Privacy Policy | PaySaxas

Your privacy and the protection of your personal data are important to us.

This Privacy Policy ("Policy") sets out the basis on which we collect, use, disclose and protect personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"); the Finnish Data Protection Act (1050/2018); the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data; the ePrivacy Directive 2002/58/EC as implemented in Cyprus and Finland; the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the Personal Information Protection Act (British Columbia) and Canada's Anti-Spam Legislation ("CASL"); and other applicable data protection laws.

We strongly encourage you to read this Policy carefully before using our Website or creating an account with us. It explains how we process your personal data and what rights you have.

We may update or amend this Policy from time to time to reflect changes in our practices, regulatory requirements, or other legal obligations. The most recent version of the Policy will always be available on our Website, and Section 20 explains how we tell you about material changes.

We collect and process personal data strictly for legitimate and lawful purposes, including the provision of our Services, compliance with regulatory and contractual obligations, enhancement of user experience, and delivery of effective customer support.

This Policy applies to the Website and to processing at group level. Where the Privacy Policy of PaySaxas Oy or of PaySaxas Financial Solutions Corporation applies to a service, that policy prevails over this Policy in relation to that service, except for the joint-controller processing described in Section 1 (registration and sign-in), to which this Policy applies.

1. General

For the purposes of this Policy, references to “PaySaxas,” “we,” “our,” or “us” shall mean Paysaxas Ltd, a company duly incorporated and validly existing under the laws of Cyprus, registered with the Registrar of Companies under registration number HE439690, having its registered office at Stasinou 23, 1st floor, flat/office 101, Egkomi, 2404, Nicosia, Cyprus. Where the controller table in this Section gives a processing activity to another PaySaxas Affiliate, this Policy refers to that company as “the PaySaxas company that provides your account”, and, for that processing, “we”, “our” and “us” also mean that company.

Paysaxas Ltd operates the Website. PaySaxas Oy and PaySaxas Financial Solutions Corporation provide their services through the Client Platform, each under its own Terms of Service.

PaySaxas Oy and PaySaxas Financial Solutions Corporation provide their services both to individuals and to businesses. Data protection law protects natural persons, not legal entities, so where the Client is a business, this Policy applies to the individuals who act for it or are connected with it, such as its representatives, beneficial owners and authorised users.

This Policy explains how we process your personal data.

Who is the controller of my personal data?

Processing activity	Controller
Services of PaySaxas Oy (payment and electronic money services)	PaySaxas Oy (Finland, Business ID 3387454-8)
Services of PaySaxas Financial Solutions Corporation (payment and cryptocurrency services, including holding Clients’ cryptocurrency)	PaySaxas Financial Solutions Corporation (Canada, FINTRAC reg. M23680092)
Banking-as-a-Service (BaaS) for business partners, where offered	PaySaxas Oy (Finland)
Group-level processing (the Website, marketing and sales support)	Paysaxas Ltd (Cyprus) - see Sections 9 and 16 and our Cookie Policy
Registration and sign-in on the Client Platform	PaySaxas Oy, PaySaxas Financial Solutions Corporation and Paysaxas Ltd, as joint controllers - see below

For the specific processing step of registration and sign-in on the Client Platform, PaySaxas Oy, PaySaxas Financial Solutions Corporation and Paysaxas Ltd act as joint controllers; each of PaySaxas Oy and PaySaxas Financial Solutions Corporation remains the sole controller for its own KYC/AML, transaction and account-management processing listed above. The essence of this arrangement is as follows: each of PaySaxas Oy and PaySaxas Financial Solutions Corporation is responsible for the AML/KYC verification of its own registrants and for data subject requests concerning registration for its own services; PaySaxas Oy is responsible for the technical operation of the registration and sign-in functions; Paysaxas Ltd provides this Policy on behalf of the joint controllers; and data subjects may use the single contact point described below (Art. 26(1) GDPR).

You may exercise your rights under the GDPR in respect of this processing against each of the joint controllers. In practice, please send your request to dpo_privacy@paysaxas.com, the contact point for PaySaxas Oy, PaySaxas Financial Solutions Corporation and Paysaxas Ltd for this purpose, and we will route it to the responsible entity.

