Privacy Policy

This Privacy Policy explains how personal data is collected, used, and protected when you visit the Pay2Easy website, use the merchant dashboard, or use Pay2Easy payment terminals and POS software. It is issued by:

Pay2Easy GmbH is the controller for the personal data described in this policy, unless stated otherwise.

Depending on how you interact with Pay2Easy, we may collect:

• Account and contact details, such as name, email, phone number, and business address
• Business and verification information, such as company registration and beneficial-owner details
• Transaction data processed through payment terminals and online payments
• Device and usage data, such as IP address, browser type, and pages visited
• Support communications, including messages sent to our customer support team

We do not collect more personal data than is necessary for the purposes described in this policy.

We use personal data to:

• Provide and operate Pay2Easy products and services
• Process payments and settle transaction proceeds
• Verify identity and meet onboarding, compliance, and anti-fraud obligations
• Provide customer and technical support
• Improve our website, products, and services
• Communicate service updates and, with consent, marketing information
• Meet legal, tax, and regulatory record-keeping requirements

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Performance of a contract, to provide the products and services you request
• Legal obligation, to meet compliance, tax, and financial-services regulation
• Legitimate interests, to secure our systems, prevent fraud, and improve our services
• Consent, for optional cookies and direct-marketing communications

You can withdraw consent-based processing at any time without affecting processing already carried out.

We share personal data only where necessary, and always subject to appropriate safeguards. Recipients may include:

• Regulated payment service providers, acquiring banks, and card networks
• IT, hosting, and infrastructure providers acting on our instructions
• Professional advisers, auditors, and regulators where legally required
• Fraud-prevention and compliance partners

We do not sell personal data to third parties.

Personal data is primarily processed within the European Economic Area. Where a provider is located outside the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or another lawful transfer mechanism recognised under the GDPR.

We retain personal data only as long as necessary for the purposes described in this policy, including any statutory retention period that applies to payment, tax, and accounting records under German law.

Once a retention period ends, data is deleted or anonymised in line with our internal data-retention schedule.

We apply technical and organisational measures — including encryption, access controls, and regular security testing — to protect personal data against unauthorised access, loss, or misuse.

Payment card data is handled in line with applicable PCI DSS requirements.

Our website uses cookies and similar technologies for essential, analytics, functional, and marketing purposes. Details of the categories used, retention periods, and your choices are set out in our Cookies Settings.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, where applicable
• Restrict or object to certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us using the details in Section 13.

Pay2Easy products and services are intended for business use and are not directed at children. We do not knowingly collect personal data from individuals under the age of 16.

We may update this Privacy Policy to reflect changes in our processing activities or applicable law. Material changes will be highlighted on the website, and the “Last updated” date above will be revised accordingly.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.