Privacy Policy

At TRAPAY LTD ("TRAPAY", "we", "us", "our"), we respect Your privacy and are committed to handling personal data in a transparent, lawful, and secure manner.

This Privacy Policy explains how we collect, use, store, disclose, and otherwise process personal data when You use:

• our website https://trapay.uk;
• our dashboards, portals, APIs, hosted pages, payment pages, merchant tools, reporting tools, Telegram bot, and related software solutions;
• our support, onboarding, integration, maintenance, technical assistance, analytics, and professional services;

(all together, the "Service").

Please read this Privacy Policy carefully before using the Service.

If You have any questions, concerns, or requests regarding this Privacy Policy or our use of personal data, please contact us at:

info@trapay.uk

This Privacy Policy forms part of the legal framework applicable to the use of the Service together with our Terms of Use and any other applicable policies, notices, or agreements.

We are:

For the purposes of applicable data protection law, TRAPAY will generally act as the controller of personal data described in this Privacy Policy, unless otherwise stated.

In some cases, we may process personal data:

• as an independent controller;
• jointly with another party;
• or as a service provider / processor on behalf of a merchant, client, or partner,

depending on the specific context of the Service.

If needed, You may contact us for more information about our role in relation to a specific processing activity.

TRAPAY is a provider of payment software, technical support, technical maintenance, integrations, analytics, routing/orchestration tools, fraud-prevention tools, reporting tools, and related technology services.

Important clarification

TRAPAY is not:

• a bank;
• a payment institution;
• an electronic money institution;
• an acquiring bank;
• a money remittance provider;
• a card issuer;
• a payment service provider.

TRAPAY does not itself:

• process payments;
• settle funds;
• hold customer funds;
• receive payer funds in its own name;
• transfer end-customer funds.

Payments, settlements, authorizations, chargeback processing, refunds, reserves, and related financial transaction functions are carried out by third-party payment providers, processors, acquirers, banks, and financial partners integrated through or connected to the TRAPAY software environment.

This Privacy Policy reflects that role.

By using the Service, You acknowledge that:

• You have read this Privacy Policy;
• You understand that personal data may be processed in connection with the Service;
• You will provide accurate and up-to-date information where required.

Our responsibility is to provide You with clear and up-to-date information on how we process personal data and to process personal data in accordance with applicable law.

If You use the Service on behalf of a business, merchant, or another person, You are responsible for ensuring that You are authorized to do so.

We may collect personal data when:

• You visit our website;
• You register, apply for, access, or use the Service;
• You contact us by email, forms, support channels, chatbot, Telegram bot, or other communication channels;
• You request onboarding, integration, technical support, or commercial information;
• You use our dashboards, APIs, hosted payment pages, reports, or analytics tools;
• You interact with our documentation, demos, test environments, or merchant tools;
• You participate in due diligence, compliance, fraud review, or support processes;
• data is provided to us by merchants, providers, partners, service providers, public sources, or compliance vendors;
• we generate technical, operational, or analytical data through Your use of the Service.

Depending on how You use the Service and the context of our relationship, we may collect and process the following categories of personal data.

5.1 Identification and contact data

• full name;
• business name;
• job title;
• email address;
• phone number;
• billing details;
• registered address or business address;
• communication details.

5.2 Merchant and business relationship data

• merchant onboarding information;
• corporate structure details;
• beneficial ownership information;
• associated websites or domains;
• provider-related information;
• business activity descriptions;
• documents and explanations provided during onboarding or support.

5.3 Transaction-related and reporting data

Where generated, submitted, or made available through the Service:

• transaction reference IDs;
• payment IDs;
• order IDs;
• gateway/provider information;
• payment method type;
• payment status;
• amount and currency;
• payer email, payer name, payer phone, payer country;
• technical metadata relating to transactions;
• refund and chargeback-related records;
• payment report outputs.

5.4 Technical and device data

• IP address;
• browser type and version;
• operating system;
• device type;
• session data;
• time zone;
• login information;
• API request metadata;
• SDK version or technical integration data;
• logs, performance data, and troubleshooting data.

