Privacy Policy
This Privacy Policy (hereinafter referred to as the 'Policy') outlines the personal data collected by the Spay payment infrastructure (hereinafter referred to as the 'Service', 'We'), the purposes for which it is used, and the rights of data subjects. By using the Service, you confirm that you have read this Policy.
1. Data We Collect
Merchant and beneficiary identification data: legal entity name, registration documents, full names of authorized persons, contact details.
Technical data: IP address, device and browser identifiers, API request logs, transaction metadata.
Payer payment data: masked card number or account details, amount, currency, payment status. The Service does not store full card numbers or CVV.
2. Purposes of Processing
Providing Service: account creation and maintenance, processing and monitoring payment transactions, providing analytics and reporting.
Compliance with legal requirements: AML/KYC checks, fraud prevention, mandatory disclosure to authorized bodies.
Service improvement: quality monitoring, error resolution, ensuring information security, customer support communications.
3. Legal Basis
Data processing is carried out based on applicable laws: contract performance, legal compliance, protection of legitimate interests of the Service and third parties, as well as the consent of the data subject where required.
4. Data Retention
Data is retained for as long as necessary to achieve processing purposes and comply with legal requirements, including anti-money laundering and taxation.
After the retention periods expire, data will be deleted or anonymized.
5. Data Sharing
Data may be shared with partner banks, payment systems, and processing companies as necessary for transaction processing.
We may engage infrastructure service providers (hosting, monitoring, notifications) with appropriate data protection agreements.
Data disclosure to authorized bodies occurs as required by law.
6. Data Subject Rights
You have the right to request confirmation of data processing, access to your data, and information about the purposes and recipients of processing.
You have the right to request correction, blocking, or deletion of data if it is incomplete, inaccurate, or processed in violation of legal requirements.
Requests should be sent to the contact addresses provided in the 'Contacts' section on the homepage. Response time is no more than 30 calendar days, considering applicable legal requirements.
7. Cookies
The Service uses cookies and similar technologies. Detailed information is provided in the Cookie Policy.
8. Data Security
We implement organizational and technical security measures: data encryption during transmission and at rest, access restrictions based on the principle of least privilege, activity logging, regular infrastructure audits.
The payment data infrastructure is designed in accordance with PCI DSS requirements applicable to the role of the Service.
9. Policy Changes
We reserve the right to update this Policy. The new version will be published on the website and will take effect from the date of publication unless a different date is specified in the notice.
Significant changes will be communicated to Users additionally via email or through notifications in the personal account.