Privacy Notice

Introduction

Paynt (“Paynt”, “we”, “our” or “us”) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our partners and users of our acquiring and payment processing services and visitors of our website www.paynt.com (the “Website”) and will only collect and use personal data in ways that are described here, and in ways that are consistent with our obligations and your rights under the law.

The objective of this privacy notice (the “Privacy Notice”) is to inform you about our role and responsibilities as controllers of your personal data. Therefore, we would like to let you know who is taking care of your personal data.

This Privacy Notice applies to Paynt UAB, Paynt Limited and Paynt SIA.

Paynt UAB is a company registered in Lithuania with a company number 303227757. It is located at Jogailos g. 9A, Vilnius, LT-01116, Lithuania. Paynt UAB is an electronic money institution authorised and supervised by the Bank of Lithuania under Electronic Money Institution Licence No. 2 (authorisation code LB000250). Paynt UAB provides acquiring, payment processing and related payment services to the merchants in Lithuania and across the European Economic Area under the applicable passporting arrangements.

Paynt SIA is a company registered in Latvia with a company number 40103821385. It is located at Ernesta Birznieka-Upīša iela 21, Rīga, LV-1011, Latvia. Paynt SIA provides technical support of the Website and provides outsourcing services to Paynt Limited, Paynt UAB and other Paynt group entities.

Paynt Limited is a company registered in the United Kingdom (“UK”) with a company number 10643467. It is located at 1 Ground Floor, Venari House, Trimbush Way, Market Harborough, Leicestershire, England, LE16 7XY. Paynt Limited is registered with the Financial Conduct Authority under Firm Reference Number 903111 as an agent of Rapyd Payments Limited (a company registered in England and Wales under company number 08053178, and is authorised and regulated by the Financial Conduct Authority as an electronic money institution under Firm Reference Number 900688). Paynt Limited provides acquiring and payment processing services in the UK as an agent of Rapyd Payments Limited.

For the purposes of this Privacy Notice, references to Paynt, “we”, “our” or “us” mean the Paynt entity with which you or the organisation you represent has, or seeks to establish, a relationship, or whose services you use, and which determines the purposes and means of the relevant processing. Where another Paynt entity processes personal data solely on behalf of that entity, it acts as a data processor. Where applicable, Paynt’s Data Protection Officer may be contacted using the contact details set out in Section 10 of this Privacy Notice.

According to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “EU GDPR”), and Regulation (EU) 2016/679 as it forms part of UK law, as supplemented and amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (the “UK GDPR”, and together with the EU GDPR, the “GDPR”), personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, e.g., by reference to an identifier such as a name, an identification number, location data, an online identifier, etc.

We obtain personal data about you from various sources. You may be: a visitor to our Website; a person (or representative of a person) that has entered into (or in a process of entering into) the merchant processing agreement with us; a person whose transaction we have processed under agreement with one of our merchants; a recipient of our newsletters, invitations or other marketing communications; a person that contacted us (or asked us to contact you) with questions, queries, requests, comments, complaints or other communications.

This Privacy Notice applies to personal data processed by the relevant Paynt entity in connection with the services described above. Therefore, websites, products and services of third parties (such as merchants selling their products and services) are subject to their own separate privacy policies. If you are the cardholder and Paynt has processed your transaction, the agreement between you and the relevant merchant should explain how this merchant shares your personal data with us.

Depending on the relevant processing activity, a Paynt entity may act as a data controller, joint controller or a data processor. A controller determines, alone or jointly with others, the purposes and means of processing personal data. A processor processes personal data solely on behalf of, and in accordance with the documented instructions of, a controller. A Paynt entity may separately process transaction data as an independent controller where necessary to provide payment services, comply with legal and regulatory obligations, prevent fraud, comply with payment-scheme requirements or establish, exercise or defend legal claims.

Paynt is a data controller when it determines the purposes and means of the processing taking place.

Paynt is a data processor when it is directed by the merchant to process payments, and Paynt receives instructions about processing of the transaction of the cardholder.

Please carefully read this Privacy Notice as it explains what information we collect, how we use and share it, your data protection rights, how to exercise your rights, and how you can contact us about our privacy practices.

1. What Personal Data Do We Collect?

1.1. When We Collect Personal Data From You

We may collect from you different types of personal data from various sources. We collect information about you when:

• You fill-in forms and applications;
• You contact us (or third parties engaged by us);
• You respond to our e-mails or surveys;
• You submit your data for purposes of entering into an agreement with Paynt and/or registration on our platform;
• You acquire products or services from the merchants to whom Paynt provides payment processing services;
• We receive information from third parties, for example from our affiliate companies or business partners in relation to business opportunities or from search engines, credit reference companies or government agencies.

When we collect your personal data, it is collected for specific, explicit, and legitimate purposes and will be processed only to fulfil those purposes. Paynt only collects that personal data which is adequate, relevant, and limited to what is necessary for us to fulfil those purposes. If Paynt intends to use your personal data for any new purposes not previously identified to you and which are incompatible with the original purposes, you will be notified of those new purposes before that intended use and, where applicable, provided the means by which you may restrict our use of your personal data for those new purposes. The types of personal data we collect, use and store depend on the nature of your relationship with us and/or the merchant.

1.2. When You Are a Visitor of Our Website

When you browse our Website, we process your IP address, Google Analytics ID, internet browser and device type, location data and your use of our Website and the app, including which pages you visited, how you got to our Website, the time and length of your visit and your language preferences. We use this data for our legitimate interests of: making sure our Website works properly, including debugging, to be able to deliver you content and for DDOS mitigation on our Website; improving our Website and to perform statistical analyses for optimising our Website; providing you with personal offers tailored to your needs and tailoring what we show you to your preferences, with your prior consent; contacting you with offers about our products and services, if we have your consent for this and subject to limitations under the laws of your home jurisdiction. We collect this data using cookies and similar techniques, including tags/beacons and javascripts. We only place these tracking/targeting cookies with your prior consent. More information about these techniques can be found in our Cookies Policy. We keep your data for as long as we reasonably need it for the purposes listed above – please view our Cookies Policy. We use plugins on our Website from social media networks and embedded video players which can be found on our Website. If you click on them, these plugins are activated and automatically transmit data to the plugin provider. We do not have any influence over which data these social media networks and embedded video players collect from you and we are also not aware of the extent of their data processing. If you would like more information about their data processing, this can be found in the respective privacy policies on the websites of these social media networks and embedded video players.

1.3. When You Participate in Our Marketing Activities

When you submit your contact information to us or when we collect your business contact details through our participation at trade shows, surveys or other events, we may communicate with you using the contact information we have about you to provide information about our services and our affiliates’ services, invite you to participate in our events, or otherwise communicate with you for our marketing purposes, provided that we do so in accordance with applicable law, including any consent or opt-out requirements. We collect your contact information including: name, e-mail address, work phone number, and job title. If our contact was made via our Website, we also collect your personal data as our Website visitor. Please review this Privacy Notice to learn more, including your rights to stop our use of your personal data for marketing purposes. We do not share your personal data to third parties for their marketing purposes unless you give us or the third party permission to do so. We use your data for legitimate interest in undertaking marketing activities to offer you products or services that may be of interest to you. We will only keep your data for as long as we reasonably need it for the purposes listed above which is generally five years from your latest contact with us.

1.4. When You Contact Us or Ask Us To Contact You

When you contact us or ask us to contact you regarding questions, queries, (support) requests, comments or complaints, fill out an application to become a merchant or a partner, we collect the information that you decide to provide us, including without limitations your name, company, contact details, the reason you are contacting us, verification that you are not a robot and other information we need to be of further assistance to you and/or communicate with you. We use this data: to answer your (or of the legal entity that you represent) question, comment or complaint; to respond to your (or of the legal entity that you represent) queries and (support) requests; to assess your (or of the legal entity that you represent) application to become a merchant or partner; to establish or perform our contract with you (or the legal entity that you represent); for our legitimate interests in following up with you (or the legal entity that you represent); for managing our internal administration, for training purposes; for conducting marketing research so we can improve our products and services and to be able to provide more relevant information about our products and services. We will only keep your data for as long as we reasonably need it for the purposes listed above which will be at least two years.

1.5. When You Have an Agreement with Us

If you are a person (or representative of a person) which has entered into (or in a process of entering into) the merchant processing agreement with us, we will need to confirm your identity as part of our Know-Your-Client (KYC) procedure and collect certain documents for due diligence procedures, to establish and perform business relationships with the merchant for managing our internal administration and for complying with our other legal obligations. We will ask you to provide your identification document, bank account information, extract from the commercial register, and we may also collect information from third parties for mentioned purposes. We may also collect financial and additional personal information about you, such as your tax number. We also collect data about your use of our products and services and your access to our platform, including your login details, and the questions, queries, comments and complaints you send us in relation to our business relationship. We may use third party identification and verification services in order to assist us to verify your identity and the documents provided to us. We processes your personal information for the following purposes: to provide the services and support under the agreement between us and the merchant; to improve our products and services; comply with applicable laws and regulations; to conduct analysis for statistical, strategic and scientific purposes; to protect our platform, systems and services from misuse, fraud, financial crimes or other unauthorised or illegal activity including the prevention, investigation and detection of fraud on the basis of legitimate interest; and for reporting and training purposes. We can also use your (company) e-mail address for: keeping you updated about our products and services; making you offers of similar products and services you have already purchased from us; or inviting you to events. We will keep information relating to our business relationship until 8 years after the end of the merchant’s business relationships with us. Data we have collected in relation to our legal obligation to verify our merchants will be kept by us for as long as we are legally obligated to, which is generally 8 years after end of business relationships or rejection of an application to establish the business relationships.

1.6. When We Process Your Transactions

If you engage in payment transactions with a merchant via our services or products, we will receive your payment transaction information. We may receive this information directly from you, from the merchant or from the payment scheme. The information that we collect depends upon the payment method that you choose to use - we may collect your card number (which we encrypt in accordance with PCI DSS standards), the expiry date (month and year) of your credit card, your bank account details, the amount of the transaction and the currency in which the transaction is done, the date, time and location of the transaction and the category of transaction and identification data of our merchant. We may also collect: your name, e-mail address, billing address, phone number. We process your data: to comply with our legal obligations as a financial institution; for our legitimate interest of protecting our legal rights, for example in connection with legal claims; when we have a legal obligation to process your information; to provide the service pursuant to the agreements with our customers and the specific payment schemes; to comply with applicable laws and regulations; to conduct analysis for statistical, strategic and scientific purposes; and to protect our platform, systems and services from misuse, fraud, financial crimes or other unauthorised or illegal activity. We keep the data we collect in order to perform the transaction in accordance with applicable laws up to 8 years after conclusion of the relevant transaction, to meet our fiscal, corporate and other statutory obligations. The retention terms above can be longer if we are required to keep data longer because of applicable law or to administer our business. If we need to keep any information longer for our legitimate interest of protecting our legal rights, we will keep the necessary information for this purpose until the relevant claim is finally settled.

1.7. Other Situations

If necessary, we can also process any of your information above for our legitimate interest of protecting our legal rights, for example in connection with legal claims, and when we have a legal obligation to process your information. We may also disclose or transfer your data to the relevant third parties in connection with actual or proposed company reorganisation, merger, acquisition or sale. The retention terms above can be longer if we are required to keep data longer on the basis of applicable law or to administer our business. If we need to keep any information longer for our legitimate interest of protecting our legal rights, we will keep the necessary information for this purpose until the relevant claim is finally settled.

2. What is Our Legal Basis for Using Personal Data?

Whenever we use your personal data our legal basis is one of the listed below.

2.1. Contractual and Pre-Contractual Business Relationships

We use personal data for the purpose of entering into business relationships with prospective Paynt merchants or partners, and to perform the contractual obligations under the concluded agreements.

2.2. Legal Obligations

Where the relevant Paynt entity is subject to financial-services, anti-money laundering or other legal obligations, it collects and retains personal data to comply with those obligations.

2.3. Consent

Where you have given us your consent to process your personal data for a specific purpose, for example, by ticking a box to indicate you agree for us to use your personal data in a certain way, we will process your personal data only for that purpose.

2.4. Legitimate Interests

Where allowed under applicable laws and regulations, we rely on our legitimate business interests to collect, use and process your personal data, or share it with third parties. In such case, we balance our legitimate interests against the interests and rights of the individuals whose personal data we collect, use and process.

3. How Do We Use Personal Data?

3.1. Provision of Services and Contractual Obligations

When you or the organisation you represent apply to use our services or to become our partner, you will submit to us an application providing your personal data which we will use to verify your identity (as part of our KYC or Know-Your-Partner (KYP) process) and decide whether to approve your application, to conclude (and perform under) an agreement.

