Privacy Policy

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account

means a unique account created for You to access Our Service or parts of Our Service.

Affiliate

means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

Application

refers to CentPay, the mobile application for iOS and Android provided by the Company.

Company

(referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to CENTPAY Limited, Dubai, United Arab Emirates. For the purposes of applicable data protection laws, the Company is the controller of Your Personal Data.

Country

refers to: United Arab Emirates.

Device

means any device that can access the Service, such as a mobile phone, a digital tablet or a computer.

Identity Verification

(also known as “KYC” or “Know Your Customer”) means the process by which We verify Your identity, as required by anti-money laundering, counter-terrorist financing and sanctions laws.

Personal Data

(or “Personal Information”) is any information that relates to an identified or identifiable individual. We use “Personal Data” and “Personal Information” interchangeably unless a law uses a specific term.

Service

refers to the Application, together with Our websites, including https://centpay.io, https://member.centpay.io, https://ru.centpay.io and https://hi.centpay.io, and all related features, content and communications.

Service Provider

means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, or to perform services related to the Service.

Third-Party Provider

means an independent company, not owned or controlled by the Company, that provides a service You access through the Application, such as a cryptocurrency purchase, sale or exchange provider, a card issuer, or an international payout partner.

Usage Data

refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.

You

means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Types of Data Collected

We collect only the Personal Data that is necessary to provide the Service, to keep Your Account secure, and to comply with the law. The data We collect depends on the features You use.

Personal Data

When You register for an Account, We ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. This includes:

• First name and last name
• Email address
• Password (transmitted in encrypted form and used solely to authenticate You)
• Phone number and country dialling code
• Address, City, Country and ZIP/Postal code
• Date of birth

You are responsible for ensuring that the information You provide to Us is accurate, complete and kept up to date.

Identity Verification (KYC) Data

As a provider of financial services, We are required to verify the identity of Our customers.

Before You can access certain features, such as payment cards and withdrawals, We collect:

• Identity document type (for example, passport, national identity card or other government-issued identity document)
• Identity document number, date of issue and date of expiry
• Images of the front and back of Your identity document
• A photograph of You holding Your identity document, used to confirm that You are the person to whom the document was issued
• Occupation
• Annual income, the intended purpose of Your Account, and Your expected monthly transaction volume
• The status and outcome of Your Identity Verification

Financial and Transaction Data

When You use the financial features of the Service, We collect:

• Wallet data: balances and the cryptocurrency deposit addresses generated for Your Account
• Deposit and withdrawal data: amounts, currencies, blockchain networks, wallet addresses, transaction identifiers, dates and status
• Payment card data: card type, card network, card number (masked except where the full number is required for the card to function), card status, top-up history, and card transaction records including merchant names, amounts and dates. Card PIN change requests are transmitted securely to the card issuer for processing.
• Peer-to-peer (P2P) transfer data: the recipient’s CentPay identifier or email address, the amount, the network and the status of the transfer
• International transfer data: the sender and recipient details required by the payout partner (such as names, addresses, dates of birth, nationality, contact details and bank or payout details), together with the transfer type, payout currency, payout method, amount, fees and status
• Cryptocurrency service data: the currencies, amounts, provider, payment method and recipient wallet address You select when using the Buy, Sell or Swap features
• Premium membership data: the plan You select, its price and duration, and the related charges deducted from Your wallet balance
• Rewards data: referral bonus and cashback records

When You provide Personal Data about another person, such as the recipient of a transfer, You confirm that You are entitled to share it with Us for that purpose.

Account Security Data

• Two-factor authentication (2FA) configuration data
• Login activity, including the date and time of each login, Your IP address, Your device and browser type, and the approximate city and country derived from Your IP address
• Records of security events, such as password changes and 2FA verification attempts

Customer Support Data

When You contact Us, We collect the content of Your support tickets, including the title, category, priority, description and any comments, together with Our correspondence with You.

Usage Data

Usage Data is collected automatically when using the Service. When You access the Service through a mobile device, We may collect certain information automatically, including the type of mobile device You use, Your mobile operating system and version, the version of the Application, Your network connectivity status, and the IP address of Your mobile device.

We use Your IP address to determine Your approximate location at country and city level. We use this to show You only the services and Third-Party Providers that are lawfully available in Your jurisdiction, and to detect suspicious activity on Your Account.

