Privacy Policy
This policy explains how CVPay collects, uses, and safeguards personal information when you visit our website, integrate with our API, or otherwise interact with our services.
1. Scope
This policy covers personal data processed by CVPay in the operation of our services and website. Where CVPay processes personal data on behalf of a merchant, the merchant is the data controller and CVPay acts as processor, governed by a separate data processing agreement.
2. Data we collect
Account and identity information for merchant onboarding (KYB) and end-user KYC where applicable. Transaction data required to process payments. Technical data such as IP address, device information, and log data. Communications you send to our team.
3. How we use data
To provide the services, execute transactions, meet regulatory obligations, prevent fraud and financial crime, secure our infrastructure, and communicate with you about the services. We do not sell personal data.
4. Lawful basis
Contract performance for the services you request. Legal obligation for AML, sanctions screening, tax reporting, and financial regulation. Legitimate interests in fraud prevention, network security, and product improvement — balanced against your rights.
5. Sharing
With sub-processors under written contract (cloud infrastructure, KYC vendors, fraud tooling, communications). With regulators, courts, and law enforcement where legally required. With merchants when acting as their processor.
6. International transfers
Personal data may be transferred across regions where our infrastructure and vendors operate. Transfers are governed by standard contractual clauses or equivalent safeguards recognized by the applicable data protection authority.
7. Retention
Personal data is retained only as long as required to provide the services, meet legal obligations (typically five to seven years for financial records), and defend legal claims. Beyond that, data is deleted or anonymized.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing of your personal data. Requests should be directed to kim@cvpayvn.com.
9. Security
We apply defense-in-depth technical and organizational controls to protect personal data — described in our Security page.
10. Changes
We may update this policy from time to time. Material changes will be communicated in advance where required by law.
11. Contact
Data Protection Officer: kim@cvpayvn.com.