Preamble
INGRASE Ltd., a company incorporated and existing under the laws of the Republic of Seychelles under registration number 245602, trading under the commercial name “Paykilla” (hereinafter the “Company”, “Paykilla”, “we”, “us” or “our”), is committed to protecting the privacy of natural persons whose Personal data it Processes, to providing transparent information regarding the manner in which such Personal data is Processed, and to complying with applicable data protection legislation.
This Privacy Policy (hereinafter the “Policy”) describes the categories of Personal data that the Company collects, the purposes for which such Personal data is Processed, the legal bases for the Processing, the categories of recipients with whom such Personal data may be shared, the periods for which the Personal data is retained, and the rights which Data Subjects enjoy in relation to their Personal data. This Policy applies to all visitors of the website located at https://paykilla.com (the “Website”), to all natural persons who submit the registration form available at https://paykilla.com/create-account (the “Registration Form”), and to all prospective and existing customers of the Company, as well as to their representatives, beneficial owners, directors, employees, suppliers and counterparties whose Personal data may be Processed by the Company in connection with the Services.
By accessing the Website, by submitting the Registration Form, and by registering to use the Services, you acknowledge that you have read, understood and accepted this Policy, and you consent to the Processing of your Personal data in the manner set out herein and in accordance with Applicable Law.
1. Definitions
For the purposes of this Policy, the capitalised terms set out below shall bear the following meanings.
1.1. “Applicable Law” means any law, statute, regulation, rule, order, directive, guidance or other binding instrument applicable to the Company from time to time, including, without limitation, the data protection, anti-money laundering, counter-terrorist financing and sanctions legislation applicable to the Company or to the Processing of Personal data hereunder.
1.2. “Business Relationship” means the contractual relationship established between the Company, on the one hand, and the customer or any natural or legal person represented by such customer, on the other hand, in connection with the provision of the Services.
1.3. “Personal data” means any information relating to an identified or identifiable natural person, being a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
1.4. “Processing” means any operation or set of operations which is performed on Personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1.5. “Registration Form” means the online form available at https://paykilla.com/create-account, by means of which prospective customers submit an initial application to open an account with the Company and the completion of which is a mandatory prerequisite to being considered for the Services.
1.6. “Services” means any and all services provided by the Company through the Paykilla platform, including, without limitation, the acceptance, conversion, transfer and processing of crypto assets, the operation of a crypto payment gateway, the provision of application programming interfaces, merchant dashboards and related functionalities, together with such further services as the Company may offer from time to time.
1.7. “You / Data Subject” means any natural person whose Personal data is Processed by the Company, including any visitor of the Website, any natural person completing and submitting the Registration Form, and any natural person acting on his or her own behalf or as a representative of a legal entity in the context of the Services.
2. Role of the Company
For the purposes of Applicable Law in the field of data protection, the Company acts as the data controller in respect of the Personal data Processed pursuant to this Policy, and the Company alone determines the purposes and means of such Processing, save where expressly stated otherwise herein. Where the Company engages third parties to Process Personal data on its behalf, such third parties act as data processors and are bound by appropriate contractual obligations of confidentiality and security.
Should you have any question regarding the manner in which the Company collects, stores, uses or otherwise Processes your Personal data, or should you wish to update the Personal data held by the Company in relation to you, you are invited to contact the Company by electronic mail at the address info@paykilla.com.
The Company is neither responsible nor liable for the content, privacy practices or Processing activities of any third-party website to which you may be directed by means of hyperlinks displayed on the Website. The review of the privacy policies of such third-party websites is your sole responsibility.
3. Sources of Personal data
The Company collects Personal data from several sources. Personal data is collected from you directly at the time of submission of the Registration Form, such submission being a mandatory prerequisite to the assessment of your application and to the possible establishment of a Business Relationship. Personal data is further collected from you directly in the course of the Company’s onboarding, know-your-business (“KYB”), know-your-customer (“KYC”) and customer due diligence procedures, which are conducted subsequent to the initial submission of the Registration Form. Personal data is also collected from you in the course of your use of the Services, including through the merchant dashboard and the Company’s application programming interfaces, as well as through any communications exchanged with the Company by electronic mail, instant messaging platforms, scheduled calls or any other channel of communication. Personal data is additionally collected automatically through the operation of the Website, in particular by means of cookies, log files and similar technologies, further details regarding which are set out in the Cookie Policy of the Company. Finally, Personal data may be collected from publicly available sources, from third-party service providers and from competent authorities, where such collection is necessary for the provision of the Services, for the performance of the Company’s regulatory obligations, or for the prevention of fraud, money laundering, terrorist financing or any other unlawful activity.
