HeyPay Ltd - Terms & Policies

2. Terms of Service

2.1 Acceptance of Terms

By accessing or using the HeyPay Ltd Services, you agree to be bound by these Terms. If you do not agree, you must not use our Services. HeyPay Ltd reserves the right to update these Terms, and continued use constitutes acceptance of any changes.

2.2 Eligibility

You must be at least 18 years of age and legally capable of entering into binding contracts to use HeyPay Ltd Services.

2.3 Account Registration

You agree to provide accurate and complete information when creating an account and to update such information promptly. You are solely responsible for maintaining the confidentiality of your account credentials.

2.4 Prohibited Activities

You may not use HeyPay Ltd Services for any unlawful purpose, including but not limited to money laundering, fraud, terrorist financing, or any activity that violates applicable laws. We reserve the right to terminate accounts engaged in prohibited activities.

3. Privacy Policy

3.1 Information We Collect

We collect personal information to provide and improve our Services, including:

• Personal Identifiers: Name, email address, phone number, billing and shipping address, date of birth

• Payment Information: Card details, account numbers, transaction history (processed securely, not stored by HeyPay Ltd)

• Technical Data: IP address, browser type, pages visited, cookies, and analytics

• Identity Verification Data: Where required, biometric data (e.g., facial geometry) may be collected solely for identity verification and fraud prevention, with express consent obtained

3.2 How We Use Your Information

• Process transactions and fulfill orders

• Prevent fraud and enhance security

• Comply with Anti-Money Laundering (AML) and tax obligations

• Personalize user experience

• Communicate regarding purchases and customer support

3.3 Legal Basis for Processing (GDPR/UK GDPR)

Under GDPR and UK GDPR, we process personal data on the following legal bases:

3.4 Data Sharing

We do not sell or rent your personal information. We may share information with:

• Service Providers: Payment processors, hosting providers, IT support under confidentiality obligations

• Regulatory Authorities: Where required by law

• Business Transfers: In connection with a merger or acquisition

3.5 Data Transfers

Data may be transferred outside the EEA/UK. Such transfers are safeguarded by:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• EU-U.S. Data Privacy Framework (where applicable)

• Equivalent adequacy mechanisms

3.6 Your Rights

Canada (PIPEDA):

• Right to access and correct personal information

• Right to withdraw consent for marketing

• Right to request deletion (subject to legal retention)

EU/UK (GDPR/UK GDPR):

• Right to access, rectify, erase ("right to be forgotten")

• Right to restrict processing

• Right to data portability

• Right to object to processing (including direct marketing under Art. 21(2))

• Right to withdraw consent at any time

To exercise these rights, contact us at: info@hey-pay.ca

3.7 Data Retention

• Transaction Data: Retained for 5-10 years to comply with AML and tax obligations

• Marketing Data: Retained only with consent, deleted upon withdrawal

• Biometric Data: Destroyed immediately after identity verification is complete

• Suppression Lists: Retained indefinitely to honor opt-out requests

3.8 Automated Decision-Making

Where HeyPay Ltd uses AI-assisted decision-making (e.g., fraud detection, identity verification), users have the right to request meaningful information about the decision and to seek human review.

4. Cookie Policy

4.1 What Are Cookies

Cookies are small data files stored on your device to enhance website functionality and user experience.

4.2 Types of Cookies We Use

4.3 Consent Requirements

Where HeyPay Ltd offers a "consent or pay" choice (e.g., tracking-free access via payment), this model will comply with ICO guidance requiring:

1. Genuine Choice: The paid option must be a realistic alternative, not designed to coerce consent

2. Appropriate Fee: Pricing must not penalize users who refuse cookies

3. Equivalence: Both routes provide broadly the same core service

4. No Power Imbalance: Users are not unfairly disadvantaged

5. Data Processing Agreement (DPA)

For merchants and business users, HeyPay Ltd acts as a Data Processor under GDPR/UK GDPR, while the merchant acts as the Data Controller. A formal Data Processing Agreement is available and includes:

• Duration and nature of processing

• Data subject rights handling

• Sub-processor list and notification obligations

• International transfer safeguards

• Security and confidentiality obligations

For users, HeyPay Ltd is typically a Controller, determining how payment data is processed.

6. Security Measures

HeyPay Ltd implements industry-standard security measures, including:

• End-to-end encryption of data in transit

• Tokenization of sensitive payment information

• Strict access controls

• Regular security audits and vulnerability assessments

• Privacy by design principles

7. Jurisdiction-Specific Provisions

7.1 Canada (PIPEDA)

• Consent: Express consent required for collection of sensitive personal information

• Québec Residents: Additional rights under Bill 64, including the right to be informed of automated decision-making and the option to request review. Biometric data collection requires prior disclosure to the Commission d'accès à l'information (CAI)

7.2 European Economic Area (GDPR/PSD2)

• PSD2 Compliance: As a payment service provider, HeyPay Ltd complies with PSD2 requirements for Strong Customer Authentication (SCA) and data sharing. SCA biometric data is used solely for authentication purposes unless separate explicit consent is obtained

• Data Protection Impact Assessment (DPIA): May be required for high-risk processing activities (e.g., large-scale fraud profiling)

• Silent Party Data: Processing of data of non-customers (e.g., payees) is limited and governed by strict compliance measures

7.3 United Kingdom (UK GDPR/PECR)

• PECR Compliance: Parallel to UK GDPR, PECR governs traffic and location data. Traffic data retention is limited; location data requires explicit consent for value-added services

• FCA Oversight: Where HeyPay Ltd provides payment services, FCA requirements apply to data use and transparency

• "Consent or Pay" Models: Where offered, must be justified through a DPIA and meet ICO guidance on genuine choice

8. Acceptable Use Policy

Users of HeyPay Ltd shall not:

• Use the Services for any illegal or fraudulent activity

• Interfere with or disrupt the integrity or performance of the Services

• Attempt to gain unauthorized access to any part of the Services

• Transmit any viruses or malicious code

• Violate any applicable data protection or privacy laws

Violation may result in suspension or termination of account access.

9. Disclaimer of Warranties and Limitation of Liability

HeyPay Ltd provides Services "as is." We do not warrant that the Services will be uninterrupted or errorfree. To the fullest extent permitted by law, HeyPay Ltd is not liable for any indirect, incidental, or consequential damages arising from use of the Services.

10. Governing Law

• Canadian Users: Governed by the laws of [Insert Province], Canada

• EU Users: Governed by the laws of [Insert Member State], subject to GDPR

• UK Users: Governed by the laws of England and Wales, subject to UK GDPR

11. Contact Information

For privacy inquiries, data subject requests, or compliance questions:

• Privacy Officer / DPO: Anis ur Rehman

• Email: anis@hey-pay.ca

• Address: Ontario Canada

12. Changes to These Policies

These policies are reviewed and updated regularly. Significant changes will be notified to users via email or prominent website notice. Continued use of the Services constitutes acceptance of updated policies