Merchant Privacy Policy

Security of Personal Data

The security of Personal Data is a priority for Us. We use industry-standard technical and organisational measures to protect Personal Data against unauthorised access, loss, alteration or disclosure, including:

• Encryption: all data transmitted between the Application and Our servers is encrypted using Transport Layer Security (TLS). Personal Data stored on Our systems, including verification documents, is encrypted at rest, and passwords are stored using secure one-way hashing so that they cannot be read by anyone, including Our staff.
• On Your Device: the Application keeps Your sign-in session in the secure storage provided by Your Device’s operating system.
• Access controls: access to Personal Data is limited to authorised personnel who need it to perform their duties, and who are bound by confidentiality obligations.
• Account protection: two-factor authentication, Transaction PINs, IP address allow lists for the Developer API, and login activity monitoring help protect Accounts from unauthorised access.
• Monitoring: We monitor Our systems for vulnerabilities and suspicious activity, and review Our security measures to address evolving risks.
• Service Provider security: We require Our Service Providers to protect Personal Data with appropriate security measures.
• Incident response: where required by law, We will notify You and the relevant authorities of a personal data breach without undue delay.

You also play an important role in keeping the Account secure. You are solely responsible for keeping Your password, Transaction PIN, two-factor authentication (2FA) codes, authenticator app, API Keys, Device and email account secure and confidential, and You must not share them with anyone who is not an Authorised User. Reports You download are saved on Your Device, and You are responsible for keeping them secure. We will never ask for Your password, Transaction PIN, 2FA codes or secret key by email, telephone or message.

To the fullest extent permitted by law, the Company shall not be liable for any loss, damage or unauthorised access to the Account arising from a failure to keep these details secure, including where a password, Transaction PIN, 2FA code or secret key is disclosed, or where a Device, authenticator app or email account is lost, stolen or accessed by another person. If You believe the Account has been compromised, or that any of these details have been lost or stolen, You must contact Us immediately.

Remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We use commercially reasonable means to protect Personal Data, We cannot guarantee its absolute security.

Your Privacy Rights

Depending on where You live, and subject to the conditions of applicable law, You may have the right to:

• Access the Personal Data We hold about You and receive a copy of it
• Correct inaccurate or incomplete Personal Data
• Delete Your Personal Data
• Restrict or object to certain processing of Your Personal Data
• Data portability: receive the Personal Data You provided in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Request human review of decisions made solely by automated means that significantly affect You
• Lodge a complaint with a data protection authority

To exercise any of these rights, please contact Us using the details below. We will verify Your identity before acting on Your request, and We will respond within the time required by applicable law, generally within one month (or 45 days for residents of California). We will not charge a fee for responding to Your request unless it is manifestly unfounded or excessive, and We will not treat You differently for exercising Your rights.

These rights are not absolute. We may refuse or limit a request where We must keep data to meet legal obligations, such as anti-money laundering record keeping, where the data is needed to establish, exercise or defend legal claims, or where the request would affect the rights of others. If We refuse a request, We will explain why, unless the law prevents Us from doing so.

If You are a Customer of a Merchant, You may also contact that Merchant about how it uses Your data. We will help the Merchant respond where We hold the data.

Automated Decision-Making

To meet Our legal obligations and prevent fraud, We and Our verification providers may use automated tools to check documents, screen against sanctions lists and flag unusual transactions. If a decision based solely on automated processing significantly affects You, such as the refusal of an application, You may contact Us to request that a member of Our team review the decision, express Your point of view, and contest it.

Cookies and Local Storage

The Application does not use advertising cookies or third-party advertising trackers. It stores a small amount of information on Your Device, such as Your sign-in session and preferences (for example, Your chosen theme), so that the Application works properly.

Our website, the merchant web dashboard and the live chat page opened within the Application may use cookies and similar technologies. Where required by law, We will ask for consent before placing non-essential cookies on Our website. Cookies placed by third parties, such as the live chat provider, are governed by their own policies.