Privacy Policy

2.2 Information that is collected about individuals who do not interact with us directly

We may receive Personal Data about individuals who do not interact with us directly. For example, our customers, service providers, and partners may provide us with information about individuals other than themselves when using our services. In addition, due to the unique nature of PAYSTRAX’s business, in many cases, Company obtains Personal Data from other participants in a transaction processing chain, such as card associations and their members. The types of information we receive about third parties includes:

• Information about the personnel of our customers, service providers, or partners, such as the business contact information that our customers, service providers, or partners provide to us in the context of our contractual relationships with them;
• Information about potential job candidates, such as when a recruiter contacts us about an individual who may become a candidate for a job at PAYSTRAX;
• Information about clients of our customers that our customers send to us or allow us to collect in the context of the services that PAYSTRAX performs, such as information related to financial transactions initiated by the client. Where our technology is incorporated into a customer’s website, we also may automatically collect certain information of the type described in the section below titled “Information collected via automated means”;
• Information obtained when processing transactions, such as information about payment transactions;

2.3 Information is collected from private and publicly accessible sources

We and our service providers may collect information about individuals that is publicly available, including by searching publicly accessible government lists of restricted or sanctioned persons (such as the Specially Designated Nationals And Blocked Persons List), public records databases (such as company registries and regulatory filings), and by searching media and the internet. We and or our third party verification providers may also collect information from private or commercially available sources, such as by requesting reports or information from credit bureaus and/or fraud prevention agencies, to the extent permitted under applicable law.

We also maintain pages for the Company and our services on a variety of third-party platforms, such as LinkedIn, Facebook, Twitter, YouTube, Instagram, and other social networking services. When you interact with our pages on those third-party platforms, the third-party’s privacy policy will govern your interactions on the relevant platform. If the third-party platform provides us with information about our pages on those platforms or your interactions with them, we will treat that information in accordance with this Policy.

2.4 Information collected via automated means

When you access our website, we automatically collect information about you, your computer or mobile device, and activity on our websites or mobile applications. Typically, this information includes your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our website, general location information such as city or geographic area; and information about your use of and actions on or in our website, such as pages or screens you accessed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access. Certain services that we provide or which merchants may incorporate into their websites may automatically collect additional information.

Our service providers and business partners may collect this type of information over time and across third-party websites. This information is collected via various mechanisms, such as via cookies, web beacons, embedded scripts and similar technologies. This type of information may also be collected when you read our HTML-enabled emails. Please refer to the Cookies section of this Policy for more details. You can choose to disable cookies or to opt out of the use of your browsing behaviour for purposes of targeted advertising. For opt out instructions, please review the “How to control cookies” portion of the “Cookies used to process your Personal Data” section of this Privacy Notice.

2.5 Sensitive Personal Data

In the context of processing employment applications, we may also collect sensitive information where required or permitted by law of the Republic of Lithuania. Outside of this context or otherwise as we specifically request, we ask that you not provide us with any sensitive Personal Data (e.g. information revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, genetic or biometric information, information about sex life or sexual orientation, or criminal convictions or offenses) through our website or email, or otherwise to us.

3. How PAYSTRAX uses your Personal Data

We use your Personal Data for the purposes listed below.

3.1 Providing our services

• Operating, evaluating, maintaining, improving, and providing the features and functionality of our services;
• Fulfilling a payment transaction initiated by you (either with us or our client);
• Managing our relationship with you or your company;
• Carrying out our obligations, and exercising our rights, under our agreement with you or your company;
• Communicating with you regarding your agreement with us, if you have one, including by sending you service-related emails or messages (e.g., messages regarding account verification, changes or updates to the functionality of our services, technical and security notices and alerts, and support and administrative messages);
• Personalizing the manner in which we provide our services;
• Checking for potential fraud, money laundering or terrorism financing and/or managing either our or our clients’ risk;
• Administering and protecting our business;
• Providing support and maintenance for our services, including responding to your service-related requests, questions, and feedback.

3.2 Research and development

• Developing or improving our services;
• Developing and creating analytics and related reporting, such as regarding industry and fraud trends.

3.3 Marketing

We may use your Personal Data to form a view on what services we think you may want or need, or what may be of interest to you.

We may contact you with marketing communications using the Personal Data you have provided to us if you have actively expressed your interest in concluding an agreement with us and, in any case, you have not opted out of receiving that marketing, to the extent permitted by applicable law.

You can ask us to stop sending you marketing messages at any time by contacting us using the details at “Contact us” section or clicking on the opt-out link included in each marketing message. Should you choose to opt out of receiving our marketing messages, we will continue to carry out our other relevant activities using your Personal Data, including sending non-marketing messages for the lifespan of the business relationship.

3.4 Managing our recruiting and processing employment applications

We process Personal Data, such as information submitted to us in a job application, to facilitate our recruitment activities and process employment applications, such as by evaluating a job candidate for an employment activity, and monitoring recruitment statistics.

