1. Terms and Definitions1.1. “Policy” — this Personal Data Processing Policy.
1.2. “We”,
“Us”,
“Our”, etc., as well as
“Controller” — PLAYPAY LTD, a private limited company registered in England and Wales, company number 13752318, registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.
1.3. “You”,
“Your”, etc., as well as
“Data Subject” — either (1) the sole executive body (manager), authorised representative, participant (shareholder) or beneficial owner of the Recipient (within the relations under the ITI Agreement and the Payment Agent Agreement), or (2) a Payer who makes a Transaction on the Authorization Page (within the relations under the Payer Agreement).
1.4. “Personal Data” — any information relating directly or indirectly to a specific or identifiable individual (Data Subject).
1.5. “Processing of Personal Data” — any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data. Personal data is processed by a mixed method (including automated processing).
1.6. “Automated Processing of Personal Data” — processing of personal data by means of computer technology, including automated checks and transaction monitoring systems.
1.7. “Processor” — a person processing Personal Data on Our instruction and on Our behalf.
1.8. “Confidentiality of Personal Data” — a requirement binding on Us or any other person who has obtained access to Personal Data not to permit its dissemination without the consent of the Data Subject or another lawful basis.
1.9. “Depersonalisation of Personal Data” — actions as a result of which it becomes impossible, without the use of additional information, to determine whether the personal data belongs to a specific Data Subject.
1.10. “Payment Partner” — a bank, payment institution, electronic money institution, acquirer or cryptoasset service provider holding a valid permit (licence) of the competent regulator of the relevant jurisdiction, engaged by Us for the acceptance of payments and/or for payouts to the Recipient.
1.11. “ITI Agreement” — the Agreement for the provision of information technology services concluded between the Recipient and Us on the terms of the Merchant Terms (the “Rules”) after the Recipient’s accession to them.
1.12. “Payment Agent Agreement” — the Payment Agency Services Agreement between the Recipient and Us, under which We act as the Recipient’s commercial agent and collect payments from Payers.
1.13. “Payer Agreement” — the Payer Agreement (terms of payment through the Authorization Page) published on the Site.
1.14. “Payer” — a person who is a consumer of the Recipient’s Goods and who uses the Authorization Page of the Platform to make a Transaction in favour of the Recipient.
1.15. “Recipient” — a legal entity or other person carrying out business activities, which is a Party to the ITI Agreement and the Payment Agent Agreement.
1.16. “Transaction” — a payment by the Payer for the Recipient’s Goods made through the Authorization Page.
1.17. “Site” — Our website [domain].
1.18. “Platform” — Our software called [name of the Platform], access to which is provided on the Site through the Account.
1.19. “Account” — the personalised part of the Platform through which We provide the Services under the agreements.
1.20. “Authorization Page” — the part of the Platform that enables the execution of Payers’ payment orders using a payment instrument for the purpose of making Transactions.
1.21. “Cookies” — a small text file placed by the Site on Your computer or device when You, for example, visit certain sections of the Site and/or when You use certain functions of the Site.
1.22. “Data Protection Law” — the legislation of the United Kingdom on the protection of personal data, including the UK General Data Protection Regulation and the Data Protection Act 2018 and the secondary legislation adopted pursuant thereto, as well as, where applicable to Data Subjects located in the European Union, Regulation (EU) 2016/679 (GDPR), and other requirements in the field of personal data protection applicable to Us.
1.23. “Regulator” — the Information Commissioner’s Office (ICO), as well as any other competent supervisory authority, including the supervisory authority of the EU member state of Your residence.
In other respects, definitions are understood in the meaning given to them by the Merchant Terms.
2. Subject Matter and Grounds of Processing of Personal Data2.1. Subject matter of the Policy. The provisions of this Policy apply to relations between Us and You connected with the Processing of Personal Data within the relations arising between Us concerning the use of the Platform, either under (1) the Payer Agreement, or (2) the ITI Agreement and the Payment Agent Agreement, or (3) other agreements, if We have made it possible to conclude them. We act as the controller of Your Personal Data for the purposes set out in this Policy. The Recipient is a separate controller of the Personal Data it processes for the sale and delivery of the Goods; the Recipient’s privacy policy is published on its website.
