Merchant Privacy Policy

Interpretation

The words whose initial letters are capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account

means the merchant account registered for a business to access Our Service or parts of Our Service.

Affiliate

means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

API Keys

means the public key and secret key issued to a Merchant on the Developer API page to connect its website, app or systems to the Service.

Application

refers to CentPay Merchant, the mobile application for iOS and Android provided by the Company.

Authorised User

means any owner, director, employee, agent or other person a Merchant allows to access or use its Account.

Business Verification

(also known as “KYB” or “Know Your Business”, together with “KYC” or “Know Your Customer”) means the process by which We verify a Merchant, its owners and its Authorised Users, as required by anti-money laundering, counter-terrorist financing and sanctions laws.

Company

(referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to “CENTPAY”. For the purposes of applicable data protection laws, the Company is the controller of the Personal Data described in this Privacy Policy, except where stated otherwise.

Customer

means any person who pays a Merchant, or tries to pay a Merchant, through the Service.

Device

means any device that can access the Service, such as a mobile phone, a digital tablet or a computer.

Merchant

means the business that registers an Account and uses the Service to accept payments and manage its funds.

MT5 Account

means a MetaTrader 5 trading account linked to a Merchant’s Account.

Personal Data

(or “Personal Information”) is any information that relates to an identified or identifiable individual. We use “Personal Data” and “Personal Information” interchangeably unless a law uses a specific term. Information about a business itself is not Personal Data, but information about the people behind it, such as its owners and staff, is.

Service

refers to the Application, the merchant web dashboard at https://member.centpay.io/merchant, Our website at https://centpay.io, the Developer API, and all related features, content and communications.

Service Provider

means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals engaged by the Company to facilitate the Service, to provide the Service on behalf of the Company, or to perform services related to the Service.

Third-Party Provider

means an independent company, not owned or controlled by the Company, that provides a service connected with the Service, such as an MT5 broker or platform provider.

Usage Data

refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.

You

means the individual accessing or using the Service, such as a Merchant’s owner or Authorised User, or the Merchant on behalf of which such individual is accessing or using the Service, as applicable.

Types of Data Collected

We collect only the Personal Data that is necessary to provide the Service, to keep Accounts secure, and to comply with the law. The data We collect depends on the features You use.

Business and Owner Data

When a Merchant registers for an Account, We ask for information about the business and about the person who owns or runs it. This includes:

• Company name, trading name, registration number, country of registration, website and business category
• Owner’s full name, nationality, country of residence and date of birth
• Phone number and country dialling code
• Email address, which must be verified before You can sign in
• Password (transmitted in encrypted form and used solely to authenticate You)
• Expected monthly and annual volumes, and minimum and maximum transaction amounts

You are responsible for ensuring that the information You provide to Us is accurate, complete and kept up to date.

Business Verification Data

As a provider of payment services to businesses, We are required to verify the Merchants We work with and the people behind them. During Business Verification, We may ask for:

• Company registration documents and proof of the business address
• Details of directors, owners and beneficial owners, including identity documents and proof of address
• Information about the business activities, the source of funds and the expected use of the Account
• The status and outcome of Business Verification

Financial and Transaction Data

When You use the financial features of the Service, We collect:

• Wallet data: balances and the USDT deposit addresses generated for the Account on each supported network
• Payment data: amounts, coins, networks, wallet addresses, order IDs, transaction identifiers, dates and status of the payments a Merchant receives
• Withdrawal data: destination wallet addresses, networks, amounts, fees, dates and approval status
• P2P transfer data: the recipient Merchant’s email address, the amount, the fee and the status of the transfer
• MT5 data: the MT5 account numbers and names linked to the Account, MT5 transfers, and Your auto-transfer settings
• Fee data: the transaction and withdrawal fees that apply to the Account

When You provide Personal Data about another person, such as a recipient of a transfer, You confirm that You are entitled to share it with Us for that purpose.

Customer Data

When a Customer pays a Merchant through the Service, We process the data needed to complete and record that payment, such as the Customer’s wallet address, the amount, the order ID and, where the Merchant sends it to Us, the Customer’s name or email address. We use this data to process the payment, to show it to the Merchant, and to meet Our legal obligations, including fraud and financial crime checks.

Each Merchant is responsible for its own relationship with its Customers, including telling them how their data is shared with Us and having a lawful basis to share it.

Developer and Integration Data

When You use the Developer API, We store Your public key, a protected record of Your secret key, the IP address You allow, Your webhook addresses and Your success and failure redirect addresses. We also keep records of API calls and webhook deliveries to operate the Service, help You troubleshoot and keep the Service secure.

