Please read this privacy statement if you would like to know more about the way infinpay collect and further process your personal data.
Infinpay provides its merchant with payments gateway and payment acquiring services which include handling payments processing for merchant’s customer – the shopper. Infinpay is supervised by BNM, the central bank of Malaysia. Infinpay would like to explain the use of Personal Data entrusted as the date user.
This Privacy Policy (“Policy”) describes the "Personal Data" infinpay collect about “you”, how we use it, how we share it, your rights and choices and how you can contact us about our privacy practices. This policy also outlines your rights as a data subject, including the right to prevent or limit the processing and use of your Personal Data by us.
“Infinpay”, “we”, “ our ” or “ us ” means Infinpay, the entity responsible for the collection and use of Personal Data under this Privacy Policy. While Depending on the context, “you” means the “merchant”, the “shopper”, the “partner”, the “visitor” of infinpay’s website.
"Personal Data" relates directly or indirectly to a data subject, who is identified or identifiable from that information, or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data, information you provide to us and information we collect, when you use one of our “Services” (eg device information, IP address).
“Services” means the products and services that infinpay states are covered by this Policy which may include devices and applications provided by Infinpay, e.g.; when you visit the infinpay website hosted by infinpay, correspond with us, are (or are in the process of becoming) one of our merchant or partner, and where we process your transaction as an acquirer, we process personal data about you as a data controller.
Infinpay are not allowed to accept just any merchant without checking them and we have to determine and report when suspicious transactions take place. Therefore, if you are applying to become one of our Merchant by entering into merchant agreement and during the performance of our agreement, we will need to collect up to date information and documents to:
To carry out the above checks, we process information (including personal data) that you have provided to us and other information created by your use of the Infinpay services. Which may include your name, your contact information, a copy of your identification document, the address of your legal representative and shareholders, your bank account number, information contained in correspondence between us, bank statements, your signature and an extract of your company registration document. We may use third party identification, screening and verification services (including credit reporting agencies) in order to assist us to verify your identity and the documents provided to Infinpay.
We use this data to ensure the safety and integrity of the financial sector by aiming to identify, prevent and counter illegal conduct and to comply with our legal know-your-customer and anti-money laundering obligations.
infinpay may use automated decision-making, including profiling, when we enter into, or for the performance of, a contract with you, where allowed by applicable laws or if based on your consent. If this decision would produce legal effects or otherwise similarly significantly affect you, you have the right to obtain human intervention, express your point of view or to contest the decision based solely on automated processing, including profiling.
infinpay processes your personal information for the following purposes:
We also collect data about your use of our products and services and your merchant account, including your login details, and the questions, queries, comments and complaints you send or share with us in relation to our business relationship. We process this data to be able to perform our contract with you by following up with you and providing you with support and for our legitimate interest of being able to optimize and improve our products and services. Lastly, we may use the data for reporting and training purposes.
How long do we keep this data?
If you are or becoming one of our customers, we will keep information relating to our business relationship until 7 years after the end of your contract with us or until our rejection of your application. Data we have collected in relation to our legal obligation to verify our merchant will be kept by us for as long as we are legally obligated to. We may also disclose some of your information to competent authorities and/or regulators in case this is required to comply with our obligations as a financial institution, for example for the purpose of preventing money laundering and terrorist financing.
Whom do we disclose this information to?
infinpay disclose your information to the acquirer, payment channel operator and payment scheme which you are intend to apply with and via infipay’s payment services. We may also disclose some of your information to competent authorities and/or regulators in case this is required to comply with our obligations as a financial institution, for example for the purpose of preventing money laundering and terrorist financing.
