CalPay Business App Privacy Policy

1 About this notice

This notice explains how CalPay Limited collects and uses personal data in connection with merchant onboarding, the CalPay Business app, the merchant web portal and the CalPay merchant relationship. It also explains who receives the data, how long we keep it and the rights available to individuals under Gibraltar data-protection law.

CalPay Limited, company number 126684, of Unit G02, Eurocity, Europort Avenue, Gibraltar, is the controller where it decides why and how personal data is used. CalPay can be contacted at office@calpay.gi.

CalPay is subject to the Gibraltar General Data Protection Regulation, the Data Protection Act 2004 and, for electronic communications and cookies or similar technologies, the Communications Personal Data and Privacy Regulations 2006. The Gibraltar Regulatory Authority is the supervisory authority in Gibraltar.

2 Who this notice covers

This notice covers sole traders and individuals connected with a prospective, current or former CalPay merchant. This includes directors, partners, ultimate beneficial owners, controlling persons, authorised signatories, employees, contractors, merchant administrators and operational contacts. Information about a company is not personal data unless it identifies or relates to an individual.

3 Other organisations involved

• Adyen N.V. and relevant Adyen group companies provide regulated acquiring, payment, platform and merchant-verification services. Adyen may act as CalPay's processor for activities carried out on CalPay's instructions and as an independent controller for acquiring, KYC and KYB checks, sanctions screening, fraud prevention, regulatory compliance and other purposes determined by Adyen.
• Where Adyen-hosted onboarding is used, identity and company documents may be submitted directly to Adyen. CalPay may receive verification status, risk and account information and may access onboarding information only to the extent permitted by the platform settings and needed to administer the merchant relationship.
• Core by Carlo provides the white-label business app, merchant portal, platform and related technical services and processes personal data for CalPay under contract and CalPay's documented instructions.
• Banks, payment schemes, app-store operators, device-platform providers and professional advisers may act as separate controllers for their own legal or operational purposes.

4 Personal data we collect

• Business contact data, including name, role, business email address, telephone number, correspondence and account credentials.
• Company and business information that identifies or relates to an individual, including registration details, Gibraltar TIN or tax identifier, registered and trading addresses, business model, website and merchant category.
• Identity and verification data for sole traders, directors, partners, authorised signatories, ultimate beneficial owners and controlling persons, including date of birth, nationality, residential address and government-issued identification where required.
• Ownership and control information, including shareholding, voting rights and other control information required for onboarding or payment-provider checks.
• Bank account and settlement data, including verified payout account, payment status, fees, cashback funding, refunds, disputes, chargebacks, reserves and negative-balance information.
• Compliance, sanctions, fraud and risk-review information, including public-register results and evidence requested during onboarding or periodic review.
• Device, app, network, access-log, cookie, SDK and security information generated through the business app or merchant portal.
• Support requests, complaints, call notes, training records, service communications and marketing preferences.

CalPay usually receives information from the individual, the merchant organisation and use of the service. It may also receive information from Adyen, Core by Carlo, banks, payment networks, fraud and identity-verification providers, public registers, regulators, professional advisers and law-enforcement bodies where lawful.

5 Why we use personal data

CalPay's legitimate interests include administering merchant relationships, operating a secure payment and loyalty network, meeting payment-provider requirements, preventing fraud, understanding service performance, producing aggregated economic statistics and protecting legal rights. CalPay balances those interests against the rights and expectations of affected individuals. If information is required for onboarding, a contract or by law, failure to provide it may prevent activation, payment processing, payout or continued use.

CalPay may use personal data to create aggregated statistics and anonymised reports about merchant activity, transaction trends, settlement, cashback, use of the service and the local economy. CalPay may provide those reports and insights to participating merchants, public authorities, research bodies and other organisations. CalPay applies reporting thresholds and other safeguards designed to prevent individuals from being identified. Once information has been rendered genuinely anonymous so that an individual is no longer identifiable, it is no longer personal data.

6 Merchant verification and payment processing

Adyen determines its own KYC, KYB, sanctions, acquiring and risk decisions where it acts as an independent controller. CalPay may assist with onboarding, collect or transmit information through the approved route and receive status information needed to activate or support the merchant. CalPay does not retain local copies of identity documents where the Adyen-hosted onboarding process makes local retention unnecessary.

Each merchant legal entity must complete the verification required by Adyen and use a verified settlement account. Where a merchant group uses one commercial agreement for several entities, personal data may be linked to the relevant entity and authorised group administrators only as permitted by the agreement, access controls and applicable law.

7 Automated checks

CalPay, Adyen and approved providers may use automated rules and risk models to verify information, identify unusual activity, require further evidence, delay processing or payout, or refer an account for review. Adyen may make decisions under its own regulatory and risk responsibilities. CalPay does not make decisions based solely on automated processing that produce legal or similarly significant effects unless Gibraltar law permits the decision and the required safeguards are in place.