Account Security Data

• Two-factor authentication (2FA) configuration data
• Your Transaction PIN, stored in protected form and used only to confirm transfers and withdrawals
• Login activity, including the date and time of each login, Your IP address, Your device and browser type, and the approximate city and country derived from Your IP address
• Records of security events, such as password and PIN changes, secret key changes and 2FA verification attempts

Customer Support Data

When You contact Us by email or through live chat, We collect the content of Your messages, any details You share, such as transaction details You paste into a message, and Our correspondence with You.

Usage Data

Usage Data is collected automatically when using the Service.

When You access the Service through a mobile device, We may collect certain information automatically, including the type of mobile device You use, Your mobile operating system and version, the version of the Application, Your network connectivity status, and the IP address of Your mobile device.

We use Your IP address to determine Your approximate location at country and city level. We use this to detect suspicious activity, such as a sign-in from a new device or location, and to meet Our legal obligations.

Information Collected while Using the Application

While using Our Application, and only with Your prior permission, We may access Your Device’s camera so that You can scan another Merchant’s CentPay P2P QR code. The camera image is used only on Your Device to read the QR code, and We do not store or upload it.

You can enable or disable camera access at any time through Your Device settings. Disabling access means You will need to enter the recipient’s email address yourself.

Information We Do Not Collect

For transparency, the Application does not collect:

• Your precise GPS location
• Your contacts or address book
• Your Device’s advertising identifier
• Audio or recordings from Your microphone
• Your browsing activity on other websites or applications
• Health or medical information

We do not track You across applications or websites owned by other companies.

Sensitive Personal Data

Some of the data We collect, such as identity documents, financial and transaction information, API Keys and login credentials, is considered sensitive. We process this data only where necessary for the purposes described in this Privacy Policy, and We protect it with enhanced security measures.

We do not intentionally collect special categories of data, such as data about health, religious beliefs or political opinions, and We ask that You do not include such information in Your communications with Us.

Use of Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including processing payments, deposits, withdrawals, P2P transfers and MT5 transfers, running auto-transfer, sending webhooks, and preparing activity reports.
• To manage Accounts: to manage a Merchant’s registration and give it and its Authorised Users access to the features available to them.
• To verify Merchants and comply with the law: to carry out Business Verification and customer due diligence, screen against sanctions and politically exposed persons lists, monitor transactions, and prevent, detect and report money laundering, terrorist financing, fraud and other financial crime.
• To protect Accounts and Our Service: to operate two-factor authentication and Transaction PINs, protect API Keys, monitor login activity, and detect and prevent unauthorised access and suspicious activity.
• To contact You: to contact You by email, telephone, SMS or in-app notifications about Your Account, payments, security alerts, and changes to the Service or this Privacy Policy.
• To send You marketing communications, only where You have agreed to receive them or where otherwise permitted by law. You may opt out at any time.
• To manage Your requests: to respond to Your support requests, enquiries and complaints.
• To improve the Service: to diagnose technical problems and improve the stability, performance and security of the Service.
• To meet legal obligations and protect Our rights: to keep records, meet regulatory and tax reporting obligations, respond to lawful requests from authorities, enforce Our Terms and Conditions, and establish, exercise or defend legal claims.
• For business transfers: to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of Our assets, in which Personal Data held by Us is among the assets transferred.

Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Data, We rely on one or more of the following: the performance of Our contract with the Merchant; compliance with Our legal and regulatory obligations; Our legitimate interests (such as verifying the people behind a business, preventing fraud and keeping the Service secure), balanced against the rights of the individuals concerned; and consent, which may be withdrawn at any time without affecting processing carried out before withdrawal.

If You do not provide Personal Data that We need to meet a legal requirement or to perform Our contract with the Merchant, We may be unable to open or maintain the Account or to provide some or all of the Service.

Sharing Personal Data

We do not sell Personal Data, and We do not share it for third-party advertising. We may share Personal Data only in the following situations:

• With Service Providers: We share Personal Data with Service Providers who help Us operate the Service, such as cloud hosting, Business Verification, sanctions screening, email, SMS and live chat providers. They may process Personal Data only on Our instructions and must keep it confidential and secure.
• With MT5 brokers and platform providers: when You move funds to or from an MT5 Account, or use auto-transfer, We share the details needed to complete the transfer, such as the MT5 account number, the amount and Your Account identifiers.
• With blockchain networks: when a deposit or withdrawal is made, the wallet addresses, amounts and timestamps are recorded on a public blockchain.
• With Other Merchants and Users: When You make a P2P transfer, whether to another Merchant or to a User, limited information, such as Your name, business name, or email address, may be shared with the recipient as necessary to process the transaction. When You share or scan a P2P QR code, the information displayed may include the details encoded in the QR code.
• With Your own systems: when You set webhook or redirect addresses, We send payment updates and Customer payment details to the addresses You choose.
• With Affiliates: We may share Personal Data with Our Affiliates, in which case We will require those Affiliates to honour this Privacy Policy.
• For business transfers: We may share or transfer Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With consent: We may disclose Personal Data for any other purpose with the consent of the person concerned.

