Privacy Policy

  1. General provisions
  2. Your personal data controller is the NovaPay. The contact details of NovaPay are available at www.nova-pay.eu. Contact details of the data protection officer authorised by NovaPay:
  3. Personal data collected by NovaPay is processed in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania, the General Data Protection Regulation (hereinafter — the GDPR) and other legal acts. All employees, agents, and employees of the agents of NovaPay who know the secret of personal data must keep it safe even after termination of the employment or contractual relationship.
  4. NovaPay, in accordance with the applicable legal requirements, shall ensure the confidentiality of personal data and the implementation of appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, accidental loss, alteration, destruction, or other unlawful processing.
  5. This Privacy Policy sets out the basic rules for the collection, storage, processing, and retention of your personal data, other information relating to you, the scope, purpose, sources, recipients, and other important aspects of your personal data when you use NovaPay as a payment service provider.
  6. By accessing and / or using the information on this website and / or our services, you acknowledge and confirm that you have read, understood, and agree to this Privacy Policy. Also, after you register with the system and start using our services, this Privacy Policy becomes a Supplement to the General Payment Services Agreement.
  7. NovaPay reserves the right, at its sole discretion, to modify this Privacy Policy at any time by publishing an updated version of the Privacy Policy on the website and, if the changes are substantial, notifying registered users by email. An amended or updated version of this Privacy Policy shall take effect upon its publishing on the website.
  8. If the user of the services is a legal entity, this Privacy Policy applies to natural persons whose data is transmitted to us by the legal entity. The user shall inform the data subjects (managers, recipients, agents, etc.) of the transfer of their data to NovaPay in accordance with Article 14 of the GDPR.
  9. Purposes of the processing. Data providers, terms, and recipients
  10. The main purpose for which NovaPay collects your personal data is to provide the payment services of NovaPay to clients who send and receive payments. As a payment service provider, NovaPay is bound by law to establish and verify your identity prior to entering into financial services transactions with you, also, at the time of the provision of the services, to request further information, as well as assess and store this information for the retention period set out by legislation. Taking this into account, you must provide correct and complete information.
  11. PURPOSE:Client identification, provision of payment services (account opening, transfers of funds, payment collection and other), or implementation of other legal obligations of the payment service provider.

9.1. Personal data is processed for this purpose in compliance with legal requirements related to:

9.1.1. establishment and verification of the client’s identity;

9.1.2. conclusion and execution of agreements with the client or in order to take steps at the request of the client;

9.1.3. execution of transfers of funds and transmission of necessary information together with a transfer in accordance with legislation;

9.1.4. implementation of the “Know Your Client” requirements;

9.1.5. continuous and periodic monitoring of the client’s activity;

9.1.6. risk assessment;

9.1.7. updating client data in order to ensure its accuracy;

9.1.8. prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, determination of politically exposed persons or financial sanctions imposed on the client;

9.1.9. ensuring proper risk and organisation management.

9.2. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document and a copy of the document, a face photo, direct video transmission (direct video broadcast) recording, citizenship, email address, phone number, current account number, IP address, current activity, current public function, and other data required by legal acts governing the prevention of money laundering and terrorist financing.

9.3. This personal data is collected and processed on the basis of a legal obligation imposed on the payment service provider, i.e. the Law on Payments, the Law on Money Institutions, laws on the prevention of money laundering and terrorist financing, and other applicable legal acts, and is required in order to open an account and / or provide a payment service.

9.4. Data retention period: 8 (eight) years after the termination of the business relationship with the client according to the Law on Prevention of Money Laundering and Terrorist Financing.

9.5. Data providers: the data subject, credit and other financial institutions and their branches, state and non-state registers, databases for checking the data of identity documents (databases of expired documents and other international databases), authority check registers (registers of notarised authority and other databases), companies maintaining registers of international sanctions, law enforcement agencies, bailiffs, legal entities (provided you are a representative, employee, founder, shareholder, participant, contractor, or the real beneficiary of these legal entities), partners or other legal entities that engage us or are engaged by us in the provision of services, social networks where you have a profile linked to our system, and other persons.

9.6. Groups of data recipients: supervisory authorities, credit, financial, payment and / or electronic money institutions, pre-trial investigation institutions, state tax agencies, payment service representatives or partners of NovaPay (if the transaction is carried out using their services), recipients of transaction funds receiving the information in payment statements together with the funds of the transaction, the recipient’s payment service providers and correspondents, participants, and / or parties related to national, European, and international payment systems, debt collection and recovery agencies, companies processing consolidated debtor files, lawyers, bailiffs, auditors, other entities having a legitimate interest, other persons under an agreement with NovaPay or on other lawful bases.

  1. PURPOSE:Debt management.

10.1. Personal data under this purpose is processed in order to manage and collect debts, submit claims, demands, lawsuits and other documents, and to provide documents for debt collection.

10.2. For this purpose, the following personal data may be processed: name, surname, national identification number, address, date of birth, data from an identity document, email address, phone number, current account number, IP address, current account statements, and other data related to the circumstances in which the debt arose.

10.3. Data retention period: the due date for the debt is 8 (eight years) from the day the debt is incurred, and after the opening of legal proceedings, the time limit is extended until the debt is repaid and for 24 (twenty-four) months after the repayment. The data retention period is based on the limitation periods for proceedings set out by the Civil Code of the Republic of Lithuania.

10.4. Data providers: the data subject, credit, financial, payment and / or electronic money institutions, state and non-state registers, companies processing consolidated debtor files, other persons.

10.5. Groups of data recipients: companies processing consolidated debtor files, credit, financial, payment and / or electronic money institutions, lawyers, bailiffs, courts, pre-trial investigation institutions, state tax agencies, debt collection and recovery agencies, and other entities having a legitimate interest.

10.6. Please note, that if you have a debt to NovaPay and you are postponing the performance of your obligations for more than 30 (thirty) days, NovaPay has the right to provide the information on your identity, contact details, and credit history, i.e. financial and property liabilities and information on their execution, and debts and their payment to companies managing debtors’ databases, as well as to debt collection companies. You can access your credit history by contacting the credit bureau directly.

  1. PURPOSE:To support and administer relations with clients, prevent disputes, and collect evidence (recording phone conversations), correspondence of business relations with the client.

11.1. Personal data is processed for this purpose in order to:

11.1.1. maintain the business relationship and communication with the client;

11.1.2. protect the interests of the client and / or NovaPay;

11.1.3. prevent disputes, provide evidence of business communication with the client (recordings of conversations, correspondence);

11.1.4. perform quality assessment and ensure the quality of services provided by NovaPay;

11.1.5. where it is necessary for the execution of the agreement, in order to take steps at the request of the client, or in implementing a legal obligation.

11.2. For this purpose, the following personal data may be processed: name, surname, address, date of birth, email address, phone number, IP address, current account statements, phone conversation recordings, and correspondence with the client.

11.3. Data retention period: 8 (eight) years after the termination of the business relationship with the client.

11.4. Data providers: the data subject.

11.5. Data recipients: supervisory authorities, companies processing consolidated debtor files, lawyers, bailiffs, courts, pre-trial investigation institutions, debt collection and recovery agencies, other entities having a legitimate interest, other entities under an agreement with NovaPay.

  1. PURPOSE: Credit rating assessment, credit risk management, and automated decision-making.

12.1. The personal data for this purpose is processed to assess the creditworthiness of clients, to manage the credit risk, and to meet the requirements related to operational risk management and capital adequacy, so that NovaPay can offer to provide funding.

12.2. The following personal data may be processed for this purpose: name, surname, address, date of birth, email address, telephone number, current account number, IP address, current account statements, the client’s balance on the account, financial liabilities, credit and payment history, income, education, workplace, current work position, work experience, available assets, data on family members, a credit rating, and other information.

12.3. Data retention period: 10 (ten) years after the termination of the business relationship with the client.

12.4. Data Providers: the data subject, credit and other financial institutions and their branches, law enforcement agencies, other registers and state institutions, companies processing consolidated debtor files (e.g. in Lithuania, UAB “Creditinfo Lithuania” or other), natural persons who provide data about spouses, children, and other persons related by kinship or affinity, co-debtors, guarantors, collateral providers, etc., legal entities when the client is a representative, employee, contractor, shareholder, participant, owner, etc. of these legal entities, and partners or other legal entities who NovaPay employs for service provision.

12.5. Data recipients: credit, financial, payment and / or electronic money institutions or service providers assisting in the assessment of creditworthiness, and companies processing consolidated debtor files.

12.6. In order to conclude or offer to enter into a funding agreement with you and to provide you with services, NovaPay will, in certain cases, apply decision-making based on the automated processing of your personal data. In this case, the system checks your creditworthiness with a set algorithm and assesses whether the service can be provided. If the automated decision is negative, it may be changed by the client providing more data. NovaPay takes all the necessary measures to protect your rights, freedoms, and legitimate interests. You have the right to demand human intervention, express your opinion, and challenge an automated decision. You have the right to oppose an automated decision by contacting NovaPay directly.

  1. PURPOSE:Protection of interests of NovaPay and the client (video surveillance on the premises of NovaPay).

13.1. Personal data for this purpose is processed in order to ensure the security of NovaPay and / or the client, to protect the life and health of the client and / or their representative, and other rights of NovaPay and the client (video surveillance and recording in the premises of NovaPay) in a pursuit of the legitimate interest to protect clients, employees, and visitors of NovaPay and their property, as well as the property of NovaPay.

