Retention, Transfer and Disclosure

Part 4 of 6

Retention of Personal Data

The Company will retain Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Personal Data to the extent necessary to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymising data. We apply different retention periods to different categories of Personal Data based on the purpose of processing and Our legal obligations:

Business Verification and Transaction Records

Business Verification data, customer due diligence records and transaction records, including Customer payment records: retained for at least five (5) years after the end of Our business relationship with the Merchant, or for any longer period required by applicable anti-money laundering laws or a competent authority.

Account Information

Merchant Accounts: retained for the duration of the Account relationship plus up to 24 months after Account closure, to handle any post-termination issues or resolve disputes, except where a longer period applies under the paragraph above.

Security, Usage and Integration Data

Login activity and server logs (IP addresses, access times): up to 24 months for security monitoring, fraud prevention and troubleshooting.
API call and webhook delivery logs: up to 24 months for troubleshooting and security.

We may retain Personal Data beyond the periods stated above for the following reasons:

Legal obligation: We are required by law to retain specific data (for example, financial records for regulatory or tax authorities).
Legal claims: the data is necessary to establish, exercise, or defend legal claims, or is subject to an investigation or legal hold.
Explicit request: You ask Us to retain specific information.
Technical limitations: the data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymise Personal Data according to the following procedures:

Deletion: Personal Data is removed from Our systems and no longer actively processed.
Backup retention: residual copies may remain in encrypted backups for a limited period consistent with Our backup retention schedule, and are not restored except where necessary for security, disaster recovery, or legal compliance.
Anonymisation: in some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to any individual. This anonymised data may be retained indefinitely.

Transfer of Personal Data

CentPay Merchant is used by businesses around the world. Information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located, including Our Service Providers and Third-Party Providers. This means that information may be transferred to, and maintained on, computers located outside of Your state, province, country or other governmental jurisdiction, where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Personal Data are subject to appropriate safeguards, such as standard contractual clauses approved by the relevant authorities. The Company will take all steps reasonably necessary to ensure that data is treated securely and in accordance with this Privacy Policy, and to transfer Personal Data only where appropriate controls are in place.

Deleting Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update certain information at any time by signing in to the Account or by contacting Us. To request the closure of an Account and the deletion of the related Personal Data, please email Us at support@centpay.io from the email address registered to the Account, with the subject line “Account Deletion Request”.

Before an Account can be closed, any remaining balance must be withdrawn, auto-transfer must be turned off, and any pending transactions, withdrawals or disputes must be resolved. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so, as described in the Retention section above. Deleting an Account does not affect data recorded on blockchain networks, or data held by MT5 brokers and other Third-Party Providers under their own privacy policies.

Disclosure of Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Personal Data may be transferred. Where required by law, and where reasonably practicable, We will provide notice before Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court, a regulator, a government agency or a financial intelligence unit), including the reporting of suspicious transactions. Where the law prohibits Us from telling You about such a disclosure, We will not do so.

Other Legal Requirements

The Company may disclose Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation
Protect and defend the rights or property of the Company
Prevent or investigate possible wrongdoing, fraud or financial crime in connection with the Service
Protect the personal safety of users of the Service or the public
Protect against legal liability