Privacy Policy

1. Purpose

Payt World OÜ, a private limited company organised and existing under the laws of Estonia, having its registered address at Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, 10115, Estonia ("PAYT", "we", "our" or "us"), recognises the protection of personal data as a priority in the operation of the Platform and the services supplied alongside it (together, the "Platform").

PAYT understands that safeguarding privacy sustains the trust of its merchants, buyers, partners, service providers, staff and any other individual whose data it processes in connection with its activities (each, a "User" and/or "Data Subject", as the context requires). Beyond complying with applicable law, PAYT commits to operating on the principles of lawfulness, transparency, purpose limitation, adequacy, necessity, data minimisation, security, prevention, non-discrimination and accountability, and to adopting organisational and technical measures that reduce risk across the lifecycle of the data it holds.

This Privacy Policy (the "Policy") is intended to:

a) reinforce PAYT's commitment to privacy, confidentiality and the secure processing of personal data collected or otherwise processed in the course of its business and the supply of its services;

b) explain, clearly and accessibly, which categories of personal data PAYT may process, the purposes for which it may collect and use them, the legal bases that may support that processing, and the ways PAYT may collect, store, organise, consult, share, transfer and otherwise process such data;

c) describe the safeguards and security measures PAYT adopts to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration or disclosure, or any other unlawful or unauthorised processing, recognising that no system is entirely immune to threats and that continuous improvement is part of information security;

d) set out the choices, controls and rights a Data Subject may exercise over their personal data, including how to manage preferences and how to request access, correction, deletion, objection, restriction, portability, withdrawal of consent and any other right available under applicable law; and

e) provide transparency about PAYT's role and operations, including that PAYT may act, depending on the service and context, as controller and/or processor (or the equivalent concepts under applicable law), and that it may rely on third-party providers — for payments, anti-fraud, identity verification, hosting, analytics, customer support and compliance — strictly to the extent necessary to deliver its services, protect the Platform, prevent fraud and abuse, meet legal and regulatory obligations, and protect Users and PAYT alike.

PAYT reviews and updates its internal governance, policies, procedures and technology to keep pace with good practice in information security and privacy, and welcomes questions, concerns or suggestions about this Policy or about how it handles personal data.

For privacy-related requests or enquiries, a Data Subject may contact PAYT's Data Protection Officer ("DPO") at [email protected].

2. Scope

This Policy applies to every activity, operation, product, service, system, platform, website, application, tool and environment that PAYT operates, manages or makes available.

Without limitation, it covers the processing of personal data relating to: merchants, content providers, suppliers and other parties who register for, contract with or otherwise use the Platform; buyers, consumers, end users and recipients of digital products, services or content made available through the Platform; PAYT's own staff, contractors, representatives, officers and collaborators; business partners and service providers — including payment, compliance, fraud-prevention, identity-verification, hosting, analytics, customer-support and technology providers; and any other natural person whose personal data PAYT processes in connection with its business (together, "Data Subjects").

This Policy applies to every service through which PAYT collects, uses, stores, consults, shares, transfers or otherwise processes personal data, whatever the means of access — websites, mobile applications, APIs, integrations, electronic communications, support channels, or operational and compliance procedures — and applies globally to the extent applicable law permits and requires. It complements, without replacing, any specific privacy notice, contractual clause or data-protection term presented in connection with a particular service, product, jurisdiction or processing activity.

PAYT may amend, update or revise this Policy from time to time to reflect changes in its practices, technology, services, business operations, or applicable law. Where a change is material, PAYT will take reasonable steps to notify Data Subjects through an appropriate channel — a notice on the Platform, an email, or an in-product notification among them.

Unless stated otherwise, a revised Policy takes effect on publication, and continuing to access or use the Platform after that date constitutes acknowledgement and acceptance of the revised terms to the extent applicable law permits. By registering for, contracting for or otherwise using the Platform, a merchant or buyer acknowledges having read, understood and agreed to this Policy; PAYT obtains specific, express consent for particular processing activities where the law requires it. Data Subjects are encouraged to review this Policy from time to time.

3. Definitions

Data processing agents. The parties involved in processing personal data, classified as controllers or processors. A controller determines the purposes and means of processing personal data; a processor processes personal data on a controller's behalf, strictly under the controller's documented instructions.

Anonymisation. A technical and organisational process by which personal data is rendered irreversibly incapable of being linked, directly or indirectly, to an identified or identifiable individual, such that re-identification is not reasonably possible even by technical means.

Cookies. Small text files, containing a sequence of characters, created and stored on a user's device when a website is visited. Cookies let a website recognise a device, remember preferences, personalise content, strengthen security and improve the user experience; a user may configure their browser to refuse or flag cookies, though disabling them may affect the availability of certain features.

Personal data. Any information relating to an identified or identifiable natural person, including information that can directly or indirectly identify that person — name, identification numbers, government-issued documents, contact details, location data, online identifiers, or other elements characteristic of their physical, physiological, genetic, mental, economic, cultural or social identity.

Sensitive personal data. Personal data revealing racial or ethnic origin, religious or philosophical belief, political opinion, trade-union membership, health data, sex life or sexual orientation, genetic or biometric data, or any other data classified as sensitive under applicable law.

Device. Any electronic equipment used to access PAYT's services, including desktop computers, laptops, tablets, smartphones or other internet-enabled devices.

Data Protection Officer (DPO). The individual PAYT designates to oversee compliance with applicable data protection law, monitor internal data-protection practice, advise on data-protection obligations, and act as the primary point of contact between PAYT, Data Subjects and regulatory authorities.

IP address. A numerical identifier assigned to a device connected to the internet, which may indicate the approximate geographic location, network or access point from which the device connects to online services.

Geolocation data. Information that identifies or estimates a device's geographic position — country, state, city or other location indicator — obtained through means such as IP-address analysis, GPS, Wi-Fi or mobile-network signals, subject to the device's configuration and the user's permissions.

Economic Group. Payt Tecnologia e Educação Digital Ltda (CNPJ 39.478.394/0001-23), a legal entity duly incorporated and existing under the laws of Brazil and under common ownership with PAYT, including its subsidiaries, affiliates and entities under common control, where relevant for operational, compliance or legal purposes.

Data Subject. Any identified or identifiable natural person whose personal data PAYT processes, including merchants, buyers, end users, collaborators, service providers, applicants and representatives of legal entities.

Processing. Any operation or set of operations performed on personal data, whether by automated or non-automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, combination, restriction, erasure or destruction.

Users. Any individual or legal entity that accesses, registers for, contracts with or otherwise uses the Platform, including merchants, buyers and end consumers.

4. Cookies and Similar Technologies

PAYT uses cookies and similar technologies to keep the Platform functioning properly, improve the user experience, strengthen security, and meet applicable legal and regulatory obligations. Cookies are small text files stored on a user's device when the Platform is accessed; similar technologies may include pixels, tags, SDKs or local storage, together referred to in this section as "cookies".

4.1 Categories of cookies used

• strictly necessary cookies (first-party) — essential to the Platform's operation, enabling authentication, account security, fraud prevention, session management and transaction processing; the Platform cannot function properly without them;
• functional and performance cookies — remember a user's preferences, improve usability, and support a consistent, efficient experience;
• analytics and measurement cookies (third-party) — used, on a limited basis, by analytics or infrastructure partners to understand how the Platform is used, measure performance and improve services, generally in an aggregated or statistical form that does not directly identify a user; and
• security and compliance cookies — support security controls, fraud detection, anti-money-laundering measures, risk analysis and compliance with applicable law.

4.2 Third-party cookies

Some cookies are placed or managed by third-party providers acting on PAYT's behalf — hosting providers, analytics services, payment processors or security vendors among them. These parties apply their own privacy and cookie notices; PAYT does not control third-party cookies and recommends a user review those notices to understand how the party processes their data.

4.3 Managing cookie preferences

A user may configure their browser to decline cookies, to be notified before one is stored, or to remove cookies already stored, at any time through their browser settings. Disabling or removing cookies may leave some Platform features unavailable, impaired or limited; where a cookie is placed by a third party, its own cookie or privacy notice describes the management options it offers.

4.4 Consent and legal basis

Where applicable law — including the GDPR and applicable e-privacy rules — requires it, PAYT obtains a user's consent before placing a non-essential cookie on their device. Cookie-based processing rests on legitimate interest for strictly necessary, security and operational cookies, and on the user's consent, where the law requires it, for non-essential cookies.

5. Data Collected When Accessing PAYT Services

In line with applicable data protection law, PAYT collects only the data strictly necessary to supply its services, while keeping its systems efficient, secure and reliable for merchants, buyers and end users. The information PAYT may collect when the Platform is accessed falls into the two groups below.

