Privacy
Policy

Who We Are

Convrt Payments LLC ("Convrt," "we," "us," or "our") is a payment gateway and SaaS platform provider. This Privacy Policy explains how we collect, use, share, retain, and protect personal information in connection with our payment gateway services, website, and related products.

Scope

This Policy applies to:

1. Merchants who register for and use Convrt's payment processing services
2. End Users/Customers whose payment information is processed through our platform when purchasing from Merchants
3. Website Visitors who access www.convrtpayments.com
4. Business Contacts including prospective customers, partners, and service providers

Regulatory Framework

Convrt complies with applicable data protection and privacy laws, including:

1. General Data Protection Regulation (GDPR) – EU Regulation 2016/679, applicable to personal data of EU/EEA residents
2. UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 – applicable to UK residents
3. California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) – Cal. Civ. Code §§ 1798.100 et seq., applicable to California residents
4. Florida Information Protection Act (FIPA) – Fla. Stat. § 501.171, governing data breach notification
5. Payment Card Industry Data Security Standard (PCI DSS) v4.0.1
6. Other US state privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA)
7. Applicable privacy laws in jurisdictions where we process data

Controller and Processor Roles

Under data protection law, Convrt acts in different capacities depending on the data:

1. Data Controller for Merchant account data, business relationship data, and fraud/risk analytics
2. Data Processor when processing End User payment data on behalf of Merchants to complete transactions
3. Joint Controller in certain fraud prevention and compliance screening activities

Where Convrt acts as a Processor for Merchants, we offer a Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs) for cross-border transfers. Contact dpo@convrtpayments.com to request a DPA.

Merchant Account Information

Business Identity Data

1. Business legal name, DBA names, business type (corporation, LLC, sole proprietor, etc.)
2. Tax identification numbers (EIN, VAT number, or equivalent)
3. Business registration documents and licenses
4. Business address, phone number, email, website URL
5. Industry classification and description of goods/services

Beneficial Owner and Representative Information

1. Names, titles, and ownership percentages of beneficial owners (individuals owning 25% or more)
2. Government-issued identification (passport, driver's license, national ID)
3. Date of birth and nationality
4. Residential address and contact information
5. Authorized signatory information for account management

Financial Information

1. Bank account details (account number, routing number, IBAN, SWIFT/BIC)
2. Bank statements and proof of account ownership
3. Credit reports and financial background checks
4. Processing volume projections and historical transaction data

Transaction and Payment Data

Payment Instrument Information

1. Cardholder name as it appears on card
2. Card brand (Visa, Mastercard, Amex, Discover, etc.)
3. Truncated card number (first 6 and last 4 digits) – full PAN is tokenized and not stored
4. Card expiration date
5. Billing address (street, city, state/province, postal code, country)
6. Payment tokens and encrypted payment credentials for recurring billing
7. Digital wallet identifiers (Apple Pay, Google Pay tokens)

Device and Technical Data

1. IP address (both IPv4 and IPv6)
2. Device type, model, and operating system
3. Browser type, version, and language settings
4. Geolocation data (country, city, approximate location derived from IP)
5. Device fingerprints and fraud detection signals

Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies. Cookie categories and their purposes:

You can manage cookie preferences through our cookie consent banner or browser settings. Blocking strictly necessary cookies may limit functionality.

Fraud Prevention and Risk Data

To detect and prevent fraud, we collect and analyze:

1. Transaction velocity patterns (frequency, amount, timing)
2. Behavioral biometrics (typing patterns, mouse movements, touchscreen interactions where implemented)
3. Email and phone verification data (validation scores, reachability)
4. Cross-reference data from fraud databases and watchlists
5. Chargeback history and dispute records
6. Sanctions screening results (OFAC SDN, EU Consolidated List, UN lists)
7. Adverse media and risk intelligence from third-party providers
8. Device reputation scores and threat intelligence

Legal Bases for Processing (GDPR/UK GDPR)

Under GDPR, we process personal data based on the following lawful bases:

1. Performance of Contract (Art. 6(1)(b)) – to provide payment services, process transactions, and fulfill our obligations to Merchants
2. Legal Obligation (Art. 6(1)(c)) – to comply with AML/KYC laws, tax reporting, court orders, and regulatory requirements
3. Legitimate Interests (Art. 6(1)(f)) – for fraud prevention, risk management, service improvement, and business operations
4. Consent (Art. 6(1)(a)) – for marketing communications, optional cookies, and other processing requiring explicit consent

Purposes of Processing

We use personal information to authorize, process, and settle payment transactions; tokenize payment credentials for secure storage and recurring billing; route transactions to appropriate Acquirers and Card Networks; manage refunds, voids, and chargebacks; facilitate Settlement to Merchant bank accounts; verify business identity and conduct KYC/AML checks; detect and prevent fraud using machine learning models; comply with AML/CFT laws; assess merchant risk profiles and chargeback exposure; improve platform performance; and deliver marketing communications (with consent where required).

Payment Ecosystem Participants

1. Acquiring Banks and Payment Processors – to authorize, clear, and settle transactions
2. Card Networks (Visa, Mastercard, Amex, Discover) – for transaction routing, network rules compliance, and chargeback management
3. Issuing Banks – for authorization requests and transaction disputes
4. Payment Method Providers (Apple Pay, Google Pay, PayPal, etc.) – to process alternative payment methods
5. ACH Networks and Banking Partners – for direct debit and bank transfer processing

Service Providers and Subprocessors

1. Cloud Infrastructure (AWS, Google Cloud, Microsoft Azure) – hosting, storage, computing
2. Identity Verification and KYC (Jumio, Onfido, Trulioo) – document verification, biometric authentication
3. Fraud Prevention and Risk (Sift, Forter, Kount) – fraud scoring, device intelligence, behavioral analytics
4. Sanctions and Compliance Screening (Dow Jones, Refinitiv World-Check) – watchlist monitoring, PEP screening
5. Customer Support Tools (Zendesk, Intercom) – ticketing, live chat, help desk
6. Analytics and Monitoring (Google Analytics, Datadog, Sentry) – website analytics, performance monitoring
7. Marketing and CRM (HubSpot, Mailchimp, Salesforce) – email marketing, customer relationship management
8. Legal and Professional Advisors – attorneys, accountants, auditors, consultants

All service providers are bound by confidentiality obligations and data processing agreements consistent with GDPR Article 28 and CCPA requirements. A complete list of subprocessors is available upon request by contacting dpo@convrtpayments.com.

No Sale of Personal Information (CCPA)

Cross-Border Data Flows

Convrt is based in the United States. Personal data collected from individuals in the European Economic Area (EEA), United Kingdom, Switzerland, and other jurisdictions is transferred to and processed in the United States and other countries where our service providers operate. These countries may not provide the same level of data protection as your home jurisdiction.

Transfer Mechanisms and Safeguards

For transfers of personal data from the EEA/UK to the US and other non-adequate countries, Convrt implements the following safeguards:

1. Standard Contractual Clauses (SCCs) – We use the European Commission's Standard Contractual Clauses (Commission Implementing Decision 2021/914). Merchants subject to GDPR may request execution of SCCs by contacting dpo@convrtpayments.com
2. UK International Data Transfer Agreement (IDTA) – For transfers from the UK, we use the ICO International Data Transfer Agreement or Addendum to SCCs
3. Supplementary Technical Measures – Encryption of data in transit (TLS 1.2+) and at rest (AES-256), tokenization of payment card data, access controls, data minimization, and regular security audits (PCI DSS Level 1, SOC 2 Type II)
4. Adequacy Decisions – Where available, we rely on European Commission adequacy decisions for transfers to adequately protected countries

Retention Periods

1. Transaction Data: Seven (7) years from transaction date – to comply with IRS, tax authority, and financial record-keeping requirements, and meet PCI DSS and Card Network audit requirements
2. Merchant Account Data: Duration of business relationship plus seven (7) years – for contract enforcement, audit, tax compliance, and fraud prevention
3. KYC/AML Records: Five (5) years after relationship termination – as required by the US Bank Secrecy Act, FinCEN regulations, and comparable international AML laws
4. Security Logs and Audit Trails: Minimum one (1) year, up to seven (7) years – depending on legal and regulatory requirements
5. Marketing and Communications Data: Until consent is withdrawn or opt-out is requested, then deleted within 30 days
6. Website Usage Data and Cookies: Up to two (2) years for analytics cookies; session cookies deleted when browser closes

Deletion and Anonymization

After retention periods expire, we securely delete or anonymize personal data using industry-standard methods including secure deletion from active systems and backups, anonymization through aggregation and removal of identifiers, and physical destruction of hardware at end of life. Retention periods may be extended if data is subject to legal holds, ongoing litigation, regulatory investigation, or dispute resolution.

Technical Safeguards

1. Encryption: TLS 1.2+ for data in transit; AES-256 encryption for data at rest
2. Tokenization: Payment card data tokenized using PCI-compliant tokenization services
3. Network Security: Firewalls, intrusion detection/prevention systems (IDS/IPS), network segmentation, DDoS protection
4. Access Controls: Role-based access control (RBAC), principle of least privilege, multi-factor authentication (MFA)
5. Vulnerability Management: Regular security assessments, penetration testing, quarterly ASV scans, patch management
6. Monitoring and Logging: 24/7 security monitoring, SIEM, audit logging, anomaly detection
7. Endpoint Security: Anti-malware, endpoint detection and response (EDR), device encryption
8. Secure Development: Secure coding practices, code reviews, security testing in CI/CD pipelines

Certifications and Audits

1. PCI DSS Level 1 Service Provider – annual QSA audit
2. SOC 2 Type II – annual audit of security, availability, and confidentiality controls
3. ISO/IEC 27001 (target certification) – information security management system
4. Quarterly ASV Scans – by PCI-approved scanning vendors

Audit reports and certifications are available to Merchants under NDA upon request.

Data Breach Notification

In the event of a data breach involving personal data, Convrt will investigate and contain the breach promptly and notify affected individuals and supervisory authorities as required by applicable law, including within 72 hours of discovery for GDPR-reportable breaches. We will cooperate with regulatory investigations and forensic analysis.

Rights Under GDPR and UK GDPR

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

You also have the right to lodge a complaint with your national supervisory authority. EU Data Protection Authorities: edpb.europa.eu | UK ICO: ico.org.uk

Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the CCPA and CPRA:

1. Right to Know – Request disclosure of categories and specific pieces of personal information collected, sources, business purposes, and third parties with whom we share it
2. Right to Delete – Request deletion of personal information we collected from you, subject to legal exceptions
3. Right to Correct – Request correction of inaccurate personal information
4. Right to Opt-Out – Opt out of the sale or sharing of personal information (we do not sell personal information)
5. Right to Limit Use of Sensitive Personal Information – Limit the use and disclosure of sensitive personal information to necessary service provision
6. Right to Non-Discrimination – We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at privacy@convrtpayments.com. We will respond within 45 days (extendable by an additional 45 days with notice). We may request verification of your identity before processing your request.

How to Exercise Your Rights