Privacy Policy — PaySaxas Oy

This Privacy Policy explains how PaySaxas Oy (“the Company”) processes the personal data of its Clients and Prospective Clients and, where applicable, of their representatives, beneficial owners and other individuals authorised to act for them, and of other individuals whose personal data the Company receives in connection with the Service described in the Company’s Terms of Service, such as the payers and payees of payments. This Privacy Policy should be read together with the Company’s Terms of Service and with the Platform Privacy Policy, which describes data processing at the level of the wider PaySaxas group and its shared website. If this Privacy Policy and the Platform Privacy Policy conflict in relation to the Service, this Privacy Policy prevails, except for the joint-controller processing of registration and sign-in data described in the Platform Privacy Policy, to which that policy applies.

Capitalised terms used but not defined in this Privacy Policy have the meaning given to them in the Company’s Terms of Service. “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR. In the event of any conflict between this Privacy Policy and the Terms of Service regarding the processing of Personal Data, this Privacy Policy shall prevail.

1. General Compliance

The controller is PaySaxas Oy, Business ID 3387454-8, Lapinlahdenkatu 16, 00180 Helsinki, Finland, dpo_privacy@paysaxas.com.

The Company processes Personal Data in accordance with applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Finnish Data Protection Act (1050/2018), and any other relevant legislation. The Company acts as a data controller and undertakes to process Personal Data lawfully, fairly, and transparently in accordance with the principles established under Article 5 of the GDPR.

2. Lawful Basis and Purpose of Processing

Personal Data is collected and processed to the extent necessary for:

(a) the performance and enforcement of the Company's Terms of Service, the provision of the Service, and taking steps at your request before entering into it (Art. 6(1)(b) GDPR);

(b) the fulfilment of the Company’s legal obligations, including AML and CTF requirements under Finnish law, obligations under payment services legislation, and tax and accounting obligations, such as reporting information on payees of cross-border payments to the Finnish Tax Administration (Art. 6(1)(c) GDPR); and

(c) the Company’s legitimate interests in maintaining, improving and securing the Service, preventing fraud, establishing, exercising or defending legal claims, paying commissions to referral partners, and ensuring compliance and operational continuity (Art. 6(1)(f) GDPR).

For the Service, the Company relies on consent only for the selfie that a Client may take in the App to recover access to the Account with a new phone. The Company’s identity-verification provider compares that selfie with the identity document given at onboarding, and the selfie is processed only with the Client’s explicit consent (Art. 9(2)(a) GDPR). The Client does not have to give it and may withdraw it at any time; if the Client does not give it, the Company reviews the request to use a new phone in another way.

Biometric data used for identity verification at onboarding is processed because this is necessary for reasons of substantial public interest, to verify the identity of a customer, or of a person acting for a customer, who is not physically present, as required by the AML Act (Art. 9(2)(g) GDPR and section 6(1)(2) of the Data Protection Act (1050/2018)).

3. Consequences of Not Providing Personal Data

Provision of identity, KYC/AML verification, and related Personal Data is both a statutory requirement under the AML Act and a contractual requirement necessary for the Company to enter into and perform the Company's Terms of Service. If the Client does not provide this data, or does not keep it up to date, the Company will be unable to open an Account for the Client or may be required to suspend or terminate an existing Account, as described in Sections 3, 15 and 16 of the Company's Terms of Service.

4. Categories of Personal Data

The Company may collect and process the following categories of Personal Data, which it obtains from the Client and the individuals acting for it, from identity-verification and screening providers, from public registers and other publicly available sources, and from other payment service providers and payment systems in connection with payments:

(a) identification data (including full name, date of birth, nationality, identification number and copies of identity documents);

(b) contact data (including address, telephone number, and e-mail address);

(d) verification and compliance data (including KYC/KYB documentation, AML screening results, risk assessment data and the results of periodic re-verification of identity documents by the Company’s identity-verification provider, such as the status and expiry date of a document);

(e) technical data (including device information, IP address, the country derived from the IP address, a random device identifier that the Company sets in the browser at sign-in, session activity and records of recovery of access to the Account);

(f) correspondence and communication records with the Company;

(g) biometric data (facial-recognition and liveness data), where used for identity verification;

(h) politically-exposed-person status, sanctions listings and adverse-media information obtained through screening and, where Article 10 GDPR and applicable Finnish law, including the Data Protection Act (1050/2018), permit it, criminal-offence data obtained in the same way;

(i) records of the Client's instructions and requests given through the Client Platform or by e-mail; and

(j) data about the representatives, beneficial owners and authorised users of business Clients.