Crash and Diagnostic Data

We use Firebase Crashlytics, a service provided by Google LLC, to detect and fix Application crashes and errors. When the Application crashes, Crashlytics collects technical information such as the error details, Device model, operating system version, an Application installation identifier, and the state of the Application at the time of the crash. Crash reports may be associated with Your CentPay user identifier and email address so that We can investigate problems affecting Your Account. This data is used only to keep the Service stable and secure, and is never used for advertising.

Information Collected while Using the Application

While using Our Application, and only with Your prior permission, We may access:

• Your Device’s camera, so that You can photograph Your identity documents and take Your verification photo
• Your Device’s photo library or storage, so that You can upload existing images of Your identity documents

We use this information only to complete Your Identity Verification. You can enable or disable access to this information at any time through Your Device settings. Disabling access may prevent You from completing Identity Verification.

Information We Do Not Collect

For transparency, the Application does not collect:

• Your precise GPS location
• Your contacts or address book
• Your Device’s advertising identifier
• Audio or recordings from Your microphone
• Your browsing activity on other websites or applications
• Health or medical information

We do not track You across applications or websites owned by other companies.

Sensitive Personal Data

Some of the data We collect, such as identity document details and images, financial account and payment card information, and login credentials, is considered sensitive under data protection laws. We process this data only where necessary for the purposes described in this Privacy Policy, and We protect it with enhanced security measures.

Where the comparison of Your verification photo with Your identity document involves biometric processing, We carry it out only where permitted by law, such as for the prevention of fraud and financial crime, or with Your explicit consent where the law requires it. We do not intentionally collect other special categories of data, such as data about health, religious beliefs or political opinions, and We ask that You do not include such information in Your communications with Us.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including processing deposits, withdrawals, card transactions, P2P transfers, international transfers, premium membership charges, referral bonuses and cashback.
• To manage Your Account: to manage Your registration as a user of the Service and give You access to the features available to You.
• To verify Your identity and comply with the law: to carry out Identity Verification and customer due diligence, screen against sanctions and politically exposed persons lists, monitor transactions, and prevent, detect and report money laundering, terrorist financing, fraud and other financial crime.
• To issue and manage payment cards: to issue, activate, freeze, unfreeze and manage Your cards and process PIN change requests through Our card-issuing partners.
• To connect You with Third-Party Providers: to route Your cryptocurrency requests to the provider You select, and to show You only the providers available in Your jurisdiction.
• To protect Your Account and Our Service: to operate two-factor authentication, monitor login activity, and detect and prevent unauthorized access and suspicious activity.
• To contact You: to contact You by email, telephone, SMS or in-app notifications about Your Account, security alerts, transactions, and changes to the Service or this Privacy Policy.
• To send You marketing communications, only where You have agreed to receive them or where otherwise permitted by law. You may opt out at any time.
• To manage Your requests: to respond to Your support requests, enquiries and complaints.
• To improve the Service: to diagnose technical problems and improve the stability, performance and security of the Service.
• To meet legal obligations and protect Our rights: to keep records, meet regulatory and tax reporting obligations, respond to lawful requests from authorities, enforce Our Terms and Conditions, and establish, exercise or defend legal claims.
• For business transfers: to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of Our assets, in which Personal Data held by Us is among the assets transferred.

Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Data, We rely on one or more of the following: the performance of Our contract with You; compliance with Our legal and regulatory obligations; Our legitimate interests (such as preventing fraud and keeping the Service secure), balanced against Your rights; and Your consent, which You may withdraw at any time without affecting processing carried out before withdrawal.

If You do not provide Personal Data that We need to meet a legal requirement or to perform Our contract with You, We may be unable to open or maintain Your Account or to provide some or all of the Service.

Sharing Your Personal Data

We do not sell Your Personal Data, and We do not share it for third-party advertising. We may share Your Personal Data only in the following situations:

• With Service Providers: We share Personal Data with Service Providers who help Us operate the Service, such as cloud hosting, Identity Verification, sanctions screening, customer support and crash reporting providers. They may process Personal Data only on Our instructions and must keep it confidential and secure.
• With card issuers and card networks: to provide payment cards, We share the necessary Personal Data, including Identity Verification data, with Our card-issuing partners and card networks such as Visa and Mastercard, who process it as independent controllers under their own privacy policies.
• With Third-Party Providers: when You use a cryptocurrency feature, We share the information needed to process Your request with the provider You select.
• With payout and banking partners: to complete international transfers, deposits and withdrawals.
• With other users: when You send a P2P transfer, limited information such as Your name or account identifier may be shown to the recipient.
• With Affiliates: We may share Your Personal Data with Our Affiliates, in which case We will require those Affiliates to honour this Privacy Policy.
• For business transfers: We may share or transfer Your Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Your consent: We may disclose Your Personal Data for any other purpose with Your consent.