2.2. Grounds of processing. We process Your Personal Data on one or more of the following grounds: (1) Your consent; (2) the processing is necessary for the conclusion and performance of an agreement to which You are a party, or for taking steps at Your request prior to the conclusion of an agreement; (3) the processing is necessary for the performance of Our obligation provided for by applicable legislation, including requirements in the field of combating money laundering and the financing of terrorism, tax requirements and the Payment System Rules; (4) protection of Our legitimate interests or the legitimate interests of third parties, including for the purposes of preventing fraud, ensuring information security, and establishing, exercising or defending legal claims, provided that such interests do not infringe Your rights and freedoms; (5) protection of the vital interests of the Data Subject.
2.3. Consequences of refusal. The provision of part of the Personal Data is a necessary condition for the conclusion and performance of agreements with Us and Our Payment Partners. If such data is not provided, or if consent is withdrawn (where processing is based solely on consent), We may be unable to provide You with services or to perform obligations under concluded agreements.
3. Acceptance of the Terms of the Policy3.1. Acceptance of the terms. You are deemed to have familiarised Yourself with the Policy (1) either after You have registered on the Site and confirmed this by ticking the relevant box in the form, or (2) after You have confirmed a Transaction by clicking the “Pay” button (or equivalent), as provided for by the Payer Agreement. Please note that We may store data on Your actions in ticking the box (by means of a logging system) throughout the entire existence of the Account, as well as for 5 (Five) years after its deletion, unless a different period is provided for by applicable legislation.
3.2. Withdrawal of consent. If processing is carried out on the basis of consent, You may withdraw it at any time by sending a request to the address indicated in the Official Notice. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal, and does not terminate processing carried out on other grounds provided for by clause 2.2 of the Policy.
4. Term of the Policy and of Processing of Personal Data4.1. Term of the Policy. After the terms of the Policy are accepted, it is valid indefinitely. However, this does not affect the period of Processing of Your personal data — it is established by this Policy.
4.2. Period of processing of personal data. As a general rule, We process Your Personal Data throughout the entire existence of the Account, as well as for 5 (Five) years after its deletion (or from the date We receive a duly executed withdrawal of Your consent to the processing of personal data), unless a longer storage period is established by applicable legislation, the ITI Agreement, the Payment Agent Agreement or another agreement connected with the use of the Platform to which You are a party. Data necessary for compliance with requirements on combating money laundering and the financing of terrorism, as well as Transaction data, is stored for not less than 5 (Five) years from the date of termination of the relationship or of the making of the Transaction; technical logs are stored for up to 12 (Twelve) months. Upon expiry of the storage period, Personal Data is deleted or depersonalised.
4.3. Amendment. The Policy may be amended by Us at any time. This may be connected, inter alia, with changes in Our business processes, the influence of external factors and other reasons. After amendments are made, we immediately publish the amended Policy on the Site so that You have the opportunity to study it in its new version. We will notify You of the amendment of the Policy by sending a notification to the Account and/or by publishing it on the Site. If You continue to use the Platform after amendments are made to the Policy, we unconditionally consider that You have familiarised yourself with the Policy in its new version.
5. Grounds for Development, Purposes and Principles of the Policy5.1. Grounds for development. The Policy has been developed (1) in performance of the requirements of the Data Protection Law, and also (2) in performance of the requirements of the Payment Partners and the Payment System Rules. The Policy is binding on all Our employees who have access to Your Personal Data.
5.2. Purposes of processing. We process Personal Data for the following purposes: (1) conclusion and performance of the ITI Agreement, the Payment Agent Agreement, the Payer Agreement and other agreements, including the collection of payments and the making of refunds and payouts; (2) identification and verification of Data Subjects, carrying out checks within the framework of the requirements of the United Kingdom and the European Union on combating money laundering and the financing of terrorism and sanctions compliance; (3) ensuring the conduct of Transactions and settlements in respect of them, including the examination of disputes and challenges (chargeback); (4) prevention of fraud and ensuring information security; (5) compliance with the requirements of applicable legislation, requests of state authorities and the Regulator; (6) improvement of the operation of the Site and the Platform, technical support; (7) exchange of legally significant communications and communication with You. We do not use Your Personal Data for direct marketing without Your consent.
