1. INTRODUCTION

This Privacy Policy describes how your personal information is collected, used, and shared when you use our payment services, website, or mobile application (collectively, the "Service").

By accessing or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

Data Controller: For the purposes of data protection laws (including the GDPR), the entity responsible for your personal data is the service operator ("we, " us," or "our").

2. WHAT INFORMATION WE COLLECT

We collect different types of information to provide and improve our Service, comply with legal obligations, and prevent fraud.

2.1. Information You Provide to Us

• Account Information: When you register for an account, we collect your name, email address, phone number, and password.
• Business Information: If you use the Service as a merchant, we may collect your business name, business address, tax identification number (e.g., VAT, EIN), and registration documents for identity verification (KYC) and compliance with Anti-Money Laundering (AML) laws.
• Financial Information: Bank account details or payment method information necessary to process payouts or collect payments. Please note: We do not store full payment card numbers. Sensitive payment data is processed directly by our secure third-party payment partners.
• Communications: Any information you provide when contacting our support team.

2.2. Information Collected Automatically

• Usage Data: Information about how you interact with our Service, including IP address, browser type, device information, operating system, pages viewed, and the dates/times of your visits.
• Cookies and Tracking Technologies: We use cookies and similar technologies to maintain your session, remember your preferences, and analyze Service performance.

2.3. Transaction Information
When you make or receive a payment through our Service, we collect details about the transaction, such as the amount, date, time, and the parties involved. This information is necessary for record-keeping and regulatory compliance.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• To Provide and Maintain the Service: Processing payments, managing accounts, and providing customer support.
• To Comply with Legal Obligations: Verifying your identity to meet AML and KYC requirements, reporting to tax authorities, and responding to lawful requests from regulators or law enforcement.
• To Prevent Fraud and Enhance Security: Monitoring for suspicious activity, unauthorized transactions, and other potential risks.
• To Communicate with You: Sending service updates, responding to inquiries, and providing information about changes to our terms or policies.
• To Improve the Service: Analyzing usage patterns to enhance user experience and develop new features.

4. LEGAL BASIS FOR PROCESSING (EEA & UK USERS)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Performance of a Contract: To fulfill our obligations under the Terms of Service.
• Legal Obligation: To comply with applicable laws, such as financial regulations and tax laws.
• Legitimate Interests: To operate and improve our Service, prevent fraud, and ensure network security, provided those interests do not override your fundamental rights.
• Consent: For certain marketing activities, where we have obtained your explicit consent (which you may withdraw at any time).

5. SHARING YOUR INFORMATION

We do not sell your personal information. We may share your information with third parties only in the following circumstances:

• Payment Processors and Financial Partners: To process transactions, we share necessary information with our banking partners and payment gateways. These parties are contractually required to protect your data.
• KYC/AML Verification Providers: To verify your identity and comply with regulatory requirements, we may share information with trusted identity verification services.
• Service Providers: We engage third-party companies to assist with hosting, analytics, customer support, and email communications. These providers have access to your data only to perform tasks on our behalf.
• Legal and Regulatory Authorities: If required by law, or in response to a valid legal request (such as a court order or government investigation).
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. INTERNATIONAL DATA TRANSFERS

As a global service, your information may be transferred to and processed in countries outside your country of residence. These countries may have data protection laws different from those in your home country.

When we transfer personal data from the EEA or UK to countries not deemed "adequate" by the European Commission, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data is protected.

7. DATA SECURITY

We take the security of your personal information seriously. We implement appropriate technical and organizational measures to protect your data from unauthorized access, disclosure, alteration, or destruction.

• All communications between your device and our servers are encrypted using industry-standard TLS (Transport Layer Security) protocols.
• Access to personal data is restricted to personnel who require it to perform their job functions.
• While we strive to protect your information, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

8. DATA RETENTION

We retain your personal information for as long as your account is active or as needed to provide you with the Service. We may also retain your information for a longer period where required by legal or regulatory obligations.

• KYC and Transaction Records: Financial regulations often require us to retain identification records and transaction history for a minimum of five (5) years after the end of our business relationship.
• If you request deletion of your account, we may be required to retain certain information in a restricted archive to comply with applicable laws.

9. YOUR RIGHTS

Depending on your location, you may have the following rights regarding your personal data:

For users in the EEA, UK, and similar regions (GDPR):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure (Right to be Forgotten): Request deletion of your data, subject to legal retention requirements.
• Restriction: Request that we limit the processing of your data.
• Data Portability: Request a copy of your data in a structured, commonly used format.
• Objection: Object to processing based on legitimate interests or for direct marketing.

For users in California (CCPA/CPRA):

• The right to know what personal information we collect, use, and share.
• The right to request deletion of your personal information.
• The right to opt-out of the sale or sharing of personal information (we do not sell your data).
• The right to non-discrimination for exercising your CCPA rights.

To exercise your rights, please contact us using the information in Section 11. We will verify your identity before processing your request.

10. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by updating the "Effective Date" at the top of this policy and, where appropriate, by providing additional notice (such as an email).

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

11. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@elpay.online