4Pay Privacy Policy

1.1. 4Pay IT Solutions LTD (hereinafter (“4Pay”, “we”, “our”, “us”) values your privacy and is committed to protecting it in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). This Privacy Policy aims to inform you about how 4Pay processes personal data strictly in its role as a data processor, acting solely on the documented instructions of its business customers (data controllers) who use our services.

1.2. This Privacy Policy outlines our current practices and commitment to data protection and privacy. We strive to collect and process only the data that is strictly necessary for our interactions with (prospective) customers, (future) partners, and users or visitors of our websites and online resources, in order to provide services and/or information for specific and legitimate purposes.

1.3. 4Pay is dedicated to safeguarding the confidentiality and privacy of the information in its possession and is committed to the proper use and protection of personal data, ensuring transparency and respect for individual rights in accordance with applicable data protection legislation (“data protection law”), including EU Regulation 2016/679 (GDPR), where applicable.

1.4. Our Privacy Policy is available in its latest version on the homepage of our website: http://krionyx.com. We encourage you to review it carefully, as it explains how we collect, use, share, and protect the personal data we obtain.

2.1. This Policy should be read together and in conjunction with the relevant Terms of the service provided by 4Pay and applies also to use of our website and online systems pursuant to the relevant Terms. 4Pay in this Privacy Policy refers to 4Pay business, that is responsible for processing personal data exclusively as a processor, acting only under the instructions of the relevant data controller (our business customer).

2.2. This Privacy Policy applies to personal data processed by 4Pay solely in its capacity as a data processor and as described in this Privacy policy. It contains information on:

The personal data we collect;

How we use personal data;

With whom personal data might be shared, and

What rights are afforded.

2.3. This Policy is addressed to natural persons (“data subjects”) in the context of relationships that arise between 4Pay and its Customers, where natural persons:

Are Directors, signatories, representatives, shareholders, beneficial owners, secretaries, officers, employees of legal entities or are Individuals who are current or potential/applicant or former Customers;

Represent a legal entity/Customer, have applied to 4Pay for a service/product offered by 4Pay, are applicable users of a 4Pay service/product, website or online system.

Are end users whose personal data is processed by 4Pay solely on behalf of our business customers (controllers) when such end users use services of those customers (for example, initiating payments from their bank accounts).

2.4. In this Policy, “Personal Data” (also, “personal information”, “information”, “data”) refers to information that identifies you or may identify you (e.g. your name, address, identification number). “Processing” of Personal Data refers to actions such as collecting, handling, storing and protecting personal data.

2.5. Some links on 4Pay websites may contain links or lead/originate to/from non-4Pay websites or areas with their own data protection policies, which may differ from our Privacy Policy. Please ensure that the relevant policies of other entities are acceptable to you prior to using other sites or areas. 4Pay does not accept any responsibility or liability for third party websites. Additionally, if you are not a data subject to whom this Policy is addressed, please refer to the privacy policy of the relevant data controller entity of your personal data to learn more about how the entity processes it. 4Pay may be involved in your data processing as the processor, as in the cases referred to in this Privacy Policy.

2.6. 4Pay maintains an internal Record of Processing Activities (ROPA) documenting all categories of personal data processed, purposes, retention periods, and recipients, as required under GDPR Article 30.

3.1. The establishment and legality of contractual relations and provision of services between 4Pay and its Customers is dependent on provision of the information requested by 4Pay, which includes personal data of data subjects. It is an obligation to provide personal data to us:

– Under our legal obligations. Provision of personal data may be required under legal obligations applicable to our Customers (controllers). Where such obligations apply (e.g. AML, fraud prevention), 4Pay processes personal data only on behalf of and under the documented instructions of the controller. 4Pay itself does not determine the legal basis for such processing;

– For contractual purposes. Establishment of business relations for provision of services, execution of transactions and for the performance of contractual obligations between both parties (4Pay and its Customers) requires provision of certain personal data;

– Our legitimate interests. Based on legitimate interests identified by the relevant controller (e.g. ensuring security, fraud prevention), 4Pay may process data under the controller’s instructions.

3.2. Personal data is requested prior to the establishment and during the contractual relationship. Failure to provide requested data to us may result in us not being able to enter into a contract (establish business relations), or execute an order without requested data, or that we may no longer be able to continue with an existing relationship and provision of services and would have to terminate the relationship.

