Payou

Legal and compliance information

Privacy Policy

Last Updated: July 19, 2026

1. GENERAL PROVISIONS

PAYOU LTD ("PAYOU", "we", "us", or "our") respects the absolute privacy of our b2b clients, corporate partners, and web system visitors. This Privacy Policy details how we collect, process, secure, disclose, and manage corporate, telemetry, technical routing, and personal data through our software platform, API endpoints, and our main corporate domain https://payou.pro.

PAYOU LTD acts as a Data Processor regarding transactional metadata routed through our smart API keys, and as a Data Controller concerning direct corporate client onboarding structures, KYC registrations, and communication telemetry. We handle data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. CATEGORIES OF DATA WE PROCESS

In the execution of our technical aggregation services, we process the following categories of data:

  • a) Onboarding and KYB Corporate Data: Authorized corporate representative's name, passport data, date of birth, residential address, corporate incorporation certificates, share structures, commercial website URLs, and corporate contact numbers.
  • b) API Transactional Telemetry Metadata: Truncated transaction amounts, requested transaction currencies, geographical parameters (GEO), selected payment method classifications, specific provider identifier values (Provider IDs), success statuses, and technical customer web parameters (IP address, anonymized browser user-agent tokens).
  • c) Technical Tracking Data: Standard server access logs, device parameters, and anonymized analytical cookies processed during connection sessions on payou.pro to maintain security and layout responsiveness.

3. PURPOSES OF PROCESSING

We process corporate and transaction telemetry data strictly based on contractual execution, legal compliance, and valid b2b legitimate interests:

  • To provision and maintain our core payment aggregation routing software and platform features.
  • To execute proper technical transaction cascading and routing to third-party clearing partner systems.
  • To prevent fraud, malicious system exploits, DDoS activities, and card testing scripts across our API endpoints.
  • To fulfill automated and manual underwriter risk profiling and institutional regulatory audit requests.
  • To process official corporate feedback, system support requests, and critical integration notifications.

4. DATA DISCLOSURE AND GLOBAL TRANSFERS

PAYOU LTD does not sell, lease, or distribute your corporate or transaction information to any external advertising networks. Your transaction metadata and corporate profiles are transferred strictly to authorized third parties to execute processing operations:

  • a) Third-Party Licensed Acquirers & PSPs: To route actual payment intent requests to the specific licensed partner networks that finalize payment capturing.
  • b) Cloud Infrastructure & Database Hosts: Encrypted storage instances situated strictly within premium certified cloud networks (such as AWS / Google Cloud infrastructure located within the EU/UK).
  • c) Official Enforcement or Judicial Regulators: If required under statutory frameworks or explicit judicial mandates under United Kingdom or international law.

5. SECURITY OF PROCESSING

PAYOU LTD implements strict industry-standard technical, procedural, and administrative safeguards designed to preserve data integrity and prevent unauthorized access. Our communication pipelines utilize robust Transport Layer Security (TLS 1.3) data encryption protocols. Access to primary client metadata, API tokens, and client server keys is strictly restricted to designated technical engineering and compliance staff under strict internal access control frameworks.

6. DATA RETENTION

We retain corporate KYB profiles and transaction tracking log telemetry for as long as necessary to fulfill the underlying b2b contract parameters, or for longer durations to satisfy statutory record-keeping, anti-fraud auditing, and tax compliance requirements under UK law (typically seven years post-account termination).

7. YOUR DATA RIGHTS

Under the UK GDPR, you possess definite statutory rights concerning your personal information, including the right to request access, rectification, structural erasure ("right to be forgotten"), processing restriction, data portability, or to file a formal complaint with the competent supervisory body—the Information Commissioner's Office (ICO) in the United Kingdom. To execute your rights, please reach out to our team at [email protected].