5.1 Information provided by merchants and their consumers

PAYT may collect personal data that merchants and their consumers provide voluntarily during registration, contractual dealings, onboarding, transactions, communications or use of the Platform, including full name or business name, email address, telephone number, government-issued identification where legally required, residential or business address, account credentials, and payment-related information such as cardholder name, masked card details, expiry date, billing address, transaction identifiers and payment-method metadata.

This information supports transaction processing, user authentication, account management, fraud prevention, regulatory compliance, customer support and the performance of contracts made through the Platform; PAYT may also use it to contact the parties concerned where an operational issue, a dispute or a transaction irregularity arises. A merchant may be asked for further personal data — identification documents, corporate records or other verification material — for account creation, modification, verification, compliance review or the termination of services, and PAYT may engage third-party providers to assist with identity verification, compliance checks, fraud prevention or risk analysis, always under contractual obligations consistent with the safeguards this Policy describes.

Merchants remain responsible for the accuracy, completeness and currency of the personal data they give PAYT; PAYT is not liable for inaccurate, outdated or incomplete data a merchant or consumer submits. Where a Data Subject contacts PAYT electronically, PAYT may keep their contact details and a record of the exchange, and may use that information to answer enquiries, issue operational notices, and, where the law permits, send service-related communications; PAYT does not sell personal data to third parties for independent marketing purposes. A Data Subject may ask PAYT to update or correct their data, delete it, or opt out of marketing communications at any time by contacting the DPO.

5.2 Data collected automatically

PAYT may automatically collect data reflecting usage patterns, security and system performance when a user browses, accesses or interacts with its digital environments, including:

• navigation and interaction data — pages visited, features used, timestamps and interaction logs, used for security monitoring, analytics and service improvement;
• comments and user-generated content — the content of a submission together with technical data such as IP address and browser details, used for moderation, security and spam prevention;
• media uploads — files a user uploads may carry embedded metadata (such as EXIF data); users are encouraged to strip unnecessary metadata before uploading, since it may be visible to other users or administrators;
• cookies and similar technologies, as described in Section 4;
• embedded third-party content — interactions with content or integrations a third party supplies are governed by that party's own privacy practices;
• device and technical data — operating system, browser type, language settings, device identifiers, access timestamps and system logs, generally aggregated for analytics, diagnostics, performance and security; and
• geolocation data — approximate location derived from IP address, device settings or network signals, used to strengthen transaction security, prevent fraud, meet regulatory requirements and support customer service, with precision depending on device configuration and user permissions.

6. Personal Data Processed by PAYT

Personal data collected under this Policy is processed by PAYT for legitimate, specific and explicit purposes tied to supplying its services, meeting legal and regulatory obligations, managing risk, and operating the Platform properly. Subject to applicable law, PAYT processes personal data for the following purposes:

a) performance of contractual obligations, including executing, administering and enforcing agreements with merchants, buyers or other users;

b) compliance and verification procedures, including identity verification, onboarding checks and regulatory validation, carried out directly or through authorised third-party providers;

c) fraud prevention and financial-crime mitigation, including detecting, preventing, investigating and monitoring fraud, money laundering, terrorist financing and other unlawful activity;

d) provision and operation of services, including enabling access to the Platform, processing transactions, managing accounts and facilitating digital products and services;

e) customer support and communication, including responding to enquiries, complaints, requests and operational issues raised through available channels;

f) security enhancement, including implementing and improving measures that protect users, transactions, systems and data against unauthorised access, misuse, loss or breach;

g) service administration and management, including internal controls, system maintenance, platform monitoring and operational oversight;

h) compliance with legal and regulatory obligations, including know-your-customer, anti-money-laundering and counter-terrorist-financing duties, tax reporting, accounting, consumer protection and other applicable frameworks;

i) internal operations, including data analysis, system testing, audits, research, reporting, statistics and resolving technical or operational incidents;

j) service improvement and optimisation, including evaluating usage patterns, performance metrics and feedback to improve functionality, usability and quality;

k) advertising-effectiveness analysis, where the law permits, to measure and understand campaign performance and deliver relevant communications;

l) interactive features, enabling voluntary participation in interactive Platform functionality;

m) informing users of related products or services similar to those they have used, subject to applicable consent and opt-out requirements;

n) legal proceedings and evidence production, including establishing, exercising or defending legal claims and complying with lawful requests from competent authorities;

o) investigations and risk management, including preventing, detecting and combating illegal activity, fraud and financial crime, and protecting the integrity of the Platform, its users and the financial system;

p) marketing and market research, including prospecting, surveys and analytics, where the law permits and subject to consent;

q) account maintenance and updates, including contacting users to update registration data or clarify legal or administrative notices; and

r) automated decision-making related to fraud detection, risk assessment, transaction monitoring and service eligibility, where the law permits and subject to appropriate safeguards.

