Privacy Policy

1. Who this policy applies to, and our role

Novupay ("Novupay", "we", "us", "our") is a company incorporated in Costa Rica that provides fiat payment acceptance services to businesses. This policy applies when you use our services, apply for an account, visit our website, or contact us.

Our customers are businesses. This policy covers the personal information of the people we deal with in two different capacities.

Where we decide why and how information is processed, we are the controller. This applies to information about the owners, directors, staff and representatives of merchant businesses, applicants during onboarding, people who contact us, and visitors to novupay.com. It also applies where we use transaction data for our own fraud prevention, risk management, record-keeping and legal compliance purposes.

Where we process information on behalf of a merchant, we act for that merchant. When a merchant uses Novupay to accept payments, we process information about that merchant's own customers in order to complete those payments. The merchant is responsible for its own privacy notice to its customers, for having a lawful basis to collect their data, and for answering their privacy requests in the first instance. We will support a merchant in responding.

This policy is not a substitute for the privacy notice a merchant must give its own customers.

2. Information we collect

Merchant and applicant information

Business name, registered address, trading address, website, incorporation and registration details, business activity and product descriptions, and ownership structure.

Verification information

To meet our legal, financial-crime and card-scheme obligations, we collect identity and business-verification data during onboarding and from time to time afterwards. This can include incorporation documents, corporate records, beneficial-ownership information, government-issued identity documents, proof of residential address, and supporting documents for the individuals connected to a business.

Account and contact information

Names, business email addresses, phone numbers, job titles, and account credentials for the people who apply for, manage or use a Novupay account.

Settlement information

Bank account details, cryptocurrency wallet addresses, and the supporting information needed to verify that settlement details belong to the merchant.

Payer information

When someone makes a payment to a merchant through the Novupay checkout, we receive and process the information needed to complete and secure that payment. Depending on the payment method, this can include payment card or wallet details, the payer's name, billing information, email address or other contact details, the transaction amount, currency and reference, IP address, device and browser information, and fraud and risk signals such as behavioural indicators and the outcome of authentication checks.

Transaction and account activity

Details of the transactions processed through a merchant account, including amounts, currencies, payment methods, timestamps, references, approval and decline outcomes, refunds, chargebacks, reserve balances and settlements.

Technical and usage information

Device, browser, IP address, log and usage data collected automatically when you use our website, checkout or merchant dashboard, including through cookies and similar technologies.

Communications

Messages, applications, support requests, and other information you send us by email, form or other channel, together with our replies.

3. How we use information

We use the information we collect to:

• assess applications, onboard merchants, and set up and administer merchant accounts;
• verify identities and businesses, and meet our anti-money-laundering, counter-terrorist-financing, sanctions and other legal obligations;
• process payments, apply reserves, calculate fees and make settlements;
• authenticate payers and authorise transactions with card schemes, issuers and payment method providers;
• detect, investigate and prevent fraud, chargeback abuse, prohibited activity and other misuse of the services;
• manage risk, including monitoring transaction patterns, chargeback and fraud ratios, and merchant activity against the terms of the relationship;
• handle chargebacks, disputes, refunds and enquiries;
• keep the records that card scheme rules, financial-crime rules and our partners require us to keep;
• communicate with you about your account, service changes, technical matters and support;
• operate, secure, troubleshoot and improve our website, checkout and services;
• comply with applicable law and respond to lawful requests from authorities, regulators and card schemes.

4. Why we are allowed to process it

We process information because it is necessary to provide the services a merchant has asked for and to perform our agreement with them; because we are subject to legal, regulatory and card-scheme obligations relating to financial crime, verification and record-keeping; and because we have a legitimate interest in preventing fraud, managing risk, securing our systems and running our business responsibly.

Where the law requires consent for a particular use, such as certain analytics cookies or marketing messages, we ask for it and you can withdraw it at any time.

Where a merchant instructs us to process its customers' data, the merchant is responsible for establishing a lawful basis for that processing.

5. Card data and payment security

Payment card details entered in the Novupay checkout are transmitted to us and our payment partners over encrypted connections and handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS).

We do not give merchants access to full card numbers or security codes. Merchants receive transaction data such as the outcome, amount, reference, and limited card identifiers needed to reconcile payments and handle disputes.

Merchants must not store, transmit or process full card numbers, security codes or other sensitive authentication data outside the Novupay integration, and must comply with PCI DSS to the extent it applies to them.

6. How we share information

We share information only where it is needed, and only with:

• acquiring banks, card schemes, issuers, wallet providers and payment method operators involved in authorising, processing, settling and disputing transactions;
• service providers that help us run the business, such as identity and document verification, sanctions and PEP screening, fraud and risk scoring, cloud hosting, communications and analytics vendors, under contracts that require them to protect the data and use it only for the purposes we specify;
• merchants, where the information relates to transactions processed for them, to the extent needed for reconciliation, customer service and dispute handling;
• regulators, law-enforcement agencies, financial-intelligence units, courts and card schemes, where we are legally required or permitted to disclose, or where disclosure is necessary to prevent or investigate financial crime, fraud or a breach of scheme rules. Where the law prohibits us from telling you about such a disclosure, we will not do so;
• professional advisers, such as lawyers, auditors and accountants, under a duty of confidentiality;
• parties to a corporate transaction, such as a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal information, and we do not share it for unrelated advertising.