The Company collects and retains Personal data for the purposes of (i) complying with its obligations under Applicable Law, in particular those relating to the combating and prevention of money laundering and terrorist financing and to sanctions compliance, (ii) assessing applications submitted through the Registration Form and determining whether a Business Relationship may be established, (iii) providing, operating, maintaining, developing and improving the Services, (iv) understanding the requirements of its customers and prospective customers, (v) compiling Website statistics, and (vi) planning and conducting marketing and market research activities.
4. Categories of Personal data collected
4.1. Personal data collected through the Registration Form
Upon submission of the Registration Form available at https://paykilla.com/create-account, the Company collects from you, on a mandatory basis, the categories of Personal data and business information described in this Section 4.1. Should you decline to provide the said information, the Company shall not be in a position to review your application or to offer you the Services.
The Company collects your name, being the full name of the natural person completing the Registration Form, whether acting on his or her own behalf or as a representative of a legal entity. The Company collects your electronic mail address, being the address at which the Company shall direct further communications in connection with your application and, where applicable, in connection with the subsequent Business Relationship. The Company collects an additional contact detail selected by you, such as a Telegram handle, a WhatsApp number, a Signal identifier or any equivalent identifier on any other instant messaging platform, provided for the purpose of facilitating communication with the Company. The Company collects a short description of your business, product or service, including the nature of your activity and the category of goods or services in respect of which you intend to use the Services. The Company collects the estimated monthly transaction volume, expressed in United States Dollars and selected by you from the ranges made available in the Registration Form, namely less than USD 10,000; from USD 10,000 to USD 50,000; from USD 50,000 to USD 100,000; and above USD 100,000. The Company collects the target regions or countries in which your business operates or intends to operate, or in which you intend to offer goods or services to customers. Finally, the Company records your consent to this Policy, as evidenced by the ticking of the corresponding checkbox in the Registration Form, together with the date and time of submission and the associated technical metadata.
4.2. Personal data collected during onboarding and in the course of the Business Relationship
Further to the submission of the Registration Form and throughout the duration of the Business Relationship, the Company may additionally collect Personal data and documentation as set out in this Section 4.2.
The Company may collect full contact details, including a telephone number, a postal address and any further messaging identifier. The Company may collect one or more wallet addresses, being the public addresses on the relevant blockchain network associated with the wallets to be used for the execution of payouts, settlements and transfers. Where you act as a representative of a legal entity, the Company may collect information relating to that entity, including its legal name, any trading name, its registered office and place of business, its registration number, its tax identification number, the identity of its directors, officers and ultimate beneficial owners, its ownership and control structure, and the source of its funds and source of its wealth. The Company may further collect information regarding your position within the legal entity that you represent, including your title, the scope of your authority and any power of representation conferred upon you.
The Company shall collect the Personal data and documentation necessary for the performance of its anti-money laundering, counter-terrorist financing and sanctions obligations, including, without limitation, a copy of a valid identity card or passport, a proof of residence (such as a recent utility bill or bank statement), the results of KYC database and sanctions screening checks, the results of politically-exposed-person and adverse-media screening, the results of fraud database checks, and any further documentation or information that the Company may reasonably require from time to time for compliance purposes.
4.3. Personal data collected automatically
In the course of your visit to and interaction with the Website, including the pages on which the Registration Form is made available, the Company may automatically collect the following categories of Personal data. The Company may collect technical information, including the Internet Protocol address used to connect your device to the Internet, your login information, the type and version of your browser, your time zone setting, the types and versions of your browser plug-ins, your operating system and platform and any device identifier. The Company may collect information concerning your visit, including the full Uniform Resource Locators (URLs) clickstream to, through and from the Website (together with the date and time of each interaction), the referral source, the pages viewed, the products and services viewed or searched for, the page response times, the length of visits to certain pages, the page interaction information (such as scrolling, clicks and mouse-overs), and the method used to navigate away from any given page. The Company may collect metadata in respect of the submission of the Registration Form, including the date and time of submission and the record of your consent to this Policy. The Company may collect any telephone number used to contact the Company’s communication channels. Further information regarding cookies and similar technologies is set out in the Cookie Policy of the Company.
