Privacy Policy

This Policy applies to personal data we process about individuals who visit our website, register for or use our services, or otherwise interact with us. ECardPay is responsible for the personal data described in this Policy as a controller, and determines how and why it is processed.

Where services are delivered through our Partners, those Partners may also process your personal data as controllers in their own right for their own regulatory and operational purposes. This Policy describes our processing; a Partner's own privacy notice governs the processing it carries out as a controller.

We collect personal data that you provide to us, that is generated when you use the services, and that we receive from Partners and other third parties such as verification providers. The categories of data we collect include:

We use personal data to provide and operate the services, including setting up and servicing your Account, processing transactions, issuing and managing cards, and providing customer support. We also use it to meet our legal, regulatory and compliance obligations, including identity verification, customer due diligence, sanctions screening and anti-money-laundering monitoring.

We use personal data to detect, prevent and investigate fraud and other unlawful activity, to secure our systems and protect our customers, to communicate with you about the services and important changes, and to improve and develop the services, including through analytics and research. Where we send you marketing communications, we do so only where permitted and you can opt out at any time.

Where data-protection law requires a legal basis for processing, we rely on the following, depending on the context: the performance of our contract with you, to provide the services you request; compliance with our legal and regulatory obligations, including financial-crime and record-keeping requirements; our legitimate interests, such as securing our services, preventing fraud and improving our products, provided these are not overridden by your interests and rights; and, where required, your consent, for example for certain cookies or marketing.

Where we rely on your consent, you may withdraw it at any time; this will not affect the lawfulness of processing carried out before withdrawal.

We share personal data only where necessary to provide the services, meet our obligations, or as otherwise described in this Policy. We do not sell your personal data. We may share personal data with:

Because we and our Partners operate across borders, your personal data may be transferred to and processed in countries other than the one in which you are located. Some of those countries may have data-protection laws that differ from those in your jurisdiction.

Where we transfer personal data internationally, we put in place appropriate safeguards required by applicable law, such as standard contractual clauses or transfers to jurisdictions recognised as providing an adequate level of protection, to help ensure your data remains protected.

We keep personal data for as long as necessary to provide the services and for the purposes described in this Policy. Where we are subject to legal, regulatory, tax or accounting requirements, we retain data for the periods those requirements specify.

In particular, records relating to identity verification, transactions and financial-crime compliance are typically retained for at least five years after the end of our relationship with you, or longer where a specific law, regulator or investigation requires it. When personal data is no longer required, we delete it or anonymise it securely.

Depending on your jurisdiction and subject to applicable law, you may have rights in relation to your personal data, including the right to access the data we hold about you, to have inaccurate data corrected, to have data deleted where we are permitted to do so, to receive certain data in a portable format, and to object to or restrict certain processing.

Some of these rights are limited. For example, we may be unable to delete data that we are legally required to retain for financial-crime or record-keeping purposes, or that we need to establish, exercise or defend legal claims. To exercise your rights, or if you have questions about how we handle your data, contact us at hello@ecardpay.com. You may also have the right to complain to your local data-protection authority.

We maintain technical and organisational security measures designed to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption of data in transit and at rest, access controls, strong authentication, monitoring and staff training.

No system can be guaranteed to be completely secure, and you also play an important role in protecting your data. You should keep your credentials confidential, enable available security features, and contact us promptly if you suspect any unauthorised access to your Account.

We use cookies and similar technologies on our website and in our applications. For details of the cookies we use, why we use them and how you can manage them, please see our Cookie Policy.

The services are intended for adults aged 18 and over and are not directed at children. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected such data without appropriate authority, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our services, our Partners, or legal and regulatory requirements. Where the changes are material, we will give you notice through the application, by email or by other reasonable means. The date at the top of this Policy shows when it was last updated.

If you have any questions, requests or concerns about this Policy or how we handle your personal data, please contact our privacy team at hello@ecardpay.com.