Otherwise, we will not disclose your information to any third party, unless we have your permission, except when this is necessary in connection with the purposes above or with legal claims or when we have a legal obligation to do so.
infinpay is a payment service provider and as such infinpay provides acquiring services to its Merchant. Being an acquirer means that Infinpay accepts payment on behalf of the relevant merchant and then transfers the funds paid by the shopper (“you”) to the merchant. infinpay’s role is to request the relevant payment scheme, such as Mastercard, Visa, Paynet to authenticate & authorize a transaction and send this to the shopper’s bank (the issuer) for approval. If this bank gives approval, Infinpay is notified of this by the relevant payment scheme and makes the payment to the merchant’s designated recipient bank.
When we provide such acquiring service to our customer, we process your personal data as a data controller. It is important to us that your personal data is treated with care and that you are well informed about the way we process your personal data.
We process the data we need for our legitimate interest of providing so-called acquiring services to our merchants which are typically web shops or mobile application selling you goods and services. This means that we receive your payment on behalf of the merchant and handle related matters around these payment transactions.
infinpay process your data to comply with our legal obligations as a financial institution, such as to monitor financial transactions for the purpose of preventing money laundering and terrorist financing. For these purposes we may collect your card number (which we encrypt in accordance with PCI DSS standards), the expiry date (month and year) of your credit card, the amount of the transaction and the currency in which the transaction is done, the date, time and location of the transaction and the category and ID of the merchant with whom you are shopping.
If necessary, we can also process any of your information above for our legitimate interest of protecting our legal rights, for example in connection with legal claims, and when we have a legal obligation to process your information.
In addition, Infinpay processes your personal information for the following purposes:
How long do we keep this data?
We only keep your data for as long as we reasonably need it for the purposes listed above.
We keep the data we collect in order to perform the transaction in accordance with applicable laws, in most cases this is a period of 7 years after conclusion of the relevant transaction.
The retention terms above can be longer if we are required to keep data longer because of applicable law or to administer our business. If we need to keep any information longer for our legitimate interest of protecting our legal rights, we will keep the necessary information for this purpose until the relevant claim(s) has/have been settled.
Whom do we disclose this information to?
Infinpay disclose your information to the merchant with whom you are shopping. We may also disclose some of your information to competent authorities and/or regulators in case this is required to comply with our obligations as a financial institution, for example for the purpose of preventing money laundering and terrorist financing.
Otherwise we will not disclose your information to any third party, unless we have your permission, where this is necessary in connection with the purposes above or with legal claims or when we have a legal obligation to do so.
infinpay offers its merchant stacks of fraud detection services. For some of our fraud services, infinpay may acts as a data controller and/or data processor on behalf of, and under the instructions of, its merchants. Please have a look at merchants’ privacy policies for more information regarding this processing of your personal data.
This statement applies to the processing activities of fraud detection, prevention and monitoring where infinpay acts as a data controller.
The following information may be used (including, without limitation): transaction data (such as card number and cardholder name); email address; location data; IP address; information on disputed transactions; information on confirmed fraud; merchant details; mobile device; and unique identifier(s).
Infinpay may use your personal data for the purposes of protecting you against fraud or unauthorized transactions and preventing and monitoring fraud. This includes the identification of fraud with the payment details provided by our merchants or information about fraud from other third parties such as issuer, acquirers or payment scheme owners. Additionally, infinpay may use and aggregate your personal data to create and run models or other methods to accurately identify, predict, prevent and mitigate fraud across the infinpay platform. These models or other methods may be leveraged to offer fraud-related products and services to our merchants.
Note that following the use of these fraud models and/or other methods may result in merchants making decisions as to whether or not to grant you access to a product or service.
How long do we keep this data?
We will only keep the data for as long as we reasonably need it for the purposes listed above
When you browse our website, we process your IP address, internet browser and device type, location data and information about your use of our website and the app, including which pages you visited, how you got to our website, the time and length of your visit and your language preferences. We collect this data using cookies and similar techniques.
We use this data for our legitimate interests of making sure our website works properly, including debugging, to be able to deliver you content and for DDOS mitigation on our website, and improving our website and to perform statistical analyses for optimizing our website.