The Company reserves the right to request additional Personal data beyond the categories set out in this Section 4 where such additional data is reasonably necessary for the provision of the Services or for compliance with Applicable Law.
5. Purposes of Processing and legal bases
The Company Processes your Personal data for the purposes and on the legal bases set out in this Section 5.
5.1. Evaluation and processing of the registration request
The Personal data submitted through the Registration Form is Processed in order to assess whether the prospective business is eligible for the Services, to determine the commercial terms and product configuration most appropriate to your business, to conduct preliminary risk screening (including screening by reference to geography, sector of activity and expected transaction volume), and to contact you in relation to your application by means of the contact details that you have provided. The legal basis for such Processing is (i) the taking of pre-contractual steps at your request and (ii) the legitimate interest of the Company in evaluating business opportunities and managing risk.
5.2. Creation and operation of the account and provision of the Services
Personal data is Processed in order to enable you to create an account and to access your personalised dashboard, to provide, maintain and support the Services, and to notify you of any change to the Services, the applicable terms and conditions or this Policy. The legal basis for such Processing is (i) the performance of the contract concluded between you (or the legal entity you represent) and the Company and (ii) the legitimate interest of the Company in operating its business.
5.3. Compliance with legal and regulatory obligations
Personal data is Processed in order to perform KYC, KYB, customer due diligence and ongoing monitoring obligations, to perform anti-money laundering, counter-terrorist financing and sanctions screening, to respond to lawful requests from courts, regulators, law enforcement agencies and other competent authorities, and to maintain the records required by Applicable Law. The legal basis for such Processing is compliance with the legal obligations to which the Company is subject.
5.4. Communications relating to the Services, promotional offers and market research
Personal data is Processed in order to inform you of special offers, of new features or of product updates, and to invite you to participate in surveys or market research activities. The legal basis for such Processing is (i) the legitimate interest of the Company in keeping you informed of Services that may be of interest to you and (ii), where required by Applicable Law, your consent. You may withdraw your consent and unsubscribe from marketing communications at any time by contacting the Company at info@paykilla.com or by using the unsubscribe mechanism included in the relevant communications.
5.5. Administration, security and improvement of the Website and the Services
Personal data is Processed for internal operational purposes, including troubleshooting, data analysis, testing, research and statistical purposes, for the purpose of detecting, preventing and investigating fraud, abuse, security incidents and violations of the applicable terms and conditions, for the purpose of enabling you to participate in interactive features of the Services where you elect to do so, and for the purpose of ensuring that the content of the Website is presented in the manner best suited to you and to your device. The legal basis for such Processing is the legitimate interest of the Company in administering, securing and improving the Website and the Services.
You may elect not to provide the Company with certain categories of Personal data; however, in the event that you fail to provide the Personal data necessary for the provision of the Services or required by Applicable Law, the Company may be unable to provide the Services and may suspend or terminate the Business Relationship.
6. Disclosure of Personal data
The Company does not sell or rent your Personal data. The Company may, however, disclose Personal data in accordance with this Policy, with Applicable Law or with your consent, in each case where such disclosure is reasonably necessary (i) for the purpose of providing you with access to the Services and performing the Company’s obligations towards you, (ii) for the purpose of entering into and performing the Business Relationship with you or with the legal entity that you represent, (iii) for the purpose of complying with Applicable Law, or (iv) for the purpose of protecting the legitimate interests of the Company in maintaining, improving and developing the Services.
The categories of recipients to whom the Company may disclose Personal data include the Company’s personnel, agents and contractors, each of whom is bound by appropriate obligations of confidentiality; the Company’s professional advisors, including legal, audit, accounting and compliance advisors; the Company’s business partners, suppliers and sub-contractors, including banking partners, payment service providers, custody providers, blockchain analytics providers, cloud hosting and infrastructure providers, communication platforms and customer support tools, to the extent necessary for the performance of any contract entered into with them or with you; analytics providers and search engine providers that assist the Company in the improvement and optimisation of the Website; and regulatory authorities, law enforcement agencies and other competent public bodies, to the extent that the Company is subject to a legal obligation to disclose such Personal data or where such disclosure is necessary to establish, exercise or defend the legal rights of the Company or of any third party.
