Privacy Policy
Last updated: September 2026
1. Who we are
NeoPayments LLC (“NeoPayments”, “we”, “us”, “our”) operates payment methods and payment gateway services for merchants. Our services include card acceptance, digital wallets, local and alternative payment methods, hosted checkout pages, a payments API, multi-currency settlement and fraud screening.
This Privacy Policy explains how we collect, use, share and protect personal data, and what rights you have in relation to it.
2. Scope and our role
This policy applies to three groups of people:
- Website visitors who browse this website or send us a message through our contact form.
- Merchant prospects and clients, including the owners, directors, authorised representatives and employees of businesses that apply for or use our services.
- End customers, meaning the individuals who pay a merchant using a payment method or checkout provided through NeoPayments.
For website visitors and merchant prospects and clients, NeoPayments acts as the controller and decides how and why personal data is processed.
When we process payments on behalf of a merchant, we generally act as a processor (or service provider) for that merchant, and the merchant is the controller of its customers’ data. In that case the merchant’s own privacy notice governs the processing, and requests about that data should be directed to the merchant first. We act as an independent controller for end-customer data only to the extent we must process it for our own legal and regulatory obligations, such as anti-money laundering checks, sanctions screening, fraud prevention and compliance with card scheme rules.
3. Data we collect
Contact form data
When you use our contact form, we collect your name, company name, email address and the content of your message.
Merchant onboarding and verification data
To assess and onboard a merchant, we collect information required for know-your-customer (KYC) and know-your-business (KYB) checks. This may include company registration details, ownership and control structure, identity documents and dates of birth of beneficial owners and authorised signatories, business address, website and business model details, expected transaction volumes, bank account details for settlement, and the results of sanctions, politically exposed person and adverse media screening.
Transaction data
When we process payments, we receive data needed to execute and secure each transaction, such as payment method details, amount, currency, date and time, order reference, merchant identifier, billing information provided at checkout, device and browser information, IP address, and authorisation, refund and chargeback records.
Technical data
When you visit our website or use our dashboard or API, our servers automatically record technical data, including IP address, browser type and version, operating system, referring page, requested pages, timestamps and error logs.
4. Purposes and legal bases
We use personal data for the following purposes and, where applicable data protection law requires a legal basis, rely on the bases indicated:
- Responding to enquiries sent through our contact form: our legitimate interest in answering business enquiries, or steps taken at your request before entering into a contract.
- Onboarding merchants and providing our services, including account management, payment processing, settlement and support: performance of a contract.
- Identity verification, anti-money laundering, counter-terrorist financing and sanctions compliance: compliance with legal obligations.
- Fraud prevention and transaction risk screening: compliance with legal obligations and card scheme rules, and our legitimate interest in protecting merchants, end customers and our platform from fraud.
- Operating and securing our website and systems, including monitoring, troubleshooting and preventing abuse: our legitimate interest in running a secure and reliable service.
- Establishing, exercising or defending legal claims and responding to lawful requests from authorities: legal obligations and our legitimate interests.
We do not use personal data for automated decisions that produce legal effects without human review, except where transaction risk screening automatically declines a payment to prevent fraud. If you believe a payment was declined in error, you may contact the merchant or use our contact form.
5. Payment card data
Card data is handled in line with the requirements of the Payment Card Industry Data Security Standard (PCI DSS). Full card numbers are encrypted in transit and at rest, and are replaced with tokens as early as possible in the payment flow, so that merchants and most of our internal systems work only with tokens. Card security codes (CVV/CVC) are never stored after authorisation. Access to card data is limited to the systems and personnel that require it to process payments.
7. International transfers
Because payments often involve banks, card schemes and payment method providers in several countries, personal data may be transferred to and processed in countries other than the one in which it was collected. Where the law of the originating country restricts such transfers, we put appropriate safeguards in place, such as standard contractual clauses approved by the relevant authorities, transfers to countries recognised as providing an adequate level of protection, or other mechanisms permitted by applicable law.
8. Retention
We keep personal data only for as long as needed for the purpose for which it was collected, and for any longer period required by law.
- Contact form data is kept for up to 24 months after our last communication, unless it becomes part of a merchant relationship.
- Merchant onboarding and verification data and transaction records are kept for the duration of the business relationship and afterwards for the period required by anti-money laundering, tax and accounting laws, which is typically at least five years after the relationship ends or the transaction is completed.
- Server logs are kept for a limited period, normally not more than 12 months, unless needed to investigate a security incident.
When retention periods expire, data is deleted or irreversibly anonymised.
9. Security
We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, tokenization of card data, network segmentation, role-based access controls, multi-factor authentication for administrative access, logging and monitoring, and regular security testing. Staff with access to personal data are bound by confidentiality obligations. No method of transmission or storage is completely secure, but we work to protect personal data against unauthorised access, loss and alteration, and we will notify affected parties and authorities of personal data breaches where required by law.
11. Your rights
Depending on the law that applies to you, you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectification of inaccurate or incomplete data;
- Erasure of your data, where there is no longer a lawful reason for us to keep it;
- Restriction of processing in certain circumstances;
- Objection to processing based on our legitimate interests;
- Portability, meaning receipt of data you provided to us in a structured, commonly used and machine-readable format;
- Complaint to a data protection supervisory authority, in particular in the country where you live, work or where an alleged infringement took place.
Some rights are limited where we must keep data to meet legal obligations, for example under anti-money laundering law. To exercise your rights, use our contact form. We may ask for information to verify your identity before responding. If your request concerns a payment you made to a merchant, we may refer it to that merchant as the controller, and we will assist the merchant in responding.
12. Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children through this website. If you believe a child has provided us with personal data, please tell us through our contact form and we will delete it where appropriate.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services or in legal requirements. The current version is always published on this page with its “Last updated” date. Where changes are material, we will inform merchant clients through their account or by other appropriate means.
14. Contact
For questions about this Privacy Policy or our handling of personal data, or to exercise your rights, please use our contact form.