Privacy Policy

1 Introduction

paytech Ltd values your privacy and is committed to protecting your personal information.

This Privacy Policy (‘Policy’) explains how paytech Ltd (‘paytech Ltd’, ‘we’, ‘us’, ‘our’), a Company incorporated under the laws of the Republic of Cyprus with registration number ΗΕ 440168, with its registered office at Archiepiskopou Makariou III, 84, OFFICE 1, 6017, Larnaca, Cyprus, acting as a Data Controller for the activities described in this Policy, collects and processes your personal information, i.e. information collected online and offline, in accordance with the General Data Protection Regulation (2016/679) and the applicable Data Protection Laws of the Republic of Cyprus (the ‘Law’).

We also process Personal Data on behalf of business clients under their instructions and our Data Processing Agreement. Clients may themselves act for merchants or other customers. This includes our white-label software, payment gateway and payment orchestration services, related integrations and support, and NetworkToken and 3DS2 services where selected. Data may include cardholder and payment details, token records and lifecycle events, transaction information, device or browser information, and authentication requests and results. For this processing, the relevant controller’s privacy notice applies. Please direct rights requests to that controller; we assist our clients under the applicable Data Processing Agreement.

This Policy primarily covers our website and our direct interactions with individuals, including prospective clients and representatives of business clients. Where we process Personal Data on behalf of a business client, the applicable client agreement and Data Processing Agreement govern that processing and the Parties’ contractual obligations. This Policy does not amend those agreements. Where we process Personal Data as an independent controller in connection with our Software or Services, we provide the required information through this Policy or a supplementary privacy notice made available to the affected individuals. Nothing in those agreements limits individuals’ rights under applicable data protection law.

2 Definitions

‘Data Controller’ means the person or organisation which determines when, why and how to process Personal Data and implements appropriate technical and organisational measures to comply with the Law;

‘Data Protection Officer’ means the person who is formally appointed with the purpose of ensuring that we are aware of and comply with our data protection responsibilities and obligations according to the Law;

‘Data Subject’ means a living, identified or identifiable natural person about whom we hold Personal Data;

‘Personal data’ means data about the Data Subject who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

‘Processing’ means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction;

‘Special Categories of Personal Data’ means the information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, genetic data, or biometric data used to uniquely identify a person.

We do not intentionally collect Special Categories of Personal Data for ordinary website enquiries or business account administration. If such data is necessary for a specific activity, we will explain the purpose and identify both a lawful basis under Article 6 GDPR and an applicable condition under Article 9 GDPR before processing it. For the purposes of this Policy, Personal Data includes Special Categories of Personal Data;

‘the Law’ means the General Data Protection Regulation (2016/679) (GDPR) and the applicable Data Protection Laws of the Republic of Cyprus;

‘Third Party’ means the recipient of your Personal Data as defined below.

3 The Principles of Law

• Lawfulness, fairness and transparency: Personal Data shall be processed in a lawful, fair and transparent manner;
• Purpose Limitation: Personal Data shall be obtained only for specific, lawful purposes and not further processed in a way that is not compatible with those purposes;
• Data Minimization: Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which is processed (not excessive);
• Accuracy: Personal Data shall be accurate and kept up to date; Storage Limitation: Personal Data shall not be held for any longer than necessary;
• Confidentiality and Integrity: Personal Data shall be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organizational measures.

4 The kind of information we collect about the Data Subjects

The purpose of the Processing of the Personal Data of the Data Subjects is largely based on each of the Services that the Data Subject has requested. In general, the Personal Data is processed, within the scope of the business relationship with the Data Subjects.

• Contact details (e.g. names, email address, telephone numbers);
• Demographic details (e.g. nationality, gender, age group);
• Personal Correspondence (e.g. emails that you send to us, information posted publicly on our social media channels);
• Bank and account details used to administer payment of our own invoices for Services;
• IP addresses, browser and device information, and website usage information collected when you use our website;
• Any additional information that can be necessary for the provision of particular Services.

We receive Personal Data directly from you, through your use of our website, and from the business client or organisation you represent when it provides your business contact details. Where information is required to respond to your enquiry, perform a contract or comply with a legal obligation, failure to provide it may prevent us from responding or providing the relevant Service. Optional information is not required.

Further information about cookies and similar technologies, including how to manage your preferences, is available in our Cookies Policy.

5 On what legal basis do we process the Personal Data

We collect, store, use and disclose Personal Data for the following purposes and on the following legal bases:

• Contract: To take steps at your request before entering into a contract and perform a contract with you, including providing Services and administering payments, where you are personally a party to that contract.
• Legitimate interests: To respond to business enquiries, manage relationships with corporate clients and their representatives, provide support, secure our website and Services, prevent misuse, and establish, exercise or defend legal claims. We rely on these interests only where they are not overridden by your interests or fundamental rights and freedoms.
• Legal obligations: To maintain legally required accounting and tax records, comply with data protection duties and respond to binding requests from competent authorities.
• Consent: For non-essential cookies and related analytics or advertising, and marketing communications where consent is required by law. You may withdraw consent at any time through the relevant cookie controls, an unsubscribe link or the contact details below. Withdrawal does not affect the lawfulness of processing before withdrawal.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you in the activities for which we act as a Data Controller under this Policy.