5.5 Fraud, risk, and security data

Where relevant to the Service:

• device and browser signals;
• fingerprint-related identifiers;
• BIN-related information;
• IP geolocation;
• anomaly and scoring outputs;
• security event data;
• fraud-related flags;
• technical indicators of suspicious or abnormal activity.

5.6 Support and communication data

• support tickets;
• email correspondence;
• call or meeting notes;
• onboarding communications;
• chatbot or Telegram bot interactions;
• documents, screenshots, logs, or files shared for support purposes.

5.7 Compliance and due diligence data

Where required for business verification, provider onboarding, fraud review, or compliance:

• identification documents;
• business registration documents;
• proof of address;
• source of funds or source of wealth information;
• sanctions, PEP, or adverse media screening results;
• beneficial ownership data;
• tax or corporate verification information;
• compliance notes and internal review outputs.

5.8 Marketing and business development data

• business contact information;
• employer/company details;
• event participation data;
• professional profile information;
• communication preferences;
• website engagement data.

5.9 Cookies and similar technologies

We may collect information through cookies, analytics tools, and similar technologies. Where applicable, please also refer to our Cookie Policy.

We may process personal data for the following purposes.

6.1 To provide the Service

Including:

• account setup;
• user authentication;
• dashboard access;
• technical operation of software features;
• integration support;
• API functionality;
• hosted page functionality;
• reporting tools;
• payment routing/orchestration software functionality.

6.2 To provide support, maintenance, and technical assistance

Including:

• troubleshooting;
• issue resolution;
• onboarding support;
• product support;
• service administration;
• training and guidance.

6.3 To provide analytics, reporting, and operational tools

Including:

• generation of merchant reports;
• transaction-related reporting;
• internal and customer-facing analytics;
• performance measurement;
• usage insights;
• product monitoring.

6.4 To detect, prevent, investigate, and mitigate fraud, abuse, security incidents, and misuse

Including:

• anomaly detection;
• anti-fraud scoring;
• identity and technical consistency checks;
• monitoring unusual or prohibited activity;
• protecting the integrity and security of the Service.

6.5 To carry out compliance, business verification, due diligence, and risk review

Including:

• merchant onboarding checks;
• provider-related due diligence;
• KYB/KYC-related reviews where relevant to the Service;
• compliance with legal obligations;
• audit and control activities.

6.6 To communicate with You

Including:

• service updates;
• onboarding communications;
• billing and commercial communications;
• support responses;
• product notices;
• security alerts;
• legal notices.

6.7 To manage business relationships

Including:

• commercial discussions;
• contract management;
• invoicing;
• billing;
• account administration;
• service renewals;
• partner management.

6.8 To improve the Service

Including:

• testing;
• debugging;
• feature development;
• product research;
• system performance analysis;
• internal analytics;
• quality assurance.

6.9 To comply with legal and regulatory obligations

Including:

• responding to lawful requests;
• legal claims;
• investigations;
• record keeping;
• data retention obligations;
• enforcement of our rights.

6.10 For marketing and business development

Where lawful and appropriate, we may process business contact data to:

• provide product information;
• respond to partnership inquiries;
• send updates about our services;
• conduct B2B marketing communications.

Depending on the situation, we may rely on one or more of the following legal bases:

• performance of a contract or steps prior to entering into a contract;
• legitimate interests, including operating, securing, supporting, improving, and developing the Service, and managing business relationships;
• compliance with legal obligations;
• consent, where required;
• establishment, exercise, or defence of legal claims.

Where we rely on legitimate interests, such interests may include:

• operating and improving our software and infrastructure;
• fraud prevention and security;
• support and customer relationship management;
• internal analytics and product performance;
• business development and commercial communications in a B2B context;
• enforcing our rights and protecting our business.

Where consent is used, You may withdraw it at any time, although this will not affect processing already carried out lawfully before withdrawal.

We may receive personal data from:

• You directly;
• Your employer or organization;
• merchants or clients using the Service;
• providers, processors, acquirers, banks, or integration partners;
• compliance service providers;
• fraud-prevention, screening, and verification vendors;
• public registries and public sources;
• event organizers, business directories, and professional networks;
• our own systems, logs, analytics, or technical environments;
• support and communication channels.

