Paypercut Privacy Notice

1. About this Privacy Notice

This Privacy Notice explains how Paypercut EOOD ("Paypercut", "we", "us" or "our") collects,
uses, discloses, stores and otherwise processes personal data in connection with our business,
our software platform and related services. We may update this Privacy Notice from time to time
to reflect changes in our services, processing activities, legal requirements or business
practices.
Paypercut is a software-as-a-service and technology platform provider. Our platform enables
merchants and other businesses ("Merchants") to manage and facilitate card payment activities
and related services. This Privacy Notice is intended to explain how Paypercut processes
personal data where Paypercut acts as a data controller and, where relevant, to explain how
Paypercut processes personal data on behalf of other parties as a data processor.
This Privacy Notice applies to individuals in the EU whose personal data we process, including,
as applicable:

• Merchants who are individuals (including sole traders) and directors, officers, beneficial
  owners and other individuals connected with Merchants, including authorised
  representatives, attorneys and contact persons.
• Employees and users authorised by Merchants to access the Paypercut platform.
• Customers, cardholders and payers who make or attempt to make payments to
• Merchants using payment services supported by the Paypercut platform and the
  individuals involved in chargebacks, refunds, disputes or transaction investigations.
• Representatives of business partners, service providers and other organisations with
  whom we interact.
• Visitors to our websites and users of our online services.
• Other individuals whose personal data we process in connection with the conduct of our
  business.

‍
This Privacy Notice is intended to apply to processing of personal data within the scope of the
Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR"), together with
applicable national data protection legislation, including the Bulgarian Personal Data Protection
Act.

2. Who is responsible for your personal data?

The relevant data controller for personal data processed by Paypercut for its own purposes is:

Paypercut EOOD
Company number: 208256434
Registered address: Villa Rosa, Oborishte 22A, 1504 Sofia, Republic of Bulgaria
Website: https://paypercut.com
Privacy contact: onboarding@paypercut.co

3. Our different roles under data protection law

Depending on the processing activity, Paypercut may act in different capacities.

3.1 Paypercut as controller

Paypercut acts as an independent controller where we determine the purposes and means of
processing personal data for our own purposes. This includes processing relating to:

• Managing our relationship with Merchants and business partners.
• Establishing and administering accounts, onboarding Merchants and verifying business
  information.
• Conducting KYC and KYB checks and identifying and verifying directors, beneficial
  owners and any individuals connected with Merchants.
• Fraud prevention and detection.
• AML and counter-financial-crime activities, including sanctions and screening checks.
• Assessing Merchant, transaction and other risks.
• Protecting the security and integrity of our platform and systems and preventing misuse,
  abuse or prohibited activity.
• Complying with legal and regulatory obligations applicable to Paypercut.
• Billing, accounting and financial administration.
• Improving and developing our products and services and conducting analytics.
• Communicating with you, Merchants, customers and business contacts.
• marketing, where permitted by applicable law.

3.2 Paypercut as processor for Merchants and other third parties

Paypercut may also process personal data on behalf of Merchants and other third parties
including BNPL providers, referral partners, analytics providers, or alternative payment service
providers. Such parties may provide Paypercut with personal data relating to its customers,
cardholders, payers or other individuals in order to use Paypercut's platform and related
services. Where Paypercut processes personal data on behalf of a third party and in
accordance with their documented instructions, Paypercut acts as a processor, and the third
party generally acts as the controller. If you are an individual whose personal data is processed
by Paypercut solely on behalf of a third party, you should generally contact the relevant third
party regarding the processing and exercise of your data protection rights. You may also contact
Paypercut, and we will assist the third party as required by applicable law and our contractual
arrangements.

3.3 Regulated Payment Service Providers

Regulated payment and acquiring services associated with transactions supported by the
Paypercut platform are provided by regulated payment service provider (such as Paynetics AD,
Paynetics UK Limited, and Adyen NV) (each a “PSP”). A PSP may process personal data as an
independent controller in connection with the regulated payment and acquiring services it
provides and in accordance with its own legal and regulatory obligations.

‍
Alternatively, where Paypercut facilitates regulated payment acquiring services provided by a
PSP Paypercut and that PSP may also act as joint data controllers in respect of personal data
processed for those services. In such cases:

• The respective roles and responsibilities of the joint controllers are defined in a separate
  joint controller data processing arrangement.
• Each controller remains responsible for complying with its obligations under the GDPR.
• You may exercise your data protection rights against either controller.

