Privacy Policy

In this policy, “we”, “us” and “our” mean AvantPay.

AvantPay is a payment technology platform. We provide payment acceptance, routing and settlement services to online businesses (“Merchants”) together with licensed partner banks, acquirers, payment providers and cryptocurrency service providers (“Partners”). Our services include payment acceptance and routing between Partners, settlements and payouts to Merchants, refunds and dispute handling, the payment page, API integration, payment links and QR codes, payments in Telegram bots, the merchant dashboard and related support (together, the “Services”).

Our website is https://avantpay.io (the “Website”). The merchant dashboard is available at https://avantpay.io/lk, payers use payment pages at addresses such as https://avantpay.io/link/<id>, and our API documentation is published at https://avantpay.io/developers.

You can contact us about anything in this policy, including data protection matters, at [email protected].

Data protection law, in particular the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018, distinguishes between a controller, which decides why and how personal data is used, and a processor, which handles personal data on behalf of a controller and on its instructions. Our role depends on the activity:

• We are the controller of personal data about Merchant representatives, applicants, dashboard users and Website visitors. We are also a controller where we use payer data for our own purposes, such as meeting anti-money laundering (AML), counter-terrorist financing and sanctions requirements that apply to us or to our Partners, preventing fraud across our platform, dealing with disputes and chargebacks with Partners, and keeping our own financial records.
• We act as a processor for the Merchant where we handle payer data only to deliver the Services to that Merchant and on its instructions, for example showing order details on the payment page, sending payment status notifications to the Merchant's systems or displaying transactions in the Merchant's dashboard.

If you paid a Merchant through AvantPay, the Merchant is responsible for its own use of your data, including any data it collected before directing you to our payment page. Please read the Merchant's privacy notice and contact the Merchant directly with questions about how it uses your data. If you contact us about a matter for which the Merchant is the controller, we will pass your request to the Merchant or tell you how to reach them.

Partners that authorise and settle payments, such as card acquirers and banks, generally act as independent controllers of the data they receive from us and handle it under their own privacy notices.

We process personal data about three main groups of people: Merchant representatives, payers and Website visitors.

Merchant representatives. This group includes directors, owners, beneficial owners, authorised signatories, employees and other individuals who apply for, manage or use a Merchant account. We may process:

• identity and contact details: name, email address, Telegram username, phone number, job title and the company you represent;
• business details: company name and registration details, website or project, description of products and services, expected monthly turnover and other information provided in the application;
• verification data collected for know your customer (KYC) and know your business (KYB) checks: identity documents, proof of address, date of birth, nationality, ownership and control information, and the results of sanctions, politically exposed person (PEP) and adverse media screening;
• payout details: bank account details or cryptocurrency wallet addresses to which funds due to the Merchant are paid;
• dashboard account data: login email, password (stored only as a cryptographic hash), two-factor authentication settings, one-time login codes sent by email, and team roles and permissions;
• technical and usage data: IP address, browser and device type (user agent), login history, actions performed in the dashboard and API request logs;
• communications: messages you send to our support team by email, Telegram or other channels, and records of our correspondence with you.

Payers. These are people who make a payment to a Merchant using our Services. We may process:

• transaction data: amount, currency, date and time, order number, payment method, payment status, and any refund or chargeback history;
• payment details: card details entered on the payment page (such as card number, expiry date and security code), details needed to complete a payment through SBP (Russia's Faster Payments System) or ERIP (Belarus), or cryptocurrency wallet addresses and transaction hashes. Card details are transmitted in encrypted form to Partners for authorisation and are not stored by us beyond what is needed to process the payment;
• contact details that you enter on the payment page or that the Merchant passes to us, such as a name, email address, phone number or Telegram identifier;
• technical and security data: IP address, approximate location derived from the IP address, browser and device information, and a device identifier generated by our fraud-prevention service;
• information about disputes and refund requests, and any communications with our support team.

Website visitors. If you visit the Website or submit our application form, we may process:

• the information you enter in the application form: name, Telegram contact (username or phone number), website or project, expected monthly turnover and any comment you add;
• technical data such as IP address, browser type, pages requested and the date and time of your visit, which are recorded in server and security logs.

We do not intentionally collect special category data, such as information about health, religious beliefs, political opinions or ethnic origin. However, identity documents provided for verification may incidentally reveal such information, PEP screening may reveal political opinions, and AML screening may reveal information about criminal allegations or convictions. We process this information only where permitted by Articles 9 and 10 of the UK GDPR and Schedule 1 to the Data Protection Act 2018, for example where it is necessary to prevent or detect unlawful acts or to meet regulatory requirements relating to fraud and money laundering, and we keep an appropriate policy document where the law requires one.