Individuals connected with a Client. The Client remains responsible, as a separate controller, for the Personal Data that it provides to the Company about its representatives, directors, beneficial owners, employees and other individuals, such as the auditor named in a request for an Audit Confirmation, including for having a lawful basis to provide that data and for informing the individuals concerned that the Company processes it as described in this Privacy Policy. The Company processes that Personal Data as a separate controller for the purposes described in this Privacy Policy, including, in the case of the auditor’s details, to complete and send the Audit Confirmation on the basis of its legitimate interest in providing the service requested by the Client (Art. 6(1)(f) GDPR). The individuals concerned may exercise their rights under Section 14 directly with the Company.

Payers, payees and other individuals who are not Clients. When the Company executes or receives a payment, it processes the Personal Data of the payer or payee that accompanies the payment, such as their name, account number (IBAN), address and the payment reference, including where a business Client sends or receives payments for its own customers. The Company uses this data to execute the payment, to verify the payee, to comply with Sanctions and to monitor payments for AML/CTF purposes, on the basis of its legal obligations, including under Regulation (EU) 2023/1113 on information accompanying transfers of funds, Regulation (EU) No 260/2012 and the AML Act (Art. 6(1)(c) GDPR), and of its legitimate interest in executing payments for its Clients (Art. 6(1)(f) GDPR). This data forms part of the Company’s transaction records and is retained under Section 9(a). A business Client that uses an Account for payments of its own customers shall inform them that the Company processes their Personal Data as described in this Privacy Policy.

5. Data Accuracy

The Client shall ensure that all Personal Data provided to the Company is accurate, complete, and kept up to date throughout the duration of the Company's Terms of Service. The Company shall take reasonable steps to ensure that any inaccurate or outdated Personal Data is rectified or erased without undue delay.

6. Data Minimisation and Purpose Limitation

The Company collects and processes only such Personal Data as is adequate, relevant, and limited to what is necessary for the purposes set out in this Privacy Policy or the Platform Privacy Policy. Personal Data shall not be further processed in a manner incompatible with those purposes.

7. Transparency and Privacy

The categories of Personal Data processed and the lawful bases for processing are set out in Sections 2 and 4 above; the applicable retention periods are set out in Section 9; and the rights of data subjects are set out in Section 14. For information about data processing at the level of the wider PaySaxas group and its shared website - including cookies, automated fraud-prevention tools such as Google reCAPTCHA used on shared sign-in and registration forms, group-level marketing, and the joint-controller arrangement between the Company, PaySaxas Financial Solutions Corporation, and Paysaxas Ltd - see the Platform Privacy Policy.

8. Automated Decision-Making and Profiling

The Company uses automated tools to screen and risk-score applicants and Clients for AML/CTF, sanctions and fraud purposes, including by reference to country risk. These tools also take into account, for example, the information provided in the application, the results of identity verification and of sanctions, PEP and adverse-media screening, and how the Account is used. Where a decision to decline an application or to restrict or suspend an Account, or to hold or reject a payment, is based solely on automated processing and has legal or similarly significant effects, this is done only where it is necessary for entering into or performing a contract with the individual concerned or is authorised by EU or Finnish law with suitable safeguards (Art. 22(2) GDPR). The applicant or Client concerned may obtain human intervention, express their point of view and contest the decision by contacting dpo_privacy@paysaxas.com, subject to legal limits on disclosure, including the prohibition on tipping off.

9. Data Retention

Personal Data is retained only for as long as necessary for the purposes for which it was collected, and is then securely deleted or irreversibly anonymised, except as set out in this Section. In particular:

(a) Identification, KYC/AML verification and transaction records, including biometric data used for identity verification, are retained for five (5) years from the closure of the Client’s account (the end of the business relationship), in accordance with the AML Act and, from its date of application, Regulation (EU) 2024/1624, unless applicable law requires a different period. For each payment, the names, addresses and description of the payer and payee are removed five (5) years after the payment; the account numbers, amounts and dates are kept as the record of the transaction. Copies of payment messages exchanged with payment systems are kept for seven (7) years from the payment.

