Can Amazon ask for my credit card statement? I have problems with Amazon, I was trying to buy a 30 eur gift card for a birthday but they put the order on hold and blocked my account. Then I got a mail stating that I should fax Amazon my latest credit card statement with my name and address. At first I disregarded it as phishing but then months later I tried to login and found out my account is just blocked. So I sent them an email and they sent the fax request again (see below). It seems very fishy to me, no shop ever asked me to do this and I do a lot of online shopping. I cannot even do it, I don't have a card statement like that, it's a debit card actually and who uses fax in 2016? I asked my bank if they had any experience with this but they haven't replied yet. Is it even legal for Amazon to ask for this? Thank you for any thoughts on this. Greetings from Amazon.de. Please note that your order is currently on hold pending the verification of your billing information. We will be happy to proceed with your order as soon as we receive a recent credit card statement for the credit card you referenced for this order. At your earliest convenience, please fax us a statement which displays the billing name and address for the card. You can find our fax number on the Amazon.de Help page: www.amazon.de/fax Alternatively, you can ask the issuing bank of your credit card to contact us with verification of these details. You will not be able to access your account online until this verification procedure has been completed. However, it is not necessary to open a new account or place a new order; we will complete the processing of outstanding orders once your billing information has been verified. Thank you for your patience with our security measures. Please don't hesitate to contact us by email at adressen-bestaetigung@amazon.de should you have any questions. Sincerely, Amazon.de http://www.amazon.de There's no way to send them an email but their fax number is on their actual website. Delivery to the following recipient failed permanently: adressen-bestaetigung@amazon.de Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the server for the recipient domain amazon.de by amazon-smtp.amazon.com. [207.171.188.180]. The error that the other server returned was: 550 #5.1.0 Address rejected.
It is legal for a company to ask for any information they want as a condition of doing business with you, so long as their request isn't proscribed by law. I don't know of any jurisdiction where a request for banking or credit information is illegal. (In this case, however, it does seem like you are being phished. You could report the matter to your country's consumer protection agency.)
Disclaimer: Links are in German. My German is quite rough. Quoted translations provided by Google Translate. Turns out the question "Do I need an Impressum?" is complicated. I'll start with examining the case for companies, then work down to the average private citizen. Impressum requirement The requirement for an online Impressum comes from the Telemediengesetz (TMG) &sect;&nbsp;5: 1) Service providers are obliged to keep the following information readily available, readily accessible and constantly available for commercial, usually paid telemedia: the name and address under which they are established [...] Applicability based on country of origin The applicability of the TMG is described in &sect;&sect;&nbsp;2a, 3. Thankfully, there is a 2013 court case focused on these sections, involving an Egyptian company marketing cruises and not having a proper Impressum on their website. Also thankful is that law firm mth Tieben &amp; Partner summarized this decision, because as it turns out, I cannot read judicial German. Summarizing their summary, &sect;&sect;&nbsp;2a, 3 sets the standard that the required information is based on a country of origin principle (Herkunftslandprinzip), where if that country of origin is Germany, § 5 applies. However, this principle is rooted in EU directives, and as such is not applicable to non-EU countries. For these, the law falls back on the older principle of market location (Marktortprinzip). If the non-EU company advertises in Germany and thus participates in the German market, then it must have a valid Impressum. I'll note that, the TMG considers Germany to be the "country of origin" if the company is either registered in or has significant operations in Germany (see the given sections for specifics). This is not the same "country of origin" as is found in copyright law. Applicability to private website hosts As it turns out, an Impressum is not required for private non-commercial websites. However, as pointed out by this Anwalt article, the wording of the TMG makes it such that omitting an Impressum may often be illegal. In particular, the definitions section of the TMG provides very broad definitions of "Service provider" (Diensteanbieter): Service provider shall mean any natural or legal person who provides his own or third-party telemedia for use or provides access to use; in the case of audiovisual media services on demand, service providers shall mean any natural or legal person who effectively controls the selection and design of the content offered, and "commercial communication" (kommerzielle Kommunikation): Commercial communication means any form of communication which serves the direct or indirect promotion of the sale of goods, services or the appearance of an undertaking, other organization or a natural person engaged in trade, trades or crafts or a liberal professions; [...] Conclusion In terms of variables like the one you suggest, the proper "variable" for companies is the country of origin. For private web hosts, I would argue that residency is the closest analogue to country of origin as defined in TMG &sect;&sect;&nbsp;2a, 3. Location of server doesn't matter, and I don't think citizenship does either. With that in mind, the values would be: Germany: Required EU: Not required Rest of world: Required if advertised/directed in/towards Germany. with the caveat that truly private non-commercial websites never require an Impressum.
Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank. You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR. You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost. Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.
It looks like the gym was allowed to take the money out of your bank account and didn't. They didn't notice that they didn't take your money, so they can't really expect you to notice it. So you haven't done anything that would be criminal. The bigger question is how much you owe them. If you used the gym all the time, like someone paying monthly would do, they will most likely have the right to payment. That's not unlimited, there will be some &quot;statute of limitations&quot; so they can't ask you for 30 years back payments, but with less than two years they probably have a right. If they raised prices, it's unlikely the would have a right to that because they never told you. The situation while your subscription was frozen is interesting. Basically you just walked in, used the gym without paying, but they didn't stop you in any way. I could walk into your gym, ask if it is Ok to use it, and if they say &quot;yes&quot; and don't mention payment, I'm in. So for this time you can argue whether or not you owe them money. Summary: You haven't done anything criminal. You most likely owe them money. About the money, they can take you to court if you don't pay which will cost both sides money. Since you did use their service and other users did pay, the morally right thing would be to pay what seems fair to you, possibly with some negotiation. And legally, you might consider paying them enough to make both sides happy enough so you can stay a gym member and don't get sued for the money.
For a definite answer, Bob should ask his tax advisor. German freelance status (&quot;Freiberufler&quot;) is a bit difficult to navigate, because legally speaking, this status can only be applied to contract work that requires a university degree, everything else is a regular business (&quot;Gewerbe&quot;) that is taxed differently and requires you to join the chamber of commerce. This has become a bit murky as there are freelance software developers without a degree (who should be careful about using the word &quot;engineer&quot;) and the tax office seems to accept that, but I'm not entirely sure they are as lenient towards entertainers (which YT would fall under). The way I understand the Blue Card FAQ, freelancing is not allowed for Blue Card holders, I'd consider that the bigger problem (but that's an immigration issue, not a tax issue).
The fact that the terms and conditions do not mention the word &quot;disable&quot; is significant, but not in the way you seem to think. You state: &quot;...the merchant's T&amp;C which does not explicitly allow the merchant to charge a fee for a disabled account&quot;. However, this doesn't mean that the merchant needs to explicitly state that they may. What it actually means is that the merchant does not recognize the term &quot;disable&quot; in the context of terminating the service contract. (Did they use stop, terminate, delete, eliminate, fall into disuse, log off, etc. or any other similar expressions?) You haven't defined what &quot;disable&quot; means, but perhaps it is more like a &quot;pause&quot; in service for which payment is still required? (Like having the post office hold your mail vs terminating all deliveries.) What you need to do is to read the section of the T&amp;Cs that deals with terminating service and payment, understand what is required, and execute the procedures they describe. Whatever words they use, do that. If you have done all the steps and can prove it then you have a case against them, otherwise you are arguing semantics and interpretation... As to the title question, it does not appear that any &quot;law&quot; has been broken, this is just a contractual misunderstanding. P.S. This is the reason why I always set up payments through my bank to &quot;push&quot; money to vendors rather than authorizing them to &quot;pull&quot; money from me. When I am done I notify them and stop paying. I don't need to ask them to please stop taking it from me.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
What would be the most reasonable thing to do? Live with it. Oh, and stop breaking the law with your automated emails. Illegality on their part does not justify illegality on your part. Also, it’s likely that this activity has caused your email address to be blocked automatically which may explain why they aren’t contacting you. From a legal point of view, that’s the only reasonable option. You do have valid grounds for a lawsuit for the value of the watermelon but the cost of filing will be a couple of orders of magnitude greater than the value of the melon so doing so isn’t “reasonable”. If you want to vent, the internet offers a wide variety of social media platforms for which that seems to be their primary focus. But that’s got nothing to do with the law.