PROCESSING OF PERSONAL DATA ACCORDING TO GDPR AGREEMENT

This Processing of Personal Data According to GDPR Agreement („Agreement”) sets out the specific rules regarding the processing of personal data submitted by the Beneficiary, as a Client or Customer, to Payana Solutions LDA („Payana,” „Cards4ads,” „we,” „us,” „our”), as a controller of your personal data, in accordance with Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data („GDPR”), as well as any subsequent national legislation on the protection of personal data.

This Agreement is accompanied by and must be interpreted in conjunction with our Privacy Policy and the Terms and Conditions. By accepting this Agreement, you acknowledge that you have read, understood, and agreed to the processing of your personal data as outlined herein.

1. Definitions
2. „Personal Data” means any information relating to an identified or identifiable natural person („Data Subject”).
3. „Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
4. Purpose and Lawfulness of Processing
5. We will process your Personal Data for the purposes of providing our services, including but not limited to payment processing, acquiring services, payout services, and related activities.
6. The processing of your Personal Data is necessary for the performance of our contractual obligations with you, compliance with legal obligations, protection of vital interests, consent, and legitimate interests pursued by us or third parties.
7. Categories of Personal Data

We may process the following categories of Personal Data, as provided by you or obtained during the use of our services:

1. Identity and contact details. b. Financial information. c. Transaction information. d. Any other information necessary for the provision of our services and fulfillment of contractual obligations.
2. Data Retention

We will retain your Personal Data for as long as necessary to fulfill the purposes for which it was collected, as well as to comply with legal, accounting, or reporting requirements.

5. Data Subject Rights

As a Data Subject, you have certain rights under the GDPR, including but not limited to:

1. The right to access your Personal Data held by us. b. The right to rectify inaccurate or incomplete Personal Data. c. The right to erase Personal Data under certain circumstances. d. The right to restrict the processing of your Personal Data. e. The right to object to the processing of your Personal Data. f. The right to data portability, where applicable. g. The right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
2. Security Measures

We implement appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of your Personal Data, in accordance with the requirements of the GDPR.

7. Data Transfers

Your Personal Data may be transferred to and stored in countries outside of your own, including countries that may have different data protection laws from your jurisdiction. We will ensure that any such international transfers comply with the applicable data protection laws and regulations.

8. Contact

For any inquiries or requests regarding the processing of your Personal Data or to exercise your rights as a Data Subject, please contact our Privacy Officer at [email protected].

9. Subprocessing

We may engage subprocessors to assist in the processing of your Personal Data. We will ensure that any subprocessor we engage provides sufficient guarantees to implement appropriate technical and organizational measures to meet the requirements of the GDPR.

10. Data Breach Notification

In the event of a personal data breach, we will notify you and the relevant supervisory authority in accordance with our obligations under the GDPR. We will take all necessary measures to mitigate the impact of the breach and prevent any further unauthorized access or disclosure.

11. Data Protection Impact Assessment (DPIA)

Where required under the GDPR, we will conduct a DPIA to assess the potential risks and impacts of our data processing activities on the protection of your Personal Data. We will take appropriate measures to address any identified risks and ensure the protection of your rights and freedoms.

12. Changes to the Agreement

We reserve the right to modify or amend this Agreement at any time. Any material changes will be communicated to you through appropriate means. By continuing to use our services after the effective date of the amended Agreement, you acknowledge and accept the modified terms.

13. Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction in which Payana is located. Any disputes arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the courts in that jurisdiction.