Privacy Policy
This policy explains what personal data PayColab collects, why we collect it, how we protect it, and the choices available to you.
Who We Are
PayColab ("we", "us") provides payment orchestration services to businesses ("merchants"). When we process end-customer payment data on behalf of a merchant, we act as a data processor; for our own website, dashboard accounts, and marketing, we act as a data controller.
Data We Collect
- Merchant account data: name, work email, company, role, and billing details for dashboard users.
- Transaction data: payment credentials (tokenized in our PCI-DSS Level 1 vault), amounts, currencies, and routing outcomes processed on merchants' instructions.
- Technical data: IP address, device and browser information, and usage logs for security and service improvement.
- Communications: messages you send via our contact form or support channels.
How We Use Data
We use personal data to provide and secure the orchestration service, prevent fraud, meet legal and financial-regulatory obligations, improve our products, and — with consent where required — send product communications. We do not sell personal data.
Legal Bases
Where GDPR applies, we rely on contract performance (providing the service), legitimate interests (security, fraud prevention, product improvement), legal obligation (financial record-keeping), and consent (marketing).
Sharing
Data is shared only with: the payment providers a merchant has connected (to process transactions), vetted sub-processors listed in our Data Processing Addendum, and authorities where legally required. All sub-processors are bound by data protection agreements.
Retention & Security
Transaction records are retained as required by financial regulation, then deleted or irreversibly anonymized. All personal data is protected with AES-256 encryption at rest, TLS in transit, and strict access controls audited under SOC 2 Type II.
Your Rights
Depending on your jurisdiction, you may request access, correction, deletion, portability, or restriction of your personal data, and object to processing. Contact [email protected]; we respond within 30 days. You may also lodge a complaint with your supervisory authority.
Last updated: October 31, 2026