This Privacy Notice applies when SkenderPay acts as a data controller for its own website, communications, onboarding, compliance, account-management, security, business-development and administrative activities.

Where SkenderPay processes personal data strictly on behalf of a business customer under a separate data processing agreement, that customer is responsible for determining the purposes and means of processing and for providing its own privacy notice. In those situations, SkenderPay acts as processor and processes personal data in accordance with the customer’s instructions, unless applicable law requires otherwise.

This Privacy Notice applies to users, website visitors, prospective users, merchants, business representatives, partners, service providers, job or contractor applicants, and other persons who interact with SkenderPay.

"Personal data" means information relating to an identified or identifiable individual. Depending on how you interact with SkenderPay and which features are made available, we may collect the following categories of personal data:

We do not intentionally request special category personal data, such as health information, biometric data, political opinions, religious beliefs or trade union membership, unless it is necessary for a specific lawful purpose, required by law or provided by you as part of documents submitted to us. If such data is processed, we will apply appropriate safeguards and rely on a lawful basis permitted by applicable law.

We may collect personal data:

• from you directly, for example when you contact us, register interest, participate in a pilot, create an account, complete onboarding or send us documents;
• from your device or browser when you visit our website or use online interfaces;
• from business customers, merchants, partners or authorised representatives who provide information about their personnel or users;
• from identity verification, fraud prevention, sanctions screening, analytics, hosting, payment, cloud, security and other service providers, where applicable;
• from public sources, company registries, sanctions lists, regulatory databases, blockchain analytics sources, adverse media sources and other lawful sources where compliance checks are required.

Where EU, UK or similar data protection rules apply, we rely on one or more legal bases, including performance of a contract or pre-contractual steps, compliance with legal obligations, legitimate interests, consent, and, where necessary and permitted, the establishment, exercise or defence of legal claims. In jurisdictions that do not use this terminology, we process personal data on equivalent lawful grounds permitted by applicable law.

Depending on the features used and the applicable regulatory position, SkenderPay may carry out identity, business, sanctions, fraud, AML/CFT, adverse media, blockchain analytics or other risk checks. These checks may be performed by SkenderPay, by a regulated partner, or by specialist service providers.

We may use automated tools to support fraud prevention, sanctions screening, risk scoring, account security and compliance workflows. We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless we provide additional information and rights required by applicable law.

We may refuse, suspend or terminate access to features, request further information, restrict activity, report information to competent authorities or retain records where required or permitted by applicable law, internal policy or regulated partner requirements.

We use cookies and similar technologies to operate and secure our website, remember preferences, understand website usage and improve our digital services. Non-essential cookies are used only where permitted by applicable law and, where required, after you have given consent.

Further information is available in our Cookie Notice, including the categories of cookies used, their purposes, retention periods and how you can manage your preferences.

We do not sell personal data. We may share personal data where necessary for the purposes described in this Privacy Notice, including with:

• Service providers: hosting, cloud infrastructure, IT support, cybersecurity, analytics, communication tools, customer support, document management and operational vendors.
• Verification and compliance providers: KYC, KYB, sanctions screening, fraud prevention, adverse media, blockchain analytics and risk-monitoring providers, where applicable.
• Payment, banking, PSP or regulated partners: where SkenderPay uses or integrates with regulated partners or service providers for future payment, settlement, merchant or financial-service functionality.
• Business customers, merchants and partners: where necessary to operate beta, pilot, merchant or partner-supported services and subject to applicable terms.
• Professional advisers: lawyers, accountants, auditors, insurers, consultants and other professional advisers.
• Authorities and courts: law enforcement, regulators, courts, tax authorities, sanctions authorities or other competent authorities where required or permitted by law.
• Corporate transaction parties: potential buyers, investors, lenders, counterparties or advisers in connection with financing, restructuring, merger, acquisition, sale of assets or similar corporate transactions.
• Affiliates: companies under common ownership or control with SkenderPay, if any, for internal administration and the purposes described in this Privacy Notice.

Third-party platforms, websites or services may process personal data as independent controllers. Their processing is governed by their own privacy notices and terms, not by this Privacy Notice.

SkenderPay is an Arizona limited liability company. Personal data may be processed in the United States, Switzerland, the European Economic Area, the United Kingdom, Albania or other countries where SkenderPay, its personnel, service providers, partners or infrastructure providers are located.

Where applicable law requires safeguards for international transfers, we use appropriate mechanisms such as standard contractual clauses, adequacy decisions, contractual commitments, technical and organisational safeguards, transfer impact assessments or other lawful transfer mechanisms.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law. Retention periods depend on the type of data, the nature of the relationship, legal obligations, limitation periods, dispute risk, security needs and operational requirements.

When personal data is no longer required, we delete, anonymise or securely archive it. If deletion is not immediately possible, for example because data is stored in backup systems, we restrict further processing until deletion becomes practicable.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, encryption where appropriate, secure hosting, logging, monitoring, vendor due diligence, internal policies and staff access restrictions.

No website, network, system or transmission method is completely secure. You are responsible for keeping any account credentials confidential and for notifying us promptly if you suspect unauthorised access or misuse.

Depending on your location and applicable law, you may have rights in relation to your personal data, including:

• access to personal data and information about how we process it;
• correction of inaccurate or incomplete personal data;
• deletion of personal data, subject to legal retention obligations and exceptions;
• restriction of processing in certain circumstances;
• objection to processing based on legitimate interests or direct marketing;
• withdrawal of consent where processing is based on consent;
• data portability where applicable;
• the right not to be subject to certain solely automated decisions where applicable;
• the right to lodge a complaint with a competent data protection authority.

To exercise rights, contact us at privacy@skenderpay.com. We may need to verify your identity and may request additional information to process your request. We will respond within the period required by applicable law. If we cannot fulfil a request, we will explain the reason unless prohibited by law.

Where SkenderPay acts as processor on behalf of a business customer, we may direct your request to that customer or assist the customer in responding, depending on the applicable contractual and legal framework.

12.1 European Economic Area, United Kingdom and Switzerland

If EU, UK or Swiss data protection laws apply, SkenderPay provides this Notice to explain the identity of the controller, categories of personal data, purposes and legal bases of processing, recipients, international transfers, retention criteria and applicable rights. You may also have the right to complain to your local data protection authority. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner where applicable. In the United Kingdom, the competent authority is the Information Commissioner’s Office where applicable.

If SkenderPay is legally required to appoint an EU, UK or Swiss representative or data protection officer, we will update this Notice with the relevant details.

12.2 California and other US state privacy laws

SkenderPay does not sell personal information. If we later use personal information in a way that constitutes a "sale", "sharing" for cross-context behavioural advertising, or targeted advertising under applicable US state privacy laws, we will provide the required notices and opt-out mechanisms.

Where applicable US state privacy laws apply to SkenderPay, residents may have rights to know, access, correct, delete, obtain a portable copy of personal information, opt out of certain processing activities and not be discriminated against for exercising privacy rights. These rights may be subject to exceptions and verification requirements.

We may send you marketing communications, newsletters, product updates, event invitations or similar communications where permitted by applicable law. You may unsubscribe at any time by using the unsubscribe link in the message or contacting us at privacy@skenderpay.com. We may continue to send non-marketing communications, such as security notices, administrative messages, service updates or legally required notices.

SkenderPay’s website and services are not intended for children or persons under 18 years of age. We do not knowingly collect personal data from children. If we become aware that personal data of a child has been collected, we will take reasonable steps to delete it unless retention is required by law.

We may update this Privacy Notice from time to time to reflect changes in our business, technology, legal requirements or data processing practices. The updated version will be indicated by a revised "Last updated" date. If we make material changes to how we process personal data, we may provide additional notice or request consent where required by applicable law.

For privacy questions, requests or complaints, please contact:

Requests from government, regulatory or law enforcement authorities should be sent to support@skenderpay.com or another channel designated by SkenderPay for legal notices.