Paypercut and a PSP do not automatically act as joint controllers merely because Paypercut's
platform supports or facilitates payment transactions. But in cases where Paypercut and another
organisation jointly determine the purposes and means of a specific processing activity, the
parties will be joint controllers and will establish appropriate arrangements as required by
applicable data protection law.

4. What personal data do we process?

Depending on your relationship with Paypercut and the services you use, we may process the
following categories of personal data:

• Business and identification information: company details, registration and tax information,
  business address, names, dates of birth, address and contact information about
  directors, beneficial owners, representatives and other individuals connected with a
  Merchant.
• Contact and account information: names, email addresses, telephone numbers, job titles,
  account details, permissions and authentication information.
• Verification and compliance information: information used for KYC, KYB, identity
  verification, beneficial ownership checks, sanctions screening, fraud prevention, AML and
  risk management.
• Payment and transaction information: cardholder or payer names, transaction references,
  amounts, currencies, dates, payment status, refunds, chargebacks, disputes and related
  transaction metadata.
• Technical and usage information: IP addresses, device and browser information, logs,
  cookies, API activity and information about how our platform and services are used.
• Communications information: correspondence, support requests, complaints and records
  of communications with us.
• Risk and assessment information: information relevant to fraud detection, transaction and
  account risk, and other compliance or risk-management activities.

Some of the personal data we process may be received from Merchants or other third parties,
including payment service providers, verification providers, public registers and compliance or
risk-management providers.

5. How do we collect personal data?

We may collect personal data:

• Directly from you.
• From Merchants and other third parties.
• From regulated PSPs and other payment service providers.
• From public and third-party sources.

Where we receive personal data about you from a source other than you, we will provide the
information required by Article 14 GDPR, unless an applicable exemption or restriction applies.

6. Why do we process personal data?

We process personal data for the following purposes and the specific legal basis applicable to a
particular processing activity depends on the circumstances and our role in relation to that
processing.

‍

Where we rely on our legitimate interests, those interests may include operating and managing
our business, providing and improving our services, preventing fraud and financial crime,
protecting the security of our systems, managing risks, protecting our rights and property,
enforcing contractual terms, maintaining business records and communicating with customers
and business contacts. When relying on legitimate interests, we consider whether our interests
are overridden by the interests or fundamental rights and freedoms of the individuals concerned.

7. Processing of cardholder and payer data

When you make or attempt to make a payment to a Merchant using a payment service
supported by the Paypercut platform, the Merchant may provide Paypercut with certain
information relating to you and the transaction including your name and transaction-related
information. Where Paypercut processes such information solely on behalf of the Merchant and
in accordance with the Merchant's instructions, Paypercut acts as a processor, and the
Merchant is generally the controller. Paypercut may also process certain information as an
independent controller where we determine the purposes and means of processing for our own
purposes. Regulated payment and acquiring services associated with a transaction are provided
by a PSP, which may independently process personal data in connection with those services.

8. Special categories of personal data

Paypercut does not generally seek to process special categories of personal data as defined by
Article 9 GDPR. However, information provided to us or generated through compliance, fraud
prevention or risk management processes may in some circumstances reveal or indirectly relate
to sensitive information. Where we process special categories of personal data, we will do so
only where permitted under applicable data protection law and where an appropriate condition
under Article 9 GDPR or applicable national law applies.

9. Who do we share personal data with?

We may disclose personal data to the following categories of recipients.

9.1 Merchants

Where appropriate and permitted, we share and process information with Merchants in
connection with services provided through the Paypercut platform, including your transaction
information, payment-related information and information necessary to manage Merchant
accounts.

9.2 Regulated payment service providers and other third parties

We share and process relevant personal data with Paynetics AD, Paynetics UK Limited, Adyen NV and
other regulated payment services providers where necessary to facilitate payment-related services,
transaction processing, settlement, reconciliation, fraud prevention, disputes, compliance or other
related activities. PSPs process personal data as an independent controller
for its own regulated services where applicable.

9.3 Technology and other third-party service providers

We may engage third-party providers for services such as cloud hosting, IT infrastructure,
software, cybersecurity, identity verification, KYC/KYB, fraud prevention, analytics,
communications and other business support services. Where a provider processes personal
data on Paypercut's behalf, we will put appropriate contractual and organisational safeguards in
place, including where required GDPR-compliant agreements.

9.4 Independent controllers

Certain third parties may process personal data as independent controllers for their own
purposes, including Paynetics AD, Paynetics UK Limited and Adyen NV, other regulated
financial or payment service providers, financing or BNPL providers, where applicable and other
organisations where they determine their own purposes and means of processing. Where you
use a service provided by an independent controller, that organisation's own privacy notice may
apply.

