CalPay Consumer App Privacy Policy

1 About this notice

This notice explains how CalPay Limited collects and uses personal data in connection with the CalPay consumer app and related digital services. It also explains who receives the data, how long we keep it and the rights available to individuals under Gibraltar data-protection law.

CalPay Limited, company number 126684, of Unit G02, Eurocity, Europort Avenue, Gibraltar, is the controller where it decides why and how personal data is used. CalPay can be contacted at office@calpay.gi.

CalPay is subject to the Gibraltar General Data Protection Regulation, the Data Protection Act 2004 and, for electronic communications and cookies or similar technologies, the Communications Personal Data and Privacy Regulations 2006. The Gibraltar Regulatory Authority is the supervisory authority in Gibraltar.

2 Other organisations involved

CalPay provides the branded consumer service and loyalty programme. Other organisations also process personal data when they provide technology, payment or merchant services.

• Adyen N.V. and relevant Adyen group companies provide regulated payment, acquiring and platform services. Adyen may act as CalPay's processor for activities carried out on CalPay's documented instructions and as an independent controller for acquiring, fraud prevention, regulatory compliance and other purposes determined by Adyen.
• Core by Carlo provides the white-label app, platform and related technical services and processes personal data for CalPay under contract and CalPay's documented instructions.
• Participating merchants separately control personal data they collect for their sales, receipts, returns, customer service, marketing and legal obligations.
• Card issuers, payment schemes, banks, app-store operators and device-platform providers may act as independent controllers under their own privacy notices.

3 Personal data we collect

• Identity and contact data, including name, email address, telephone number, date of birth where needed for eligibility, and CalPay account identifier.
• Account and authentication data, including login history, password or authentication information, security settings, device identifiers and notification tokens.
• Transaction and loyalty data, including merchant, date, amount, currency, payment status, refunds, reversals, promotional cashback earned, cashback used and account balance.
• Limited payment information supplied by Adyen or other payment participants, including payment tokens, masked card details, authorisation status and related identifiers. CalPay does not receive or store full card security codes.
• Device, app and technical data, including IP address, operating system, app version, language, crash logs, diagnostics, cookie or SDK identifiers and security events.
• Preferences and communications, including consent choices, marketing settings, support messages, complaints, survey responses, promotion entries and records of contact with CalPay.
• Fraud and risk information, including account activity, transaction patterns, device signals and suspected misuse or account takeover indicators.

CalPay usually receives this data directly from you and from use of the service. It may also receive data from Adyen, Core by Carlo, participating merchants, app stores, banks, payment networks, fraud-prevention providers, public registers, regulators and law-enforcement bodies where lawful.

CalPay does not intentionally collect special-category personal data through the standard consumer service. If such data is provided in a support request or identity document, CalPay will use it only where a valid legal condition applies and will minimise further use.

4 Why we use personal data

CalPay's legitimate interests include operating a secure and sustainable payment and loyalty service, preventing fraud, understanding service performance, producing aggregated economic statistics and protecting legal rights. CalPay balances those interests against the rights and reasonable expectations of affected individuals. If information is required for the contract or by law, failure to provide it may prevent registration, payment processing or continued use.

CalPay may use personal data to create aggregated statistics and anonymised reports about use of the service, consumer spending patterns, merchant activity, cashback and local economic trends. CalPay may provide those reports and insights to participating merchants, public authorities, research bodies and other organisations. CalPay applies reporting thresholds and other safeguards designed to prevent individuals from being identified. Once information has been rendered genuinely anonymous so that an individual is no longer identifiable, it is no longer personal data.

5 Payments and cashback

Adyen processes payment information needed to authorise and settle transactions. CalPay receives the information required to display transactions, calculate promotional cashback, process reversals and support users. CalPay does not hold consumer or merchant funds.

Cashback is recorded as a promotional loyalty benefit linked to the CalPay account. It cannot be purchased or withdrawn as cash and may be used only in accordance with the CalPay Consumer Terms. Transaction reversals, refunds and suspected misuse may require corresponding changes to cashback records.

6 Automated checks

CalPay, Adyen and fraud-prevention providers may use automated rules and risk models to identify unusual activity, require additional authentication, delay a transaction or refer an account for review. CalPay does not make decisions based solely on automated processing that produce legal or similarly significant effects unless Gibraltar law permits the decision and the required safeguards are in place.

7 Who receives personal data

• Adyen and payment participants, including payment methods, schemes, issuers, acquirers and banks;
• Core by Carlo and approved providers of hosting, communications, analytics, security, customer support and app services;
• participating merchants where necessary to complete or support a transaction, refund, complaint or lawful merchant responsibility;
• app-store operators and device-platform providers where needed to distribute, secure or support the app;
• participating merchants, public authorities, research bodies and other organisations that receive aggregated and anonymised reports or insights that do not identify an individual;
• professional advisers, auditors, insurers, financiers and potential corporate transaction parties under appropriate confidentiality controls; and
• courts, the Gibraltar Regulatory Authority, the Gibraltar Financial Services Commission, the Office of Fair Trading, tax authorities, law-enforcement bodies and other authorities where disclosure is required or permitted by law.

CalPay does not sell personal data. Processors may use personal data only under contract and documented instructions. Some recipients, particularly payment participants, app stores, merchants and public authorities, determine their own purposes and act as independent controllers. CalPay does not include information that identifies an individual in an aggregated or anonymised report unless disclosure is required or permitted by law and supported by an appropriate legal basis.

8 International transfers

The service may involve access to or transfers of personal data outside Gibraltar. CalPay permits a restricted transfer only where the Gibraltar GDPR allows it, including where an applicable adequacy arrangement exists or approved contractual and supplementary safeguards are used. You may contact CalPay for information about safeguards relevant to your data.

9 How long we keep personal data

CalPay keeps personal data only for as long as needed for the purposes described in this notice, including legal, tax, accounting, anti-fraud, payment-dispute and claims requirements. The following retention periods normally apply:

• Account and service data for the active relationship and ordinarily for up to six years afterwards where needed for contract, tax or claims records.
• Transaction, refund and dispute records for the applicable accounting, payment-dispute and legal period. Adyen may retain information for longer where its own legal obligations require it.
• Security and access logs normally for 12 to 24 months, unless an incident, fraud case or investigation requires longer retention.
• Unsuccessful registration or prospect information normally for 12 to 24 months, unless consent, law or a live dispute supports a longer period.
• Marketing preferences until opt-out or withdrawal of consent, with a minimal suppression record retained to respect that choice.

When data is no longer needed, CalPay will delete or anonymise it, or restrict access until deletion is possible.

10 Security

CalPay uses proportionate technical and organisational measures designed to protect personal data. These may include access controls, authentication, encryption in transit and where appropriate at rest, monitoring, supplier controls, confidentiality obligations, backups, incident response and periodic review. No service is completely secure, so users should protect their credentials and notify CalPay promptly of suspected compromise.

11 Marketing cookies and app technologies

Service, security and transaction messages are necessary to operate the service. They are not optional marketing. Users may opt out of optional electronic marketing at any time through the method stated in the message or by contacting CalPay.

CalPay websites and apps may use strictly necessary cookies, local storage and similar technologies where the legal exemption applies. Non-essential analytics, advertising or tracking technologies are activated only where the consent required by Gibraltar law has been obtained. Details of the technologies in use, their providers, purposes and durations are available through the relevant cookie or privacy settings.

12 Your rights and complaints

Depending on the circumstances and the legal basis for processing, you may have the following rights:

• access personal data and receive a copy of it;
• correct inaccurate or incomplete personal data;
• request deletion where there is no overriding reason to retain the data;
• request restriction of processing in the circumstances provided by law;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive personal data provided to CalPay in a portable format where the right applies;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• request human intervention and contest a significant decision made solely by automated means, where the right applies.

To exercise a right, email office@calpay.gi. CalPay may ask for information needed to verify identity and may restrict disclosure where necessary to protect another person, security controls or a legal exemption.

You may complain to the Gibraltar Regulatory Authority, 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar, by email at info@gra.gi or through www.gra.gi. CalPay would appreciate the opportunity to address the concern first.

13 Account deletion

A user may request account deletion through the method made available in the app or by emailing office@calpay.gi. Closing an account does not require CalPay or another controller to delete information that must be retained for legal, accounting, fraud-prevention, payment-dispute or claims purposes. Any retained information will be restricted to the relevant purpose and retained only for the applicable period.

14 Changes and contact

CalPay may update this notice to reflect legal, technical or operational changes. CalPay will give prominent notice of a material change and seek consent where the law requires it. The published notice will state its effective date.