We collect most personal data directly from you, for example when you fill in the application form, upload documents, use the dashboard, enter payment details on the payment page or contact our support team.

We also receive personal data from other sources:

• Merchants, which send us order and payer details when they create a payment through the API, a payment link, a QR code or a Telegram bot, and which provide details of their representatives and team members;
• Partners, which tell us the outcome of authorisations, refunds, chargebacks and settlements, and may share fraud and risk signals with us;
• public sources, such as company registers, sanctions lists and other publicly available information that we use for KYC, KYB and AML checks;
• fraud-prevention and security services, which generate device identifiers and risk signals when you use the payment page or the dashboard;
• your device, through strictly necessary cookies and automatically generated logs, as described in the “Cookies and similar technologies” section.

Under the UK GDPR we must have a lawful basis for each use of personal data. The main purposes for which we use personal data, and the lawful bases we rely on, are set out below. Where we act as a processor for a Merchant, the Merchant is responsible for identifying the lawful basis for that processing.

Performance of a contract. Where you are a party to a contract with us, for example as a Payer under the Public Offer or as a sole trader Merchant, we process your personal data where this is necessary to enter into or perform that contract. Where you act for a Merchant that is a company or other organisation, we process your personal data on the basis of our legitimate interests in entering into and performing our contract with that Merchant. In both cases this includes processing to:

• review applications and set up the Merchant account and dashboard access;
• provide the Services, including processing payments, routing them between Partners, handling refunds and disputes, and making payouts;
• authenticate users, manage team access and provide customer support;
• send service messages, such as login codes, security alerts, payment notifications and notices of changes to our terms.

Compliance with legal obligations and related legitimate interests. We process personal data where we need to do so to comply with laws that apply to us. Where a check is required by our Partners, or by laws that apply to them rather than to us, we rely on our legitimate interests in meeting those requirements and preventing financial crime. This includes processing to:

• carry out customer due diligence, identity verification and ongoing monitoring to meet anti-money laundering, counter-terrorist financing and sanctions requirements;
• prevent, detect and investigate financial crime and report suspicious activity to the relevant authorities;
• keep accounting, tax and transaction records;
• respond to lawful requests from courts, regulators, law enforcement agencies and other public authorities;
• deal with data protection requests and complaints.

Legitimate interests. We process personal data where this is necessary for our legitimate interests, or those of Merchants, Partners or payers, and those interests are not overridden by your rights and interests. These include:

• preventing and detecting fraud, abuse and unauthorised payments, including through device fingerprinting and risk scoring;
• protecting the security and integrity of our systems, the dashboard and the payment page, including bot protection on dashboard sign-in and the Website application form;
• assessing and managing commercial and risk exposure, including deciding whether to onboard or continue working with a Merchant and whether to apply reserves or holds;
• responding to enquiries from businesses that submit the application form;
• managing our relationships with Merchants and Partners, and improving the Services and developing new features, using aggregated or de-identified data wherever possible;
• establishing, exercising or defending legal claims, including chargebacks and other disputes;
• running our business efficiently, including keeping internal records and carrying out any reorganisation, merger or sale of all or part of our business.

Consent. We rely on consent only where the law requires it, for example for electronic marketing that is not otherwise permitted under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), or for non-essential cookies if we introduce them in future. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew your consent.

We may send Merchant representatives occasional updates about our Services. Where such a message counts as electronic marketing, we will send it only as permitted by PECR, and every message will include a simple way to opt out.

Where we rely on legitimate interests, you can ask us for more information about how we have balanced our interests against yours. If you do not provide information that we need to meet a legal or contractual requirement, such as verification documents, we may be unable to open or maintain a Merchant account or to process a payment.

To protect payers, Merchants and our platform, we and our Partners use automated tools to screen payments and account activity for signs of fraud, money laundering and other misuse. These tools take into account factors such as the payment amount and frequency, the payment method, IP address and approximate location, device identifiers and patterns seen in previous transactions.

Based on this screening, a payment may be approved, declined, sent for additional authentication (such as 3-D Secure) or held for manual review. Activity on a Merchant account may also be flagged for review, which can lead to a request for further information, a reserve or hold on funds or, in serious cases, suspension of the account.