To operate the Service effectively, we may share personal data where necessary with:

9.1 Service providers and infrastructure providers

Including providers of:

• hosting;
• cloud infrastructure;
• analytics;
• communications;
• ticketing;
• collaboration tools;
• fraud and risk tools;
• screening tools;
• storage;
• logging;
• monitoring;
• development and testing;
• professional services.

9.2 Payment providers and financial partners

Where relevant to integrations and merchant services, with:

• processors;
• acquirers;
• banks;
• payment providers;
• card or payment scheme-related counterparties;
• settlement or routing partners.

9.3 Group companies or affiliates

Where relevant to administration, support, security, product development, or business operations.

9.4 Professional advisers

Including:

• lawyers;
• accountants;
• auditors;
• consultants;
• insurers.

9.5 Authorities and official bodies

Where legally required or appropriate, with:

• courts;
• law enforcement;
• regulators;
• supervisory authorities;
• ombudsmen;
• tax authorities;
• other competent public bodies.

9.6 Other parties chosen or authorized by You

Where You instruct us or where sharing is necessary to provide the Service requested by You.

We do not sell personal data as such.

Where personal data is transferred outside the UK, EU, or EEA, we will take steps to ensure that appropriate safeguards are in place, as required by applicable law.

These safeguards may include, where applicable:

• adequacy decisions;
• standard contractual clauses;
• the UK International Data Transfer Addendum;
• other lawful transfer mechanisms.

Because TRAPAY may use international infrastructure, providers, vendors, and service partners, some data may be processed in countries outside Your jurisdiction.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including for:

• providing the Service;
• fulfilling contractual obligations;
• fraud prevention and security;
• legal, tax, audit, and compliance requirements;
• dispute resolution;
• enforcement of rights;
• internal record-keeping.

Retention periods may vary depending on:

• the nature of the data;
• the Service used;
• the legal or contractual context;
• provider requirements;
• audit and compliance obligations;
• risk and dispute considerations.

When personal data is no longer required, we will delete, anonymize, or securely archive it in accordance with applicable law and internal retention practices.

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, unlawful processing, accidental loss, destruction, alteration, or disclosure.

These measures may include:

• access controls;
• authentication controls;
• system monitoring;
• logging;
• role-based permissions;
• vendor controls;
• secure infrastructure practices;
• internal review procedures.

However, no system can be guaranteed to be completely secure, and You should also take appropriate steps to protect Your own credentials, devices, and communications.

Subject to applicable law, You may have the right to:

• access personal data we hold about You;
• request correction of inaccurate data;
• request erasure of certain data;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability of certain data;
• lodge a complaint with a supervisory authority.

These rights are not absolute and may depend on the legal basis and circumstances of the processing.

If You would like to exercise any of Your rights, please contact us at:

info@trapay.uk

We may ask for information necessary to verify Your identity before responding.

If You have any concerns about how we process personal data, please contact us first at:

info@trapay.uk

We will do our best to review and address Your request.

If You believe that Your rights have been infringed, You may also lodge a complaint with the relevant data protection supervisory authority.

In some cases, other parties may independently control personal data processed in connection with the Service, for example:

• merchants using TRAPAY software;
• payment providers, processors, acquirers, or banks;
• external fraud or compliance providers;
• service platforms chosen by the user or merchant.

Where another party acts as an independent controller, its own privacy policy and legal terms may also apply.

TRAPAY is not responsible for how such third parties process personal data once they receive it as independent controllers.

The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from children in connection with the Service.

If You believe that personal data relating to a child has been provided to us inappropriately, please contact us.

Where permitted by law, we may send You service-related or business-related communications.

Where we send marketing communications, You may opt out at any time by using the unsubscribe option where available or by contacting us.

Please note that even if You opt out of marketing messages, we may still send You necessary service, legal, operational, support, billing, or security-related communications.

We may update this Privacy Policy from time to time to reflect changes in:

• applicable laws or regulations;
• our business operations;
• our software, services, or integrations;
• our security, risk, or compliance practices.

The most current version will be published on our website.

We encourage You to review this page periodically.

Unless otherwise stated, changes become effective when published.

If You have any questions, comments, complaints, or requests regarding this Privacy Policy or the way we process personal data, please contact: