Privacy Policy

1. Who we are

WayPay Limited ("WayPay", "we", "us"), 1521 Blake St, Ste 47009, Denver, CO 80202, United States, provides crypto payment services to businesses. This policy explains how we collect, use, share and protect personal data when you visit usewaypay.com, contact us, or when you or your company use our services.

For data about our business customers, their staff and visitors to our website, WayPay is the controller. For data about our customers' own clients ("End Users"), our customer is generally the controller and we process it on their behalf, except where we must use it for our own legal obligations, such as anti-money-laundering and sanctions screening, in which case we act as a controller for that purpose.

2. Data we collect

• Contact data: name, job title, company, work email and phone number, and the content of messages you send us.
• Business and KYB data: company registration details, licenses, ownership structure, and identity information and documents for directors, beneficial owners and authorized users.
• Transaction data: wallet addresses, transaction hashes, amounts, assets, timestamps, and Travel Rule information about originators and beneficiaries where required.
• Account and security data: console login records, security-key identifiers, approval records, API usage logs, IP addresses and device information.
• Website data: basic technical information your browser sends when you visit our website, such as IP address, browser type and pages requested, kept in server logs.

We collect this data from you directly, from your company, from your use of the services, from public blockchains, and from identity-verification, blockchain-analytics and sanctions-screening providers.

3. How we use it

• To provide the services and perform our contract with you or your company, including onboarding, processing transactions, support and billing.
• To meet legal obligations, including customer due diligence, transaction monitoring, sanctions screening, Travel Rule, suspicious-activity reporting, tax and record-keeping.
• To keep the services secure, including fraud prevention, access control, audit logs and incident response.
• To communicate with you, including replying to inquiries, sending service notices and, where permitted, information about our services. You can opt out of marketing at any time.
• To improve our business, using aggregated or de-identified information where possible.

Where the EU or UK GDPR applies, our legal bases are performance of a contract, compliance with legal obligations, and our legitimate interests in running a secure and compliant payment business. Where we rely on consent, you may withdraw it at any time.

4. Cookies

Our website does not use cookies for advertising or analytics, and we do not track you across other websites. All fonts, images and scripts are served from our own servers.

5. How we share data

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only with:

• service providers that help us operate, such as hosting, key-management, identity-verification, blockchain-analytics, email and support providers, under contracts that limit their use of the data;
• other virtual-asset service providers involved in a transaction, where the Travel Rule requires it;
• our customer, in the case of End User data we process on their behalf;
• regulators, law-enforcement agencies, courts and tax authorities, where the law requires or permits it;
• professional advisers, auditors and insurers, under duties of confidentiality;
• a buyer or successor, in connection with a merger, acquisition or sale of all or part of our business.

Wallet addresses and transactions are recorded on public blockchains by design. We cannot remove or change data recorded on a blockchain.

6. International transfers

WayPay is based in the United States, and we and our service providers may process data in the United States and other countries. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. Retention

We keep KYB, transaction and related records for at least five years after the end of the business relationship or the date of the transaction, or longer where the law requires. Contact inquiries that do not lead to a business relationship are kept for up to two years. Security logs are kept for as long as needed for security and audit purposes. When data is no longer needed, we delete or anonymize it.

8. Security

We protect personal data with encryption in transit and at rest, least-privilege access, hardware-key authentication for staff, and logging of access to sensitive systems. No system is completely secure, and we will notify you and the relevant authorities of a personal data breach where the law requires.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data, subject to our legal obligations to keep certain records;
• object to or restrict certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it;
• lodge a complaint with your local data-protection authority.

California residents have the right to know, delete and correct personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise your rights, contact us through the contact form on our website or write to our registered address. We will verify your identity before acting on a request and respond within the time the law requires. If you are an End User of one of our customers, we may refer your request to that customer as the controller.

10. Children

Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date, and we will notify customers of material changes by email or in the console.

12. Contact

WayPay Limited
1521 Blake St, Ste 47009
Denver, CO 80202, United States