2. Definitions

Accessibility Statement means our separate statement on accessibility compliance, available at Accessibility Statement and, for the Client Platform, at Accessibility feedback;

Client means a natural or legal person that opens an account with a PaySaxas Affiliate. This includes a person who opens an account with PaySaxas Oy through a Banking-as-a-Service partner;

Client Platform means the online customer portal and, where made available, the mobile application through which a PaySaxas Affiliate makes its services available to its clients;

Controller means the entity which, alone or jointly with others, determines the purposes and means of the processing of personal data, as defined in Art. 4(7) GDPR. PIPEDA does not use this term or draw the same controller/processor distinction; where this Policy refers to an entity as a "controller" in connection with processing governed by PIPEDA, this is a drafting convenience aligning with the GDPR terminology used throughout this Policy, and that entity's actual accountability for the personal information in question is determined under PIPEDA's own principles, not by this definition;

Cookie Policy means our separate policy on the use of cookies and similar technologies, available at Cookie Policy;

Partner Cookie Policy means the cookie policy of the Partner Portal;

PaySaxas Affiliates has the meaning given in the Platform Terms of Service;

Personal data / Personal Information means any information relating to an identified or identifiable individual;

Processor means the entity which processes personal data on behalf of, and on the documented instructions of, a controller, as defined in Art. 4(8) GDPR, subject to the same clarification above in respect of PIPEDA-governed processing;

Services means the payment and electronic money services provided by PaySaxas Oy, the payment and cryptocurrency services provided by PaySaxas Financial Solutions Corporation and, where offered, the Banking-as-a-Service (BaaS) infrastructure provided by PaySaxas Oy to business partners, each under the terms of the company that provides it;

Website means the public website operated by Paysaxas Ltd at paysaxas.com (including its language versions).

3. How to contact PaySaxas?

Questions about this Policy and requests to exercise your rights should be sent to:

Email: dpo_privacy@paysaxas.com (our Data Protection Officer);

Mailing address in the EU: PaySaxas Oy, Lapinlahdenkatu 16, 00180 Helsinki, Finland;

Mailing address in Canada: PaySaxas Financial Solutions Corporation, 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4, Canada.

We are committed to responding to your inquiries and assisting you in exercising your data protection rights.

We respond to requests under the GDPR without undue delay and in any event within one month of receipt. Where a request is complex or we have received a high number of requests, we may extend this period by up to two further months; in that case, we will tell you about the extension and the reasons for it within one month of receipt. We respond to requests under Canadian privacy law within thirty (30) days of receipt. Where that law allows, we may extend this period, generally by up to a further thirty (30) days; in that case, we will tell you within the first thirty (30) days, with the reasons and your right to complain to the competent privacy commissioner. We do not charge for handling your request, unless it is manifestly unfounded or excessive.

4. What is the legal basis on which you process my personal data?

We rely on the following legal bases under Art. 6(1) GDPR:

(a) Contract (Art. 6(1)(b)): to provide the Services to the Client, including processing payments, managing accounts and providing support, and to take steps at your request before entering into a contract.

(b) Legal obligation (Art. 6(1)(c)): to comply with obligations under EU or Member State law, including anti-money-laundering legislation applicable to PaySaxas Oy, and tax and regulatory reporting.

(c) Legitimate interests (Art. 6(1)(f)): ensuring the security of our Website, systems and Services; preventing fraud and abuse; internal audits and analytics; improving our Services; establishing, exercising or defending legal claims; managing relationships with Clients and prospective Clients; and, for PaySaxas Financial Solutions Corporation, complying with Canadian law where that obligation is not an EU or Member State legal obligation. We balance these interests against your rights, and you may object as described in Section 12(E).

(d) Consent (Art. 6(1)(a)): for the specific purposes for which we ask for it, such as optional cookies and marketing where consent is required. You may withdraw consent at any time.

Processing governed by PIPEDA is carried out by PaySaxas Financial Solutions Corporation on the basis of consent or the exceptions PIPEDA permits, as described in its Privacy Policy.

5. Is it necessary to provide my personal information?

Providing the personal data marked as required at registration and during verification is a statutory and contractual requirement. PaySaxas Oy and PaySaxas Financial Solutions Corporation are required by anti-money-laundering law to identify and verify Clients, their beneficial owners and representatives. If you do not provide it, we cannot open or maintain an account or provide the relevant Services. Other information (such as marketing preferences) is optional, and declining to provide it does not affect the Services.

6. What type of personal data do you collect?

To provide the Services, we collect information about Clients who are individuals and about individuals who (1) represent a Client when interacting with us or (2) give us instructions about the Client’s account. We collect the following types of personal data.

Directly collected information (D)

This refers to the information which you directly provide to us (e.g. by filling the web-site forms, corresponding with us, contacting us for any reason).

Indirectly collected information (I)

This kind of information relates to you but you do not provide it directly (e.g. an IP address).

Automatically generated information (A)

This type of information is generated automatically by the system. Though such information isn’t provided by yourself it relates to you and is considered to be personal data. It has 2 subtypes:

static A (SA) – this information doesn’t usually change once it’s created (e.g. your internal id); and
dynamic A (DA) – this subtype changes accordingly to the actions performed by you.

