Privacy Policy

Privacy policy objective and its application

We value your trust and are committed to ensure proper protection of your personal data. We respect your privacy and pledge to process and protect your personal data in a fair and lawful way in accordance with the applicable legal requirements of the European Union (General Data Protection Regulation 2016/679) (hereinafter referred to as the “GDPR”).

This Privacy policy explains how we collect and process the personal data about people who use our payment initiation and account information services. This Privacy policy provides information about the scope of processing personal data, the purposes, sources, recipients, and other important aspects of personal data processing.

In this Privacy policy, we describe what personal data we collect and process about people who use our payment services, clients, visitors of this website, people that consented to receive direct marketing messages.

We may process your personal data for purposes other than those described in this Privacy policy. If this is the case, we will provide you with a separate privacy statement informing you about such processing.

Please note that additional information might be provided in applicable terms and conditions, contracts, and other documents provided by us.

We may change this Privacy policy at any time at our sole discretion, therefore, you have a responsibility to make sure that you are familiar with the latest version of the Privacy policy.

Definitions

Personal data

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Personal data processing

Personal data processing means any operation or set of operations which is performed on personal data or on sets or personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Company

www.corytech.com is a website operated by Corytech operators (“Company”, “we”, “our”, or “us”). Corytech Operators refer to all parties that provide services available on this website according to their authority and role (“Corytech services”), including but not limited to legal persons, unincorporated organizations and teams that provide services and are responsible for such services and are represented currently by:

Corytech operators may change as Corytech’s business adjusts, in which case, the changed operators shall perform their obligations under these terms with you and provide services to you, and such change does not affect your rights and interests under these terms. Additionally, the scope of Corytech operators may be expanded due to the provision of new Corytech services. By continuing to use Corytech services, you are deemed to have agreed to execute these terms jointly with the newly added Corytech operators.

Contact information

Due to the requirements of the GDPR, the Company has appointed a Data protection officer.

You can contact the Company via email: [email protected].

Personal data

We may collect personal data about you directly from you and from a third party (such as your bank or merchant from who you buy goods or services), where you have given your explicit consent for your information to be transferred to the Company in order to initiate payment and receive bank account information.

Your personal data also might be obtained indirectly from other organisations where you have explicitly consented to your information to be transferred, specific register and information systems.

We will collect and process your personal data in accordance with the applicable laws and regulations.

We may use and transfer your personal data for several different purposes and we rely on different legal grounds while processing it. Depending on whether you are a person who uses payment services, a representative of a current or potential client of ours or a website visitor, the below information sets out what categories of personal data we process, for what purpose and legal ground we rely on when processing the personal data. We also describe how we collect your personal data and who we may transfer it to, as well as the legal ground that allows us to do so.

Personal data collected while processing your payment

If you are a card-holder making a payment to a merchant using our Services to process your payment, we may, directly or through a merchant using our payment processing service, collect, store and process financial and transaction related personal data about you and your transaction. This may include your billing address, delivery address, date of birth, purchase amount, date of purchase, payment method, credit or debit card number, bank account information and additional necessary information required to process your transaction. Merchants are responsible for providing appropriate privacy information to you about our processing of your data.

When securing our website and Services, we may collect details about your device, your transaction, your computer’s internet protocol and other technical information, through our data security and firewall providers.

Implementation of the “Know Your Client” principle and prevention of money laundering and terrorist financing

When required for compliance with applicable laws (including specifically anti-money laundering and counter-terrorism financing laws and regulations), we may verify your information and collect information from publicly available sources, credit reference or fraud prevention agencies or check data against government sanction lists, either directly, or using identity verification providers or due diligence and screening information providers.

For this purpose, we may process the personal data of our client’s representatives, directors and shareholders and / or other persons.

We may process the following personal data: name, surname, a unique sequence of symbols intended to identify the person, date of birth, the number and period of validity of the residence permit and the place and date of its issuance, address, citizenship, the country of issuance of the identification document (in cases of a stateless person), workplace (in cases of client’s director), image, personal identification document details, equity of the legal entity’s shares/voting rights/control (in cases of shareholder and beneficiary), signature, other data required by the Law on Prevention of Money Laundering and Terrorist Financing.