Where a decision based solely on automated processing has a legal or similarly significant effect on you, we will make it only where the UK GDPR allows, for example where it is necessary for a contract or is authorised by law, and we will put appropriate safeguards in place. You have the right to ask for a person to review the decision, to express your point of view and to contest the decision. Please contact us using the details in the “Contact us” section. If your payment has been declined, you may also wish to contact the Merchant or the bank that issued your card.

Cookies are small text files that a website stores on your device. Similar technologies include local storage and scripts that collect information about your browser and device. Under PECR, we may use these technologies without your consent only where they are strictly necessary to provide a service you have requested; otherwise we need your consent.

We currently use only technologies that are strictly necessary for the Website, the dashboard and the payment page to work securely:

• session cookies, which keep you signed in to the dashboard and maintain your session as you move between pages;
• security tokens, including CSRF (cross-site request forgery) tokens, which protect forms and accounts against malicious requests;
• fraud-prevention technology on the payment page and the dashboard, provided by FingerprintJS, which collects information about your browser and device to generate a device identifier. We use it only to prevent fraud, detect unauthorised access and keep payments secure, and not for advertising;
• bot protection on dashboard sign-in and the Website application form, provided by Google reCAPTCHA, which analyses browser and interaction data to distinguish people from automated programs. Google's use of this data is governed by Google's own privacy policy and terms of service;
• security cookies set by Cloudflare, our content delivery and security provider, which help identify trusted traffic and protect the Website against attacks.

We do not use advertising cookies or third-party analytics cookies. If we decide to introduce non-essential cookies in future, we will update this policy and ask for your consent before setting them.

You can block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Website, the dashboard or the payment page may not work, and you may be unable to sign in or complete a payment.

We share personal data only where this is necessary for the purposes described in this policy. Where a service provider acts as our processor, we require it to protect personal data and to use it only on our instructions. Some recipients, including Partners, Google (for reCAPTCHA) and Telegram, use personal data as independent controllers under their own privacy notices. The recipients are:

• the Merchant you are paying or that you represent, which receives transaction details, payment statuses and related information through the dashboard, the API and notifications;
• Partners (banks, card acquirers, payment providers and cryptocurrency providers) and payment systems (such as card schemes, SBP and ERIP), which need the data to authorise, process, settle, refund and investigate payments and to meet their own legal obligations;
• cloud hosting: Yandex Cloud, which hosts our systems and databases in data centres in Russia;
• content delivery and security: Cloudflare, which delivers the Website, protects it against attacks and relays application notifications to Telegram;
• email delivery: Yandex Cloud Postbox, which sends login codes, notifications and other service emails;
• fraud prevention: FingerprintJS, which provides device identification for fraud prevention and security;
• bot protection: Google, through reCAPTCHA on dashboard sign-in and the Website application form;
• messaging: Telegram, which we use to receive notifications about applications submitted through the Website form and to communicate with applicants and Merchants; payments started in a Merchant's Telegram bot are also subject to Telegram's privacy policy;
• professional advisers, such as lawyers, auditors, accountants and insurers, who are bound by duties of confidentiality;
• public authorities, including law enforcement agencies, regulators, tax authorities and courts, where we are required or permitted by law to disclose information;
• a buyer or successor, if we sell, transfer or reorganise all or part of our business, on the basis that the recipient protects the data to an equivalent standard.

When we act as a Merchant's processor, Yandex Cloud (including Postbox) and Cloudflare act as our sub-processors.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

We are based in the United Kingdom, but many of the organisations we work with are located elsewhere. In particular, our systems are hosted by Yandex Cloud in data centres in Russia; Partners may be located outside the UK, including in Russia and Belarus where local payment methods such as SBP and ERIP are used; and service providers such as Cloudflare, Google, FingerprintJS and Telegram may process data in the United States, the European Economic Area and other countries.

Some of these countries are not covered by UK adequacy regulations, which means that UK law does not regard them as providing an equivalent level of protection for personal data. Where we transfer personal data outside the UK, we make sure that the transfer is lawful by relying on one or more of the following:

• adequacy regulations made by the UK Government, where they cover the destination country or, for the United States, the recipient organisation certified under the UK Extension to the EU-US Data Privacy Framework;
• the International Data Transfer Agreement issued by the Information Commissioner's Office, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any supplementary measures we consider necessary, such as encryption;
• in limited cases, the exceptions permitted by Article 49 of the UK GDPR, for example where an occasional transfer is necessary to perform a contract with you or a contract made in your interest, or to establish, exercise or defend legal claims.

You can contact us for more information about the safeguards that apply to a particular transfer.