MT5 Accounts

MT5 Accounts and the MetaTrader 5 platform are provided by Third-Party Providers. When You link an MT5 Account or move funds to or from it, the relevant MT5 broker and platform provider process Personal Data as independent controllers in accordance with their own privacy policies. We are not responsible for their privacy practices, and We encourage You to review their terms and privacy policies.

Blockchain Transactions

Cryptocurrency transactions are recorded on public, decentralised blockchain networks. Information such as wallet addresses, transaction amounts and timestamps is permanently visible to anyone, and may in some cases be linked to You or to Your Customers by third parties.

These networks are not owned, operated or controlled by the Company, and information recorded on them cannot be changed or deleted by the Company or by anyone else. For this reason, the rights to correction and deletion cannot be exercised in respect of data recorded on a blockchain network. Please consider this carefully before making any cryptocurrency transaction.

Retention of Personal Data

The Company will retain Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Personal Data to the extent necessary to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymising data. We apply different retention periods to different categories of Personal Data based on the purpose of processing and Our legal obligations:

We may retain Personal Data beyond the periods stated above for the following reasons:

• Legal obligation: We are required by law to retain specific data (for example, financial records for regulatory or tax authorities).
• Legal claims: the data is necessary to establish, exercise, or defend legal claims, or is subject to an investigation or legal hold.
• Explicit request: You ask Us to retain specific information.
• Technical limitations: the data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymise Personal Data according to the following procedures:

• Deletion: Personal Data is removed from Our systems and no longer actively processed.
• Backup retention: residual copies may remain in encrypted backups for a limited period consistent with Our backup retention schedule, and are not restored except where necessary for security, disaster recovery, or legal compliance.
• Anonymisation: in some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to any individual. This anonymised data may be retained indefinitely.

Transfer of Personal Data

CentPay Merchant is used by businesses around the world. Information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located, including Our Service Providers and Third-Party Providers. This means that information may be transferred to, and maintained on, computers located outside of Your state, province, country or other governmental jurisdiction, where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Personal Data are subject to appropriate safeguards, such as standard contractual clauses approved by the relevant authorities. The Company will take all steps reasonably necessary to ensure that data is treated securely and in accordance with this Privacy Policy, and to transfer Personal Data only where appropriate controls are in place.

Deleting Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update certain information at any time by signing in to the Account or by contacting Us. To request the closure of an Account and the deletion of the related Personal Data, please email Us at support@centpay.io from the email address registered to the Account, with the subject line “Account Deletion Request”.

Before an Account can be closed, any remaining balance must be withdrawn, auto-transfer must be turned off, and any pending transactions, withdrawals or disputes must be resolved. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so, as described in the Retention section above. Deleting an Account does not affect data recorded on blockchain networks, or data held by MT5 brokers and other Third-Party Providers under their own privacy policies.

Disclosure of Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Personal Data may be transferred. Where required by law, and where reasonably practicable, We will provide notice before Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court, a regulator, a government agency or a financial intelligence unit), including the reporting of suspicious transactions. Where the law prohibits Us from telling You about such a disclosure, We will not do so.

Other Legal Requirements

The Company may disclose Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing, fraud or financial crime in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of Personal Data

The security of Personal Data is a priority for Us. We use industry-standard technical and organisational measures to protect Personal Data against unauthorised access, loss, alteration or disclosure, including:

• Encryption: all data transmitted between the Application and Our servers is encrypted using Transport Layer Security (TLS). Personal Data stored on Our systems, including verification documents, is encrypted at rest, and passwords are stored using secure one-way hashing so that they cannot be read by anyone, including Our staff.
• On Your Device: the Application keeps Your sign-in session in the secure storage provided by Your Device’s operating system.
• Access controls: access to Personal Data is limited to authorised personnel who need it to perform their duties, and who are bound by confidentiality obligations.
• Account protection: two-factor authentication, Transaction PINs, IP address allow lists for the Developer API, and login activity monitoring help protect Accounts from unauthorised access.
• Monitoring: We monitor Our systems for vulnerabilities and suspicious activity, and review Our security measures to address evolving risks.
• Service Provider security: We require Our Service Providers to protect Personal Data with appropriate security measures.
• Incident response: where required by law, We will notify You and the relevant authorities of a personal data breach without undue delay.

