Data Processing Agreement

1. Scope and roles

This agreement applies when ZYND SARL, which operates ZyndPay, processes personal data on behalf of the merchant to provide the services enabled for its account. For that processing, the merchant is the controller and ZyndPay is the processor.

ZyndPay acts as an independent controller when it processes data for its own purposes: business verification (KYB), prevention of financial crime, sanctions screening, legal reporting, platform security, and the establishment or defence of legal claims. Those purposes are covered by our Privacy Policy. Roles follow the actual processing and the applicable law.

2. Instructions

ZyndPay processes the data only on the documented instructions of the merchant set out in the MSA, in any accepted processing schedule and in authenticated service requests, unless the law requires otherwise. In that case, ZyndPay informs the merchant beforehand unless the law prohibits it.

Instructions must not require unlawful processing, disclosure of another customer's data or circumvention of platform security. ZyndPay informs the merchant if an instruction appears unlawful and may suspend it pending clarification.

3. Details of the processing

• Subject matter: operation of the payment integration, transaction messages, reconciliation and support.
• Duration: the term of the services, plus the periods needed for return, deletion and legal retention.
• Operations: collection, validation, organisation, hosting, transmission, retrieval, reconciliation, restricted support access and deletion.
• Data subjects: the merchant's customers, payers and payees, business contacts and account users.
• Categories of data: identifiers, contact details, transaction references, payment status, amounts and currencies, necessary device and security information, and customer service correspondence.

The merchant must obtain written approval before submitting sensitive data, full images of identity documents or unrelated personal data. Card authentication data must never be submitted unless the integration expressly supports it and it is lawful.

4. Confidentiality and security

Access is restricted to authorised personnel bound by confidentiality and appropriately trained. Security measures are proportionate to the data and the risk, and include access control, least privilege, authentication, encrypted transport, logging, change management, vulnerability handling and recovery arrangements.

The merchant protects its own systems, devices, staff and data exports, and does not share an administrator account among different users. Security information is provided through a confidential review, without disclosing credentials, private keys or exploitable details.

5. Sub-processors

ZyndPay may use sub-processors needed for the services, under written obligations consistent with this agreement. On request, it provides their identity, function and location through a controlled channel.

For a material change affecting merchant data, ZyndPay gives prior notice where practicable, ordinarily 30 days. The merchant may object on reasonable data protection grounds before the change takes effect. The parties then look for a reasonable alternative; if none is practicable, the affected processing may be terminated. An emergency replacement for security or continuity reasons is notified promptly. ZyndPay remains responsible for the performance of its sub-processors as required by law.

6. International transfers

Accepting this agreement does not replace a transfer mechanism required by law. The parties identify the relevant transfers and put in place adequacy decisions, contractual clauses, authorisations or other lawful safeguards before the transfer. ZyndPay may refuse an instruction that would require an unlawful transfer.

7. Requests and incidents

ZyndPay assists the merchant with requests from data subjects, impact assessments, regulators’ enquiries and breach obligations, to the extent relevant to its processing. Requests received directly are referred to the merchant unless the law requires ZyndPay to respond.

ZyndPay notifies the merchant of a confirmed personal data breach affecting its data without undue delay, with the available information on its nature, the data concerned, likely consequences, containment measures and a contact point. Missing information is provided as it becomes available. Neither party delays a mandatory notification while waiting for the other’s approval.

8. Audits

The merchant may obtain the information reasonably needed to demonstrate compliance, ordinarily through existing reports and a confidential questionnaire. Where justified, a further audit is carried out by a qualified independent auditor, under confidentiality, with reasonable notice and scope, without disrupting live services or exposing other customers. Requests from regulators or following a significant incident are not subject to an annual limit. The cost of a discretionary audit is borne by the party requesting it.

9. Return and deletion

At the end of the services, ZyndPay provides the available merchant data in a commonly used format on authenticated request, and deletes or returns the remaining data as agreed, except where the law requires it to be kept. Backups expire through regular rotation. Retained legal and compliance records remain restricted and are not reused for other purposes. An erasure request cannot require the destruction of financial records that must be kept by law.

10. Precedence and liability

This agreement sets the baseline obligations of ZyndPay as a processor. Any materially different processing must first be documented in an accepted schedule. More protective mandatory legal provisions prevail. Liability follows the MSA, to the extent compatible with data protection law and the rights of data subjects.

11. Contact

Questions about this agreement, the list of sub-processors or a data incident: privacy@zyndpay.io.