Privacy Policy

Last updated: [DATE]

Draft for legal review. Text in [BRACKETS] is completed before this page is published.

This Privacy Policy explains how [COMPANY NAME] (“ExelPay”, “we”, “us”) processes personal data when you visit exelpay.com, contact us, use our dashboards or are involved in a payment processed through the ExelPay platform.

1. Who is responsible

The controller is [COMPANY NAME], [REGISTERED ADDRESS], registration number [COMPANY REGISTRATION NUMBER]. You can contact us about privacy at [PRIVACY CONTACT EMAIL]. [Our data protection officer can be reached at [DPO CONTACT EMAIL].]

When we process cardholder and customer data on behalf of a merchant to provide payment services, the merchant is usually the controller and we act as its processor, or each party acts as an independent controller where required by card scheme rules or law.

2. What we collect

• Website visitors: pages visited, approximate country, device and browser type, collected without cookies through privacy-friendly analytics provided by our hosting provider. We do not build visitor profiles.
• Sales enquiries: the details you send through the contact form: name, work email, company, website, country, business type, expected volume and your message.
• Dashboard users: name, work email, role, authentication factors (stored securely), sign-in history, IP addresses and an audit log of actions taken.
• Merchants and their owners: identification and verification information needed for onboarding, anti-money-laundering and sanctions checks.
• Payment data: information about the transactions we process, such as amount, currency, merchant reference, masked card number, card brand, issuing country, authentication result and device or network information used for fraud prevention. Full card numbers are stored only in our isolated card vault in tokenized and encrypted form.

3. Why we use personal data and on what legal basis

We do not sell personal data and we do not use it for automated decisions that produce legal effects on you, except fraud and risk checks on payments, which you can ask to have reviewed by a person through the merchant you paid.

4. Who we share data with

We share personal data only as needed with: acquirers, card schemes and payment processors to process payments; identity verification and sanctions screening providers; hosting and infrastructure providers ([HOSTING PROVIDERS, e.g. Amazon Web Services, Vercel]); our email delivery provider for contact form messages; professional advisers; and authorities when the law requires it. All providers are bound by contracts that protect your data.

5. International transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses and apply additional safeguards where needed.

6. How long we keep data

We keep data only as long as necessary: contact enquiries for up to [24] months after our last exchange; dashboard audit logs and transaction records for the periods required by law and card scheme rules, typically [5 to 10] years; website analytics in aggregate form only.

7. Security

We protect personal data with encryption in transit and at rest, managed keys with scheduled rotation, an isolated card vault, multi-factor authentication, least-privilege access, four-eyes approval for sensitive actions and a tamper-evident audit trail.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent. To exercise them, contact [PRIVACY CONTACT EMAIL]. If you paid a merchant through ExelPay, you can also contact that merchant. You may complain to your data protection authority, [SUPERVISORY AUTHORITY].

9. Changes

We will update this policy when our practices change and show the date of the latest version at the top.