Privacy policy.

1. Who we are

SouthPay is a software and payment orchestration platform operated by SouthPay LLC, a Wyoming limited liability company ("SouthPay", "we", "us", or "our"). This Privacy Policy explains how we handle personal information in connection with the SouthPay website at southpay.io and related subdomains, our marketing and sales communications, and the SouthPay platform.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, SouthPay is the controller of the personal information described in this policy, except where this policy states that a third-party payment service provider acts as an independent controller (see Section 6).

If you are a merchant, this policy supplements the SouthPay Merchant Payment Services Agreement and the SouthPay AML Policy. In the event of any conflict between this policy and the Merchant Payment Services Agreement on the subject of data, this policy governs questions of personal information and the Merchant Payment Services Agreement governs the commercial relationship.

2. Scope of this policy

This policy covers:

• visitors to the SouthPay website who browse, read documentation, or book a call;
• prospective merchants who begin or complete the signup process;
• merchants and their authorized representatives, directors, and ultimate beneficial owners; and
• individuals who contact us by email or other channels.

This policy does not cover the data practices of third-party payment service providers ("PSPs"), the platforms on which you operate your store (such as Shopify or WooCommerce), or any other third-party website or service, even where we link to them. Those parties operate under their own privacy policies.

We do not knowingly collect personal information from end-user payers through the website. Where an end user pays a merchant through a SouthPay-generated checkout, any personal information involved in that payment is handled by the applicable PSP under its own policy.

3. Information we collect

3.1 Information you provide to us

• Account and signup information, including your name, business name, business email address, country, and the information you submit during registration.
• Know-your-business (KYB) information, where applicable, including legal entity name and registration details, registered address, information about directors and authorized representatives, and information about ultimate beneficial owners holding 25% or more of the merchant. KYB documentation is collected and verified primarily by our PSPs; where we receive it, we handle it as described in this policy.
• Payout configuration, including bank account details or cryptocurrency wallet addresses you designate to receive settlement.
• Communications, including the content of emails, support requests, and information you provide when you book or attend a call.

3.2 Information we collect automatically

• Usage and device data, including IP address, browser type, operating system, referring pages, pages viewed, and timestamps, collected when you use the website or platform.
• Cookies and similar technologies, as described in Section 8.

3.3 Information we receive from third parties

• Verification and screening results from PSPs, identity verification providers, sanctions-screening providers, and blockchain analytics providers, used to satisfy the obligations described in our AML Policy.
• Referral information from partners who introduce you to SouthPay.

We do not collect special categories of personal data (such as health, biometric, or political data) in the ordinary course, and we ask that you do not provide such data to us.

4. How we use personal information

We use personal information to:

• create and administer your account and provide access to the platform;
• onboard you, including coordinating KYB, sanctions screening, and due diligence with our PSPs as described in the AML Policy;
• route transactions and configure settlement to your designated payout destination;
• communicate with you about your account, support requests, and service or security matters;
• send marketing and promotional communications where you have consented or where otherwise permitted by law, subject to your right to opt out at any time;
• monitor, detect, and prevent fraud, money laundering, terrorist financing, sanctions evasion, and other financial crime, and to comply with the controls described in our AML Policy;
• operate, secure, maintain, and improve the website and platform; and
• comply with legal obligations and respond to lawful requests from competent authorities.

5. Legal bases for processing (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract, to provide the platform and administer your account and the Merchant Payment Services Agreement.
• Compliance with a legal obligation, for KYB, sanctions screening, transaction monitoring, record retention, and reporting under applicable anti-money-laundering and sanctions law.
• Legitimate interests, to secure and improve our services, prevent fraud and misuse, and conduct direct marketing to business contacts, balanced against your rights and freedoms.
• Consent, for certain marketing communications and non-essential cookies, which you may withdraw at any time.

6. How we share personal information

We share personal information with:

• Third-party payment service providers (PSPs), who perform payment execution, settlement, fiat conversion, custody (if any), and their own compliance procedures. PSPs act as independent controllers of the personal information they process and apply their own privacy policies.
• Service providers and processors who support us under contract, including cloud hosting, analytics, customer communication, and identity-verification vendors, who may process personal information only on our instructions.
• Compliance and screening providers, including sanctions-screening and blockchain-analytics providers.
• Competent authorities, law enforcement, and regulators, where required by applicable law or to protect our rights, and as described in our AML Policy. Where we file a report relating to suspected financial crime, we do not disclose to you or any third party whether such a report has been or may be filed, except as permitted by law.
• Professional advisors, such as lawyers, auditors, and accountants.
• Successors, in connection with a merger, acquisition, reorganization, or sale of assets, including any entity formed to own or operate the SouthPay platform, consistent with the assignment provisions of the Merchant Payment Services Agreement.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law.

7. International transfers

We are based in the United States, and we use service providers and PSPs located in multiple jurisdictions. Where we transfer personal information out of the EEA or the UK, we rely on an adequacy decision where one applies, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where necessary.

8. Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember your preferences, measure usage, and improve performance. Strictly necessary cookies are required for the website to function. Analytics and other non-essential cookies are used only where permitted, and where required by law we ask for your consent before setting them. You can control cookies through your browser settings and, where offered, through our cookie banner. Disabling some cookies may affect how the website works.

9. Data retention

We retain personal information for as long as necessary to provide the platform and to satisfy the purposes described in this policy. In line with our AML Policy, we retain records relating to merchant onboarding, transactions, sanctions screening, and compliance decisions for not less than five (5) years from the date of the relevant activity or the end of the merchant relationship, whichever is later, or for such longer period as applicable law requires. Where personal information is no longer required, we delete or anonymize it.

10. Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, and alteration, including access controls, encryption in transit, and segregation of duties. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

11. Your rights

Depending on where you are located, you may have some or all of the following rights regarding your personal information:

• to access the personal information we hold about you;
• to request correction of inaccurate or incomplete information;
• to request deletion, subject to our legal retention obligations, including those under the AML Policy;
• to object to or restrict certain processing;
• to data portability;
• to withdraw consent where processing is based on consent; and
• to opt out of marketing communications at any time.

If you are in California, you have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information as those terms are defined, and we do not discriminate against you for exercising your rights.

Certain rights are limited where we are legally required to retain information or to refrain from disclosure, particularly in connection with anti-money-laundering and sanctions obligations. To exercise your rights, contact us using the details in Section 14. We may need to verify your identity before responding. You also have the right to lodge a complaint with your local data protection authority.

12. Children

The SouthPay website and platform are intended for businesses and adults. We do not knowingly collect personal information from children under the age of majority in their jurisdiction. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

13. Changes to this policy

We may update this policy from time to time. The version published on the SouthPay website at any given time is the version then in force, and the "Last updated" date reflects the most recent change. Where a change is material, we will take reasonable steps to notify you. Continued use of the website or platform after an update constitutes acceptance of the updated policy.

14. Contact

Questions, requests, or complaints relating to this policy may be directed to: