1. General Provisions
1.1. This Privacy Policy (the “Policy”) defines the procedure for the collection, use, storage, transfer, and protection of personal data of users (“User”, “you”) when using the PINTOPAY services (“Services”) through available interfaces, including the website and the Mini-App (collectively, the “Access Interfaces”).
1.2. The personal data controllers are the relevant entities of the PINTOPAY Group (collectively, the “Group”, “we”, “us”), depending on the nature of the Services provided, unless expressly stated otherwise.
1.3. This Policy forms an integral part of the PINTOPAY Terms & Conditions and applies in conjunction with them.
2. Legal Grounds for Data Processing
We process the User’s personal data on the following legal grounds:
- (a) performance of a contract — provision of the Services in accordance with the Terms & Conditions;
- (b) compliance with legal obligations, including AML/CTF requirements, sanctions legislation, and requirements of payment systems and issuing banks;
- (c) legitimate interests of the Group, including ensuring security, fraud prevention, risk management, and improvement of the Services;
- (d) the User’s consent, where and when such consent is required by applicable law (for example, for marketing communications).
3. Categories of Personal Data Processed
Depending on the Services used, we may process, to the extent necessary and proportionate, the following categories of data:
- ● identification data (full name, date of birth, citizenship);
- ● contact data (email address, phone number);
- ● identity document data;
- ● data required for KYC / AML / sanctions checks;
- ● information on source of funds and transactional activity;
- ● technical data (IP address, device data, logs);
- ● data on the use of the Services and Access Interfaces.
Such data are processed solely for the purposes specified in Section 4 and are not used beyond what is necessary.
4. Purposes of Personal Data Processing
Personal data are processed for the following purposes:
- ● registration, onboarding, and account maintenance;
- ● provision of the Services (cards, wallets, exchanges, virtual accounts);
- ● compliance with AML/CTF, sanctions, and regulatory requirements;
- ● fraud prevention and risk management;
- ● interaction with the User and customer support;
- ● fulfillment of obligations to payment and card partners;
- ● improvement, testing, and development of the Services;
- ● delivery of service-related notifications;
- ● delivery of marketing messages only where consent is provided, if required.
5. Transfer of Personal Data to Third Parties
5.1. We may transfer the User’s personal data to:
- ● companies within the Group;
- ● card issuers and payment partners;
- ● custodial and payment service providers;
- ● KYC/AML, antifraud, and IT service providers;
- ● governmental and regulatory authorities — where lawful grounds exist.
5.2. Data transfers are carried out only to the extent necessary for the relevant purpose and subject to contractual confidentiality obligations.
5.3. Transfer of data to third parties for marketing purposes is permitted only with the User’s separate consent, where required by applicable law.
6. Cross-Border Data Transfers
Due to the cross-border nature of the Services, personal data may be transferred to and processed outside the User’s country of residence. In such cases, the Group takes reasonable measures to ensure an adequate level of data protection in accordance with applicable law.
7. User Rights
To the extent permitted by applicable law, the User has the right to:
- ● request access to their personal data;
- ● request correction or updating of personal data;
- ● request deletion of personal data, unless retention is required by law;
- ● restrict or object to processing;
- ● withdraw consent to data processing (where applicable);
- ● lodge complaints with competent data protection authorities.
Requests may be submitted via the Service’s support channels.
8. Data Retention and Protection
8.1. Personal data are retained no longer than necessary for the purposes of processing or as required by applicable law.
8.2. We implement reasonable technical and organizational measures to protect data against loss, unauthorized access, alteration, or disclosure.
9. Marketing Communications
9.1. Service and operational notifications are an integral and mandatory part of the provision of the Services.
9.2. Marketing communications are sent only in cases and to the extent permitted by applicable law and subject to the User’s consent, where required.
The User may opt out of marketing communications at any time.
10. Cookies and Technical Data
We use cookies and similar technologies to ensure the operation of the Access Interfaces, perform analytics, and improve the user experience. The User may manage cookies through their device or browser settings.
11. Changes to the Policy
We reserve the right to update this Policy. The current version is made available through the Access Interfaces. Continued use of the Services constitutes acknowledgment of the updated version.
12. Contact Details
For questions related to the processing of personal data, the User may contact the Service’s support team through the Access Interfaces or via email: [email protected].