1. Introduction
VG Pays ("VG Pays", "we", "us", or "our") operates the PayId payment orchestration platform, this website, our developer documentation, and related services (together, the "Services"). This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, apply to become a merchant, use our Services, or pay a merchant that uses our platform.
By using our website or Services, you acknowledge the practices described in this policy.
2. Our role
Depending on the context, we act in different roles under data protection law:
- As a controller for data about website visitors, prospective and onboarded merchants, and their representatives, and for data we must process for our own legal, regulatory, fraud prevention, and risk management obligations.
- As a processor or service provider for data about a merchant's customers (cardholders and payers) that we process on the merchant's instructions to complete payment transactions. In that case, the merchant's own privacy policy also applies.
3. Information we collect
Information you give us
- Contact and business details: name, job title, work email, phone number, company name, website, business address, and registration details.
- Onboarding and due diligence information: identity documents of directors, owners, and authorized signatories; ownership structure; bank account details; business model, processing history, and expected volumes, as required for know-your-customer (KYC), know-your-business (KYB), and anti-money laundering (AML) checks.
- Communications: emails, support requests, and any other information you choose to send us.
Information we collect when payments are processed
- Transaction data: amount, currency, date and time, order reference, merchant details, and transaction status.
- Payment instrument data: card number, expiry date, cardholder name, and other payment method details. Card data is handled in line with the Payment Card Industry Data Security Standard (PCI DSS) and is tokenized where possible.
- Payer data: name, email address, billing address, and phone number, where the merchant provides them.
- Device and risk data: IP address, device and browser information, and other signals used for fraud screening and authentication.
Information collected automatically on our website
- IP address, browser type, operating system, referring pages, pages viewed, and the date and time of your visit.
- Information from cookies and similar technologies, described in section 9.
Information from third parties
We may receive information from acquiring banks, card schemes, alternative payment method providers, identity verification and credit reference agencies, fraud prevention services, sanctions screening providers, and public registers.
4. How we use your information
- To provide, operate, and maintain the Services, including authorizing, routing, capturing, refunding, and settling transactions.
- To evaluate merchant applications and carry out KYC, KYB, AML, sanctions, and underwriting checks.
- To detect, prevent, and investigate fraud, chargebacks, security incidents, and other prohibited activity.
- To meet our legal, regulatory, and card scheme obligations, including record keeping and reporting to authorities.
- To communicate with you about your account, integration, service updates, and support requests.
- To improve and secure our website, platform, and documentation.
- To send you information about our Services where permitted by law. You can opt out at any time.
5. Legal bases for processing
Where data protection law requires a legal basis, we rely on one or more of the following:
- Contract: processing needed to provide the Services or to take steps before entering into a contract with you.
- Legal obligation: processing required by financial services, AML, tax, and other applicable laws.
- Legitimate interests: preventing fraud, securing our platform, improving our Services, and managing our business, where these interests aren't overridden by your rights.
- Consent: for example, for non-essential cookies or certain marketing. You can withdraw consent at any time.
6. How we share information
We don't sell personal data. We share it only as needed to provide the Services and meet our obligations, with:
- Payment partners: acquiring banks, card schemes, payment networks, and alternative payment method providers that process transactions.
- Merchants: the merchant you are paying receives details of your transaction.
- Service providers: hosting, data storage, identity verification, fraud screening, communications, and professional advisers, under contracts that require them to protect the data.
- Authorities: regulators, law enforcement, courts, and tax authorities where required by law or to protect rights and safety.
- Corporate transactions: a buyer or successor in the event of a merger, acquisition, or sale of assets, subject to this policy.
7. International transfers
Payments often involve parties in several countries, so your data may be transferred to and processed in countries other than your own. Where we do this, we use appropriate safeguards required by applicable law, such as contractual protections with recipients.
8. Data retention
We keep personal data only for as long as needed for the purposes in this policy. Transaction and due diligence records are generally retained for the period required by financial services, AML, tax, and card scheme rules, which is often at least five years after the end of the business relationship. When data is no longer needed, we delete or anonymize it.
9. Cookies
Our website uses cookies and similar technologies. Essential cookies are needed for the site to work and for security. With your consent where required, we may also use analytics cookies to understand how the site is used. You can control cookies through your browser settings. Blocking some cookies may affect how the site works.
10. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, tokenization of card data, access controls, network monitoring, and PCI DSS-aligned processes. Merchants authenticate API requests with signed hashes, and merchant passwords are never sent in request bodies. No system is completely secure, so we can't guarantee absolute security, but we work to protect your information and respond to incidents promptly.
11. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy.
- Correct inaccurate or incomplete data.
- Ask us to delete your data, subject to our legal retention obligations.
- Restrict or object to certain processing, including direct marketing.
- Receive your data in a portable format.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with your local data protection authority.
If we process your data as a processor for a merchant, we may refer your request to that merchant. To exercise your rights, email marketsyncfzco@protonmail.com. We may need to verify your identity first.
12. Children's privacy
Our Services are intended for businesses and are not directed at children. We don't knowingly collect personal data from children through our website.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. Where changes are significant, we will take reasonable steps to let you know.
14. Contact us
If you have questions about this Privacy Policy or how we handle personal data, contact us at:
VG Pays
[Registered company name and address]
Email: marketsyncfzco@protonmail.com