9.5 Authorities and legal recipients

We may disclose personal data where necessary or permitted by law to regulators, law
enforcement authorities, supervisory authorities, legal advisers and other persons where
disclosure is required or permitted by applicable law.

10. International transfers

Paypercut will seek to process personal data within the European Economic Area ("EEA").
However, some of our service providers or recipients may be located outside the EEA. Where
personal data is transferred outside the EEA, we will comply with the GDPR and applicable data
protection law. Depending on the circumstances, transfers may be based on an adequacy
decision adopted by the European Commission, European Commission's Standard Contractual
Clauses or another lawful transfer mechanism recognised under applicable data protection law.
Where appropriate, we will implement additional safeguards required by applicable law.
Information about relevant international transfers and safeguards may be obtained by contacting
us.

11. How long do we keep personal data?

We retain personal data only for as long as necessary for the purposes for which it was
collected, unless a longer retention period is required or permitted by law. The applicable
retention period depends on the nature of the data and the purpose of processing. Generally, we
retain personal data for the duration of the relationship and for an appropriate period afterwards
to meet operational, legal, accounting, contractual and dispute-management requirements. We
may retain information for longer where necessary to establish, exercise or defend legal claims,
comply with a legal obligation, or protect our legitimate interests.

12. Cookies and similar technologies

We use cookies and similar technologies on our website and in connection with the provision of
our online services. These may include strictly necessary cookies, functional cookies, analytics
cookies and marketing or advertising cookies. Strictly necessary cookies may be used where
necessary to provide requested services or operate our website. Where consent is required for
non-essential cookies or similar technologies, we will request consent in accordance with
applicable law.

13. Data security

We implement appropriate technical and organisational measures designed to protect personal
data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or
access. The measures we use may include: access controls; authentication mechanisms;
encryption where appropriate; monitoring and logging; network and infrastructure security;
security testing; backup and recovery procedures; and employee confidentiality obligations. No
method of transmitting or storing information is completely secure. However, we take
appropriate measures to reduce the risks to personal data and to respond to suspected or
confirmed personal data breaches in accordance with applicable law.

14. Your data protection rights

Depending on the circumstances and subject to applicable legal restrictions, you have the
following rights under the GDPR:

• Right of access — to obtain confirmation as to whether we process your personal data
  and, where applicable, a copy of that data.
• Right to rectification — to request correction of inaccurate or incomplete personal data.
• Right to erasure — to request deletion of personal data in certain circumstances.
• Right to restriction — to request that processing is restricted in certain circumstances.
• Right to data portability — to receive certain personal data in a structured, commonly
  used and machine-readable format and, where technically feasible, request its
  transmission to another controller.
• Right to object — to object to certain processing based on legitimate interests or to
  processing for direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw
  consent at any time. Withdrawal does not affect the lawfulness of processing carried out
  before withdrawal.
• Rights relating to automated decision-making — where applicable under GDPR, you
  may have rights in relation to decisions based solely on automated processing.

These rights are not absolute and may be subject to conditions, exemptions and legal
restrictions. You may exercise your rights by contacting us at:

Email: onboarding@paypercut.co

We may ask for additional information to verify your identity where reasonably necessary to
protect personal data and prevent unauthorised access. We will normally respond to a valid
request without undue delay and, in any event, within the period required by applicable data
protection law. Where permitted by law, this period may be extended where a request is
complex or multiple requests have been received. If we are unable to comply with your request,
we will explain the reasons, subject to any legal restrictions on providing such information.

15. Complaints and supervisory authorities

If you have concerns about how Paypercut processes your personal data, we encourage you to
contact us first so that we can investigate and address your concerns.
You also have the right to lodge a complaint with a competent data protection supervisory
authority.
As Paypercut is established in Bulgaria, the relevant supervisory authority in Bulgaria is:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
Sofia 1592
Republic of Bulgaria
Email: kzld@cpdp.bg
Website: https://cpdp.bg/

You may generally lodge a complaint with the supervisory authority in the EU/EEA country
where you normally live, work or where you believe an infringement has occurred, subject to the
applicable rules.

16. Contact us

If you have questions about this Privacy Notice or how Paypercut processes personal data,
please contact us:

Paypercut EOOD
Company number: 208256434
Villa Rosa, Oborishte 22A
1504 Sofia
Republic of Bulgaria

Privacy enquiries: onboarding@paypercut.co
Website: https://paypercut.com