reasons relating to your particular situation, to processing based on W-HA’s legitimate interests. However, this right may be restricted, in particular if there are legitimate and compelling grounds for processing or for the establishment, exercise or defence of legal claims.
Right to object to direct marketing: you have the right to object, at any time, to the processing of Data for direct marketing purposes, including profiling if it is related to this direct marketing.
Right to portability: under certain circumstances, this right allows you to (i) obtain all or part of the Data previously provided to W-HA in a structured, commonly used and machine-readable format in order to store or reuse it, or (ii) request that W-HA transfers this Data to another organisation where technically feasible. This right applies only to processing operations where the legal basis is the consent of the Data Subject or the performance of a contract.
Right to withdraw consent: you may withdraw your consent at any time for processing based on consent. This withdrawal does not affect the lawfulness of processing carried out prior to withdrawal of consent.
Right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal or similarly significant effects for the Data Subject.
Giving directions concerning the retention, erasure and disclosure of Data after death.

If there is reasonable doubt as to the identity of the Data Subject exercising their rights, W-HA may ask them to provide any document proving their identity.

If you are not satisfied with your dealings with W-HA, you have the option of lodging a complaint with the supervisory authority responsible for compliance with personal data obligations in your country:

In France: Commission Nationale de l’Informatique et des Libertés – CNIL (address: 3 place de Fontenoy TSA 80715 – 75334 Paris Cedex 07)
In Belgium: Autorité de protection des données (address: rue de la presse, 35 1000 Bruxelles)
In Italy: Garante per la protezione dei dati personali (address: Piazza Venezia 11, 00187 Roma – Italy)
In the Netherlands: Dutch Data Protection Authority (address: Postbus 93374 2509 AJ DEN HAAG – Netherlands
In Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit – BfDI (address: Graurheindorfer Str. 153, 53117 Bonn – Germany)
In Spain: Agencia Española de Protección de Datos (address: C/ Jorge Juan 6, 28001 Madrid – Spain)
In Ireland: Data Protection Commission (address: 21 Fitzwilliam Square, Dublin 2, D02 RD28 – Ireland)
In Luxembourg: Commission nationale pour la protection des données – CNPD (address: 15 Boulevard du Jazz, L-4370 Belvaux – Luxembourg)
In Portugal: Comissão Nacional de Proteção de Dados – CNPD (address: Avenida D. Carlos I, 134, 1.º, 1200-651 Lisboa – Portugal)
In Austria: Österreichische Datenschutzbehörde (address: Barichgasse 40-42, 1030 Wien – Austria)
In Greece: Hellenic Data Protection Authority (address: Kifisias Avenue 1-3, 115 23 Athens – Greece)

8. HOW IS YOUR DATA SECURED?

W-HA ensures that your data is processed securely and confidentially, including when certain operations are carried out by subcontractors. To this end, appropriate technical and organisational measures are in place to prevent the loss, misuse, corruption and deletion of your personal data. These measures are adapted according to the level of sensitivity of the data processed and the level of risk presented by the processing or its implementation.

9. MODIFICATION OF THE DATA PROTECTION POLICY

This Personal Data Protection Policy may be amended at any time by W-HA, in particular to comply with any regulatory, case law, editorial or technical developments. Any changes will be posted on this Policy page, and the version date will be updated. These amendments will applicable on the date the amended version comes into force. You are thus invited to regularly consult the latest version of this policy.

Last updated on 18/12/2025

EXERCISE YOUR RIGHTS REGARDING YOUR PERSONAL DATA

⚠️ Attention: This form is only for requests related to accessing and managing your personal data.

If your request actually concerns your personal data, please fill out the form below.