Privacy Policy

1. Our principles.

• Visit our website;

• Complete any of our documents;

• Contact us (by phone, messenger or email);

• Register to open an account or use any of our services;

• Perform transactions; or

• Contact us for any other reason.

• Government IDs and other identifying information such as your passport, national ID card, social security number, taxpayer identification number, and any other document you provide for identification purposes;

• Contact information such as your first name, last name, address (including proof of address such as a utility bill), telephone number, fax number, email address, country of residence and details of the device you use (phone, computer or tablet);

• Personal characteristics such as date of birth and country/place of birth, nationality;

• Financial data such as transaction data, details of your payment instrument including but not limited to account number, card number, card expiration date, CVC/CVV code, details of the credit/financial institution and/or issuer and information related to the products or services purchased including the location and time of the transaction, financial information including source of wealth, tax income, earnings;

• Functions and powers of the relevant representative(s);

• Employment and professional information (including, but not limited to, resume, professional membership, position and duties, professional qualifications);

• Records of correspondence/communication and/or telephone calls if you contact us. Such records may include your first name, last name, email address, telephone number, your company name and other personal information that you may disclose to us during such communication;

• Your username and other registration information;

• Your image in the form of a photo or video (if required as part of our Know Your Customer (KYC) checks);

• Browser and device data, such as IP address operating system and browser type. These are statistical data about the browsing actions and patterns of users of the Website, which don’t identify any individual;

• Cookie data such as time spent on the Website, pages visited, language preferences and other anonymous traffic data;

• Company information such as company name, products and services offered, jurisdiction.

• Fulfillment of our obligations within our business relationships and/or agreements concluded between us and our partners, including in relation to the provision of financial services;

• Processing transactions/payments;

• Customer acceptance and onboarding procedures, communicating with customers;

• Maintaining and developing our business;

• Maintaining our IT systems, including administrative and management systems, processes and policies;

• Monitoring for any potential fraud, money laundering, terrorist financing or criminal risks;

• Developing identity verification procedures and processes to comply with legal/regulatory requirements;

• Conducting market research and marketing activities;

• Ensuring that content from the Website is presented in the most effective manner and that our Website is safe and secure;

• Allowing you to use interactive features of our Website;

• Administration of our Website.

• Processing is necessary to comply with a legal obligation: We are required by law to carry out various actions to prevent fraud and money laundering.

• Processing is necessary to enter into or fulfill a contractual obligation: We process your personal data to fulfill our contractual obligations to you as our Client or Payer.

• Processing is necessary for the purposes of our legitimate interests: We process personal data based on our various legitimate interests, such as prevention of crime, fraud and anti-money laundering activities, activities to administer our business and further develop our services, direct marketing, risk management, initiating legal claims and preparing defence in the event of legal proceedings, disclosing information to other data recipients such as our service providers, auditors and technology providers and/or to monitor and improve our relationship with you and/or to maintain our internal records and/or to track communications to/from you using our systems and/or to protect the integrity of our IT systems.

• Processing is based on your consent. Since you have given us specific consent for processing, the lawfulness of the processing is based on your consent.

• Our group of companies. In order to provide our services/products, we share personal data with our group companies. We are the entity responsible for the overall use of personal data by other group companies in connection with the services/products we provide;

• Third party financial institutions. These may include card companies, payment processors, financial institutions based in Cyprus or abroad to facilitate transactions and any other services you request, and credit/financial institutions with which you, as a customer or payer, maintain your payment account or other type of account;

• Global compliance databases in accordance with our «Know Your Customer» and «Due Diligence» procedures.

• Credit reference agencies. We may share personal data with credit reference agencies for the purpose of carrying out credit checks and obtaining credit reports;

• Third party service providers. We disclose personal data to service providers only where necessary to enable the provision of our services, including but not limited to payment/transaction processing or other services;

• Our IT service providers and other companies that assist us in the efficient operation of our business by providing technology expertise, penetration testing, file storage and records management, logistics services and solutions, and other subcontractors.

