Privacy Notice of ALTPAY

This Privacy Notice describes the rules according to which AltPay LTD processes the personal data of any person/legal entity using any services offered by ALTPAY.

1. GLOSSARY

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
ALTPAY: AltPay LTD (further ALTPAY or we);
Card: payment card issued by ALTPAY;
Payment Account: payment account at ALTPAY;
Payment Account Terms: regulated under General Terms and Conditions available on the www.altpay.uk website;
Policy: this Privacy Notice;
Person (You): any person using any services offered by ALTPAY (including user);
User: a person or an entity, who uses the Services, agreed to the Terms of Use and is a holder of an Account;
Data controller of personal data: AltPay LTD, registry code 11347482, address Suite 5, 3rd Floor, Sovereign House, 1 Albert Place, London, England, N3 1QB (incl data controllers authorized by ALTPAY);
Data Protection Officer- The responsible person appointed by the ALTPAY.

2. THE PRINCIPLES OF PROCESSING PERSONAL DATA

ALTPAY principles while processing Person’s/ ALTPAY user personal data:

2.1. ALTPAY processes personal data only in accordance with this Policy and applicable laws;

2.2. ALTPAY collects and processes personal data only for the purposes stipulated in this Policy;

2.3. ALTPAY makes sure that the personal data which ALTPAY collects and processes is:

2.3.1. adequate, relevant and limited to what is necessary for the purposes stipulated in this Policy;
2.3.2. accurate and up to date and stored only for such period as is necessary for the purposes stipulated in this Policy.

2.4. ALTPAY applies appropriate technological and organizational measures to ensure the availability, authenticity, integrity and confidentiality of personal data.

3. THE PERSONAL DATA WE COLLECT

The personal data, which ALTPAY collects and processes includes the following:

3.1. Personal Details – Your personal details, including:

• Full name;
• Date of birth;
• Personal identification code;
• Citizenship;
• Residency;
• Residential address;
• e-mail address;
• mobile phone number;
• occupation, photo of person, which is provided to ALTPAY for the purpose of identifying the person.

3.2. Identification Document Data – Data retrieved from Person’s identification document which Person has forwarded to ALTPAY, including the document number, issue date, expiry date and issuing entity, photo of Person’s identification document, which Person has forwarded ALTPAY for the purpose of identifying itself.

3.3. Due Diligence Data – Data which ALTPAY collects for the purpose of conducting customer due diligence under applicable anti-money laundering laws from Person and appropriate databases, including information about:

• whether Person have been affiliated with money laundering or terrorist financing;
• whether Person have been prosecuted for a crime;
• whether Person have been subject to any international financial sanctions;
• whether Person have (been) held a public office or
• whether the Person is/ have been a close relative or associate of someone who has held PO.

3.4. Transaction Data – Details of any transfers made to and from Person’s Payment Account, including the name and account number of the payer and the payee, the date, time, currency, amount and explanation of the transaction.

3.5. Card Data – Person’s Card data, including:

• Card number of the Person;
• the name printed on Person’s Card;
• the expiry date of Person’s Card;

3.6. Device Data – Information regarding the device on which Person is using the ALTPAY services, including the device’s model, name or any other identifier and the IP address of the network from which Person is using the ALTPAY IBA (Internet bank of AltPay)

3.7. Preference Data – Person’s preferences in the ALTPAY app/i-ALTPAY (language preferences, transaction limits, etc).

3.8. Contact Data – The contacts list on Person’s device.

3.9. Customer Support Data – Communication between Person and ALTPAY’s customer support (e-mails and calls).

3.10. Usage Data – Data about Person interaction with the IBA (e.g. information about which features of the IBA does Person use, which features do not use, etc).

3.11. Other Data – Other data not listed in this Section 3, which is generated as a result of using the ALTPAY Services (e.g. gif-images added to payments, comments added to claims, etc).

4. GROUNDS FOR COLLECTING AND PROCESSING PERSONAL DATA

ALTPAY collects and processes personal data for the following purposes:

4.1. Compliance purposes (GDPR art 6 ( 1 ) ( a )) – to perform an obligation under applicable laws, including the obligation to:

• avoid money laundering, terrorist financing and fraud;
• ensure the fulfilment of international financial sanctions;
• ensure the security of ALTPAY’s payment services;
• comply with the lawful inquiries and orders of:
• public authorities, including foreign public authorities with whom ALTPAY is obliged to cooperate under applicable laws;
• other financial institutions with whom ALTPAY is obliged to cooperate under applicable laws.