We use these abbreviations below to address different types of personal information: D, I, SA, and DA.

7. What information do you collect, when, and why?

There are several points at which we collect personal information from you:

When you first sign up the following information is requested or assigned:

No	Personal Data	Type	Purpose
1.	Full Name	D	To identify you
2.	Phone number	D	Used for notifications and security confirmations
3.	Email address	D	Used for notifications and alerts, security confirmations, serves as a login
4.	Marketing source (where you arrived through a link)	I	To understand how you found us
5.	IP address and browser (recorded when you sign in)	I	To identify you, comply with Anti-Money Laundering and Counter-Terrorist Financing requirements, fulfil our contractual obligations, and protect your account from fraudulent activity.
6.	Language	I	To communicate with you in your language
7.	Internal id	SA	To identify you in the system
8.	Date of the registration	SA	Used for statistics
9.	Verification indicator	DA	To record whether your identity has been verified
10.	Status	DA	To record the stage of your registration and the status of your account
11.	Referral code or partner reference	I	(If any) To administer referrals

Legal basis for the data in this table: steps taken at your request before entering into a contract and the performance of our contract with you where you are the Client (Art. 6(1)(b) GDPR); for PaySaxas Oy, its legal obligations under anti-money-laundering law (Art. 6(1)(c) GDPR); our legitimate interests in entering into and performing our contract with the business you represent, keeping accounts secure, preventing fraud, administering referrals and keeping statistics (Art. 6(1)(f) GDPR).

Retention periods for the personal data listed above are determined in accordance with the criteria set out in Section 11 of this Policy.

Before we provide our Services, each Client must pass KYC/AML verification under our internal anti-money-laundering procedures. During the verification, we ask for the following data about the Client if the Client is an individual or, if the Client is a business, about its ultimate beneficial owners, senior management and representatives:

No	Personal Data	Type
1.	First name	D
2.	Last name	D
3.	Date of birth	D
4.	ID/Passport data	D
5.	ID/Passport scans or photo	D
6.	Address	D
7.	Residence confirmation	D
8.	Citizenship	D
9.	Host country	D
10.	Host city	D
11.	Photo or video of your face taken for a liveness check, where used (see below)	D
12.	Results of sanctions, politically exposed person (PEP) and adverse-media screening	I

Purpose (applicable to the data listed in the table above): identification and verification of the Client or, where the Client is a business, of its ultimate beneficial owners, senior management and representatives, and compliance with applicable Anti-Money Laundering and Counter-Terrorist Financing legislation.

Legal basis: for PaySaxas Oy, legal obligation (Art. 6(1)(c) GDPR) under Finnish anti-money-laundering law. For PaySaxas Financial Solutions Corporation, the processing is governed by PIPEDA and applicable Canadian law; where the GDPR also applies to it, we rely on our legitimate interests in complying with our regulatory obligations and preventing financial crime (Art. 6(1)(f) GDPR).

Where identity verification involves biometric data used to identify you uniquely (for example, facial recognition or liveness detection), the PaySaxas company that provides your account processes it only for identity verification and fraud prevention, and only where a condition of Article 9(2) GDPR applies, together with applicable national law. If you cannot complete biometric verification, contact that company, which will tell you whether another way of verifying your identity is available.

Additional Information Collected on an Ongoing Basis:

No	Personal Data	Type	Purpose
1.	Transaction history	DA	For fulfillment of our contractual obligations and statistics. Anti-Money Laundering and Counter Terrorism Financing procedures/requirements
2.	Where offered, information from our questionnaires about your satisfaction, how did you hear about us	D	For improving our Services and offers
3.	Records of correspondence	D	For fulfilment of our contractual obligations, e.g. deal with your requests, provide information in case of difference of opinions, settlement of disputes
4.	Computer and connection information such as browser type, version and time zone setting, browser plug-in types and versions, the country derived from your IP address and a random device identifier that we set in your browser when you sign in	I	To keep your account secure and to detect and prevent fraud and money laundering
5.	Location data from your phone, where you allow it in your device settings	I	To detect fraud and to meet our anti-money-laundering obligations. The App does not read your location today; we will tell you in the App before it starts, and you can turn location access off in your device settings at any time

Legal basis for the data in this table: the performance of our contract with you where you are the Client (Art. 6(1)(b) GDPR); for PaySaxas Oy, its legal obligations under anti-money-laundering law (Art. 6(1)(c) GDPR); our legitimate interests in performing our contract with the business you represent, improving our Services, handling your requests and keeping your account secure and, for PaySaxas Financial Solutions Corporation, in complying with its regulatory obligations and preventing financial crime (Art. 6(1)(f) GDPR); and, for location data from your phone, our legitimate interest in preventing fraud and, for PaySaxas Oy, its legal obligations under anti-money-laundering law.

This Section describes the main types of personal data we collect. If we start to collect new types of personal data, or to use them for new purposes, we will update this Policy before we do so.

Where do we collect your personal data from?

We collect your personal data directly from you. For KYC/AML verification and fraud prevention, we also collect it from the Client that you represent or own; from public sources such as trade and beneficial-ownership registers; from sanctions, politically-exposed-person (PEP) and adverse-media screening providers; and from identity-verification service providers (see Section 9 for the recipients we use).

Children’s personal data

Our Services are available only to individuals who have reached the age of majority in their place of residence and are at least 18 years old. We do not knowingly collect personal data from younger individuals, except as described below. If we learn that we have done so, we will delete the data unless the law requires us to keep it. If you believe that we may have collected information about a child, please contact us immediately.

However, we may process personal data of individuals under that age where a business Client submits it, or we obtain it from public registers, in relation to their role as an ultimate beneficial owner or shareholder, solely for KYC/AML verification. This does not permit them to hold or operate an account or otherwise use our Services.

Mobile application

Our mobile application for iOS and Android (the “App”) is part of the Client Platform and lets you use it on your phone. Once released, the App will be available only from the Apple App Store and Google Play. This part explains what the App stores on and reads from your phone and why; the rest of this Policy also applies.

What the App stores on and reads from your phone. The App stores and reads only what it needs to provide the service you have requested and to keep your account secure:

(a) Security keys. When you register your phone, the App creates cryptographic keys on it. The private key never leaves your phone. We keep the public key and a record of the phone (the name you give it, when it was added or removed, and why). You use the phone to approve sign-ins and payments, and we keep a record of each approval or refusal. If you lose access to your phone, we review your request before you can use a new one, and we keep a record of that recovery. To recover access with a new phone, you can take a selfie in the App, which our identity-verification provider compares with the identity document you gave when you opened your account. We ask for your explicit consent before the selfie (Art. 9(2)(a) GDPR). You do not have to give it, and you can withdraw it at any time. If you do not give it, contact us and we will review your request to use a new phone in another way. We keep the result with the record of the recovery (see Section 11) and delete the images within thirty (30) days.

(b) Integrity checks. The App asks Apple (App Attest) or Google (Play Integrity) to confirm that it is the genuine App and that your phone has not been tampered with. We keep the result with the record of your phone.

(c) Notifications. To send you approval requests and messages, the App uses a notification address issued by Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging). Notifications are delivered through Expo. Their content is encrypted, so these providers see only encrypted data.

(d) Settings, such as your language and time zone, which we store with your account.

The App does not use advertising identifiers and does not track you across other companies’ apps or websites.

Consent and permissions. Storing and reading this information is strictly necessary to provide the App and keep your account secure, so it does not require your consent under the ePrivacy rules. Your phone asks your permission before the App can send notifications or use your camera to capture your identity document and a selfie during verification; you can change this at any time in your phone’s settings. If you turn notifications off, you will need to open the App to see approval requests.

Legal basis. We keep the records of your phones, approvals and recoveries of access to comply with our legal obligations on strong customer authentication and fraud prevention (Art. 6(1)(c) GDPR) or, where no such obligation applies to the company that provides your account, on the basis of our legitimate interest in keeping your account secure (Art. 6(1)(f) GDPR). We process integrity-check results on the basis of our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). We use notification addresses to provide the App to you under our contract with you (Art. 6(1)(b) GDPR) or, if you use the App on behalf of a business Client, on the basis of our legitimate interest in providing our Services to that Client (Art. 6(1)(f) GDPR).

Recipients and transfers. Apple and Google act as independent controllers for the integrity checks and, in Apple’s case, for notifications. Google (Firebase Cloud Messaging) and Expo (650 Industries, Inc.) process notification data on our behalf. These providers may process data in the United States under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (see Section 10).

Retention. We keep the record of each phone for five (5) years after it is removed or your account is closed, whichever is earlier, and the records of your approvals and of any recovery of access for five (5) years from the end of our business relationship, in each case longer while a related fraud case, claim or complaint is open. Technical data is deleted much sooner: for example, a phone’s notification address is deleted within 24 hours after the phone is removed, and the technical details of integrity checks after 90 days.

8. Why do you use personal data?

We may use your personal information for the following purposes:

Providing our Services

We use your personal data to deliver and maintain the Services you request from us. This includes processing transactions, managing your account, and providing customer support.

Legal basis: to provide our service, legal obligations, legitimate interests

Contacting you

We may use your personal data to communicate with you regarding service-related updates, notifications, and inquiries. This may include responding to your inquiries or addressing any concerns you may have.