13.2. For this purpose, the following personal data may be processed: video recordings on the premises managed by NovaPay.

13.3. Before entering the premises of NovaPay where video surveillance is conducted, you are informed about the surveillance by special markings.

13.4. Data retention period: 1 (one) year.

13.5. Data providers: the data subject who visits the premises of NovaPay where video surveillance is conducted and is captured by the surveillance camera.

13.6. Data recipients: courts, pre-trial investigation institutions, lawyers (only in case of an attempt to attack).

  1. Informing the client about services.Personal data for this purpose is processed in order to inform the client about the services provided by NovaPay, their prices, specifics, changes in the terms of the agreements concluded with the client, and for sending system and other messages relating to the provided NovaPay services.

14.1. The following personal data may be processed for this purpose: email address, phone number.

14.2. The data subject confirms that they are aware that such messages are necessary for the execution of the General Payment Services Agreement and / or its supplements concluded with the client, and they are not considered to be direct marketing messages.

14.3. Data retention period: 24 (twenty-four) months after the termination of the business relationship with the client.

14.4. Data providers: the data subject.

14.5. Data recipients: the data for this purpose is not provided to other persons.

  1. Direct marketing.For this purpose, personal data is processed in order to provide the client with offers on the services provided by NovaPay.

15.1. The following personal data may be processed for this purpose: email address, phone number.

15.2. With this document, you confirm that you are aware of the fact that the aforementioned data may be processed for the purpose of direct marketing, and that you have the right to disagree and to object the use of your personal data for this purpose at any time by informing NovaPay thereof in writing via email to: backoffice@nova-pay.eu. The message must contain the full name and email address of the personal data subject.

15.3. Data retention period: until the termination of the business relationship with the client or until the day the client objects the data processing for this purpose.

15.4. Data providers: the data subject.

15.5. Data recipients: The data for this purpose may be transmitted to search or social networking systems (the possibility to object data processing is ensured by the websites of these systems). The data shall not be provided to other persons.

  1. Statistical analysis.Your personal data collected for the aforementioned purposes, except for the national identification number, identity documents and their details, also the exact place of residence, may be processed for the purpose of statistical analysis. For this purpose, personal data shall be processed in such a way that, by including it in the scope of statistical analysis, it is not possible to identify the data subjects concerned. The collection of your personal data for the purpose of statistical analysis is based on the legitimate interest to analyse, improve, and develop the conducted activity. I am aware that I have the right to disagree and object my personal data processing for such purpose at any time and in any form by informing NovaPay thereof. However, NovaPay may continue to process the data for statistical purposes if it proves that the data is processed for compelling legitimate reasons beyond the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defence of legal claims.
  2. Service improvement.The data collected for all of the above purposes can be used to improve technical and organisational tools, IT infrastructure, adapt services to the devices used, develop new NovaPay services, enhance satisfaction with existing services, as well as test and improve technical tools and IT infrastructure.
  3. Service misuse prevention and proper service delivery.The data collected for all of the above purposes may be used to prevent unauthorised access and use, i.e. to ensure privacy and information security.
  4. For the processing of personal data, NovaPay may engage data processors and / or, at its own discretion, hire other persons to perform certain ancillary functions on behalf of NovaPay (e.g. data centres, hosting, cloud hosting, system administration, system development, software development, provision, support services such as improvement and development; services of customer service centres; marketing, communication, consulting, temporary staffing, or similar services). In such cases, NovaPay shall take the necessary measures to ensure that such data processors process personal data in accordance with NovaPay’s instructions and applicable laws, and shall require compliance with the appropriate personal data security measures. NovaPay shall also ensure that such persons are bound by confidentiality obligations and cannot use such information for any purpose other than the performance of their functions.
  5. Personal data collected for the purposes specified in this Privacy Policy shall not be processed in any way incompatible with these legitimate purposes or legal requirements.
  6. I agree that my data referred to above will be provided and received through a software tool used by NovaPay or its authorised agent, also by other means and third persons with whom NovaPay has entered into personal data processing agreements in accordance with laws and regulations.

Geographical area of processing

  1. Generally, personal data is processed within the European Union / European Economic Area (EU / EEA), but may in certain cases be transmitted and processed outside the EU / EEA.
  2. Personal data may be transferred and processed outside the EU / EEA where the transfer is necessary for the conclusion or execution of a contract (for example, when a payment is carried out to a third party or through a third party partner (correspondent)) or with the consent of the client. In all of these cases, we seek to ensure that appropriate technical and organisational measures are in place.