4.2. Contractual purposes (GDPR art 6(1)(b)) – to perform or enter into a contract between Person and ALTPAY.

4.3. Fraud monitoring purposes (GDPR art 6(1) (f)) – to monitor and decrease payment fraud.

4.4. Analytical purposes (GDPR art 6(1)(f)) – to gain a better understanding of the preferences of ALTPAY’s customers and how do customers interact with the ALTPAY.
Note that upon processing personal data for Analytical Purposes, the data is part of a large mass of data. ALTPAY does not analyze Person’s individual preferences or Person’s individual interaction with the ALTPAY.

4.5. Marketing Purposes (GDPR art 6(1)(a)) – to send marketing e-mails of ALTPAY’s products and services.

ALTPAY does not process personal data for profiling or other automated decision making.

5. PERSON’s CONSENT ON OPERATIONS FOR DATA PROCESSING

ALTPAY needs Person’s consent for processing personal data for the following purposes:

• Marketing purposes;
• Additional Features.

If ALTPAY would want to process personal data for any new purpose, which requires Person’s consent, then ALTPAY will not process personal data for such new purpose, before ALTPAY has received Person’s consent for such processing.

6. CONSENT ON WITHDRAWAL FOR PROCESSING PERSONAL DATA

The consent for the processing of personal data can be withdrawn at any time. Send an email to info@altpay.uk to delete personal data or write message via ALTPAY website https://altpay.uk/contacts.

The withdrawal of Person’s consent does not affect the legality of processing personal data prior to the withdrawal of Person’s consent.

7. LEGISLATIVE RESPONSIBILITY TO DISTRIBUTE THE PERSONAL DATA TO ALTPAY

There is no statutory obligation for Person to provide ALTPAY its personal data. However, there are statutory obligations for ALTPAY to collect personal data. In order for ALTPAY to provide Person its services, ALTPAY needs to collect and process personal data. In case ALTPAY is not able to collect or process personal data, ALTPAY will not able to provide Person its services.

8. OTHER SOURCES FOR COLLECTING PERSONAL DATA

ALTPAY collects Due Diligence Data from sources other than Person itself. Such sources include:

• databases of people affiliated with money laundering or financing terrorism;
• databases of people, who have been accused of a crime;
• databases of people subject to international financial sanctions;
• databases of people who have held a public office, etc.

Some of these databases are publicly available and some of them are not. In addition, ALTPAY uses other public databases for collecting Due Diligence Data.

9. TERMS FOR STORING AND KEEPING OF PERSONAL DATA

ALTPAY stores personal data for the following periods:

9.1. Transaction Data – 7 years after Payment Account is closed. ALTPAY is obliged to store this data for such period under accounting and taxation laws.

9.2. Personal Details, Identification Document Data, Due Diligence Data, Card Data – 5 years after termination of the business relationship with ALTPAY, which, upon the request of the FCA may be extended up to another 5 years. ALTPAY is obliged to store this data for such period under Money Laundering and Terrorist Financing Prevention Act.

9.3. Device Data, Preference Data, Contact Data – Until the closure of Payment Account.

9.4. Customer Support Data, Usage Data – 1 year as of its creation, except for e-mails and chat logs, which are stored at least until the closure of Payment Account. ALTPAY stores this data for such period as within this period the data is still relevant for Analytical Purposes. E-mails and chat logs are necessary for providing customer support until such time when Person is no longer a customer of ALTPAY.

9.5. Other Data – Deleted after closing Payment Account. This data is necessary only for enabling Person the use of the ALTPAY and is not necessary after Payment Account is closed.

After the periods stipulated in this Section ALTPAY will delete personal data

ALTPAY stores personal data on servers/cloud located within the European Economic Area.

10. PERSON RIGHTS IN CONNECTION WITH PERSONAL DATA

In connection with the processing of personal data, person has the following rights:

Right to information – Person has the right to receive the information provided in this Policy. The valid version of this Policy will be available on the https://altpay.uk/ website at any given time.

Right to access – Person has the right to ask ALTPAY to provide Person with a copy of its personal data which ALTPAY processes.

Right to Rectification – Person has the right to ask ALTPAY to rectify Person’s personal data in case the data is incorrect or incomplete.