3.5 Complying with law

We use your Personal Data as we believe necessary or appropriate to comply with applicable laws of the Republic of Lithuania, lawful requests and legal process, such as to respond to legal documents or requests from government authorities.

3.6 Compliance, fraud prevention and safety

We use your Personal Data as we believe necessary or appropriate to (a) enforce the terms and conditions that govern our services; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

3.7 With your consent

In some situations, applicable law may require us to request your consent to use your Personal Data in certain contexts, such as when we use certain cookies or similar technologies or would like to send you certain marketing messages. If we request your consent to use your Personal Data, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us. If you have consented to receive marketing communications from our third party partners, you may withdraw your consent by contacting those partners directly.

3.8 To create anonymous data

We may create anonymous data from your Personal Data and other individuals whose Personal Data we collect. We make Personal Data into anonymous data by excluding information that makes the data personally identifiable to you and use that anonymous data for our lawful business purposes.

4. Sharing of Personal Data

4.1 Service providers

We may employ third party companies and individuals to administer and provide services on our behalf (such as companies that provide customer support, companies that we engage to host, manage, maintain, and develop our website and IT systems, and companies that help us process payments). These third parties may use your information only as directed by PAYSTRAX and in a manner consistent with this Privacy Policy and are prohibited from using or disclosing your information for any other purpose.

4.2 Participants in the transaction processing chain

PAYSTRAX shares Personal Data with companies in the transaction processing chain in connection with processing a payment transaction, such as merchants, banks or other card issuers, card associations.

4.3 Credit reference, fraud protection, risk management, and identity and verification agencies

PAYSTRAX shares Personal Data with credit bureaus, fraud protection, risk management, and identity verification agencies to help guard against, detect, and respond to fraud, money laundering or terrorism financing, and/or manage our or our clients’ risk, and ensure we comply with contractual, legal, or regulatory requirements.

4.4 Professional advisors

We may disclose your Personal Data to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

4.5 Compliance with Laws and Law Enforcement; Protection and Safety

PAYSTRAX may disclose information about you to supervisory authorities or law enforcement officials (including tax authorities) or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal process, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern our services; (d) protect our rights, privacy, safety or property, and/or that of you or others; and (e) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

4.6 To Other Parties with Your Permission or to Fulfill a Contract They Have With You

Company may transfer your Personal Data to any third party who is not otherwise covered by the other listed categories above where you have given us permission to do so, or with whom you have entered into a contract when we need to transfer your Personal Data to that party in order to fulfil that contract.

5. Your rights as a data subject

We have a legal obligation to ensure that your Personal Data is kept accurate and up to date. We kindly ask you to assist us to comply with this obligation by ensuring that you inform us of any changes that have to be made to any of your Personal Data that we are processing.

You may, at any time, exercise the following rights with respect to our processing of your Personal Data:

• Right to access. You are entitled to ask us if we are processing your Personal Data and, if so, for a copy of the Personal Data we hold about you, as well as obtain certain other information about our processing activities.
• Right to rectification. If any Personal Data we hold about you is incomplete or inaccurate, you can require us to correct it, though we may need to verify the accuracy of the new data you provide to us.
• Right to erasure. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law.
• Right to object. Where our reason for processing your Personal Data is legitimate interest you may object to processing as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
• Right to withdraw consent. Where our reason for processing is based on your consent, you may withdraw that consent at any time. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
• Right to the restriction of processing of your Personal Data. You can contact us with a request to restrict the processing of your Personal data, except for storage, if one of the following applies:
  • you contest the accuracy of the Personal Data for a period enabling us to verify the accuracy of the Personal data;
  • the processing of your Personal Data is unlawful and you oppose the erasure of your Personal Data and request the restriction of their use instead;
  • the data are no longer necessary in relation to the purposes for which they were collected, but they are required by the Data Subject for the establishment, exercise or defense of legal claims;
  • you have objected to processing pending the verification whether our legitimate grounds override your legitimate grounds. It is possible that due to the restriction of processing of Personal Data and during the period of such restriction we will not be able to ensure the provision of services to you.
• Right to portability of your Personal Data. You can contact us with a request to receive Personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format, also you can submit a request for us to transmit your Personal data to another controller to the extent this is technically possible and when:
  • the processing of your Personal data is based on your consent or performance of an agreement concluded with you; and
  • the processing of your Personal data is carried out by automated means.
• Opt-out from marketing. We will also give you the opportunity to opt out of our communication with you whenever we send you information about PAYSTRAX or any other information that we believe may be of interest to you. Additionally, you can also opt out at any time by contacting us.
• Right to file a complaint regarding the processing of Personal Data. If you believe that we process your Personal Data in breach of Regulation (EC) 2016/679 and/or other legislation regulating the processing of Personal Data, we ask you to always contact us at first. If you are not satisfied with the problem solution offered by us or, in your opinion, we have not taken actions that are necessary based on your request, you have a right to file a complaint with the State Data Protection Inspectorate or to bring a court action.

