Retention, Transfer and Disclosure

Part 4 of 6

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymizing data. We apply different retention periods to different categories of Personal Data based on the purpose of processing and Our legal obligations:

Identity Verification and Transaction Records

Identity Verification data, customer due diligence records and transaction records: retained for at least five (5) years after the end of Our business relationship with You, or for any longer period required by applicable anti-money laundering laws or a competent authority.

Account Information

User Accounts: retained for the duration of Your Account relationship plus up to 24 months after Account closure, to handle any post-termination issues or resolve disputes, except where a longer period applies under the paragraph above.

Customer Support Data

Support tickets and correspondence: up to 24 months from the date of ticket closure, to resolve follow-up enquiries, track service quality, and defend against potential legal claims.

Security and Usage Data

Login activity and server logs (IP addresses, access times): up to 24 months for security monitoring, fraud prevention and troubleshooting.
Crash and diagnostic data: up to 90 days, in accordance with the retention settings of Firebase Crashlytics.

We may retain Personal Data beyond the periods stated above for the following reasons:

Legal obligation: We are required by law to retain specific data (for example, financial records for regulatory or tax authorities).
Legal claims: the data is necessary to establish, exercise, or defend legal claims, or is subject to an investigation or legal hold.
Your explicit request: You ask Us to retain specific information.
Technical limitations: the data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data according to the following procedures:

Deletion: Personal Data is removed from Our systems and no longer actively processed.
Backup retention: residual copies may remain in encrypted backups for a limited period consistent with Our backup retention schedule, and are not restored except where necessary for security, disaster recovery, or legal compliance.
Anonymisation: in some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to You. This anonymized data may be retained indefinitely.

Transfer of Your Personal Data

CentPay is used by customers around the world. Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located, including Our Service Providers, card partners, Third-Party Providers and payout partners. This means that Your information may be transferred to, and maintained on, computers located outside of Your state, province, country or other governmental jurisdiction, where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards, such as standard contractual clauses approved by the relevant authorities. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy, and to transfer Your Personal Data only where appropriate controls are in place, including for the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update certain information at any time by signing in to Your Account. To request the deletion of Your Account and Personal Data, please email Us at support@centpay.io from the email address registered to Your Account, with the subject line “Account Deletion Request”.

Before Your Account can be closed, any remaining balance must be withdrawn and any pending transactions, card balances or disputes must be resolved. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so, as described in the Retention section above. Deleting Your Account does not affect data recorded on blockchain networks, or data held by Third-Party Providers, card issuers and payout partners under their own privacy policies.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. Where required by law, and where reasonably practicable, We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court, a regulator, a government agency or a financial intelligence unit), including the reporting of suspicious transactions. Where the law prohibits Us from telling You about such a disclosure, We will not do so.

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation
Protect and defend the rights or property of the Company
Prevent or investigate possible wrongdoing, fraud or financial crime in connection with the Service
Protect the personal safety of users of the Service or the public
Protect against legal liability