Profiling

  1. Profiling carried out by NovaPay involves the processing of personal data by automated means for the purposes of legislation relating to risk management and continuous and periodic monitoring of transactions in order to prevent fraud; such ongoing profiling is based on the legal obligations of NovaPay.
  2. For the purpose of direct marketing and statistical analysis, profiling may be carried out using Matomo, Google, Facebook, and other analytics tools.

Processing the personal data of minors

  1. A minor under 14 (fourteen) years of age, seeking to use the payment services of NovaPay, shall provide written consent from their representative (parent or legal guardian) with regard to their personal data processing.

Cookie policy

  1. NovaPay may use cookies on this website. Cookies are small files sent to a person’s Internet browser and stored on their device. Cookies are transferred to a personal computer upon first visiting the website. NovaPay uses only necessary cookies, which on personal devices are used to identify the person, improve the functionality and use of the website, and to streamline the person’s access to the website and information contained therein.
  2. Most web browsers accept cookies, but the person can change the browser settings so that cookies would not be accepted. However, in this case, some functions may not work.

The right of access, rectification, erasure of your personal data and to restrict data processing

  1. You have the following rights:

30.1. THE RIGHT OF ACCESS TO DATA: to obtain information as to whether or not NovaPay processes your personal data, and, where that is the case, access to the personal data processed by NovaPay and to receive information on what personal data and from which sources are collected, the purposes of the processing, the recipients to whom the personal data have been or may be provided; to obtain from NovaPay a copy of the personal data undergoing processing in accordance with the applicable law. Upon the receipt of your written request, NovaPay, within the time limit laid down in the legislation, shall provide the requested data in writing, or specify the reason of refusal. Once in a calendar year, data may be provided free of charge, but in other cases a remuneration may be set at a level not exceeding the cost of the data provision.

30.2. THE RIGHT OF RECTIFICATION: if your data processed by NovaPay is incorrect, incomplete, or inaccurate, you can address NovaPay in writing for the rectification of the incorrect or inaccurate data or to have the incomplete personal data completed by providing a relevant request;

30.3. THE RIGHT TO BE FORGOTTEN: to request the termination of the data processing (erase the data), in the case that the data subject withdraws the consent on which the processing is based, or the personal data is no longer necessary in relation to the purposes for which it was collected, or the personal data has been unlawfully processed, or the personal data has to be erased for compliance with a legal obligation. A written notice of objection to personal data processing shall be submitted to NovaPay personally, by post, or via electronic means of communication. If your objection has legal grounds, NovaPay, after examining the request, shall terminate any actions of processing of your personal data, with the exception of cases provided for by law. It should be noted that the right to require the immediate erasure of your personal data may be limited or not possible due to the obligation of NovaPay as a payment service provider to store data about the clients’ identification, payment transactions, concluded agreements, etc. for the period laid down in legislation;

30.4. THE RIGHT TO RESTRICTION OF PROCESSING: to request to restrict the processing of personal data, when the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise, or defence of legal claims. A data subject who has obtained restriction of processing shall be informed by the data controller before the restriction of processing is lifted;

30.5. THE RIGHT TO OBJECT: the right to object to the processing of your personal data for direct marketing purposes;

30.6. to address the supervisory authority with a claim regarding the processing of your personal data, if you believe that the personal data is processed in violation of your rights and legitimate interests stipulated by applicable legislation;

30.7. to contact the data controller and / or the data protection officer for the purpose of exercising your rights;

30.8. other statutory rights.

  1. You can send your request for access, rectification, or objection to data processing via email to: backoffice@nova-pay.eu. The person submitting the request must clearly indicate their full name and sign the request with a qualified electronic signature.

Third-party websites

  1. NovaPay is not responsible for the protection of the Client’s privacy on websites of third parties, even if such websites are accessed by the client through links provided on this website. NovaPay recommends to learn the privacy policies of each website that does not belong to NovaPay.

The use of logos

  1. The client, using the services of NovaPay for business objectives and professional interests, agrees that their name and / or logo may be used by NovaPay for direct marketing purposes (e.g. by indicating that the client is using the services provided by NovaPay).

Ensuring information security

  1. NovaPay aims to ensure the highest level of security for all information obtained from the Client and public data files. In order to protect this information from unauthorised access, use, copying, accidental or unlawful erasure, alternation, or disclosure, as well as from any other unauthorised form of processing, NovaPay uses appropriate legal, administrative, technical, and physical security measures.

Final provisions

  1. These Privacy policy provisions are subject to the law of the Republic of Lithuania. All disputes regarding the provisions of the Privacy Policy shall be settled by negotiation and, in case of failure to resolve an issue by negotiation, the dispute shall be taken to courts of the Republic of Lithuania.