CX Pay B.V. ("CX Pay", "we", "us") respects your privacy. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have. It applies to our website, dashboard, APIs, terminals, and mobile applications.
1. Information we collect
1.1 Information you provide
When you sign up as a merchant, contact our sales team, or use our services, we collect:
- Account and business information, including company name, registration details, address, beneficial ownership information, and tax identifiers required for KYC and AML compliance.
- Identification documents, including passports, government IDs, proof of address, and articles of incorporation.
- Contact details, including names, emails, phone numbers, and roles of authorised representatives.
- Bank and settlement information, including account numbers and routing information for payouts.
1.2 Information we collect automatically
- Transaction information, including card BIN, last four digits, amount, currency, merchant, transaction status, and timestamps.
- Device and technical information, including IP address, device fingerprint, browser type, operating system, and pages viewed.
- Customer transaction data, including the cardholder's name, email, billing address, and shipping address when provided during checkout.
1.3 Information from third parties
We may receive information about you from third parties, including:
- Card networks (Visa, Mastercard, American Express, Discover) and our acquiring bank partners.
- Fraud detection providers and identity verification services.
- Sanctions and AML screening providers.
2. How we use your information
We use personal data to:
- Provide, operate, and maintain our payment services.
- Process card and alternative payment transactions and settle funds to merchant accounts.
- Verify your identity and comply with KYC, AML, and sanctions obligations.
- Detect, prevent, and investigate fraud, abuse, and security incidents.
- Respond to inquiries and provide customer support.
- Improve our products and develop new features.
- Send service-related communications and, with your consent, marketing communications.
- Comply with legal and regulatory obligations.
3. Legal bases for processing
Where the GDPR or similar laws apply, we rely on the following legal bases:
- Performance of a contract, where processing is necessary to provide our services to you.
- Compliance with a legal obligation, including KYC, AML, sanctions, and tax reporting.
- Legitimate interests, including fraud prevention, security, product improvement, and direct marketing to existing customers.
- Consent, where you have given us explicit consent for a specific purpose, including some marketing communications and certain cookies.
4. Who we share information with
We share personal data with:
- Banking partners and card networks to process transactions and settle funds.
- Service providers who help us deliver our service, including hosting, fraud detection, and identity verification.
- Regulators, law enforcement, and tax authorities where required by law.
- Professional advisors including auditors and legal counsel under appropriate confidentiality obligations.
- Acquirers or successors in a merger, acquisition, or sale of all or part of our business.
We do not sell personal data.
5. International data transfers
CX Pay operates across the Caribbean, Latin America, the Americas, and the US Pacific. Personal data may be transferred to and processed in jurisdictions outside your country of residence. Where required by law, we put in place appropriate safeguards including Standard Contractual Clauses and equivalent mechanisms.
6. Data retention
We retain personal data only as long as necessary for the purposes set out in this policy, or as required by law. Transaction records and KYC documentation are typically retained for a minimum of 5 years after the relationship ends, in line with regulatory requirements. Marketing data is retained until you withdraw consent.
7. Security
We maintain industry-standard administrative, technical, and physical safeguards designed to protect personal data. We are PCI-DSS Level 1 certified. Despite these measures, no system is completely secure. If we become aware of a security incident affecting your personal data, we will notify you in accordance with applicable law.
8. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Request deletion of your personal data, subject to legal retention obligations.
- Object to or restrict processing in certain circumstances.
- Receive your personal data in a portable format.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with a supervisory authority.
To exercise these rights, contact us at hello@cxpay.global.
9. Cookies and tracking
We use cookies and similar technologies for the following purposes:
- Strictly necessary cookies, required for the website and dashboard to function (cannot be disabled).
- Performance cookies, to measure how visitors use the site so we can improve it.
- Functional cookies, to remember your preferences.
- Marketing cookies, set with your consent, to deliver relevant content.
You can manage cookie preferences via our cookie banner or your browser settings.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or via a notice on our website. The "Last updated" date at the top reflects the most recent revision.
For privacy questions, requests, or to contact our Data Protection Officer:
This document is a CX Pay v2 placeholder pending legal review. Final wording will be confirmed by CX Pay's legal counsel before publication.