8 Who receives personal data

• Adyen and payment participants, including payment methods, schemes, issuers, acquirers and banks;
• Core by Carlo and approved providers of hosting, communications, analytics, identity verification, security, customer support and app services;
• authorised users within the merchant organisation or merchant group, subject to role-based access and the merchant's instructions;
• participating merchants, public authorities, research bodies and other organisations that receive aggregated and anonymised reports or insights that do not identify an individual;
• professional advisers, auditors, insurers, financiers and potential corporate transaction parties under appropriate confidentiality controls; and
• courts, the Gibraltar Regulatory Authority, the Gibraltar Financial Services Commission, the Office of Fair Trading, tax authorities, law-enforcement bodies and other authorities where disclosure is required or permitted by law.

CalPay does not sell personal data. Processors may use personal data only under contract and documented instructions. Some recipients, particularly Adyen for its independent-controller activities, payment participants and public authorities, determine their own purposes. CalPay does not include information that identifies an individual in an aggregated or anonymised report unless disclosure is required or permitted by law and supported by an appropriate legal basis.

9 International transfers

The service may involve access to or transfers of personal data outside Gibraltar. CalPay permits a restricted transfer only where the Gibraltar GDPR allows it, including where an applicable adequacy arrangement exists or approved contractual and supplementary safeguards are used. You may contact CalPay for information about safeguards relevant to your data.

10 How long we keep personal data

CalPay keeps personal data only for as long as needed for the purposes described in this notice, including legal, tax, accounting, anti-fraud, payment-dispute, KYC, KYB and claims requirements. The following retention periods normally apply:

• Merchant account, contract and service data for the merchant relationship and ordinarily for up to six years afterwards where needed for contract, tax or claims records.
• Payment, settlement, refund and dispute records for the applicable accounting, payment-dispute and legal period. Adyen may retain information for longer where its own legal obligations require it.
• Merchant verification and compliance information only for as long as CalPay needs it for onboarding, risk, legal or contractual purposes. CalPay minimises local copies where Adyen-hosted onboarding is used.
• Evidence of acceptance of Adyen terms and updates for the period required by the platform agreement and applicable law.
• Security and access logs normally for 12 to 24 months, unless an incident, fraud case or investigation requires longer retention.
• Unsuccessful prospect or onboarding information normally for 12 to 24 months, unless consent, law or a live dispute supports a longer period.
• Marketing preferences until opt-out or withdrawal of consent, with a minimal suppression record retained to respect that choice.

11 Security and merchant responsibilities

CalPay uses proportionate technical and organisational measures designed to protect personal data. These may include access controls, authentication, encryption in transit and where appropriate at rest, monitoring, supplier controls, confidentiality obligations, backups, incident response and periodic review. Identity and KYC documents should be submitted only through the secure route designated by CalPay or Adyen unless another method is expressly approved.

Merchants must keep administrator and staff accounts accurate, assign access only to authorised people, remove access promptly when it is no longer needed, protect credentials and notify CalPay of suspected compromise. Merchants remain responsible for privacy information and lawful processing carried out for their own customer, employee and business purposes.

12 Merchant marketing cookies and app technologies

Service, security, onboarding, KYC, KYB and transaction messages are needed to administer the merchant relationship and are not optional marketing. Individuals may opt out of optional electronic marketing at any time through the method stated in the message or by contacting CalPay.

CalPay websites, business apps and merchant portals may use strictly necessary cookies, local storage and similar technologies where the legal exemption applies. Non-essential analytics, advertising or tracking technologies are activated only where the consent required by Gibraltar law has been obtained. Details of the technologies in use, their providers, purposes and durations are available through the relevant cookie or privacy settings.

13 Your rights and complaints

Depending on the circumstances and the legal basis for processing, you may have rights to access, correct, delete or restrict personal data; object to legitimate-interest processing and direct marketing; receive certain data in portable form; withdraw consent; and request safeguards for significant decisions made solely by automated means.

To exercise a right, email office@calpay.gi. CalPay may ask for information needed to verify identity and may restrict disclosure where necessary to protect another person, confidential risk controls, security or a legal exemption.

You may complain to the Gibraltar Regulatory Authority, 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar, by email at info@gra.gi or through www.gra.gi. CalPay would appreciate the opportunity to address the concern first.

14 Account deletion

An authorised CalPay Business user may request deletion of their app user account through the method made available in the app or by emailing office@calpay.gi from the business email address linked to the account. CalPay may need to verify the request with the relevant merchant administrator.

Deleting an app user account does not require CalPay, Adyen, the merchant or another controller to delete information that must be retained for legal, accounting, regulatory, fraud-prevention, payment-dispute, KYC, KYB or claims purposes. Any retained information will be restricted to the relevant purpose and retained only for the applicable period.

15 Information about younger staff

Merchant-related information may occasionally identify staff under 18 where the merchant lawfully employs them and the information is necessary for account access, support or transaction operations. CalPay will minimise such information and apply appropriate safeguards. The standard CalPay consumer service remains restricted to users aged 18 or over.

16 Changes and contact

CalPay may update this notice to reflect legal, technical or operational changes. CalPay will give prominent notice of a material change and seek consent where the law requires it. The published notice will state its effective date.