Legal basis: to provide our service, legal obligations, legitimate interests

Providing you with news, special offers, and general information

We may use your personal data to send you newsletters, promotional offers, and general information about our Services and events we offer. You have the option to opt out of receiving such communications at any time.

Legal basis: legitimate interests, your consent (if required by law)

Ensuring the security of your account

We may use your personal data to enhance the security and protection of your account and our Services. This may include verifying your identity, detecting and preventing fraudulent activities, and safeguarding against unauthorized access.

Legal basis: legitimate interests, legal obligations

Compliance with legal obligations, enforcing our rights and other legal issues.

We may process your personal data to comply with legal obligations, such as tax reporting, fraud prevention, and regulatory reporting requirements. In certain situations, we may need to process your personal data to protect our rights and interests in legal proceedings, including initiating or defending against legal claims, investigations, or disputes.

Legal basis: legitimate interests, legal obligations

Market research

For this purpose, we generally use anonymised or pseudonymised data. Where data is truly anonymised, data protection law does not apply to it. Where data is pseudonymised (that is, it can still be attributed to an identifiable individual), it remains personal data and is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) or, where required, your consent (Art. 6(1)(a) GDPR). Where we use identifiable data for market research, we do so on the same bases.

Legal basis: legitimate interests, your consent (if required by law)

Business transfers or restructuring

In the event of a business transfer or restructuring, such as a merger, acquisition or sale of assets, we may use and disclose your personal data in connection with that transfer, in accordance with applicable data protection law.

Legal basis: legitimate interests, legal obligations.

9. Can you disclose my personal data to anyone?

We may lawfully disclose your personal data to the following categories of recipients:

PaySaxas Affiliates

We may share personal data with PaySaxas Affiliates for the purpose of providing the Services.

Government and regulatory authorities

We may disclose personal data to governmental or regulatory authorities where required by law, including to central or local authorities within the EU, Canada, or other jurisdictions as mandated by applicable law.

Service providers acting on our instructions (processors)

We share personal data with processors that act solely on our instructions. The main ones are described below:

KYC/AML verification: Sum and Substance Ltd (United Kingdom), which verifies identity documents and biometric data, screens against sanctions, politically-exposed-person and adverse-media sources, and monitors transactions on our behalf. The United Kingdom is covered by a European Commission adequacy decision.
Sign-in and fraud protection: Google LLC, via Google reCAPTCHA, which is loaded on the sign-in, registration, password-reset and verification pages of the Client Platform and the Partner Portal, on the accessibility report form and the certificate verification page, in the App and on the contact form of our Website to protect them against automated abuse, on the basis of our legitimate interest in the security of our Services (Art. 6(1)(f) GDPR). It is used only for security, fraud and abuse prevention and not for advertising. Google receives your IP address and browser information and returns a risk score. Google LLC may process this data in the United States under the EU-U.S. Data Privacy Framework. If it blocks you, write to support@paysaxas.com and we will help you complete your request another way.
Website analytics and advertising: Google LLC (Google Analytics, Google Ads and Google Tag Manager), only if you accept analytics and marketing cookies (see our Cookie Policy).
Sales and communication tools: providers of customer-relationship management, meeting-booking (Calendly) and messaging services that we use to answer enquiries and provide sales support.
Enquiry handling: PaySaxas Oy, which receives and answers enquiries sent through the contact form on the Website on our behalf.
SMS delivery: providers that send one-time security codes and payment-approval messages (your phone number and the message text).
E-mail delivery: Google LLC (Google Workspace).
Account-number validation: a provider in the United Arab Emirates that checks payee IBANs and finds the bank (IBAN only).
We also operate our own error-monitoring system within the EEA, which collects technical information about errors and may include personal data; no third party receives it.

Service providers engaged for specific functions

Where the provision of the Services requires PaySaxas Oy or PaySaxas Financial Solutions Corporation to engage a third party for a specific function, such as wallet and key-management technology for cryptocurrency, custody of cryptocurrency, or business banking, payment and correspondent account services, personal data necessary for that third party to perform that function is shared with it for that purpose only. They include the regulated financial institutions that PaySaxas Financial Solutions Corporation engages as Approved Sub-Providers under its Terms of Service, custodians and technology providers. Where an Approved Sub-Provider acts as an independent controller in relation to its processing of personal data connected with its function, this is described in its own privacy notice.

Other business partners

We may share your personal data with our professional advisers, such as auditors and lawyers, and with market researchers who help us improve our Services. They are required to protect your personal data and to use it only for the purposes we have defined. If you were introduced to us by a referral partner, the partner sees only the commission it earns in respect of you, under a reference number, and not your name, contact details, account status or transactions.