All personal data PAYT collects or a user provides is treated as confidential and processed in accordance with applicable law, under technical and administrative measures designed to guard against unauthorised access, loss, alteration or unlawful processing. A Data Subject may request further information about how PAYT processes their personal data by contacting the DPO.

7. Retention Period of Personal Data

PAYT retains and processes personal data only for as long as necessary to fulfil the purposes for which it was collected, and to meet applicable legal, contractual, regulatory and operational obligations. How long a given item of data is kept depends on: the nature of the product or service involved — transactional, contractual, compliance-related or support-related; the specific purpose of the processing, such as fraud prevention, regulatory compliance, dispute resolution, customer support or service improvement; and applicable legal, regulatory and contractual retention requirements, including those imposed by financial, tax, consumer-protection, anti-money-laundering and data-protection law.

Personal data is kept in identifiable form only for as long as needed for these lawful purposes; afterwards it is securely deleted, destroyed or anonymised, unless the law requires or permits longer retention. In particular, PAYT deletes, anonymises or otherwise renders inaccessible personal data once its purpose has been fulfilled, once a Data Subject withdraws consent where consent was the applicable basis and no other basis justifies continued retention, or once a competent authority, court order or applicable law requires deletion, anonymisation or restriction.

Notwithstanding the foregoing, PAYT may retain personal data for longer where necessary to comply with a legal or regulatory retention obligation, to establish, exercise or defend a legal claim, to fulfil or enforce a contractual obligation, to prevent fraud or other unlawful activity, or to comply with a request from a competent authority. During any such extended retention, PAYT restricts processing to storage, security and compliance-related purposes, under appropriate safeguards.

8. Rights of the Data Subject

Subject to applicable law, a Data Subject may exercise the following rights over their personal data; availability and scope vary by jurisdiction, the nature of the processing, and the applicable legal basis.

8.1 Right of access

Confirming whether PAYT processes personal data relating to the Data Subject, and, if so, obtaining access to it — including the categories of data processed, the purposes of processing, the categories of recipients, the applicable retention periods or the criteria used to set them, and the existence of automated decision-making. Access may be given electronically, through secure means, or in physical form, as reasonably requested and permitted by law.

8.2 Right to rectification

Requesting the correction, updating or completion of personal data that is inaccurate, incomplete or outdated, having regard to the purposes of processing.

8.3 Right to erasure, anonymisation or restriction

Requesting erasure, anonymisation or restriction of processing where the data is no longer necessary for the purpose collected, the processing is excessive or unlawful, consent has been withdrawn with no other basis applying, or the processing is otherwise unlawful — subject to PAYT's ability to retain data required for compliance, legal defence, fraud prevention or enforcing contractual rights.

8.4 Right to data portability

Requesting, where applicable and technically feasible, the portability of personal data to another provider or controller, in a structured, commonly used and machine-readable format, subject to applicable regulation and to protecting PAYT's commercial, industrial and intellectual-property interests.

8.5 Right to information on data sharing

Requesting information about the public or private entities with which PAYT has shared the Data Subject's personal data, subject to legal and contractual confidentiality obligations.

8.6 Right to information regarding consent

Where consent is the legal basis for processing, receiving clear information about the option to grant or refuse consent, and the potential consequences — including any limits on access to services or features — of refusing it.

8.7 Right to withdraw consent

Withdrawing consent at any time, free of charge, where processing rests on consent; withdrawal does not affect the lawfulness of processing carried out before it, nor does it prevent processing on another lawful basis.

8.8 Right to object to processing

Objecting, on grounds relating to their particular situation and where the law permits, to processing based on legitimate interest or another basis that does not require consent. PAYT will assess the objection and either stop the processing or demonstrate compelling legitimate grounds that override the Data Subject's interests, rights and freedoms.

8.9 Right to lodge a complaint

Lodging a complaint with the competent data protection authority about how PAYT processes their personal data; PAYT encourages a Data Subject to raise the matter with it first so any concern can be clarified and resolved directly.

8.10 Exercise of rights and limitations

A Data Subject exercises any of these rights by contacting the DPO through the channel below; PAYT may ask for reasonable identity verification first, and will make reasonable efforts to respond within the period applicable law sets. PAYT may limit or decline a request where processing or retention is needed to comply with a legal or regulatory obligation, establish, exercise or defend a legal claim, prevent fraud or other unlawful activity, protect the security and integrity of its systems, or protect the rights of PAYT, its merchants, its consumers or third parties.

