1. Scope and Roles
This notice explains how PayCow handles personal data where the EU General Data Protection Regulation (GDPR) applies. PayCow Distributed Ledger Technologies generally acts as a controller when deciding how merchant account, security, support and administrative data is used. When processing customer transaction or order information solely on a merchant’s documented instructions, PayCow may act as a processor and the merchant may be the controller. The role depends on the specific processing activity, not simply the name of the service.
2. Information We Process
Depending on how you use PayCow, data may include account and business contact details, authentication and support activity, IP addresses, user-agent-derived browser/OS information, security-verification results, logs of registration attempts, transaction status, wallet addresses, public blockchain identifiers, donation or order information and limited operational metadata. Merchant storefront and donation settings may contain information merchants choose to publish. Public blockchain records can remain available outside PayCow’s control.
3. Purposes and Lawful Bases
- Contractual necessity: account administration, delivery of subscribed services and transaction-status functionality.
- Legitimate interests: system integrity, fraud detection, access security, incident response and appropriate operational records, subject to balancing against individual rights.
- Legal obligations: records or disclosures required under applicable law.
- Consent: specific optional processing where consent is required, including non-essential cookies if implemented.
The applicable lawful basis varies by activity; no single basis applies automatically to every data type or purpose.
4. Recipients and Service Providers
Relevant data may be processed by hosting, email-delivery, security verification and technical service providers to operate the platform. For example, registration email screening and network abuse checks involve external verification services. Merchants may receive transaction and customer information connected with their own stores, donations or payment operations. We do not treat service-provider access as permission for unrestricted independent use. Additional disclosures may be required where particular providers or circumstances apply.
5. International Data Transfers
Data may be transmitted or accessed outside the European Economic Area where PayCow or its service providers operate. Where GDPR transfer rules apply, transfers must rely on an appropriate legal mechanism, such as an adequacy decision, applicable standard contractual clauses, or another lawful exception, together with any required safeguards. The specific destinations and transfer mechanisms should be confirmed against current provider arrangements.
6. Retention and Security
We aim to retain personal information only as long as necessary for the applicable service, security purpose or legal requirement. Retention differs by record type; for example, temporary-email registration rejection logs are configured to expire after 90 days, while other operational, financial or account records may have different periods. We use access controls and security measures suited to the service, but no internet-connected system is risk free. Backup copies and public blockchain records may not be removable on the same schedule as application records.
7. Your GDPR Rights
Where the GDPR applies and subject to relevant conditions and exceptions, you may request access, rectification, erasure, restriction, portability or object to certain processing. You may withdraw consent at any time for processing based on consent, without affecting processing already lawfully completed. You may also have rights concerning solely automated decisions producing legal or similarly significant effects.
Identity verification may be required to protect other users. Some deletion requests cannot be fulfilled immediately when records must be retained by law or for defensible legal claims.
8. How to Exercise Rights
Contact [email protected] with the subject “GDPR Data Request” and describe the data or service involved. We will assess the request and respond within the time period required by applicable law; under the GDPR this is generally one month, subject to permitted extensions. Do not include a password, private key or API secret.
If PayCow is acting solely as a processor for a merchant-controlled dataset, we may refer the request to the relevant merchant or assist that merchant in handling it.
9. Complaints and Supervisory Authorities
Individuals covered by the GDPR may lodge a complaint with the data protection supervisory authority in the EU/EEA country of their habitual residence, workplace or the location of an alleged infringement. You can also contact us first so we can investigate your concern. Nothing in this notice limits statutory rights or remedies.
10. Policy Updates
This document supplements PayCow’s Privacy Policy and Cookie Policy. We may update it to reflect changes to processing activities, service providers or legal requirements. The date above identifies this publication version. This text is a transparency statement and does not by itself certify GDPR compliance.
Related documents: Privacy Policy · Cookie Policy · GDPR & Data Protection.