Third-Party Cryptocurrency Providers

The Company does not operate a cryptocurrency exchange. The Buy, Sell and Swap features in the Application are provided by independent, licensed third-party cryptocurrency service providers. When You use these features, You transact directly with the relevant third-party provider.

The availability of these services may depend on Your country of residence and may change from time to time. For fiat purchases and sales, Your transaction may be processed through the third-party provider’s own payment partners, which the Application displays as provider options. These third-party providers and their payment partners may carry out their own identity verification and anti-money laundering checks, may collect additional Personal Data directly from You, and process such data as independent controllers in accordance with their own privacy policies. We are not responsible for the privacy practices or services of any third-party provider or its payment partners, and We encourage You to review their terms and privacy policies before using their services.

Blockchain Transactions

Cryptocurrency transactions are recorded on public, decentralised blockchain networks. Information such as wallet addresses, transaction amounts and timestamps is permanently visible to anyone, and may in some cases be linked to You by third parties.

These networks are not owned, operated or controlled by the Company, and information recorded on them cannot be changed or deleted by the Company or by anyone else. For this reason, Your rights to correction and deletion cannot be exercised in respect of data recorded on a blockchain network. Please consider this carefully before making any cryptocurrency transaction.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymizing data. We apply different retention periods to different categories of Personal Data based on the purpose of processing and Our legal obligations:

We may retain Personal Data beyond the periods stated above for the following reasons:

• Legal obligation: We are required by law to retain specific data (for example, financial records for regulatory or tax authorities).
• Legal claims: the data is necessary to establish, exercise, or defend legal claims, or is subject to an investigation or legal hold.
• Your explicit request: You ask Us to retain specific information.
• Technical limitations: the data exists in backup systems that are scheduled for routine deletion.

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data according to the following procedures:

• Deletion: Personal Data is removed from Our systems and no longer actively processed.
• Backup retention: residual copies may remain in encrypted backups for a limited period consistent with Our backup retention schedule, and are not restored except where necessary for security, disaster recovery, or legal compliance.
• Anonymisation: in some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to You. This anonymized data may be retained indefinitely.

Transfer of Your Personal Data

CentPay is used by customers around the world. Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located, including Our Service Providers, card partners, Third-Party Providers and payout partners. This means that Your information may be transferred to, and maintained on, computers located outside of Your state, province, country or other governmental jurisdiction, where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards, such as standard contractual clauses approved by the relevant authorities. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy, and to transfer Your Personal Data only where appropriate controls are in place, including for the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update certain information at any time by signing in to Your Account. To request the deletion of Your Account and Personal Data, please email Us at support@centpay.io from the email address registered to Your Account, with the subject line “Account Deletion Request”.

Before Your Account can be closed, any remaining balance must be withdrawn and any pending transactions, card balances or disputes must be resolved. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so, as described in the Retention section above. Deleting Your Account does not affect data recorded on blockchain networks, or data held by Third-Party Providers, card issuers and payout partners under their own privacy policies.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. Where required by law, and where reasonably practicable, We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court, a regulator, a government agency or a financial intelligence unit), including the reporting of suspicious transactions. Where the law prohibits Us from telling You about such a disclosure, We will not do so.

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing, fraud or financial crime in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is a priority for Us. We use industry-standard technical and organisational measures to protect Your Personal Data against unauthorised access, loss, alteration or disclosure, including:

• Encryption: all data transmitted between the Application and Our servers is encrypted using Transport Layer Security (TLS). Personal Data stored on Our systems, including identity documents, is encrypted at rest, and passwords are stored using secure one-way hashing so that they cannot be read by anyone, including Our staff.
• Access controls: access to Personal Data is limited to authorised personnel who need it to perform their duties, and who are bound by confidentiality obligations.
• Account protection: two-factor authentication and login activity monitoring help protect Your Account from unauthorised access.
• Monitoring: We monitor Our systems for vulnerabilities and suspicious activity, and review Our security measures to address evolving risks.
• Service Provider security: We require Our Service Providers to protect Personal Data with appropriate security measures.
• Incident response: where required by law, We will notify You and the relevant authorities of a personal data breach without undue delay.