Banking-as-a-Service partners

If you opened your account through a Banking-as-a-Service partner, PaySaxas Oy gives that partner your application status and account number. Under the mandate you give the partner in the Client Platform, which you can withdraw there at any time, the partner also has access to your account and transaction data. The partner acts for you as an independent controller, not on behalf of PaySaxas Oy, and its own privacy notice explains how it uses your data.

Third parties you ask us to share information with

We share your personal data with third parties where you instruct us to do so, for example with an auditor you designate when you request an auditor confirmation through the Client Platform.

We may also disclose your personal data in the following cases:

in response to lawful requests by public authorities, including to meet national security or law enforcement requirements;
to protect, establish, or exercise our legal rights, or to defend against legal claims, including to comply with a subpoena, court order, or other legal process;
where disclosure is necessary on the basis of our legitimate interest in protecting against imminent physical harm or financial loss, or investigating, preventing, or acting on illegal activity or suspected fraud (Art. 6(1)(f) GDPR);
in connection with a merger, restructuring, joint venture, assignment, or the sale of part or all of the business.

10. Where does PaySaxas store personal data?

Our primary data storage infrastructure is located in data-centers within the EEA. These infrastructure providers act as our processors and their processing is limited to server maintenance; they do not have first-hand access to your personal data.

Certain categories of personal data are additionally shared with third-party service providers located outside the EEA (such as Google), as described in Section 9 of this Policy. Unlike the EEA infrastructure providers above, these third parties do process your personal data directly, on the legal bases and for the purposes set out in Section 9. Google LLC may process personal data in the United States under the EU-U.S. Data Privacy Framework.

Transfers within the PaySaxas group and to sub-providers. PaySaxas Oy and Paysaxas Ltd may transfer personal data to PaySaxas Financial Solutions Corporation in Canada on the basis of the European Commission’s adequacy decision for Canada (Decision 2002/2/EC), which covers recipients subject to PIPEDA. Where the adequacy decision does not apply, the transfer is made subject to appropriate safeguards under Chapter V of the GDPR. Personal data may also be transferred to approved sub-providers in accordance with Chapter V of the GDPR. You may obtain a copy of the relevant safeguards by contacting dpo_privacy@paysaxas.com.

We care about the protection of your personal data and use appropriate data protection measures, such as:

high level of organizational information security system;
professional software with high level of cyber protection;
high level of the equipment protection;
employees have limited access to your personal data in accordance with their professional responsibilities.

As part of our operations, we may transfer your data to service providers located outside the EEA. We strictly adhere to all legal requirements when transferring personal data outside the EEA. We may transfer your Personal Data outside the EEA only in following cases:

if the country of recipient provides the adequate level of personal data protection as determined by the European Commission;
If we implement appropriate safeguards to protect your rights as a data subject; and
if specific exemptions apply in certain situations, for example, in cases where there is a public interest, compliance with legal requirements, or the transfer is necessary for the establishment, exercise, or defense of legal claims.

Where staff or contractors of PaySaxas group companies located outside the EEA have access to personal data in the course of their work, that access is a transfer made in accordance with Chapter V of the GDPR. We cooperate only with reputable and reliable partners.

11. How long do you store the personal data?

We will retain personal data for as long as it is necessary to provide the Services, or, where processing is based on your consent, until such time as you lawfully withdraw your consent to further processing, if applicable. Thereafter, personal data will be retained only for such period as is required to comply with applicable statutory and regulatory obligations, or as may be necessary for the establishment, exercise, or defence of legal claims. Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised.

We retain personal data only for as long as necessary for the purposes described in this Policy. In particular:

KYC/AML and transaction records: five (5) years from the closure of the Client’s account (or the end of the business relationship), as required by anti-money-laundering legislation and, for PaySaxas Financial Solutions Corporation, the PCMLTFA. After that period, the data is deleted or irreversibly anonymised or, where we need to keep a record of a payment, pseudonymised.
Applicants whose applications are declined or withdrawn: the KYC/AML verification and screening records, and a record of the decision, are kept for five (5) years from the date of the decision or withdrawal, to prevent fraud and to establish, exercise or defend legal claims; other contact and sales data is deleted within twelve (12) months of that date.
Prospective clients (sales support): up to 24 months from our last interaction (Section 16).
Technical and log data: up to 24 months, unless part of an AML or security record.
Device records from the App: five (5) years after the device is removed or the account is closed, whichever is earlier. Records of approvals and of any recovery of access: five (5) years from the end of the business relationship.
Accounting records: for the period required by applicable accounting law.
Consent-based data (for example marketing): until you withdraw consent or the purpose ends.
Data needed to establish, exercise or defend legal claims: for the applicable limitation period.

12. What rights related to personal data processing do I have?

You are entitled to perform a range of operations with regard to your personal data.