Right to erasure – Person has the right to ask ALTPAY to erase Person’s personal data, unless ALTPAY is obliged to continue processing personal data under law or under a contract between Person and ALTPAY, or in case ALTPAY has other lawful grounds for the continued processing of Person’s personal data. ALTPAY will, in any case, delete personal data as soon as it no longer has lawful grounds for processing Person’s personal data.

Right to restriction – Person has the right to ask ALTPAY to restrict the processing of Person’s personal data in case the data is incorrect or incomplete or in case Person’s personal data is processed unlawfully.

Right to data portability- Person has the right to ask ALTPAY to provide Person or, in case it is technically feasible, a third party, personal data, which Person itself has provided ALTPAY and which is processed in accordance with Person consent or a contract between Person and ALTPAY.

Right to object – Person has the right to object to processing personal data in case Person believe that ALTPAY has no lawful grounds for processing Person’s personal data. For any processing conducted in accordance with Person consent, Person can always withdraw its consent.

Right to file complaints – Person has the right to file complaints regarding Processing personal data.

Person can exercise its rights stipulated in this Section 11 by using the respective functionalities of the ALTPAY or sending a respective request to info@altpay.uk.

ALTPAY will make its best efforts to respond to Your application submitted in accordance with this Section 11 within 2 weeks. Under GDPR article 12(3) ALTPAY must respond to Your application within 1 month. In case it is necessary due to the number and complexity of applications filed with ALTPAY, ALTPAY may, under GDPR article 12(3), also respond to Your application within 3 months.

11. PROCESSING PERSONAL DATA REGARDING CHILD ACCOUNT

ALTPAY does not open Child Account as according to ALTPAY Terms and Conditions it can be opened by a person with an active legal capacity of at least 18 years of age.

12. DISTRIBUTION OF PERSONAL DATA

Upon processing personal data, ALTPAY may share elements of Person’s personal data with the following third parties:

• public authorities and other financial institutions whom ALTPAY is obliged to disclose personal data under law;
• server hosts/ cloud service providers who host ALTPAY’s servers/ clouds;
• payment processors and payment network operators who process Person’s transactions;
• identification service providers who help ALTPAY verify Person’s identity and acquire Due Diligence Data;
• card manufacturers who manufacture Person’s Card;
• communication service providers who facilitate e-mails, calls, SMS messages and other communication between Person and ALTPAY;
• couriers who help ALTPAY deliver letters (e.g. letters with Your Card and PIN codes);
• partners, with whom ALTPAY has arranged You a gift, a discount or another special offer;
• other parties involved with the provision of ALTPAY’s services.

The partners listed in Section 12 above may be located within and outside of the European Economic Area but ALTPAY makes sure that the servers on which personal data is stored are, in any case, located within the European Economic Area.

13. SHARING PERSONAL DATA WITH THIRD PARTIES AND SAFEGUARDING MEASURES APPLIED

Upon sharing personal data with third parties, ALTPAY will apply the following safeguards:

• ALTPAY enters into a data processing agreement with the relevant third party;
• ALTPAY makes sure that such third party undertakes to implement appropriate technical and organizational measures ensuring the processing of personal data in accordance with this Policy and applicable laws;
• ALTPAY makes sure that personal data will not be forwarded to any countries which the Commission of the European Union has not recognized as ensuring an adequate level of data protection.

ALTPAY cannot apply the safeguards stipulated in Section 14 above upon sharing personal data with public authorities and other financial institutions whom ALTPAY is obliged to disclose personal data under law.

14. AMENDMENT OF THE PRIVACY POLICY

ALTPAY may unilaterally amend this Policy from time to time. Upon amending this Policy, ALTPAY will notify person about the new Policy by e-mail and/or via the IBA (Internet bank of AltPay). In case the new Policy refers to processing personal data for any new purpose, which requires Person’s consent, then ALTPAY will not process personal data for such new purpose, before it has Your consent for processing Your personal data for such new purpose.

15. INQUIRIES, REQUESTS AND COMPLAINTS

In case You have inquiries, requests or complaints regarding the processing of Your personal data, You may forward them to:

• info@altpay.uk
• https://altpay.uk/contacts

In case You have complaints regarding the processing of Your personal data, You may file them with the Data Protection Inspectorate or the Data Protection Authority of the state in which You have permanent residence.