(b) Applicants whose applications are declined or withdrawn. The KYC/AML verification and screening records, and a record of the decision, are retained for five (5) years from the date of the decision or withdrawal, to prevent fraud and to establish, exercise or defend legal claims (Art. 6(1)(c) GDPR and the AML Act; otherwise Art. 6(1)(f) GDPR). Other application data, except the identification data that the AML Act requires the Company to keep, is deleted within twelve (12) months of that date.

(c) Accounting records. Accounting vouchers, including invoices and payment records for fees such as the Onboarding Fee, are retained for six (6) years from the end of the year in which the financial year concerned ended, and the accounting books and financial statements, to the extent that they contain Personal Data, for ten (10) years from the end of the financial year, as required by the Finnish Accounting Act (1336/1997).

(d) Technical and session data (as described in Section 4(e)) are retained for up to twenty-four (24) months from collection, except where they form part of an AML record (retained under paragraph (a)) or of an audit or security log (retained under paragraph (g)).

(e) Data needed to establish, exercise or defend legal claims is retained for the applicable limitation period.

(f) Records of a recovery of access to the Account after the loss or replacement of the phone registered for authentication, including the review of the request and the authorisation to register the new phone, are retained for five (5) years from the end of the business relationship, or for longer while a related fraud case, claim or complaint is open. The full new phone number is removed from the recovery record thirty (30) days after the recovery is closed. Where the Client took a selfie for the recovery, the result of the comparison is kept with the recovery record and the images are deleted within thirty (30) days after the recovery is closed.

(g) Audit and security logs about a Client are retained for five (5) years from the end of the business relationship.

(h) Correspondence with the Client (Section 4(f)) and records of the Client’s instructions and requests (Section 4(i)) are retained for five (5) years from the end of the business relationship.

On expiry of the applicable period, Personal Data is securely deleted or irreversibly anonymised or, where the Company needs to keep a record of a payment, pseudonymised. Data we are required to keep is not erased before the end of the applicable period, even if you ask us to erase it (see Section 14). Data in encrypted backups and archives is erased when those are overwritten on their scheduled cycle; backups are encrypted and access-restricted, are used only to restore our systems and expire within thirty-five (35) days.

10. Data Sharing and Recipients

Personal Data may be shared with:

(a) PaySaxas Affiliates: Paysaxas Ltd, as a joint controller of registration and sign-in on the Client Platform and for the group-level functions described in the Platform Privacy Policy; and PaySaxas Financial Solutions Corporation, as a service provider to the Company under its outsourcing agreement with it and, where the Client transfers funds to or from an account of PaySaxas Financial Solutions Corporation, as the payee or payer of that transfer;

(b) the Company’s banking partners, payment processors, AML/KYC verification providers, and other authorised third-party service providers involved in the provision and maintenance of the Service;

(c) competent courts, supervisory authorities, or governmental agencies when required by law or pursuant to a valid order, including the FIN-FSA, the Financial Intelligence Unit and the Finnish Tax Administration, to which the Company reports information on payees of cross-border payments as required by value added tax legislation;

(d) the payers and payees of payments, their payment service providers and the payment and settlement systems used by the Company's banking partners, to the extent necessary to execute payments, to verify the payee and to provide the information that must accompany transfers of funds;

(e) third parties to which the Client instructs the Company to disclose information, such as the auditor named by the Client in a request for an Audit Confirmation or a supervisory authority of the Client;

(f) where the Client was introduced to the Company by a referral partner, that partner, which sees only the commission it earns in respect of the Client, under a reference number, and not the Client's name, contact details, account status or transactions (Art. 6(1)(f) GDPR); and

(g) account information and payment initiation service providers to which the Client has given explicit consent under Clause 7.14 of the Terms of Service.

Where Personal Data is disclosed pursuant to (c) above, the Company verifies the lawfulness of the request and discloses only the Personal Data necessary to comply with it.

Personal Data may also be disclosed to a purchaser or successor, and to its advisers, in connection with a proposed or actual merger, acquisition, reorganisation or sale of all or part of the Company’s business, subject to confidentiality obligations, on the basis of the Company’s legitimate interest in such a transaction (Art. 6(1)(f) GDPR).