You can submit requests to exercise these rights by emailing the PAYSTRAX DPO using the contacts provided in “Contact Us” section. We may need to request specific information from you to help us confirm your identity and ensure you are entitled to exercise a right in respect of your Personal Data, for example, a merchant identification number or account number. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We will respond to all legitimate requests promptly and, in any event, within any timeframes prescribed by applicable law. In general, we must respond to queries within 1 (one) month from the receipt of the request, so it is important that requests are identified and sent to the PAYSTRAX DPO using the contacts provided in “Contact Us” section as soon as possible. Occasionally it may take us longer than 1 (one) month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Any transmission of your Personal Data will be handled in a secure manner.

6. The location of the processing of your Personal Data

PAYSTRAX primarily store and process Personal Data within the European Union. Nevertheless, it may at times be necessary that your Personal Data is transferred to and stored at a destination outside the European Union. It may also be processed by data processors operating outside the EU. By submitting your Personal Data to us or by consenting to the processing of your Personal Data you agree to the processing of your data, including both data storage and data transfer, outside the EU for the purposes set out in this Policy. We will take all reasonably necessary precautions to ensure that your data is treated securely and in accordance with the applicable Data Protection Laws. We will not store any of your Personal Data longer than necessary to fulfil the purposes set out in this Policy.

For example, we may transfer your Personal Data based on:

• an adequacy decision by the European Commission;
• standard data protection clauses elaborated by the European Commission;
• standard data protection clauses elaborated by a DPA;
• using other possible safeguards and derogations where it is allowed by the applicable laws.

If we will plan to transfer Personal Data outside of EU to third parties in countries not deemed by the European Commission to provide an adequate level of protection for Personal Data, the transfer will be only made pursuant to:

• A contract approved by the European Commission (sometimes called “Model Clauses” or “Standard Contractual Clauses”);
• The EU-US Privacy Shield;
• The consent of the individual to whom the Personal Data relates; or
• Other mechanisms or legal grounds as may be permitted under applicable European law

As with all of your Personal Data, you may request that we inform you on the details of the processing of your Personal Data on the basis of Article 15 of the GDPR. You may, as with the exercise of any your rights as a data subject, do so by contacting us via the information that has been provided at the end of this Policy.

7. Retention and deletion of your Personal data

We will use your Personal Data for no longer than necessary based on why we collected it and what we use it for. This may include our need to satisfy a legal, regulatory, accounting, or reporting requirement.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Normally we will store the data that we have acquired in compliance with the applicable legislation of the relevant jurisdiction for 10 (ten) years as of the expiry of contractual relations with you. We will use your Personal Data for marketing purpose until you inform us that you no longer wish to receive such information from us. For managing our recruiting and processing employment applications we will retain the data that we have obtained via our recruitment processes for as long as necessary to evaluate the application and in accordance with all relevant laws and regulations. Furthermore, we may ask for your consent to retain your Personal Data for some time after we have evaluated your application.

In general terms, we will retain your Personal Data for the duration of your involvement/engagement with us and for as long as reasonably necessary afterwards.

PAYSTRAX deletes or destroys all Personal as soon as possible where it has been confirmed that there is no longer a need for us to retain it.

8. Cookies used to process your Personal Data

8.1 What are Cookies

A cookie is a small file (usually less than 1 kB), typically of letters and numbers, downloaded on to a device such as a computer or mobile device when you access our websites. For more information about cookies or local storage, including how to see what cookies have been set and how to manage, block and delete them, see: https://www.allaboutcookies.org/.

8.2 How to control cookies

You can control and/or delete cookies as you wish –for details, see http://www.allaboutcookies.org/. You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed. If you do this, however, you may have to manually adjust some preferences every time you visit a site and some services and functionalities may not work.

These cookie settings are usually found in the ‘options’ or ‘preferences’ menu of your internet browser. In order to understand these settings, the following links may be helpful. Otherwise you should use the ‘Help’ option in your internet browser for more details.

More information about how to manage cookies preferences on the most popular browsers can be found here:

• Edge
• Internet Explorer
• Chrome
• Firefox
• Safari
• Opera

To opt-out of third-parties collecting any data regarding your interaction on our website, please refer to their websites for further information.

8.3 Types of Cookies We Use

PAYSTRAX may use the following cookies:

Types of Cookies

1. First and third-party cookies: whether a cookie is ‘first’ or ‘third’ party refers to the domain placing the cookie. First-party cookies are those set by a website that is being visited by the user at the time.

2. Third-party cookies are cookies that are set by a domain other than that of the website being visited by the user. If a user visits a website and another entity sets a cookie through that website, this would be a third-party cookie.

Duration of Cookies

Session cookies –these cookies allow website operators to link the actions of a user during a browser session. A browser session starts when a user opens the browser window and finishes when they close the browser window. Session cookies are created temporarily. Once you close the browser, all session cookies are deleted.

Persistent cookies –these cookies remain on a user’s device for the period of time specified in the cookie. They are activated each time that the user visits the website that created that particular cookie.