Privacy Notice

1. Introduction

BZNpay ("we," "us," or "our") respects your privacy. This Privacy Notice explains how we collect, use, share, and protect information when you visit bznpay.com or submit information to us. In short: your information stays with us, and we only share strictly what is needed to do our work.

2. Who We Are

BZNpay is operated by Tolba, Amsterdam, the Netherlands, which is the controller of personal data processed in connection with this website and our services. For privacy matters, contact [email protected].

3. What We Collect

Depending on how you interact with us, we may collect:

• Contact and identity information: name, work email, company name, job role.
• Business information: industry, monthly transaction volume, geographies of operation, licensing status, website URL, and any other information you voluntarily provide about your business.
• Communications: the content of messages, form submissions, and correspondence.
• Technical data: IP address, browser type, device type, referring URL, pages visited, and cookie identifiers.

4. How We Use Your Data

We process your data to:

• evaluate your inquiry and determine potential fit with our network;
• share relevant details with prospective acquirers, payment service providers, and partners to facilitate introductions;
• respond to your questions and communicate with you about our services;
• operate, maintain, and secure our website;
• comply with legal and regulatory obligations.

5. Legal Bases for Processing (GDPR)

We rely on the following legal bases:

• Consent: when you voluntarily submit information through our forms.
• Legitimate interests: to operate our business and facilitate introductions, where not overridden by your rights.
• Legal obligation: where processing is required by applicable law.

6. Who Receives Your Data

Your information stays with us by default. We share it only as follows:

• Acquirers, payment service providers, and financial partners: when we identify a potential match in connection with your inquiry, we share strictly what is needed for them to assess your file, and nothing more.
• Service providers: companies that process data on our behalf to run our business, limited to the following categories: hosting, content delivery and website security; workspace, email and communications; database, workflow and document tooling; customer relationship management; and delivery of website form submissions. Each operates under terms that restrict its use of your data to the services it provides to us and require appropriate safeguards. A current list of these providers is available on request at the contact address in Section 2.
• Competent authorities: where we are legally obliged to do so.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

7. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or adequacy decisions to ensure your data receives an equivalent level of protection.

8. Data Retention

We retain your data only for as long as necessary for the purposes described here, typically up to 24 months after our last meaningful interaction with you, unless a longer retention period is required by law or for the defense of legal claims.

9. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten") in certain circumstances;
• Restriction of processing;
• Data portability;
• Objection to processing based on legitimate interests;
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at the email address in Section 2.

10. Complaints

If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

11. Security

We apply reasonable technical and organizational measures to protect your data against loss, misuse, and unauthorized access. No system is perfectly secure, however, and information is submitted at your own risk.

12. Cookies

The website currently sets no nonessential cookies and runs no advertising trackers. If we introduce analytics or other nonessential cookies, we will ask for your consent through a cookie banner before they are set.

13. Changes

We may update this Privacy Notice from time to time. The effective date at the top will reflect the most recent revision.

14. Contact

For any privacy-related questions, please contact [email protected].