Our legal basis is one or more of the following:

• Processing is necessary for the performance of a contractual and pre-contractual business relationships;
• Processing is necessary for the purposes of the legitimate interests to be efficient in our contractual obligations and we want to provide you with good services;
• Processing is necessary for compliance with a legal obligation to which Paynt is subject.

3.2. Fraud Detection and Prevention, Risk Management

We use your personal data to carry out risk analysis, fraud prevention and risk management. For example, we verify your identity in order to protect against fraud and confirm that you are eligible to use our services or provide your services to us.

Our legal basis is one or more of the following:

• Processing is necessary for the performance of a contractual and pre-contractual business relationships;
• Processing is necessary for the purposes of the legitimate interests to meet our legal obligations and to develop and improve how we deal with financial crime;
• Processing is necessary for compliance with a legal obligation to which Paynt is subject.

3.3. Our Legal Obligations and Rights

In the specific cases, to perform our legal obligations we may share your personal data with third parties, for example, we may share your personal data with fraud-prevention agencies. As well as we may need to share your personal data in relation to legal claims or to help detect or prevent crime.

Our legal basis is one or more of the following:

• Processing is necessary for the purposes of the legitimate interests to comply with the laws and regulations applicable to us;
• Processing is necessary for the performance of a task carried out in the public interest;
• Processing is necessary for compliance with a legal obligation to which Paynt is subject.

3.4. Marketing Communication

We may use your personal data to:

• Provide you with information about other products and services offered by Paynt that are similar to the services used by you (or where otherwise allowed under the applicable laws);
• Better understand your potential interest in other products and services;
• Provide you with information about products and services that you might be interested in;
• To provide you with information on products and services of cooperation partners of Paynt, provided that the merchant has consented to receive such information;
• Better understand the effectiveness of our marketing communications;
• To ask your opinion about products and services.

Where required by the applicable laws, we will ask for prior consent to receive the above-mentioned information. You may unsubscribe or opt-out of further communication by changing preferences of marketing communications in merchant Data Account settings or by sending an e-mail to [email protected].

Our legal basis is one or more of the following:

• You have given consent to receive marketing communications.
• Processing is necessary for the purposes of the legitimate interests to develop Paynt products and services.

4. What are Your Data Protection Rights?

4.1. Right to Access Your Personal Data

You can ask us to provide confirmation as to whether your personal data is being processed, and, where that is the case, a copy of your data if you would like to know what personal data we process and the purpose of processing.

4.2. Right to be informed

You can ask us to provide information about how we process your data. We strive to provide you with transparent information and policies such as this Privacy Notice, other information available on the Website, and by answering questions sent to us.

If you have any questions in relation to our use of your personal data, or if you wish to exercise your data protection rights, you should send the data subject request via e-mail to [email protected]. Where applicable, you may also contact Paynt’s Data Protection Officer using the contact details set out in Section 10 of this Privacy Notice.

4.3. Right to Rectification

You can ask us to correct inaccurate or incomplete information about yourself. Before we update your data, we may need to check the accuracy of the new personal data you have provided by contacting you.

4.4. Right to Erasure

You can ask us to delete your personal data in certain circumstances, for example where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw your consent and there is no other lawful basis for processing, or where the personal data has been processed unlawfully. The right to erasure is not absolute and we may retain your personal data where we are required or permitted to do so by applicable law.

4.5. Right to Restrict or Object the Processing

You have the right to ask us to stop the processing, for example, if you believe we use your data unlawfully or your personal data is inaccurate. You may also object to our processing where you believe there are circumstances that would make such processing unlawful. You can always object to us using your personal data for direct marketing.

4.6. Right to Data Portability

You can ask us to transfer personal data to you or another company. If we can, and are allowed to do so under the applicable laws and regulations, we will provide your personal data in a structured, commonly used and machine-readable format.

4.7. Right to Challenge an Automated Decision

You can challenge an automated decision made by us if this decision produces legal effects or similarly significantly affects you. In this case, you can ask us to carry out a human review instead of an automated decision we made about you.

4.8. Right to Withdraw Consent

Where you have provided a consent for us to use your personal data, you can withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

4.9. Right to Lodge a Complaint

If you believe that your right to personal data protection has been violated, you may lodge a complaint with your national supervisory data protection authority, for example, the State Data Protection Inspectorate in Lithuania, Data State Inspectorate in Latvia, and the Information Commissioner’s Office in the UK, depending on the circumstances. You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement. A list of EU national supervisory authorities is available on the European Data Protection Board’s website.

5. How to Exercise Your Rights?

To exercise any of your rights set out in the previous section, you can send us an e-mail to [email protected]. Usually, we will not charge you a fee when you exercise your rights. However, where your requests manifestly unfounded or excessive, in particular because of their repetitive character, we have legal rights either: (a) to charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) to refuse to act on the request.

6. How Do We Disclose Personal Data?

6.1. Paynt Group

We may share your personal data within our affiliated and subsidiary companies in order to provide you with our services and for our administration purposes.

6.2. Service Providers and Business Partners

We may share your personal data with service providers and our business partners in order to provide you with certain services and to perform contracts we enter into with you or them.

On the contractual basis we authorise such service providers and business partners to use or disclose the personal data only to perform services on behalf of Paynt and to comply with legal requirements. Therefore, such service providers are contractually obliged to protect the personal data they process on our behalf. Most of our service providers are located in the EEA or the UK. If we transfer your data to a service provider outside the EEA or the UK, as applicable, we will do so in accordance with applicable data protection laws and Section 8 of this Privacy Notice.

6.3. Authorities

We may disclose your personal data to the authorities, for example, to courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence under certain circumstances (if you have requested us to provide necessary information or we are required to do so by law). For example, we may provide your personal data to a government authority under anti-money laundering and counter terrorist financing legislation.

7. How Long Do We Store Personal Data?

Our retention periods for personal data are determined by the purposes for which the personal data is processed, applicable legal and regulatory requirements, and our legitimate business needs, where applicable. We retain personal data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we may retain the information you provided to us as long as necessary to provide you with the services you requested through our Website and until the time limit for claims which may arise from those services has expired, or to comply with regulatory requirements regarding the retention of such data. So, if we use your personal data for more than one purpose, we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose(s) with a shorter period once that period expires.

When personal data is no longer needed, we either irreversibly anonymise the data (and we may further retain and use the anonymised information) or securely destroy the data.

8. Do We Transfer Personal Data to Other Countries Outside of the EEA or the UK?

Your personal data may be transferred outside the EEA or the United Kingdom, as applicable, under certain circumstances, for example, when personal data is transferred to, or stored in, or accessed by our employees or service providers in a destination outside the EEA or the UK. We ensure that such transfer of personal data is on the basis of either: (a) an adequacy decision, or (b) appropriate or suitable safeguards as required by applicable laws or regulations.

The European Commission has recognised the UK as providing an adequate level of protection for personal data transferred from the EEA to the United Kingdom. Accordingly, such transfers do not require additional transfer safeguards. This adequacy decision is subject to ongoing monitoring and periodic review by the European Commission, and this Privacy Notice will be updated if the position changes. Where Paynt Limited transfers personal data from the UK to another country, the transfer will be made in accordance with the UK GDPR, on the basis of applicable UK adequacy regulations or other legally recognised safeguards.

Where no applicable adequacy decision or regulation exists, we may use appropriate safeguards, including the European Commission’s standard contractual clauses or the transfer mechanisms recognised under the UK GDPR, as applicable.

9. How Do We Use Personal Data for Marketing?

If you conclude an agreement with us on provision of services, and if allowed by applicable laws, we will assume you want us to contact you by e-mail with information about our or cooperation partners’ products and services, offers and promotions. Where required by the applicable laws, we will ask for prior consent to receive marketing information. At any time, you may unsubscribe or opt-out of further communication by adjusting preferences on our platform or by sending an e-mail to [email protected]. As well as you can use the unsubscribe link provided in any marketing message we send you.

We will not share your information to any organisations outside our affiliated and subsidiary companies for their marketing purposes without your consent. We do not sell your personal data.

10. How to Contact Us?

If you have any questions or complaints about this Privacy Notice, please send us a written application to the registered office of the relevant Paynt entity identified in the Introduction or send an e-mail to [email protected] indicating your name, surname and request details, or contact us via customer support.

Where applicable, Paynt’s Data Protection Officer may also be contacted in relation to the processing of your personal data and the exercise of your data protection rights by e-mail at [email protected]. Communications addressed to the Data Protection Officer will be handled or routed accordingly.