CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERT�S
The President
Registered letter with AR
Examination of the case: Paris, the 2 3 SEP. 2019
Our Ref.: MLD/JLI/KKR/XD/APA/CLP191091
Case n°19002617
(to be referenced in all correspondence)
Dear Mr. Chief Executive Officer,
This is further to the email exchanges between my services and 's Legal Director,
concerning the complaint addressed to the CNIL by the Spanish data protection authority, m
accordance with the provisions of Article 5 6 . 1 of the General Data Protection Regulation (GDPR).
The complaint concerned a request to delete a user account on the website< >.
Those exchanges lead me, in agreement with other European data protection authorities
concerned by the processing carried out by your company, to proceed to the closure of this
complaint.
Indeed, it is noted that the request to delete a user account from the complainant has been taken
into account in accordance with the article 1 7 of the GDPR.
Furthermore, I have taken notes of the explanation given on the payment data retention period,
as provided in article L.133-24 of the Monetary and Financial Code, which specifies that "The
payment service user shall, without delay, report to his payment service provider an unauthorised or
incorrectly executed payment transaction and at the latest within 13 months of the debit date under
penalty offoreclosure unless the payment service provider has not provided or made available to him
the information relating to that payment transaction in accordance with Chapter IV of Title 1 of Book
III". As a result, regardless the deletion of the complainant's user account, some information necessary
to manage any claims and disputes related to a payment made on your platform are stored in an
intermediate archive during a thirteen months period since the last payment made on the user account,
and this, in accordance with Article 17(3) of the GDPR.
--------------- R E P U B L I Q U E FRAN<;AISE----------------
3 P l a c e d e F o n t e n o y , TSA 8 0 7 1 5 - 75334 P A R I S C E D E X 07 - 0 1 53 73 22 22 - w w w . c n i l . f r
Les donnees personnel/es necessatres a f'accomplissement des missions de la CNIL sont trattees dans des fichiers destines a son usage exclusif.
Les personnes concernees peuvent exercer leurs droits lnformatique et libertes en s/adressant au delegue a la protection des donnees (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus: www.cnil.fr/donnees·personnelles.
Finally, I have noticed that the complainant was directly informed by email on the l " of April
2 0 1 9 of the consideration given to his request, the need to keep some of his data and the date on which
all his data will actually be deleted in their entirety.
The CNIL reserves the right, in case of new complaints, to use all of the powers conferred to it
under the GDPR and the law of January 6th, 1 9 7 8 as amended.
Yours sincerely.