5.3. Principles. We adhere to the following principles of Processing of Personal Data: (1) processing is carried out on a lawful, fair and transparent basis; (2) processing is limited to the achievement of specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not permitted; (3) the content and scope of the Personal Data processed correspond to the stated purposes and are not excessive; (4) accuracy, sufficiency and up-to-dateness of the Personal Data in relation to the purposes of processing are ensured; (5) storage is carried out for no longer than is required by the purposes of processing, unless a different storage period is provided for by the Policy or by applicable legislation; (6) an appropriate level of security and confidentiality of Personal Data is ensured.
6. Composition of the Personal Data Collected6.1. Registration on the Platform. In accordance with the ITI Agreement, upon registration on the Site We collect the following Personal Data: (1) first name, (2) surname, (3) telephone number, (4) email address.
6.2. Data for identification of the Recipient. After registration, when You submit a project for approval, We will ask You to provide Personal Data, which We process and transmit to the Payment Partners in performance of the requirements of legislation on combating money laundering and the financing of terrorism, the Payment System Rules and other applicable requirements. The personal data of the manager, authorised representative, participant (shareholder) and beneficial owner of the Recipient requested may include the following, depending on the project and the requirements of the Payment Partners:
01. surname and first name (and middle name, if any);
02. date and place of birth;
03. citizenship;
04. details of the identity document (name, series and number, issuing authority, date of issue and period of validity, or similar data);
05. address of registration / actual residence (country, postcode, region, locality, address details);
06. details of the document confirming the right of stay (residence) in the country of location (if any);
07. mobile telephone subscriber number;
08. email address;
09. tax number (VAT / TIN or equivalent), if any;
10. details of the position and authority, documents confirming authority;
11. information on the ownership and control structure of the Recipient, including information on participants (shareholders) and beneficial owners;
12. information on the beneficiary (the person for whose benefit the client acts, including on the basis of an agency agreement, agreements of mandate, commission and trust management, as well as payments on instruction of / on behalf of a third party);
13. bank details (name of the bank, account number / IBAN, SWIFT/BIC, country of the bank) and/or the stablecoin wallet address and network for payouts;
14. information necessary for carrying out sanctions checks and business reputation checks.
6.3. Data of Payers. If You are a Payer, the following are processed for the conclusion and performance of the Payer Agreement: (1) bank card number, (2) bank card expiry date (month/year), (3) bank card verification code (CVC2/CVV2 or equivalent), (4) email address and other contact details, if indicated on the Authorization Page, (5) data on the Transaction (amount, currency, Recipient, date and time). The verification code is not stored after Authorization has been carried out. Bank card data is processed in accordance with the applicable requirements of the PCI DSS Standard — by Us independently (where We hold valid confirmation of compliance) and/or with the engagement of persons holding valid confirmation of compliance with the PCI DSS Standard.
6.4. Technical data. While You use the Site, We automatically collect some of Your Personal Data. Such data includes, for example, technical information, including the Internet protocol (IP) address used to connect Your device to the Internet, login data, browser type and version, time zone setting, types and versions of browser plug-ins, operating system and platform, device identifiers, information about Your visits to websites, etc.
6.5. Other data. In exceptional cases, We may ask You to provide additional Personal Data. For example, when We need to identify You when You use the Platform, or if such data has been requested by a Payment Partner, the Regulator or another competent authority. We will warn You of this in advance and, if necessary, ask You to give additional consent.
6.6. Personal data of third parties. Please take into account that if You provide Us with the Personal Data of third parties, You warrant that You have an appropriate legal basis for such provision and for its subsequent transfer (including cross-border transfer), and that You have provided such persons with the necessary information on processing in accordance with the legislation applicable to You. If You act as the controller of the personal data of such persons, You also warrant that You ensure the procedure for the transfer and protection of their personal data to an extent no less than that provided for by this Policy. Supporting documents must be provided by You no later than 7 (Seven) calendar days from the date the relevant request is sent. The provision of the Personal Data of third parties without compliance with this warranty is not permitted, and You fully assume all liability for breach of this warranty.
6.7. Automated processing and monitoring. For the purposes of preventing fraud and complying with sanctions requirements and requirements on combating money laundering, Transactions and Your technical data may be subject to automated checking (including scoring and monitoring rules). The result of such checking may be rejection of a Transaction, suspension of access to the Platform or refusal to provide services. You have the right to state Your position and to request a review of the decision with the participation of Our employee by sending a request to the contacts indicated in the Official Notice, except where the provision of such information is contrary to the requirements of legislation on combating money laundering.