Following the legal requirements related to the implementation of “Know Your Client” principle and prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, we may process your image (in the form of a photograph or live image) (biometric data) for identification purposes. Your image and personal identification document are combined in order to check if you are the owner of the presented personal identification document.

The Company may also process personal data of people who certify copies of documents or delegation. We may process the following personal data: name, surname, workplace, signature, other data required by the Law on Prevention of Money Laundering and Terrorist Financing.

Personal data are collected and processed on the basis of the legal obligation imposed on the payment initiation service provider, i.e. us. Your biometric data (your image) shall be processed on the basis of your consent (when image is processed for identification purposes). If you do not consent with processing of your biometric data, please contact us (Service provider that provides The Company an identification platform) for another method of identifying your identity.

We will process personal data for as long as we need it to fulfil the purpose the data was collected for and following the legal requirements. Personal data will be stored for 8 years after the termination of the business relationship with the Client. The data retention period may be extended for a period not exceeding 2 years, provided there is a reasoned request from a State Authority.

Performance of the Company‘s agreements

We will process personal data of our clients, its employees as well as our service providers in order to perform the agreements.

In such a case, we may process your personal data such as: name, surname, messaging content.

In cases when the Company enters into Agreements with a natural person, the Company will also process personal identification code, contact details (e-mail address, telephone number, address), other data that may be required to perform an agreement.

The basis for the processing of data is the performance of a contract between you and the Company and legitimate interest of the Company.

Personal data indicated in this section will be processed for as long as the agreement is in effect. If personal data are indicated in the agreement, they will be stored for 10 years as of the date of expiration of the respective agreement.

Client support

We value your feedback and we want to understand what we can do to improve our services. Therefore, you can contact us in order to receive assistance on your question or concern as well as any time that you are seeking to implement your rights.

If you contact us, we will process your personal data by collecting your contact details through the source you chose to contact us (via e-mail, post or any other way).

All personal data will be processed on the basis of your consent which is expressed by your actions by sending us a question, concern or request

Your personal data will be stored for 1 year after certain question, concern or request was sent to us. In some individual cases, in accordance with the applicable legal requirements, your personal data might be stored longer.

Direct marketing

In cases you provided your contact information and expressed explicit consent to receive marketing information from us, the Company’ may contact you by phone or via e-mail providing you with the information about the Company’s services or submit other promotional material, e-mail send out commercial offers, newsletters and other advertising material.

We may process the following personal data for direct marketing purposes: name, surname, workplace, phone number, e-mail address, other information that person may provide, date of consent.

If you are our client and have not objected to our direct marketing messaging (by phone or email), we may use your personal data without explicit consent offering you similar products and/or services for which your personal data were originally collected via e-mail or phone. In such a case your personal data will be processed on the basis of our legitimate interest.

Your data will be used for direct marketing purposes for 1 (one) year as of the receipt of your consent or after provision of services.

You have the right to refuse direct marketing at any time by contacting us via e-mail on [email protected]. 

Data processors. data recipients

We can disclose your personal data to our employees, managers, service providers such as auditors, your bank or merchant.

Moreover, we can disclose information about you:

• If we must do this under the law (state institutions, law enforcement institutions and other persons in accordance with the applicable procedure;
• In order to protect our rights or interests (including the provision of your data to third parties in order to recover your debts to us);
• In order to sell a part of Company’s activities or assets, where we disclose your personal data to the potential buyer of the activities or a part thereof;
• Having sold the activities of the Company or a substantial part thereof to third parties.

We may also provide personal data to other persons upon receiving your written consent.

Except in cases provided in this Privacy Policy or / and in any other agreement signed with you , we do not transfer your personal data to any third parties.

If we disclose your personal data to groups of recipients other than those specified in this Privacy policy, we will inform you as soon as such personal data are disclosed for the first time, unless we have already provided you such information earlier.

Transfer of Personal Data to Third Parties

Clients’ Personal data is stored and processed by the Company, and its cooperation partners within the EU.