(A) Obtain confirmation about how we use your personal data

You have the right to obtain information about how we collect, process, and use your personal data. This notice aims to provide you with a clear understanding of how we process and collect your personal data.

(B) Access personal data

If personal data concerning you is processed by us, you have the right to access such data. We can provide you with a copy of your personal data in a structured, machine-readable format. We do not charge a fee for providing a copy of your personal data in an electronic format.

However, in certain cases, and to the extent permitted by applicable law, we may refuse to fulfil the request in whole or in part. Specifically, if the data is part of a criminal or other judicial proceeding, if anti-money-laundering law prohibits us from disclosing it (for example, that a report has been made to the authorities), or if it cannot be disclosed for other lawful reasons.

You have the right to demand the following additional information concerning your personal data:

the purposes of the processing;
the categories of personal data concerned;
the recipient(s) or category(s) of recipient to whom the personal data have been or will be disclosed;
the criteria determining the period for which the personal data will be stored;
the existence of automated decision-making, including the logic involved and the significance and envisaged consequences of such processing for you, as described in Section 12(G).

(D) Request rectification

You have the right to obtain the rectification of inaccurate personal data concerning you (this includes having incomplete personal data completed) from PaySaxas without any undue delay.

(E) Right to Object or Restrict Processing

You have an unconditional right to object, at any time and without providing any justification, to the processing of your personal data for direct marketing purposes.

You also have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR). Separately, you have the right to ask us to restrict processing, for example while we check the accuracy of your data or your objection (Art. 18 GDPR).

(F) Be Forgotten

You have the right to request the erasure of your personal data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw your consent and no other legal basis for processing applies; (c) you successfully object to the processing; or (d) the data has been processed unlawfully.

However, erasure will not be immediate where we are required or entitled to keep data. If you ask us to erase your data, we erase the data that we do not need to keep and restrict the rest, so that it is not used for any other purpose, until the end of the applicable retention period; we will tell you that some data is kept to meet our legal obligations, including under anti-money-laundering law, and until when. Retention periods are set out in Section 11. Data in encrypted backups and archives is erased when those are overwritten on their scheduled cycle; backups are encrypted and access-restricted, are used only to restore our systems and expire within thirty-five (35) days.

(G) Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

We use automated tools to screen and risk-score applicants and Clients for AML/CTF, sanctions and fraud purposes, including by reference to country risk. These tools also take into account, for example, the information you give us, the results of identity verification and of sanctions, PEP and adverse-media screening, and how the account is used. Where a decision to decline an application or restrict an account, or to hold or reject a payment, is based solely on automated processing and has legal or similarly significant effects, you may request human review, express your view and contest the decision by contacting dpo_privacy@paysaxas.com, subject to legal limits on what we can disclose.

We also use Google reCAPTCHA to detect and, where necessary, automatically block suspicious sign-in, registration, password-reset and account-verification attempts, without human review at the point of decision. This process affects individual sign-in or registration attempts only; it does not result in the closure of your account, a decision about your contractual relationship with us, or a permanent denial of service. If you believe you have been incorrectly or repeatedly blocked, or you cannot use these forms because of a disability, write to support@paysaxas.com and a member of our team will review your request manually. We will acknowledge within two business days.

(H) Right to withdraw your consent or permission

You have the right to withdraw your consent or permission for the processing of your personal data at any time. Where available, you can withdraw it in the same way as you gave it, for example through our cookie settings, the unsubscribe link in our emails or your device settings; you can also write to dpo_privacy@paysaxas.com. Withdrawal does not affect the lawfulness of processing based on your consent before its withdrawal.

It is important to be aware that there may be situations where we are legally entitled or obliged to continue processing your personal data despite the withdrawal of consent or permission. In such cases, we will inform you about the reasons for continued processing and any applicable legal basis.

(I) Exercising Your Rights

To exercise your rights, write to dpo_privacy@paysaxas.com. We may ask you to confirm your identity before we act on a request. Where the Client is a legal entity, the PaySaxas company that provides the Client’s account is a controller of personal data about the Client’s representatives, beneficial owners and individuals authorised to use the account, for account administration, security, and AML/CTF and regulatory compliance, and you may exercise your rights directly with us.

The Client remains responsible, as a separate controller, for the personal data it provides to us about its representatives, employees and other individuals, including for having a lawful basis to share it with us and for informing the individuals concerned.

(J) Non-discrimination

We are committed to ensuring equal treatment and non-discrimination for all individuals exercising their rights. We value privacy and strive to provide our Services without prejudice or bias.

We will not discriminate against anyone based on their decision to exercise their rights, including the right to refuse the provision of information that is not necessary for the use of our Services. Regardless of your choices or preferences, we will not deny you access to our Services, impose penalties, offer inflated rates, or employ any other direct or indirect methods of discrimination.