When we collect information about how you use our website, such as which landing pages you visit and which items you look at, we do so in order to make a determination about how we could best provide our services to you.
How long do we keep this data?
We will only keep your data for as long as we reasonably need it for the purposes listed above, e.g.; data about your visits to our website will be retained until your use or browsing session ends, except where it concerns data collected for the analytical and marketing purposes specified above. In those cases, we will keep your information for 1 year after collection.
Via our website, you can contact us or ask us to contact you regarding questions, queries, (support) requests, comments or complaints, fill out an application to become a merchant or a partner. When you do this, we collect the information that you fill out, including your name, company, contact details, the reason you are contacting us, verification that you are not a robot and other information you decide to provide us. You can also contact us by calling us or e-mailing us using for example the contact details listed on our website. If you do so, we will collect your name, company and any other information we need to be of further assistance to you and/or communicate with you.
We use this data above to answer your question, comment or complaint and respond to your queries and (support) requests and to assess your application to become a Merchant or partner. As such, this data is used by us to establish or perform our (future) contract with you and for our legitimate interests in following up with you. We also use the data above for our legitimate interest of conducting business with you and managing our internal administration, for training purposes, for establishing and performing our contract with you, for our legitimate interest of conducting marketing research so we can improve our products and services and to be able to offer our (future) merchant tailored products and services.
How long do we keep this data?
Data about any questions, comments or (support) requests you have made to us, we will only keep your data for as long as we reasonably need it for the purposes listed above or our data retention obligations.
If necessary, we can also process any of your information above for our legitimate interest of protecting our legal rights, for example in connection with legal claims, and when we have a legal obligation to process your information. We may also transfer your data in the event of a company reorganization, business transactions, such as in the event of sale or bankruptcy.
We need the help of third parties to be able to offer you our website and our products and services. Where necessary we will disclose your information to our service providers and professional advisers (e.g. IT providers, KYC partners, CRM providers, marketing support providers (such as agencies which manage our social media accounts), social media providers such as LinkedIn, analysts, customer service providers, business development providers and legal service providers). We have concluded agreements with our service providers to protect your personal data.
We may disclose information to third parties in connection with legal claims or when we have a legal obligation to do so. We may also disclose information with your permission (for example if we wish to disclose your details with another group company for their recruitment purposes).
We are committed securing your personal data and have taken steps in this regard. In order to prevent unauthorized people or parties from being able to access your data, we have put in place a range of technical and organizational measures to safeguard and secure the information we process from you.
You may have the following rights with respect to your personal data, subject to applicable exceptions:
Right to access. You may be entitled to request that we disclose to you the specific pieces of your personal data that we have collected about you in a portable and, to the extent technically feasible, readily usable format.
Right to know. You may have the right to confirm that we have collected personal data about you and know what personal data we have collected about you, including, as applicable, the categories of personal data we have collected, the sources from which we collected that personal data, the business or commercial purposes for which we collected, sold, and shared that personal data, the categories of personal data that we sold, shared, or disclosed to third parties for business purposes and the categories of third parties to whom we sold, shared or disclosed personal data.
Right to deletion. You may be entitled to request that we delete the personal data that we have collected from you. We will use commercially reasonable efforts to honor your request, in compliance with applicable laws. Please note, however, that we may need or be required to keep such information, such as for our legitimate business purposes or to comply with applicable law.
Right to object to processing of your personal data. You are entitled to object to us processing your personal data, including profiling. In some cases, you may object to the processing of your data and, where we have asked for your consent to process personal data, you can withdraw this consent at any time. Please note that Infinpay maintains a record of withdrawals of consent to ensure that we do not contact you in the future.
Right to correct your personal data. You may also have the right to update inaccurate information that we process about you.
Please note that these rights may be limited under applicable laws and are subject to technical feasibility. For example, if we collect your personal data in our role as a service provider to a Merchant, you will need to contact the merchant directly to exercise your rights.