1. Who is responsible for your data
The legal operator and data controller have not yet been identified in this draft because the operating company has not been incorporated. CryptiumPay is the product name, not a substitute for the controller's legal identity. The final notice must identify the person or entity currently responsible for processing, its address and applicable privacy contact or representative. Incorporation at a later date does not remove responsibilities for data already processed. You can direct questions to the support contact below.
2. Information you provide
Depending on the features you use, information may include account and contact details, authentication information, merchant or company details, representative information, project websites, product descriptions, uploaded branding, settings and messages sent to support. Provide only information relevant to your use of the service, and do not place sensitive identity documents or secret credentials in product descriptions, invoice notes or support messages.
3. Payment, integration and technical information
Payment features may process invoice references, amounts, asset and network selections, wallet addresses, transaction hashes, payment status, balances and withdrawal instructions. Merchant integrations may supply order references and customer information where relevant. Authentication and website operation also involve session data and browser preferences. Hosting and security infrastructure may process connection and diagnostic information; the final notice must confirm which logs, device data and retention settings are actually used.
4. Verification information
The proposed AML / KYC framework may require identity, business ownership, source-of-funds or related evidence. This draft does not assert that a particular identity provider, biometric check or automated blockchain screening system is in use. Before requesting additional verification data, the operator must establish a lawful basis, explain the collection and handling, identify relevant providers and provide a suitable submission channel. Additional safeguards may be required for sensitive or biometric information.
5. Why information is processed
The proposed purposes are to create and secure accounts, review merchant applications, provide invoices and payment information, manage balances and withdrawal requests, operate integrations, communicate about the service, respond to support requests, resolve disputes and meet applicable legal obligations. Security and fraud review should be limited to legitimate, explained purposes. Optional marketing or analytics must have a separate, appropriate basis; these drafts do not create consent merely because someone visits a page.
6. Legal bases and consent
The operator must assess the legal basis for each processing activity in the jurisdictions that apply. Where the relevant law recognises these bases, processing may be necessary for a contract, a specific legal obligation, a properly assessed legitimate interest, or valid consent. A legal obligation must actually apply to the responsible operator; it cannot be assumed from another service's policy. Where consent is required, it should be specific and withdrawable. Withdrawal does not make earlier lawful processing unlawful or remove a separate retention duty.
7. Recipients and external services
Providing the service may involve hosting, communication, authentication and other technical providers, as well as the merchant involved in a payment. If you choose an external sign-in method, the sign-in provider processes information under its own notice. Information may also need to be disclosed to professional advisers or competent authorities where there is a valid basis. The operator must confirm actual recipients, their roles and appropriate contractual safeguards. This draft does not authorise unrestricted sharing or establish an unverified list of subprocessors.
8. Public blockchains
Blockchain transfers expose information such as participating addresses, token amounts and transaction identifiers on the relevant network. Public records may be visible worldwide and can sometimes be linked to an individual using other information. CryptiumPay cannot edit or delete an independently maintained blockchain record. This does not remove obligations to protect or, where required, delete off-chain account data, internal associations and other information within the operator's control.
9. International processing
The locations of the operator, hosting infrastructure and service providers must be confirmed before the final notice is issued. If personal information is transferred internationally, the operator must identify any restrictions and implement the mechanism or safeguards required by applicable law. This draft does not claim that all information stays in one country or that a particular transfer agreement has already been signed. Relevant transfer information and a way to request details must appear in the final notice.
10. Retention and account closure
Information should be retained only for an identified purpose and the period justified by applicable law and operational need. Different schedules may be needed for accounts, transactions, verification records, security logs, support correspondence and backups. Account closure does not necessarily require immediate deletion of records needed for a valid legal obligation or dispute, but neither does it justify indefinite storage. Exact periods, starting points, deletion processes and backup handling remain to be approved and disclosed.
11. Security and your choices
The final programme should use appropriate access controls and measures to protect information, taking account of the risks and the data involved. No system can promise absolute security. Use a strong password, enable available security features and protect API and wallet credentials. The Cookie Policy explains browser storage and controls. Security certifications, encryption coverage and breach-response arrangements should be described only after their implementation has been verified.
12. Your privacy rights
Depending on applicable law and the circumstances, you may have rights to information, access, correction, deletion, restriction, portability, objection and withdrawal of consent. You may also have the right to complain to a competent supervisory authority. Contact support to ask about a request; reasonable identity checks may be needed to protect your information. The final notice must identify the relevant authority, response periods, request channel and any lawful exceptions. A blockchain's permanence is not a blanket reason to refuse every deletion request.
13. Merchant data and automated decisions
Merchants must have an appropriate basis for sending customer information to the service and provide the notices required for their own activities. The operator's role as controller or processor must be assessed for each relevant purpose rather than assumed for all data. A data-processing agreement may be required for processing on a merchant's instructions. If legally significant automated decisions are introduced, the operator must explain them and provide the safeguards and review rights required by the applicable law. This draft does not claim such decisions are currently made.
14. Children, updates and details to complete
The merchant account service is intended for adults with legal capacity. Contact support if you believe a child has provided information so the responsible operator can assess the situation and any required action. Before publication, complete the controller's identity and contact details, jurisdictional scope, processing inventory, legal bases, recipients and locations, transfer safeguards, retention schedule, security statements, rights process and notice of material changes. The revision date shown here identifies this draft only.