You also play an important role in keeping Your Account secure. You are solely responsible for keeping Your password, two-factor authentication (2FA) codes, authenticator app, Device and email account secure and confidential, and You must not share Your login details with anyone. We will never ask for Your password or 2FA codes by email, telephone or message.

To the fullest extent permitted by law, the Company shall not be liable for any loss, damage or unauthorised access to Your Account arising from Your failure to keep these details secure, including where Your password or 2FA codes are disclosed, or where Your Device, authenticator app or email account is lost, stolen or accessed by another person. If You believe Your Account has been compromised, or that any of these details have been lost or stolen, You must contact Us immediately.

Remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

Your Privacy Rights

Depending on where You live, and subject to the conditions of applicable law, You may have the right to:

• Access the Personal Data We hold about You and receive a copy of it
• Correct inaccurate or incomplete Personal Data
• Delete Your Personal Data
• Restrict or object to certain processing of Your Personal Data
• Data portability: receive the Personal Data You provided in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Request human review of decisions made solely by automated means that significantly affect You
• Lodge a complaint with a data protection authority

To exercise any of these rights, please contact Us using the details below. We will verify Your identity before acting on Your request, and We will respond within the time required by applicable law, generally within one month (or 45 days for residents of California). We will not charge a fee for responding to Your request unless it is manifestly unfounded or excessive, and We will not treat You differently for exercising Your rights.

These rights are not absolute. We may refuse or limit a request where We must keep data to meet legal obligations, such as anti-money laundering record-keeping, where the data is needed to establish, exercise or defend legal claims, or where the request would affect the rights of others. If We refuse a request, We will explain why, unless the law prevents Us from doing so.

Automated Decision-Making

To meet Our legal obligations and prevent fraud, We and Our Identity Verification providers may use automated tools to check identity documents, compare verification photos and screen against sanctions lists. If a decision based solely on automated processing significantly affects You, such as the refusal of an application, You may contact Us to request that a member of Our team review the decision, express Your point of view, and contest it.

Cookies and Local Storage

The Application does not use advertising cookies or third-party advertising trackers. It stores a small amount of information on Your Device, such as Your login session and preferences (for example, Your chosen theme), so that the Application works properly.

Our website, and Third-Party Provider pages opened within the Application, may use cookies and similar technologies. Where required by law, We will ask for Your consent before placing non-essential cookies on Our website. Cookies placed by Third-Party Providers are governed by their own policies.

Children’s Privacy

Our Service is intended only for individuals aged 18 years or older, or the age of legal majority in their country if higher. We do not knowingly collect personally identifiable information from anyone under the age of 18, and Our Identity Verification process is designed to prevent minors from opening an Account. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18, We will close the Account and delete that information, except where the law requires Us to retain it.

Links to Other Websites

Our Service may contain links to, or display pages from, websites and services that are not operated by Us, including Third-Party Provider checkout pages opened within the Application. If You click on a third-party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Limitation of Responsibility

To the fullest extent permitted by applicable law, the Company is not responsible for:

• The privacy practices, acts or omissions of Third-Party Providers, card issuers, card networks, payout partners and other third parties that process Your Personal Data as independent controllers
• Unauthorized access to Your Account resulting from Your failure to keep Your password, authenticator app, Device or email account secure
• Information that You choose to make public, or that is recorded on a blockchain network
• Delays or failures caused by events beyond Our reasonable control

Nothing in this Privacy Policy excludes or limits any liability that cannot be excluded or limited under applicable law, or any right You have under applicable data protection law.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, at Our sole discretion and without prior notice, to reflect changes in Our practices, the Service or applicable law. Any changes take effect immediately when the updated Privacy Policy is posted on this page, and the “Last updated” date at the top of this Privacy Policy will be revised accordingly.

We are not obliged to notify You individually of any changes. It is Your responsibility to review this Privacy Policy periodically to stay informed about how We collect, use and protect Your Personal Data. Your continued use of the Service after any changes are posted constitutes Your acknowledgement and acceptance of the updated Privacy Policy.

Where applicable law requires Us to notify You of a change, or to obtain Your consent before a change applies to You, We will do so.

Contact Us

If You have any questions about this Privacy Policy, or wish to exercise Your privacy rights, You can contact Us:

• By emailinfo@centpay.io
• Customer supportsupport@centpay.io