We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, regulatory, accounting and reporting requirements. When deciding how long to keep data, we consider its nature and sensitivity, why we hold it, the potential risk of harm from unauthorised use and our legal obligations.

As a general guide:

• transaction records, KYC and KYB documents and AML records are kept for at least five years after the end of our business relationship with the Merchant or after the relevant transaction, in line with anti-money laundering record-keeping standards such as those in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and for longer where the law requires it or the records are needed for an ongoing investigation, dispute or legal claim;
• accounting and tax records are kept for the periods required by applicable tax and company law;
• card details entered on the payment page are not stored by us beyond what is needed to process the payment;
• Merchant account and dashboard data are kept while the account is open and afterwards for as long as needed to meet the obligations described above;
• application form data from businesses that do not become Merchants is kept only for as long as needed to deal with the enquiry and any follow-up;
• security and technical logs are kept for a limited period needed to protect our systems and investigate incidents, unless they are required for a specific investigation.

When we no longer need personal data, we delete it or anonymise it so that it can no longer be linked to you.

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, access, alteration and disclosure. These measures include:

• encryption of data in transit and encrypted transmission of card details to Partners;
• storing passwords only as cryptographic hashes, and protecting dashboard access with two-factor authentication and one-time login codes;
• role-based access controls, so that Merchant team members and our staff can access only the data they need;
• logging and monitoring of access and activity, together with bot protection and fraud-prevention tools;
• protection against network attacks through our content delivery and security provider;
• confidentiality obligations for our staff and contractual data protection commitments from our service providers.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. You can help by keeping your dashboard login details and API keys confidential, enabling two-factor authentication and telling us immediately at [email protected] if you suspect unauthorised access to your account.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within the time required by law and, where the risk is high, we will also inform you without undue delay.

Under the UK GDPR you have the following rights in relation to your personal data. Some rights apply only in certain circumstances and are subject to legal exemptions, for example where we must keep data to comply with anti-money laundering laws.

• Right of access: to ask whether we hold personal data about you and to receive a copy of it, together with information about how we use it.
• Right to rectification: to ask us to correct inaccurate data and to complete incomplete data.
• Right to erasure: to ask us to delete your data where, for example, we no longer need it, or you have withdrawn your consent and we have no other lawful basis for keeping it.
• Right to restriction: to ask us to limit how we use your data, for example while we check its accuracy or consider an objection you have made.
• Right to data portability: to receive data you have provided to us in a structured, commonly used and machine-readable format, or to ask us to send it to another organisation, where we process it by automated means on the basis of your consent or a contract.
• Right to object: to object to processing based on our legitimate interests on grounds relating to your particular situation, and to object at any time to the use of your data for direct marketing.
• Rights relating to automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, except where the law allows, and to ask for such a decision to be reviewed by a person.
• Right to withdraw consent: where we rely on your consent, to withdraw it at any time.

To exercise any of your rights, email [email protected] with the subject “Data protection request”. We may need to ask for information to confirm your identity before we respond, so that we do not disclose personal data to the wrong person.

We will respond within one month of receiving your request. If your request is complex or you have made several requests, we may extend this period by up to two further months, and we will tell you if we do so. We do not normally charge a fee, but we may charge a reasonable fee or decline to act on a request that is manifestly unfounded or excessive.

If you are a payer and your request relates to data that we process on behalf of a Merchant, we may refer your request to that Merchant, as it is the controller for that processing, and we will help the Merchant to respond.

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection, at ico.org.uk. If you live or work in another country, you may also be able to complain to the data protection authority in that country.

Our Services are designed for businesses. Merchant accounts may only be opened and used by individuals aged 18 or over acting on behalf of a business, and we do not knowingly collect personal data from children through the Website or the application form.

Payments made through a payment page are also subject to the Merchant's own terms, including any age restrictions that apply to its products or services. If you believe that a child has provided us with personal data in breach of these rules, please contact us and we will take appropriate steps to delete it.

The Website, the payment page and our documentation may contain links to websites and services operated by others, including Merchants' websites, Partners' authentication pages (such as 3-D Secure pages or banking apps used for SBP payments) and Telegram. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy notices.

We may update this policy from time to time to reflect changes in the law, in our Services or in the way we process personal data. The date at the top of this policy shows when it was last updated.

We will publish the updated version on the Website. Where the changes are significant, we will also notify Merchants through the dashboard or by email before the changes take effect.

If you have any questions about this policy or about how we handle personal data, please contact us:

• by email: [email protected] (for requests about your rights, please use the subject line “Data protection request”);
• through the website: https://avantpay.io.