Data Protection Officer (DPO) — Email: [email protected]

This channel is dedicated to data-protection matters and requests concerning a Data Subject's rights.

9. Sharing of Personal Data

PAYT values the privacy of its users and processes personal data in line with applicable law and recognised market practice. Personal data is shared strictly on a need-to-know basis and only for the purposes this Policy describes.

9.1 Categories of recipients

PAYT may share personal data, where necessary and lawful, with: companies within the Economic Group, for internal administrative, operational, compliance, security and business-continuity purposes; service providers, suppliers, contractors and subcontractors engaged on PAYT's behalf — for payment processing and acquiring, anti-fraud and risk analysis, chargeback prevention and dispute management, identity verification and compliance services, hosting and cybersecurity, and customer support and operational services; advertising, marketing and analytics partners, only to the extent authorised and consistent with applicable consent requirements; and search-engine, analytics and performance-monitoring providers, to improve, optimise and secure PAYT's digital channels and services.

9.2 Additional disclosure circumstances

PAYT may also disclose personal data where necessary for: a corporate transaction — a merger, acquisition, reorganisation, restructuring or asset sale — where the transfer supports business continuity; legal and regulatory compliance, including a court order, subpoena or lawful request from a competent authority; a contractual obligation owed to a user, merchant or business partner; fraud prevention, security and risk management, including investigating fraud, financial crime, chargeback abuse, money laundering or terrorist financing; protecting PAYT's rights, assets, systems, merchants, consumers or third parties, including in judicial, administrative or arbitral proceedings; a judicial or administrative order; financial risk assessment or credit analysis, where the law permits; or debt collection and recovery, including through a collection agency or legal representative.

9.3 Safeguards and confidentiality

Any sharing of personal data is limited to what is strictly necessary and carried out under contractual, technical and organisational safeguards designed to preserve confidentiality, integrity and security. Where PAYT engages a third-party processor, that processor is contractually bound to process personal data only under PAYT's documented instructions, to apply appropriate security measures, and to comply with applicable data-protection law and confidentiality obligations.

10. International Transactions and Cross-Border Data Processing

Because of the international nature of PAYT's operations, its Merchant of Record model, and the global infrastructure its services require, PAYT may transfer, store and process personal data in a country other than the one where the Data Subject is located.

When a user purchases a product or service through the Platform, PAYT acts as Merchant of Record and processes payments, risk assessments and compliance activity through acquiring banks, payment processors and service providers located in multiple jurisdictions. As a result, personal data — identification data, contact information, payment details, transaction records and device or usage data among them — may be transferred to, accessed from, or processed in a foreign jurisdiction, for purposes that include: performance of internal business operations such as administration, compliance, accounting, auditing, risk management and customer support; technical support and troubleshooting, including system maintenance, error analysis, platform monitoring and service continuity; data hosting, storage and backup, including cloud infrastructure and geographically distributed data centres; testing, development, research, analytics and statistical analysis aimed at improving security, fraud detection, performance and service quality; fraud prevention, chargeback management, anti-money-laundering, counter-terrorist-financing and sanctions screening; and performance of contractual obligations, including agreements with buyers, suppliers, affiliates and business partners and the delivery of PAYT's products and services.

10.1 GDPR and international transfer safeguards

For a Data Subject located in the European Economic Area, the United Kingdom, or another jurisdiction that restricts international transfers of personal data, PAYT carries out such transfers in accordance with the GDPR and other applicable data protection law. Where personal data moves outside the EEA to a country the European Commission has not recognised as offering an adequate level of protection, PAYT relies on appropriate safeguards, which may include Standard Contractual Clauses approved by the European Commission, data-processing and data-transfer agreements imposing GDPR-equivalent obligations on the recipient, transfers to a jurisdiction covered by an adequacy decision, or additional technical and organisational safeguards against unauthorised access or misuse.

10.2 Responsibility and security measures

PAYT remains responsible for ensuring that personal data transferred internationally is protected in line with this Policy and applicable law. It requires every recipient to process personal data solely for authorised purposes, under PAYT's documented instructions, contractual obligations and applicable data-protection regulation, and applies appropriate technical and organisational measures to guard against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access during international transmission and subsequent processing.