Service providers that process Personal Data on the Company’s behalf (processors) do so only on the Company’s documented instructions and under written agreements that meet the requirements of Art. 28 GDPR, including as to confidentiality and data security. Other recipients, such as payment service providers and payment systems, authorities, auditors named by the Client and referral partners, process Personal Data as controllers in their own right, under their own legal obligations and, where applicable, their own privacy notices.

11. International Data Transfers

Where Personal Data is transferred to Canada, such transfer is made on the basis of the European Commission's adequacy decision in respect of Canada (Decision 2002/2/EC, covering organisations subject to Canada's Personal Information Protection and Electronic Documents Act). Where that decision does not apply, the transfer is made subject to appropriate safeguards under Chapter V of the GDPR.

Where Personal Data is transferred to a recipient covered by another adequacy decision of the European Commission, such as a recipient in the United States certified under the EU-U.S. Data Privacy Framework, the transfer is based on that decision.

Where Personal Data is transferred to any other country outside the European Economic Area, the transfer is made in accordance with Chapter V of the GDPR, for example on the basis of the European Commission’s Standard Contractual Clauses. You may obtain a copy of the relevant safeguards by contacting dpo_privacy@paysaxas.com.

12. Security of Processing

The Company implements appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Such measures include, without limitation, encryption, pseudonymisation, restricted access controls, secure storage environments, employee confidentiality undertakings, and periodic security assessments. The Company maintains and periodically reviews its incident-response plan to ensure timely mitigation of potential data breaches.

13. Personal Data Breach Notification

In the event of a Personal Data breach, the Company shall promptly assess the risks to the rights and freedoms of individuals and, where required by law, notify the competent supervisory authority and the affected individuals (and, where relevant, the Client) without undue delay, in accordance with Articles 33 and 34 of the GDPR.

14. Data Subject Rights

Any individual whose Personal Data the Company processes, including a Client or Prospective Client who is an individual and the representatives, beneficial owners and authorised users of a business Client, has the right to:

(a) request access to their Personal Data;

(b) request rectification of inaccurate or incomplete data;

(d) request restriction of processing;

(e) exercise the right to data portability;

(f) object to the processing of Personal Data based on legitimate interests and, at any time, to direct marketing (for group marketing, see the Platform Privacy Policy);

(g) not be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them, except as described in Section 8;

(h) lodge a complaint with the competent supervisory authority, being the Office of the Data Protection Ombudsman of Finland (Tietosuojavaltuutetun toimisto), P.O. Box 800, 00531 Helsinki, Finland, tietosuoja@om.fi, or with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement;

(i) where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3) GDPR).

We respond to requests without undue delay and in any event within one month of receipt. Where a request is complex or we have received many requests, we may extend this period by up to two further months; in that case, we will tell you about the extension and the reasons for it within one month of receipt. We handle requests free of charge unless a request is manifestly unfounded or excessive. Send requests to dpo_privacy@paysaxas.com.

We may ask you to confirm your identity before we act on a request. If you ask us to erase your Personal Data, we erase the data that we do not need to keep and restrict the rest, so that it is not used for any other purpose, until the end of the applicable retention period in Section 9, and we tell you that some data is kept to meet our legal obligations, including under anti-money-laundering law, and until when. The rights in this Section are subject to the limits set by law: in particular, where the AML Act prohibits disclosure, for example because it would reveal that a report has been or may be made to the Financial Intelligence Unit, we may refuse or restrict access to the Personal Data concerned and may not be able to tell you the reasons.

15. Data Protection Officer

The Company has appointed a Data Protection Officer (“DPO”) responsible for overseeing compliance with data-protection obligations and serving as the primary contact for supervisory authorities. The DPO may be contacted at dpo_privacy@paysaxas.com for any inquiries concerning data processing or the exercise of data-subject rights.

16. Updates to this Privacy Policy

The Company shall review and, where necessary, update this Privacy Policy to ensure continued compliance with applicable data protection laws, including the GDPR and national implementing legislation. In the event of any material change affecting the processing of Personal Data, the Company shall notify Clients of the change at least thirty (30) days before it takes effect, by email or through the Service. This Section 16 constitutes the update provisions referred to in Clause 14.1 of the Company's Terms of Service.