The Company reserves the right to disclose Clients’ Personal data to the following entities insofar as such data is necessary for the performance of their delegated functions and there is an adequate legal basis for a lawful disclosure of Personal data:

• to selected and designated third parties, including Company’s partners, affiliates, providers that perform services on behalf of the Company under a written agreement, which ensures proper safeguards and limitations with regards to Processing. This may include companies providing IT, audit, identity verification, marketing, translation and/or due diligence services, data analysis, cloud service providers and others;
• to government, regulatory or other law enforcement agencies/authorities in cases specified by law and regulatory enactments.

Transfer of Personal Data Outside the EU

Personal data may be transferred by the Company outside the EU only when appropriate security measures have been taken and if at least one of the following applies:

• Personal data transfer is required under the laws and regulatory enactments being in force in the EU;
• Personal data transfer is necessary for the Company to enter into or perform an agreement with Clients for the provision of Services;
• In other cases, where the Client has given express consent to the Processing outside the EU.

Security of your personal data

Your personal data will be processed pursuant to the requirements set out in GDPR and other applicable legal acts.

In the course of processing your personal data, we implement organizational and technical measures which ensure the protection of personal data from an accidental or unlawful destruction, alteration, disclosure and any other unlawful processing. These measures may include, among other, encryption, physical access security, auditing and other appropriate technologies.

Your rights

This section contains information about your rights related to the processing of your personal data carried out by us and cases where you can exercise these rights. If you would like to receive more information on your rights or to exercise them, please contact us via e-mail indicated in this Privacy policy.

We will provide information on actions taken on a request with regard to implementation of your rights within 1 (one) month of receipt of the request. In consideration of the request complexity and the number of received requests, the aforementioned term may be extended for 2 (two) further months. In this case, we will notify you of such term extension and reasons for it within 1 (one) month as of the receipt of request. We will refuse to implement your rights only in cases provided for in the legal acts.

Your rights are as follow:

The right to be informed

As a data controller, we are obliged to provide clear and transparent information about our data processing activities. This is provided by this Privacy policy.

The right of access

We want you to fully understand how we use your personal data and not to experience any inconvenience because of that. You can contact us at any time and ask if we process any of your personal data. If we store or use your personal data in any way, you have the right to access them.

We will provide access to the personal data we hold about you as well as the following information: the purposes of the processing, the categories of personal data concerned, the recipients to whom the personal data has been disclosed, the retention period or envisioned retention period for that personal data, when personal data has been collected from a third party, the source of the personal data.

The right to rectification

When you think we process inaccurate or incomplete personal information about you, you may exercise your right to correct or complete certain personal data. This may be used with the right to restrict processing to make sure that incorrect/incomplete personal data is not processed until it is corrected.

The right to restrict processing

You have the right to ask us to restrict the processing of your personal data or to object to their processing:

• During the period required for us to verify the accuracy of your personal data when you submit claims with regard to data accuracy;
• During the period required to determine if we have an overriding legal basis to continue processing your personal data if you exercise your right to object to the processing of your personal data.

The right to data portability

You have the right to the portability of data obtained by us under your consent or for the purpose of agreement conclusion. If you exercise this right, we will transfer a copy of the data provided by you.

The right to object

You have the right to object to the use of your personal data by us:

• In cases where we use such data in order to implement our legitimate interests but we do not have an overriding legal basis to continue using your personal data; or
• At any time when we use your personal data to send newsletters or for direct marketing purposes. In such a case, the data will not be used for these purposes anymore; however, they may be used for other legitimate purposes.

If you believe that your rights of the data subject have been and/or may be violated, please promptly contact us via email indicated in this Privacy policy. We ensure that as soon as we receive your complaint, we will contact you within a reasonable period and inform you about the complaint handling process, and them about its result.

Privacy policy review

We may update or amend this Privacy policy at any time. Such an updated or amended Privacy policy will come into effect as of its publication on our website. You should check it from time to time and make sure that you find the current version of the Privacy policy acceptable.

After making an update to the Privacy policy, we will notify you about any changes that we consider material by publishing them on our website.