3.3. 4Pay, as a provider of payment services and payment methods to merchants/providers of services and goods often acts as a processor of personal data in respect to these businesses, who are the responsible parties as controllers for your personal data and its processing. For example:

3.3.1. When 4Pay provides technical processing services for card or online payments, acting strictly as a data processor, it processes only the following categories of personal data received from the controller and necessary for the technical execution and reporting of transactions:

– transaction identifiers (internal order ID, date and time, amount, currency, and status);

– merchant identifier (controller’s company name or code);

– technical connection data (IP address of the Customer’s system, API request/response logs);

– limited contact data of the Customer’s authorized representatives (business email and phone number) used for communication and support.

No cardholder data (such as full card numbers, CVV codes, or customer payment credentials) and no end-user identification documents are stored or otherwise retained by 4Pay.

3.3.2. Client controllers may use the 4Pay software to technically transmit data between their end users and their banks or payment providers for the purpose of initiating payments. 4Pay itself is not a payment initiator and does not transfer any funds; it only provides a secure technical interface.

3.4. These actions are performed only at the request of the controller, that is, the company that directly conducts financial transactions and accounting while receiving services from 4Pay. Accordingly, we recommend that you review the relevant policies of the controller on its website or request them directly if you are a user of a service provided by the controller based on 4Pay software. In such cases, 4Pay acts solely as a data processor and does not determine the purposes of personal data processing. At the same time, 4Pay may define certain technical methods for processing the order.

4.1. Sources of Data

4Pay collects limited personal data from the following sources:

– Submitted data: information provided by the Customer (merchant/controller) during onboarding or in the course of the business relationship (e.g., business contact details of the Customer’s authorised representatives).

– Service-generated data: technical and transactional information generated automatically when the Services are used (e.g., transaction identifiers, merchant identifiers, API request/response logs, IP addresses of the Customer’s systems).

– Public or third-party data: only if required to verify the Customer’s corporate details (e.g., company registry data).

4.2. Scope of Data Processed

Acting strictly as a data processor, 4Pay processes only the following categories of personal data received from the Customer and necessary for the technical execution and reporting of transactions:

– transaction identifiers (internal order ID, date and time, amount, currency, status);

– merchant identifier (controller’s company name or code);

– technical connection data (IP address of the Customer’s system, API request/response logs);

– limited contact data of the Customer’s authorised representatives (business email and phone number) used for communication and support.

4.3. Exclusions

4Pay does not collect or retain:

– full payment card data (PAN, CVV, expiry dates),

– customer payment credentials,

– end-user identity documents, financial statements, income data or other sensitive personal information.

All processing is performed solely under the documented instructions of the Customer (data controller) and only to the extent necessary to provide the Services.

4.4. Your data is processed with the data-minimization principle in mind. We aim to limit the processing of your data and the type of data processed to strictly the data needed for a lawful reason. 4Pay processes only the personal data provided by the Customer (data controller) as necessary for the technical processing of orders and related transactions. 4Pay does not verify the accuracy, completeness, or lawfulness of such data, and the Customer remains solely responsible for ensuring that the personal data it provides to 4Pay is accurate and collected in compliance with applicable Data Protection Law.

Data may be processed by 4Pay under the documented instructions of the controller for purposes such as:

Verify identity (e.g. authentication, fraud-prevention purposes);

Provide the services requested;

Provide delivery channels (e.g. online systems);

Execute requests and act upon instructions;

Perform contractual obligations;

Support crime-prevention measures and/or cooperate with authorities;

Use technology for decision-making processes;

Perform data analytics;

Maintain communication and provide up-to-date information;

Provide ongoing support, handle inquiries, complaints and similar issues;

Provide information in relation to the requested/provided products and services;

Provide information on products/services (including advertising/marketing where permitted by the controller);

Enforce internal procedures and protective measures against fraud, risk and financial crime;

Prepare reports;

Support internal operational and administrative needs (e.g. product development, audit, risk management);

Obtain reports of an online problem (e.g. with our website/online services);

Maintain internal records and general administrative functions;

Produce statistics and analytics for internal purposes and improvement of services and website;

Ensure compliance with legal obligations and the regulatory framework;

Enforce or defend the rights of 4Pay;

Ensure security and business continuity;

Support service-quality management and product improvement.