7. Rights of the Data Subject7.1. Receipt of information and access. You have the right to receive information about Us, Our location and whether We hold Your Personal Data, and to obtain access to such Personal Data and to information about its processing.
7.2. Rectification and deletion. You have the right to require Us to rectify Your Personal Data, or to block or destroy it, if the Personal Data is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing.
7.3. Restriction and objection. You have the right to require restriction of processing, and to object to processing carried out on the basis of Our legitimate interests and to automated processing that entails legal consequences for You.
7.4. Data portability. You have the right to receive the Personal Data provided by You that is processed by automated means on the basis of consent or an agreement in a structured, commonly used, machine-readable format, and to require its transfer to another controller, where technically feasible.
7.5. Form of provision. Information on whether We hold Personal Data will be provided to You in an accessible form and will not contain Personal Data relating to other Data Subjects.
7.6. Procedure for exercising rights. You (or Your legal representative) may exercise Your rights by sending a request to the contacts indicated in the Official Notice. In order to protect Your data, We have the right to request additional information to confirm Your identity. We are obliged to reply to Your request within 30 (Thirty) days from the date of its receipt; having regard to the complexity and number of requests, this period may be extended, of which We will notify You. Rights are exercised free of charge, except in the case of manifestly unfounded or excessive requests.
7.7. Restrictions. We have the right to refuse a request in whole or in part if this is necessary for compliance with the requirements of applicable legislation (including on combating money laundering and the financing of terrorism), for establishing, exercising or defending legal claims, and also if satisfying the request would infringe the rights of third parties. We will notify You of the grounds for refusal, except where such notification is prohibited by law.
7.8. Right of complaint and protection. You have the right to lodge a complaint with the Regulator (in the United Kingdom — the Information Commissioner’s Office, ico.org.uk; in the European Union — the supervisory authority of Your member state) or to apply to the courts, and to claim compensation for losses in accordance with applicable legislation.
8. Transfer of Personal Data8.1. Categories of recipients. In order to achieve the purposes of Processing of Personal Data, We may need to provide Your Personal Data to: (1) Payment Partners and other credit (financial) institutions participating in the making of Transactions and payouts; (2) acquiring banks, issuers of payment instruments and international and local payment systems, to the extent established by security protocols and the Payment System Rules; (3) the Recipient — in respect of Payers, to the extent necessary for the delivery of the Goods, refunds and the handling of disputes; (4) organisations and services carrying out fraud prevention, sanctions screening and business reputation checks; (5) Processors providing services to Us (hosting, cloud infrastructure, technical support, analytics, communication) — on the basis of agreements providing for confidentiality and data protection obligations; (6) professional advisers (lawyers, auditors); (7) state authorities, regulators and courts — in cases provided for by applicable legislation; (8) acquirers of the business or part of it — in the event of reorganisation, merger or disposal of assets.
8.2. Mandatory and optional transfer. The transfer of information may be mandatory, for example in respect of information about the user’s equipment: IP address, OS, geographical data, equipment ID/type, channel used (browser/application), payment authorization, identification/verification — or optional, for example in respect of information on address-match indicators, account information in the provider’s system, email address, mobile telephone number, payment amount, risk level determined by the provider.
8.3. Cross-border transfer. Since We, the Payment Partners, the payment systems and the Processors may be located in different jurisdictions, Your Personal Data may be transferred outside the country of its collection, including outside the United Kingdom and the European Union. Such transfer is carried out: (1) to jurisdictions recognised by the United Kingdom (and, where applicable, the European Commission) as ensuring an adequate level of personal data protection; (2) in the absence of such recognition — on the basis of contractual safeguards (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable) obliging the recipient to ensure a level of protection no lower than that established by the Data Protection Law; (3) or on another lawful basis provided for by the Data Protection Law, including Your explicit consent or the necessity of performing an agreement to which You are a party. A copy of the safeguards applied may be requested using the contacts indicated in the Official Notice.
8.4. No sale of data. We do not sell Your Personal Data to third parties and do not transfer it to third parties for the purposes of their own marketing without Your consent.