• Cloud computing and storage providers;

• Our clients. We may disclose certain personal data that you have provided to us, or that we have obtained about you as a Payer, to relevant Clients to assist them in complying with their legal obligations or their obligations to you as their client;

• Third parties in connection with legal obligations or if we are permitted to do so by law. In certain circumstances, we may be required to disclose or share your personal data with auditors, regulators or law enforcement agencies to comply with legal obligations;

• Individuals acting on behalf of beneficial owners/shareholders of our clients/counterparties that are legal entities, including payment recipients, beneficiaries, nominal account holders, intermediary banks, correspondent banks and agents;

• Third parties in connection with a business transfer. For example, if we sell any business or assets, or merge with another legal entity, it may be necessary to disclose personal data to potential business owners or partners;

• Companies that provide video surveillance and security management services for attendance at meetings or visits to our offices;

• Companies or individuals with whom you ask us to share your personal data.

• who is located in a country that ensures an adequate level of protection of personal data, or

• In compliance with the appropriate safeguards in accordance with the provisions of applicable data protection laws (for example, by agreement in the form of standard data protection clauses adopted by the European Commission), a form of which is available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en . In some circumstances, we may carry out such transfers if

• • we have obtained the explicit consent of the relevant data subject in relation to the proposed transfer, provided that the data subject has been informed of the possible risks of such transfer (due to the absence of an adequacy decision and appropriate safeguards);

  • transfer is necessary for the performance of the contract between the data subject and us, or

  • transfer is necessary for the performance of the contract concluded in the interests of the data subject between us and another person, or

  • transfer is necessary for the establishment of the implementation or defense of legal claims.

• Conducting assessments of data, which may include payment transactions, in the context of measures to prevent fraud, money laundering and terrorist financing. These assessments are carried out for your protection.

• Marketing of our services and products, if you have given your consent to this.

• Right of access. You have the right to request a copy of the information we hold about you. You have the right to confirmation as to whether we process your personal data and, where we do, to access the personal data together with certain additional information. Such additional information includes, in particular, information about the purposes of the processing, the categories of personal data concerned and the categories of recipients of the personal data. The right to receive a copy of your data shall not adversely affect the rights and freedoms of others.

• Right to rectification. You have the right to request the rectification of inaccurate or incomplete personal data concerning you. You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

• Right to erasure (“right to be forgotten”). You have the right to request that personal data be erased if one of the following grounds applies:

• • Personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  • You withdraw your consent on which the processing is based and where there is no other legal ground for the processing;

  • You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing for direct marketing purposes;

  • Personal data have been processed unlawfully;

  • Personal data must be erased for compliance with a legal obligation.

• The above does not apply if the processing is necessary

• • to the right to freedom of expression and information;

  • for compliance with a legal obligation which requires processing by law to which we are subject; and

  • for reasons of public interest; or for the establishment, implementation or defense of legal claims.

• Right to restrict processing. You have the right to receive a processing restriction if one of the following conditions applies:

• • Accuracy of the personal data is contested for a period enabling us to verify the accuracy of the personal data.

  • Processing is unlawful and you object to the erasure of such data and instead request the restriction of its use.

  • We no longer need the personal data for the purposes of the processing, but you require its retention for the establishment, implementation or defense of legal claims.

  • You have objected to processing based on our legitimate interests, pending verification whether the grounds on which we process your information override your rights and freedoms.

• If processing has been restricted on the basis of the above, we will continue to store your personal data. However, otherwise we will only process it

• • with your consent;

  • for the establishment, implementation or defense of legal claims;

  • to protect the rights of another person or entity; or

  • for reasons of important public interest.

• Right to portability. You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another organisation and/or ask us to do this for you, provided that:

• • • Processing is based on your consent, performance or conclusion of a contract.

    • Processing is carried out by automated means.

• Right to object. You have the right to object to the processing of your personal data at any time and for reasons related to your specific situation, when the legal basis on which the processing activity is based is our legitimate interests. If you exercise this right, we will no longer process personal data unless we can demonstrate a compelling legitimate reason for processing that overrides your interests, rights and freedoms, or to establish, exercise or defend legal claims. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

• Right to withdraw consent. If the processing is based on your written consent, you have the right to withdraw consent at any time.

• To the extent that the legal basis for our processing of your personal data is consent (if applicable), you have the right to withdraw that consent at any time, without affecting the lawfulness of the processing prior to the withdrawal.

• Right to lodge a complaint. You can contact us with any questions regarding personal data using the details provided. If you are not satisfied or still have concerns, you can lodge a complaint with the Office of the Data Protection Commissioner. You can find out how to lodge a complaint on their website. (http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/page1i_gr/page1i_gr?opendocument )