Privacy Policy

At Ceylon Cash (Private) Limited ("Ceylon Cash", "CeyPay", "we", "us", "our"), we are committed to protecting the privacy and security of everyone who uses our CeyPay payment services and visits our websites (including ceypay.io and related pages). This Privacy Policy explains how we collect, use, share and protect your information when you use CeyPay or interact with us online.

By using our services or accessing our website, you agree to the practices described in this Privacy Policy.

1. Who this Policy applies to

This Privacy Policy applies to:

• Visitors to our websites
• Merchants and merchant representatives who register for and use CeyPay
• Customers who make payments using CeyPay with participating merchants

If you are a merchant, you may also have your own privacy notices for your customers. Those notices are separate from this Privacy Policy.

2. Information we collect

2.1 Information you provide to us

We may collect the following types of information that you provide directly:

• Contact details
  Name, email address, phone number and similar details when you create an account, submit an application, or contact us.
• Merchant registration and KYC details
  For merchants and their authorised signatories we may collect:
  - Business name, registration number, tax details and business address
  - Identity documents (for example national ID, passport), proof of address and other compliance documents
  - Position or role within the business
  - Bank account details for settlement of funds
• Customer payment details
  When you pay using CeyPay through a merchant, we may collect:
  - Your name and contact details if the merchant shares them with us or you provide them
  - Basic information needed to identify your transaction (for example order ID, currency, amount)
• Support and communication
  Information you provide when you:
  - Contact us by email, phone, messaging apps or forms
  - Respond to surveys, promotions or feedback requests

We do not store full payment card numbers on our own servers. Where card payments are supported, they are processed by trusted third party payment processors.

2.2 Information we collect automatically

When you use our website or CeyPay services, we may automatically collect:

• Technical and usage information
  - IP address, browser type, device type, operating system
  - Pages you view, links you click, time and date of visits
  - Session information and general usage patterns
• Transaction and payment data
  - Merchant ID, payment reference, transaction amounts and currencies
  - Crypto-related details where applicable (for example asset type, transaction hash or wallet address related to the payment)
  - Settlement status and related operational details

This information helps us operate and secure the CeyPay service and improve performance.

2.3 Cookies and similar technologies

We use cookies and similar technologies to:

• Keep you signed in and remember your preferences
• Understand how our website is used
• Improve our services and user experience

You can control cookies through your browser settings. If you disable cookies, some features of the website or dashboard may not function properly.

3. How we use your information

We may use the information described above for the following purposes:

1. To provide and operate CeyPay
   - Setting up and managing merchant and user accounts
   - Processing and settling payments between customers, merchants and settlement partners
   - Providing dashboards, reports and other service features
2. To comply with legal and regulatory obligations
   - Performing identity verification and merchant due diligence
   - Monitoring transactions for fraud, financial crime or unusual activity
   - Responding to lawful requests from regulators, law enforcement and other authorities
3. To communicate with you
   - Sending service-related messages, notifications and updates
   - Responding to your questions, support requests and complaints
   - Sending important notices about changes to our services or policies
4. To improve and develop our services
   - Analysing usage and performance of our website and CeyPay
   - Testing new features and service improvements
   - Maintaining and enhancing security
5. For marketing and promotions (where permitted)
   - Informing you about new features, offers or campaigns related to CeyPay
   - Sharing relevant updates about our products and partners

You can opt out of marketing communications at any time by following the unsubscribe instructions in the message or by contacting us. Service and transactional messages will continue even if you opt out of marketing.

4. Legal basis for processing (where applicable)

Depending on your location, we process your personal information on one or more of the following legal bases:

• Performance of a contract with you or the business you represent
• Compliance with legal and regulatory obligations
• Our legitimate interests in operating and improving our services, preventing fraud and securing our systems
• Your consent, where we rely on it (for example for certain types of marketing or cookies, if required by law)

5. How we share your information

We do not sell your personal information.

We may share your information only as follows:

1. Within Ceylon Cash and our group companies
   To provide you with a consistent and secure experience across our services.
2. With service providers and partners
   With trusted third parties who help us operate CeyPay and our business, for example:
   - Cloud hosting and infrastructure providers
   - Payment processors and settlement partners
   - Know Your Customer (KYC), fraud and risk screening providers
   - Analytics, communication and support tools
   These parties are required to handle your information securely and only for the purposes we specify.
3. With merchants and their providers
   For customers using CeyPay at a merchant:
   - We may share limited information with the merchant required to identify and reconcile your transaction.
   - The merchant may also collect information directly from you under its own privacy policy.
4. For compliance, legal and security reasons
   We may disclose information if we believe it is reasonably necessary to:
   - Comply with applicable laws, regulations or legal processes
   - Respond to lawful requests from public authorities or regulators
   - Protect the rights, property or safety of you, us, our users or others
   - Detect, prevent or address fraud, security or technical issues
5. Business transfers
   If we are involved in a merger, acquisition, restructuring, financing or sale of all or part of our business, your information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

6. Data security

We use appropriate technical and organisational measures to help protect your information from unauthorised access, loss, misuse, alteration or destruction. These measures include access controls, encryption in transit where appropriate and regular review of our security practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

7. Data retention

We retain personal information:

• For as long as needed to provide CeyPay services to you or the business you represent
• For as long as required by law or regulation (for example financial and compliance records)
• For a reasonable period to resolve disputes, enforce our agreements and protect our rights

When information is no longer required, we will delete it or anonymise it in line with our data retention policies and applicable laws.

8. International data transfers

Your information may be stored and processed in data centres or systems located outside your country. Where we transfer personal information across borders, we will take reasonable steps to ensure that appropriate safeguards are in place in line with applicable data protection requirements.

9. Your rights and choices

Depending on your location and applicable law, you may have certain rights in relation to your personal information, such as the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your information in certain circumstances
• Object to or restrict certain types of processing
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us using the details in the "Contact us" section. We may need to verify your identity before responding. Some rights may be limited by legal or operational requirements.

You can also:

• Update some account details directly in your merchant dashboard (where available)
• Opt out of marketing communications by using the unsubscribe link or contacting us

10. Third party sites and services

Our websites or services may contain links to third party sites, apps or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the end of this page. Significant changes may also be communicated through our website, dashboard or by email.

We recommend that you review this Privacy Policy periodically to stay informed about how we handle your information.

12. Contact us

If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal information, please contact us at [email protected].