10.3 Legal basis for cross-border processing

International transfers and cross-border processing of personal data rest on a lawful basis, which may include the necessity of the processing to perform a contract with the Data Subject, compliance with a legal or regulatory obligation, PAYT's legitimate interest in operating a secure, global payment platform, or another lawful basis applicable law permits.

By using the Platform to purchase a product or service, a Data Subject acknowledges and understands that cross-border processing of personal data may take place under a legal framework that differs from the one applicable in their own country of residence, and that PAYT applies the safeguards described in this Section 10 whenever that occurs.

Processing personal data internationally is inseparable from how PAYT operates as Merchant of Record: without it, PAYT could not authorise, settle, protect or account for the transactions it enables across borders. A Data Subject who would like more detail on how PAYT transfers personal data internationally, or who wishes to exercise any of the rights described in Section 8, may contact PAYT's Data Protection Officer at [email protected].

11. Final Considerations

PAYT may amend, update or revise this Policy at any time, whether in response to a change in applicable law, the adoption of new technology, a change in its business practices, or the introduction of new products, services or features.

Data Subjects are encouraged to review the current version of this Policy from time to time. Where a change is material, PAYT will take reasonable steps to notify Users beforehand, to the extent applicable law requires it, through a channel such as a notice on the Platform, an email, or an in-product notification.

Personal data is at all times processed in accordance with this Policy and applicable law. PAYT will not materially reduce the rights this Policy grants a Data Subject without a valid legal basis and, where the law requires it, that Data Subject's explicit consent.

Should a competent court or authority hold any provision of this Policy to be unlawful, invalid or unenforceable, that provision is severed from the Policy, and the remaining provisions continue in full force and effect to the greatest extent applicable law allows.

PAYT's decision not to enforce a right or provision of this Policy on a given occasion does not waive that right or provision, and does not prevent PAYT from enforcing it at a later time, within any applicable limitation period.

By accessing or using PAYT's services, platforms or digital channels, a User confirms that they have read, understood and agreed to be bound by the version of this Policy then in effect. A User who does not agree with its terms should refrain from accessing or using PAYT's services; declining to provide personal data that PAYT needs for a given purpose may mean that certain services, features or functionalities are unavailable to that User.

This Policy takes effect on the date of its publication and remains in force for an indefinite period, until validly amended or replaced under its own terms.

12. Legal Bases of Processing

PAYT processes personal data strictly in accordance with applicable data protection law, and only where a valid legal basis supports the processing concerned. Which basis applies depends on the nature of the processing, PAYT's relationship with the Data Subject, and the law of the relevant jurisdiction. Without limitation, PAYT relies on the bases below.

12.1 Consent

Where the law requires it, PAYT processes personal data on the basis of the Data Subject's freely given, informed and explicit consent — for example, for marketing and promotional communications, participation in surveys, research or optional features, and the use of cookies or similar technologies that are not strictly necessary to the Platform's operation. A Data Subject may withdraw consent at any time, free of charge; withdrawal does not affect the lawfulness of processing carried out before it.

12.2 Compliance with a Legal or Regulatory Obligation

PAYT processes personal data where necessary to meet a legal or regulatory obligation, including anti-money-laundering and counter-terrorist-financing duties, know-your-customer requirements, tax, accounting and financial-reporting obligations, the retention of transaction, access and audit logs, and requests from a competent regulatory or supervisory authority.

12.3 Performance of a Contract or Pre-Contractual Steps

PAYT processes personal data where necessary to perform a contract to which the Data Subject is a party, or to take steps the Data Subject requests before entering into one — including creating and managing an account, processing payments and executing transactions, delivering digital products and services, providing customer support and operational communications, and managing subscriptions, refunds, disputes and chargebacks.

12.4 Establishing, Exercising or Defending Legal Claims

PAYT processes personal data where necessary to establish, exercise or defend a legal claim, including in judicial, administrative or arbitral proceedings, compliance investigations and audits, dispute resolution, chargeback management and the enforcement of contractual obligations, and the prevention of and response to fraud, abuse or other unlawful activity.

12.5 Legitimate Interest

PAYT processes personal data where necessary for its legitimate interests, provided those interests are not overridden by the Data Subject's fundamental rights and freedoms — including improving and securing the Platform and its systems, detecting, preventing and managing fraud and risk, business analytics, performance monitoring and service optimisation, internal administrative and operational activities, and, where the law permits, direct communications about products or services similar to those the Data Subject has already used. Whenever PAYT relies on legitimate interest, it weighs that interest against the Data Subject's rights and reasonable expectations and applies appropriate safeguards, including an opt-out mechanism where applicable.