Where the Company discloses Personal data to a third party, the Company implements appropriate legal, organisational and technical safeguards to protect such Personal data during transfer and subsequent Processing. Given the international nature of the Services, your Personal data may be transferred to, and Processed in, jurisdictions outside the jurisdiction in which you are located. Where such international transfers take place, the Company implements the safeguards required under Applicable Law to ensure that your Personal data continues to enjoy an appropriate level of protection.
7. Retention of Personal data
The Company retains Personal data solely for such period as is reasonably necessary for the purposes for which such Personal data is Processed, as identified in Section 5 of this Policy, and thereafter for such further period as may be required under Applicable Law or as may be necessary to establish, exercise or defend legal claims. The indicative retention periods are set out below.
Personal data submitted through the Registration Form by applicants that do not subsequently enter into a Business Relationship with the Company is retained for a period of up to twelve (12) months from the date of submission, following which such Personal data is deleted or anonymised, save where a longer retention period is required under Applicable Law. Personal data of customers is retained for a period of five (5) years from the end of the Business Relationship. Personal data used for the creation and operation of the account is retained until the termination of the account, together with any further statutory retention period applicable thereto. Personal data collected for the purposes of anti-money laundering, counter-terrorist financing and sanctions compliance is retained for such period as is required under Applicable Law, being typically a period of not less than five (5) years from the end of the Business Relationship or from the date of the occasional transaction. Personal data collected automatically through the operation of the Website, including logs and analytics data, is retained for a period of up to one hundred and eighty (180) days, save where a longer retention period is required for security, audit or legal purposes.
Notwithstanding the foregoing, the Company may retain Personal data for a period exceeding the periods set out above where such longer retention is necessary (i) to discharge the Company’s legal obligations under Applicable Law, (ii) in relation to anticipated, pending or ongoing legal or regulatory proceedings, or (iii) to establish, exercise, protect or defend the rights and legitimate interests of the Company or of any third party.
8. Security of Personal data
The Company implements appropriate technical and organisational measures designed to protect your Personal data against unauthorised or unlawful Processing and against accidental loss, destruction, alteration or damage. Such measures include, without limitation, the implementation of access controls, the encryption of Personal data in transit, the use of secure storage environments, the adoption of internal information security policies and the training of the Company’s personnel. The Company periodically reviews and updates its security measures in line with the evolution of technology and of the threat landscape.
9. Rights of the Data Subject
Subject to and within the limits of Applicable Law, you enjoy certain rights in relation to the Personal data Processed by the Company. The exercise of such rights may be subject to conditions and exceptions provided for under Applicable Law, including, without limitation, exceptions based on overriding public interest, on the prevention, investigation or prosecution of criminal offences, or on the establishment, exercise or defence of legal claims.
Your rights include the right to obtain access to the Personal data Processed by the Company in relation to you; the right to obtain the rectification of Personal data that is inaccurate or incomplete; the right to obtain the erasure of your Personal data (the right to be forgotten); the right to obtain the restriction of the Processing of your Personal data or to object to such Processing; the right to data portability; where the Processing is based on your consent, the right to withdraw such consent at any time, without prejudice to the lawfulness of the Processing carried out on the basis of such consent prior to its withdrawal; and the right to lodge a complaint with a competent supervisory authority.
In order to exercise any of the above-mentioned rights, you are invited to contact the Company by electronic mail at the address info@paykilla.com. The Company may require you to provide reasonable evidence of your identity prior to acting upon any such request, and shall respond to your request within the time limits prescribed by Applicable Law.
10. Minors
The Services are not directed to, and the Company does not knowingly collect Personal data from, individuals under the age of eighteen (18) years. Should the Company become aware that it has inadvertently collected Personal data from a minor, it shall take appropriate steps to delete such Personal data without undue delay. Should you believe that the Company may be Processing the Personal data of a minor, you are invited to contact the Company at info@paykilla.com.
11. Amendments to the Policy
The Company reserves the right to amend or revise this Policy from time to time, in particular in order to reflect business developments or legal or regulatory developments under Applicable Law. Any amendment to this Policy shall be published on this page, with an updated “Last updated” date and, where appropriate, you shall be notified of such amendment by electronic mail. You are encouraged to consult this Policy from time to time in order to remain informed of the manner in which the Company Processes your Personal data.
12. Contact
Any question, concern or request in relation to this Policy or to the Processing of your Personal data may be addressed to the Company at the following coordinates.
INGRASE Ltd. (trading as “Paykilla”)
Registration number: 245602
Republic of Seychelles
Electronic mail: info@paykilla.com
Website: https://paykilla.com