Privacy Policy

FluxPay Technologies Ltd. ("FluxPay," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our payment processing services, website, dashboard, APIs, and related technologies (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

For the purposes of applicable data protection laws, including the GDPR, FluxPay Technologies Ltd. is the data controller responsible for your personal data.

1.1 Information You Provide Directly

We collect information you voluntarily provide when using our Services, including:

1.2 Information Collected Automatically

When you use our Services, we automatically collect certain information, including:

• Device Information: IP address, browser type, operating system, device identifiers, screen resolution
• Usage Data: Pages visited, features used, time spent on pages, click patterns, search queries
• Transaction Data: Payment amounts, timestamps, merchant and customer identifiers, transaction status
• Log Data: Access times, error logs, referring URLs, API calls
• Location Data: General geographic location based on IP address

1.3 Information from Third Parties

We may receive information about you from third parties, including:

• Identity Verification Services: Results of background checks and identity verification
• Credit Bureaus: Credit reports and business credit information
• Payment Networks: Transaction data from Visa, Mastercard, and other card networks
• Business Partners: Referral information from partners and affiliates
• Public Sources: Publicly available information from business registries and databases

We use the information we collect for the following purposes:

2.1 Service Delivery

• Process payment transactions and settlements
• Provide access to merchant dashboard and reporting tools
• Manage your account and provide customer support
• Send transactional notifications and service updates

2.2 Security and Fraud Prevention

• Detect, prevent, and investigate fraudulent transactions
• Verify your identity and conduct due diligence
• Monitor for suspicious activity and security threats
• Comply with anti-money laundering (AML) requirements

2.3 Legal Compliance

• Comply with applicable laws, regulations, and legal processes
• Respond to requests from regulatory authorities
• Enforce our Terms of Service and other agreements
• Protect our rights, property, and safety

2.4 Service Improvement

• Analyze usage patterns to improve our Services
• Develop new features and products
• Conduct research and analytics
• Personalize your experience

2.5 Marketing Communications

• Send promotional materials and newsletters (with your consent)
• Inform you about new features, products, and services
• Conduct surveys and gather feedback

We may share your information with the following categories of recipients:

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment processors and acquiring banks
• Cloud hosting and infrastructure providers
• Identity verification and fraud prevention services
• Customer support and communication platforms
• Analytics and monitoring services

3.2 Payment Networks and Financial Institutions

To process transactions, we share necessary information with payment card networks (Visa, Mastercard, etc.), banks, and other financial institutions involved in the payment chain.

3.3 Legal and Regulatory Authorities

We may disclose your information when required by law, regulation, legal process, or governmental request, including:

• Responding to subpoenas, court orders, or other legal processes
• Cooperating with law enforcement investigations
• Reporting suspicious activity to financial intelligence units
• Complying with regulatory examinations and audits

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

3.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

FluxPay implements comprehensive security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

4.1 Security Certifications

• PCI DSS Level 1: The highest level of payment card industry data security certification
• SOC 2 Type II: Independent verification of our security controls
• ISO 27001: Information security management certification

4.2 Technical Safeguards

• 256-bit TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Multi-factor authentication for account access
• Regular security assessments and penetration testing
• Intrusion detection and prevention systems
• 24/7 security monitoring and incident response

4.3 Organizational Measures

• Strict access controls based on least privilege principle
• Regular employee security training and awareness programs
• Background checks for employees with data access
• Documented security policies and procedures
• Incident response and breach notification procedures

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements.

5.1 Retention Periods

5.2 Data Deletion

Upon account termination or upon your request (subject to legal retention requirements), we will delete or anonymize your personal information within 90 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes.

Depending on your location and applicable laws, you may have the following rights regarding your personal information:

6.1 GDPR Rights (EEA Residents)

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with a supervisory authority

6.2 CCPA Rights (California Residents)

• Right to Know: Request information about data collection and sharing
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices

6.3 Exercising Your Rights

To exercise any of these rights, please contact us using the information provided at the end of this policy. We will respond to your request within 30 days (or the timeframe required by applicable law). We may need to verify your identity before processing your request.

We use cookies and similar tracking technologies to collect information about your browsing activities and to provide and improve our Services.

7.1 Types of Cookies We Use

7.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Services. Most browsers allow you to:

• View and delete existing cookies
• Block all cookies or third-party cookies
• Set preferences for certain websites
• Receive alerts when cookies are being set

FluxPay operates globally and may transfer your personal information to countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

8.1 Transfer Safeguards

When we transfer personal data internationally, we implement appropriate safeguards including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with all service providers
• Adequacy decisions where applicable
• Binding Corporate Rules for intra-group transfers

8.2 Data Storage Locations

Primary data processing occurs in secure data centers located in the United States and European Union. We use geographically distributed infrastructure to ensure reliability and compliance with regional data residency requirements where applicable.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email or through the Services
• Provide at least 30 days notice before material changes take effect

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.