9. Storage of Personal Data9.1. Place of storage. We store Your data on servers located in [location of the servers] and/or in other jurisdictions ensuring an adequate level of personal data protection, in compliance with the requirements of section 8 of the Policy on cross-border transfer. Certain categories of data may be stored in a jurisdiction determined by the requirements of the Payment Partner or the Payment System Rules.
10. Principles and Measures for the Protection of Personal Data10.1. Principles of protection. We apply legal, organisational, administrative, technical and physical measures to protect Personal Data to ensure its protection, taking into account the nature, scope and purposes of processing, as well as the risks to the rights of Data Subjects.
10.2. Protection measures. We ensure the security of Your Personal Data, including in the following ways: (1) restricting and determining the composition of employees having access to Personal Data; (2) appointing a person responsible for organising the processing and protection of Personal Data; (3) developing and implementing internal policies and procedures on matters of Personal Data processing; (4) determining threats to the security of Personal Data when it is processed in information systems; (5) applying organisational and technical measures, including encryption, pseudonymisation, differentiation of access rights, logging and backup; (6) accounting for information carriers and establishing rules of access to Personal Data; (7) restricting access to premises in which technical processing facilities are located; (8) detecting facts of unauthorised access and taking measures to prevent it; (9) obtaining non-disclosure undertakings from all employees involved in processing; (10) restoring Personal Data modified or destroyed as a result of unauthorised access; (11) training employees in the requirements of personal data legislation; (12) monitoring the measures taken and conducting periodic checks, including in respect of Processors.
10.3. Security incidents. In the event of a breach of the security of Personal Data entailing a risk to Your rights and freedoms, We notify the Regulator and, if required by applicable legislation, You — without undue delay, describing the nature of the breach, its likely consequences and the measures taken.
11. Cookies11.1. Use of Cookies. The Site uses Cookies. When You visit the Site, Your Internet browser transmits certain information to Our server: (1) date and time of the visit, (2) browser type, (3) language settings, (4) operating system. This information is kept in connection logs for a limited period (from a session up to a year) to ensure the security and proper operation of the Site, as well as to collect statistical information.
11.2. Functions of Cookies. There are various groups of Cookies used on the Site. The first group is strictly necessary (functional and technical) Cookies, which allow the Site to recognise Your session, language and browser and to ensure the full operation of the Site and the Authorization Page; they are used without Your consent. The second group is analytical Cookies, which allow us to count visitors and understand how they use the Site. Analytical and any other non-essential Cookies are placed only with Your consent given through the Cookie management interface on the Site, and You may withdraw Your consent at any time through that interface or Your browser settings.
11.3. Cookie storage period. In terms of storage time on users’ devices, Cookies are divided into persistent and session Cookies: “session Cookies” are files that are stored on Your device until You close the browser; “persistent Cookies” are stored on Your device until they expire or until You delete them.
11.4. Disabling Cookies. You have the option to accept or reject Cookies on all websites that You visit by changing the settings in Your web browser (as a rule, the relevant section is located in the browser’s privacy settings). Each browser has its own settings for changing and deleting Cookies. Please note that certain functionality of the Site may be unavailable if Cookies are disabled. If You use different devices to access the Site (for example, a smartphone, tablet, computer, etc.), You should make sure that each browser on each device is configured in accordance with Your preferences regarding Cookies.
12. Communication and Exchange of Legally Significant Correspondence12.1. Contacts of the Parties. In the course of performance of obligations between Us, there may be (and in some cases there must be) an exchange of important legal information. Such exchange takes place using the official contacts of the Parties (“Contact Details”) in both written and electronic form (equivalently). The conclusion of a separate agreement on the use of electronic document exchange is not required. Our Contact Details are indicated in the Official Notice, and Your Contact Details are indicated by You in the Account and/or in any other documents that You send to Us and/or through Us to Our Payment Partner. Please remember that You bear all risks connected with Your Contact Details having become out of date.
12.2. Exchange of correspondence. Correspondence may be exchanged only using the Parties’ Contact Details.
13. Final Provisions13.1. Severability. If one or more provisions of the Policy are found invalid / unenforceable, etc., such provisions shall be deemed replaced by valid provisions as close as possible in meaning, and the remaining provisions remain in force.
13.2. Language. The Policy may be published in English and other languages. The English version prevails; in the event of a discrepancy between the versions, interpretation shall be made by reference to the English version, unless otherwise established by mandatory provisions of applicable legislation.
