AYDAPAY – Privacy Policy & Cookie Notice

This Privacy Policy explains how AYDAPAY collects, uses, shares and protects personal data when you use our website, the AYDAPAY App and our customer support channels, and what rights you have. It should be read together with our Customer Data Protection Policy, which describes our security and data protection commitments in more detail.

1. Who we are and how to contact us

AYDAPAY SP. Z O.O. is the controller of your personal data. AYDAPAY is entered in the register of payment service providers of the Polish Financial Supervision Authority (KNF) as a small payment institution.

• Data protection contact: gdpr@aydapay.com or help@aydapay.com (subject: "Data Protection")
• Customer support: in-app chat · +48 737 660 344
• Post: AYDAPAY SP. Z O.O. – Data Protection, Aleja Armii Ludowej 6/164, 00-571 Warsaw, Poland

Services provided in the App by our regulated partners under their own licences ("Partner Services", Customer Account Agreement clause 1.4) involve processing by those partners as independent controllers under their own privacy notices, which we provide on request.

2. Who this Policy applies to

Individual Customers; directors, representatives, beneficial owners and authorised users of Business Customers; payees and beneficiaries; people who contact us; and visitors to our website and App. Our services are for adults aged 18 or over, and we do not knowingly collect data from minors.

3. Personal data we collect

We collect data from you, from your device, from our identity verification and screening providers, from our payment partners, and from public registers and public sources.

4. Purposes and legal bases

5. Automated decision-making

We use automated and AI-assisted tools for identity verification, screening, fraud detection and transaction monitoring. Alerts are reviewed by trained staff, and no account is refused or closed, and no payment permanently rejected, solely by an automated system. Where a decision based solely on automated processing significantly affects you, you may request human intervention, express your point of view and contest the decision.

6. Who we share data with

We do not sell personal data. We share it only where necessary with:

• our regulated partners – Banking Partner, Money Transfer Partner and licensed payout partners in the destination country – and card acquirers and payment initiation providers;
• identity verification, sanctions screening and fraud prevention providers;
• IT, cloud hosting, communications and customer support providers;
• auditors and legal advisers;
• public authorities, including the KNF, the General Inspector of Financial Information (GIIF), tax authorities, courts and law enforcement, where the law requires it.

Processors acting for us are bound by data processing agreements under GDPR Art. 28.

7. Transfers outside the EEA

Because we work with partners in the United Kingdom and deliver transfers to recipients worldwide, some data is transferred outside the European Economic Area. We do so only (a) to countries with a European Commission adequacy decision, such as the United Kingdom; (b) under the European Commission's Standard Contractual Clauses with a transfer risk assessment; or (c) where the transfer is necessary to execute a payment you have instructed (GDPR Art. 49(1)(b)).

8. How long we keep data

• Due diligence, identity verification and transaction records: 5 years from the end of the business relationship or the occasional transaction, as required by the Polish AML Act (extendable by up to 5 years at the request of the competent authority).
• Biometric data: only as long as needed to complete identity verification; the verification result and audit record are kept as part of the due diligence records above.
• Complaints and communications: at least 5 years.
• Accounting records: 5 years from the end of the tax year.
• Marketing preferences: until you withdraw consent. Cookies: as shown in the cookie table below.

Data is then securely deleted or anonymised.

9. Security

We protect personal data with encryption in transit and at rest, Strong Customer Authentication, role-based access control with access logging, data minimisation, vendor due diligence, staff confidentiality undertakings and training, and regular security testing. Details are set out in our Customer Data Protection Policy.

10. Cookies and similar technologies

Non-essential cookies are placed only after you consent through our cookie banner, where "Reject all" is as easy to choose as "Accept all". You can change or withdraw your choice at any time through the cookie settings link on our website or in your browser settings.

11. Your rights

You have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests or for direct marketing, to withdraw consent at any time, and to request human review of automated decisions. Send your request through the App or to gdpr@aydapay.com. We verify your identity and reply within one month (extendable by two months for complex requests, with notice to you). Requests are free of charge. Some rights are limited where the law requires us to keep data, for example anti-money laundering records.

You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl, or with the supervisory authority in your EU/EEA country of residence.

12. Payment secrecy

Information about you and your payments is protected by professional secrecy under the Polish Act on Payment Services and is disclosed only as permitted by that Act, the Customer Account Agreement or other law.

13. Changes

We review this Policy at least annually. We will tell you in the App or by email before any significant change takes effect. The current version and its effective date are always available on our website and in the App.

AYDAPAY SP. Z O.O. · Aleja Armii Ludowej 6/164, 00-571 Warsaw, Poland · KRS 0001036277 · help@aydapay.com