You also play an important role in keeping the Account secure. You are solely responsible for keeping Your password, Transaction PIN, two-factor authentication (2FA) codes, authenticator app, API Keys, Device and email account secure and confidential, and You must not share them with anyone who is not an Authorised User. Reports You download are saved on Your Device, and You are responsible for keeping them secure. We will never ask for Your password, Transaction PIN, 2FA codes or secret key by email, telephone or message.

To the fullest extent permitted by law, the Company shall not be liable for any loss, damage or unauthorised access to the Account arising from a failure to keep these details secure, including where a password, Transaction PIN, 2FA code or secret key is disclosed, or where a Device, authenticator app or email account is lost, stolen or accessed by another person. If You believe the Account has been compromised, or that any of these details have been lost or stolen, You must contact Us immediately.

Remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We use commercially reasonable means to protect Personal Data, We cannot guarantee its absolute security.

Your Privacy Rights

Depending on where You live, and subject to the conditions of applicable law, You may have the right to:

• Access the Personal Data We hold about You and receive a copy of it
• Correct inaccurate or incomplete Personal Data
• Delete Your Personal Data
• Restrict or object to certain processing of Your Personal Data
• Data portability: receive the Personal Data You provided in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Request human review of decisions made solely by automated means that significantly affect You
• Lodge a complaint with a data protection authority

To exercise any of these rights, please contact Us using the details below. We will verify Your identity before acting on Your request, and We will respond within the time required by applicable law, generally within one month (or 45 days for residents of California). We will not charge a fee for responding to Your request unless it is manifestly unfounded or excessive, and We will not treat You differently for exercising Your rights.

These rights are not absolute. We may refuse or limit a request where We must keep data to meet legal obligations, such as anti-money laundering record keeping, where the data is needed to establish, exercise or defend legal claims, or where the request would affect the rights of others. If We refuse a request, We will explain why, unless the law prevents Us from doing so.

If You are a Customer of a Merchant, You may also contact that Merchant about how it uses Your data. We will help the Merchant respond where We hold the data.

Automated Decision-Making

To meet Our legal obligations and prevent fraud, We and Our verification providers may use automated tools to check documents, screen against sanctions lists and flag unusual transactions. If a decision based solely on automated processing significantly affects You, such as the refusal of an application, You may contact Us to request that a member of Our team review the decision, express Your point of view, and contest it.

Cookies and Local Storage

The Application does not use advertising cookies or third-party advertising trackers. It stores a small amount of information on Your Device, such as Your sign-in session and preferences (for example, Your chosen theme), so that the Application works properly.

Our website, the merchant web dashboard and the live chat page opened within the Application may use cookies and similar technologies. Where required by law, We will ask for consent before placing non-essential cookies on Our website. Cookies placed by third parties, such as the live chat provider, are governed by their own policies.

Children’s Privacy

Our Service is intended only for businesses, and the people who register or use an Account must be 18 years or older, or the age of legal majority in their country if higher. During sign-up We ask for the owner’s date of birth and do not accept owners under 18.

We do not knowingly collect Personal Data from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18, We will close the Account and delete that information, except where the law requires Us to retain it.

Links to Other Websites

Our Service may contain links to, or display pages from, websites and services that are not operated by Us, such as the live chat page, app store pages and authenticator app pages. If You click on a third-party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Limitation of Responsibility

To the fullest extent permitted by applicable law, the Company is not responsible for:

• The privacy practices, acts or omissions of MT5 brokers, Third-Party Providers and other third parties that process Personal Data as independent controllers
• How a Merchant collects, uses or shares the Personal Data of its own Customers, including data sent to its webhook or redirect addresses
• Unauthorised access to an Account resulting from a failure to keep a password, Transaction PIN, authenticator app, API Keys, Device or email account secure
• Information that You choose to make public, or that is recorded on a blockchain network
• Delays or failures caused by events beyond Our reasonable control

Nothing in this Privacy Policy excludes or limits any liability that cannot be excluded or limited under applicable law, or any right You have under applicable data protection law.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, at Our sole discretion and without prior notice, to reflect changes in Our practices, the Service or applicable law. Any changes take effect immediately when the updated Privacy Policy is posted on this page, and the “Last updated” date at the top of this Privacy Policy will be revised accordingly.

We are not obliged to notify You individually of any changes. It is Your responsibility to review this Privacy Policy periodically to stay informed about how We collect, use and protect Personal Data. Your continued use of the Service after any changes are posted constitutes Your acknowledgement and acceptance of the updated Privacy Policy.

Where applicable law requires Us to notify You of a change, or to obtain consent before a change applies, We will do so.

Contact Us

If You have any questions about this Privacy Policy, or wish to exercise Your privacy rights, You can contact Us:

• By emailinfo@centpay.io
• Merchant supportsupport@centpay.io