6 Who Receives your Personal Data

Your Personal Data may be accessed by the following persons where necessary for the purposes set out above:

• The employees with a need for access to fulfill the purposes set out above;
• Any of our sub-contractors and/or service providers and/or associates, including but not limited to Accountant/Auditors, Legal Representatives, IT service providers, Credit/Debit Card Processing Companies which process credit/debit card payments, Feedback software providers;
• In case of an absence of your consent, your Personal Data will not be disclosed to any Third Party, other than the above-mentioned, unless the disclosure is required and/or mandatory under the provisions of any legislation, regulation or upon governmental, supervisory, competent authority request.
• Our employees are compliant with our internal Data Protection Policies and Procedures and have signed a Confidentiality and Non – Disclosure Agreement.
• Where a service provider processes your Personal Data on our behalf, we enter into a processing agreement with that party in order to ensure that this Third Party processes the Personal Data strictly according to our instructions and implements the appropriate administrative, physical and technical measures to protect the Personal Data from unauthorized or accidental use, collection, access, damage, loss or disclosure. Other recipients, such as professional advisers, banks and public authorities, may act as independent Data Controllers under their own legal obligations.

7 Transferring your Personal Data outside European Union (‘EU’) and European Economic Area (‘EEA’)

Where providing our website or Services involves transferring Personal Data outside the EEA, including access by a recipient in another country, we ensure that the transfer meets the requirements of the Law. You may contact us using the details below for information about the applicable transfer safeguards and to obtain a copy.

8 When can Personal Data be transferred outside of the EU and the EEA

• If the European Commission has made a finding that the Third Country, territory or sectors within the Third Country ensures an adequate level of privacy protection (Adequacy Decision).
• The Third Party has signed the standard data protection clauses (i.e. contract) adopted by the European Commission and agreed to apply the privacy standards of protection of the European Union. Where required, we assess the protection available in the destination country and implement supplementary measures.
• Exceptionally, a derogation under Article 49 GDPR may apply where its specific conditions are met. If we rely on explicit consent, we first inform you of the possible risks. Acceptance of this Policy is not consent to an international transfer.

9 Retention of Personal Data

We will retain the Personal Data of the Data Subjects for as long as it is necessary to fulfil the purpose for which it was collected (including for the purposes of satisfying any legal, accounting or reporting requirements). We will cease to retain Personal Data of the Data Subjects or remove the means by which the Personal Data can be associated with them (i.e. anonymize the Personal Data) as soon as this retention no longer serves the purposes for which the Personal Data were collected (except where retention is required by applicable laws). Retention is determined by the duration of the business relationship, the time needed to resolve an enquiry or support request, applicable statutory retention periods and relevant limitation periods for legal claims. Security logs are retained for the period needed to investigate and prevent misuse. Cookie durations are described in our Cookies Policy. Anonymisation means that an individual is no longer identifiable by means reasonably likely to be used. Removing names or replacing card details with tokens does not, by itself, anonymise data.

10 Protection of Personal Data

To safeguard all Personal Data from unauthorized access, collection, use, damage, loss disclosure, copying or similar risks, we have introduced appropriate administrative, physical and technical measures including appropriate access controls and encryption where warranted by the risks. We also allow access to Personal Data only to those employees who need to know such data and they will only process Personal Data on our instructions. However, no method of transmission over the internet or method of electronic storage is completely secure. While security cannot be guaranteed, we try to protect the security of the Data Subject’s Personal Data and we constantly review and enhance our information security measures.

11 The rights of the Data Subjects in relation to their Personal Data

These rights apply subject to the conditions and exceptions in the Law. You may also withdraw consent as described above.

• Right to access: Request access to their Personal Data (commonly referred to as a “data subject access request”). This enables the Data Subjects to receive a copy of their Personal Data paytech Ltd holds about them and to check that paytech Ltd is lawfully processing it;
• Right to rectification: Request to correct or update incomplete or inaccurate Personal Data.
• Right to data portability: Where processing is automated and based on consent or a contract with you, receive the Personal Data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller;
• Right to erasure: Request deletion of Personal Data where the conditions in the Law are met. This right is subject to exceptions, including where retention is necessary to comply with a legal obligation or for legal claims;
• Right to restrict processing: Request restriction where the conditions in the Law are met. Right to object: Object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object at any time to direct marketing, including related profiling, and we will stop processing for that purpose;
• Right to lodge a complaint: You may contact us or complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or another competent supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. Cyprus contact:

Kypranoros 15, 1061 Nicosia, Cyprus

Postal address: P.O. Box 23378, 1682 Nicosia, Cyprus

Tel: +357 22818456

Fax: +357 22304565

Email: [email protected]

Website: Office of the Commissioner for Personal Data Protection

12 How can you exercise your rights in relation to your Personal Data

If you wish to exercise any of your rights, you may contact our Data Protection Officer in writing or via email at the contact details provided below:

Name: PANAYIOTIS Z. TOULOURAS LLC

Address: Rafail Santi 58, NEFELI COURT 11, Ground Floor, 6052, Larnaca, Cyprus

Email: [email protected]

Where we have reasonable doubts about your identity, we may request additional information necessary to confirm it.

We will respond without undue delay and within one month of receiving your request. Where necessary because of its complexity or the number of requests, we may extend this by up to two further months and will explain the extension within the first month. Requests are normally free of charge. Any refusal or fee will be limited to circumstances permitted by law and accompanied by an explanation and information about your remedies.

13 Effect of Policy and Changes to Policy

We keep this Policy under review and may update it from time to time by publishing a revised version and updating the date above. We will provide additional notice where required by law, including before processing your Personal Data for a new purpose. Please review this Policy periodically.