If you believe that you have experienced any form of discrimination or have concerns regarding our privacy practices, please contact us immediately. We take such matters seriously and will promptly address any issues related to discrimination.

(K) Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller, or to have us transmit it directly where technically feasible.

13. Non-sale of personal data to third parties

We do not sell personal data for monetary consideration. Where you consent to advertising cookies, our advertising partners may receive data through those cookies as described in our Cookie Policy.

14. What should I do if I believe you are not complying with data privacy requirements?

In addition to contacting us, you have the option to file a complaint with your local data protection authority (e.g. the Office of the Commissioner for Personal Data Protection if you are in Cyprus, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) if you are in Finland, or the Office of the Privacy Commissioner of Canada or, where applicable, the Office of the Information and Privacy Commissioner for British Columbia if you are in Canada). You also have the right to an effective judicial remedy against a controller or processor. For processing subject to GDPR, this right is set out in Art. 79 GDPR; for processing subject to PIPEDA, it may be exercised by way of an application to the Federal Court of Canada.

15. Fraud and Phishing

We never ask for your password or one-time security codes, whether by phone, email, social media or messaging apps, and we do not charge for technical support. Our technical support is provided only through the official channels listed on our Website, including support@paysaxas.com. If you are not sure that a message or call claiming to be from us is genuine, or you believe that you have been a victim of any form of fraud, phishing or scams related to our Services, please contact us immediately. We take such matters seriously and will take appropriate action promptly.

16. Privacy to potential Clients

This Section applies to you if you are not a Client, or a representative or employee of a Client, but you are interested in our Services or represent or work for a business that is (a “potential Client”). Sections 3, 10, 12 and 14 of this Policy also apply to you.

We collect and use your personal data to respond to your enquiry and to provide sales support. We collect the following information:

your first and last name;
your email address and phone number;
if you act for a business, information about your position and the business; and
records of our communication with you.

Legal basis: our legitimate interest in developing and maintaining business relationships with potential Clients (Art. 6(1)(f) GDPR); and your consent, where the rules on electronic marketing communications require it, including, for recipients in Canada, Canada’s Anti-Spam Legislation (CASL). The consent, sender-identification and unsubscribe requirements that apply to marketing communications from PaySaxas Financial Solutions Corporation are set out in its Privacy Policy.

We may collect this data directly from you or obtain it from other sources. If we collect this data from other sources, we always ensure the legality of collecting this information. We may only disclose your personal data to suppliers who provide us with IT Services or other companies within the PaySaxas group when there is a lawful reason to do so. We will retain your personal data only for as long as it is necessary for sales support purposes, and in any event no longer than twenty-four (24) months from our last interaction with you, unless you become a Client, in which case Section 11 applies.

If we have collected data about you under this section, you have all the rights provided in Section 12 of this Policy. If you wish to exercise any of these rights, please contact our Data Protection Officer by email: dpo_privacy@paysaxas.com.

17. How is my personal data collected and used if I have an account as an individual Client?

If you open an account as an individual, including as a sole proprietor, we process your personal data as described in this Policy and in the Privacy Policy of the PaySaxas company that provides your account.

18. What ways of communication do you use?

We send you service messages by email, phone, push notification or in your account where they are necessary for the Services. We send you marketing messages only where you have agreed to receive them or the law otherwise allows it.

At any time, you may unsubscribe from marketing emails by using the link in the message or by writing to support@paysaxas.com.

19. Cookies

We use cookies and similar technologies on our Website. Details about the specific cookies we use, their purposes, retention periods, and how to manage your preferences and withdraw your consent are set out in our separate Cookie Policy and, for the Partner Portal, in the Partner Cookie Policy.

On the Client Platform we use only cookies that are strictly necessary to sign you in, keep your account secure and remember your language, including a device-recognition cookie kept for two (2) years and the Google reCAPTCHA cookie kept for six (6) months. They do not require your consent.

When you visit our Website, our servers record technical data (such as your IP address, browser and the pages viewed) on the basis of our legitimate interests in the security and operation of the Website (Art. 6(1)(f) GDPR). These logs are kept as set out in Section 11.

20. How can I stay informed about updates to the Policy

We periodically update this Policy to ensure compliance with applicable laws and regulations and to reflect changes in our practices. Changes to our cookie practices are reflected in our separate Cookie Policy. The most recent version of this Policy, with its date, can always be found at Platform Privacy Policy. If we make a material change, we will inform registered users and Clients by email or through the Client Platform before the change takes effect.

21. Accessibility

We are committed to making the Website, the Client Platform and our Services accessible. Our Accessibility Statement describes our conformance status and known limitations and explains how to report a barrier.