...
A TTP can be categorized into two four types as AISP and PISP, PISP, ASPSP, and PIISP. The customer's bank too can offer AISP and PISP services.
...
To view a live demo of the AISP flow of events, see AISP demo.
| Anchor | ||||
|---|---|---|---|---|
|
A PSU (Payment Service User) is a person who makes use of a payment service in the capacity of either a payer, payee, or both.
...
| Multiexcerpt | ||
|---|---|---|
| ||
An Account Servicing Payment Service Provider (ASPSP) is a PSP that provides and maintains a payment account for a payer. Examples of ASPSPs are the banks and credit card issuers . The ASPSPs are that are obligated to grant access to the account and transaction data on their customers’ payment accounts through APIs. |
| Anchor | ||||
|---|---|---|---|---|
|
| Multiexcerpt | ||
|---|---|---|
| ||
A Payment Instrument Issuer Service Provider (PIISP) is a PSP that verifies the coverage of a given payment amount of the PSU's account. Examples of PIISPs are the banks and credit card issuers that are obligated to verify whether the given payment amount can be covered by the PSU's account through APIs. |
Fintech
Fintech is another name for financial technology and is used to refer to a business that offers new and innovative financial services using software and modern technology.
...
- The right of transparency and modalities: All processing activities based on personal data must be transparent to individuals. It is the responsibility of the processing organizations to make these processing details available for individuals in a clear, concise, and intelligible manner. Additionally, this information must be easily accessible and should use plain language.
- The right to be informed: Each individual should be given an adequate level of information regarding the data processing organization including the name and contact details of the organization, purpose of data processing, legal basis for the processing, intended period of personal data storage, whether an automated decision-making system is in place, other recipients of data including third parties, and rights of individuals such as right to access their data at anytime, right to withdraw previous consent, and right to lodge a complaint. These details need to be provided when collecting personal data from individuals directly or indirectly.
- The right of access: GDPR facilitates individuals to request information about data processing from a processing organization by sending a Subject Access Request (SAR). This information includes what personal data has been processed, the purpose of processing, and what data is stored within the system. It is mandatory for processing organizations to respond to SARs at latest within one month of receipt. If the processing of SAR is complex, organizations can further extend this period by another two months, subject to notifying the individual about the extension.
- The right to rectification: An individual should have the right to require that the processing organization correct any errors in personal data processed without any delays.
- The right to be forgotten: An individual should have the right to request the processing organizations to erase personal data without any delays. When a processing organization makes personal data public, the individual can request to erase any links to copying and/or replication of personal data.
- The right to restrict processing: The individuals can request a processing organization to restrict their personal data processing. In such cases, the processing organization may continue to store the data, but the purposes for which the data can be processed are strictly limited.
- The right for notification obligation: The processing organization should notify the individual in the event of rectification, erasure or restriction of the individual's personal data in a concise manner.
- The right to data portability: An individual has the right to obtain the personal data stored in a processing organization in a structured, commonly used, and machine-readable format. This facilitates easy transmission of the data obtained by another organization. If technically feasible, an individual can request to transfer his/her personal data from one processing organization to another directly.
- The right to object: An individual can object the processing of the individual's personal data at any time. In such cases, the processing organization should stop the processing of affected data unless they can demonstrate legitimate grounds for continuing with the processing of the affected data.
- Rights in relation to automated decision making and profiling: An individual has the right not to be subject to decisions based solely on automated processing that significantly affect the individual. Examples of solely automated processing include online credit application, e-recruiting or e-evaluation of performance without any human intervention.
Data Protection Officer (DPO)
The Data Protection Officer (DPO) provides necessary advice to processing organizations and act as the point of contact for individuals and supervisory authorities. DPO can be a staff member or an external contractor and must possess professional qualifications and expert knowledge to perform tasks associated with the role.
...