Privacy Policy

1. About this policy

1. 1.1
   This policy explains how Checky Pro B.V. processes personal data. It applies to our website, the Dashboard, the Checkout that merchants use in their stores, and the payment services we make available through our acquiring partners. Capitalised terms have the meaning given to them in our Terms of Service.
2. 1.2
   It is written for four groups of people:

   1. a.merchants, and the people who use the Dashboard for them (article 4);
   2. b.the directors, ultimate beneficial owners and Authorised Signatories of a merchant, whose data the merchant gives us during onboarding (article 4);
   3. c.shoppers who pay in a store that uses our Checkout (article 5);
   4. d.visitors to our website (article 6).
3. 1.3
   If you are a shopper, the store you bought from is in most cases responsible for your data, and is your first point of contact. Article 3 explains why.

2. Who we are

1. 2.1
   The controller for the processing described in this policy, except where article 3.2 says otherwise, is Checky Pro B.V., Brandweerstraat 20, 7514 AE Enschede, the Netherlands, registered with the Chamber of Commerce under number 42000293.
2. 2.2
   For any question about this policy or about your personal data, and to exercise your rights, contact us at info@checkypro.com.

3. Our two roles

1. 3.1
   Data protection law distinguishes the controller, who decides why and how personal data is processed, from the processor, who processes it on the controller's behalf. We act in both roles.
2. 3.2
   We are a processor for the personal data of shoppers that we process to provide the Checkout and payments to a merchant. The merchant is the controller. That processing is governed by the Data Processing Agreement between the merchant and us.
3. 3.3
   We are a controller for:

   1. a.the data of merchants, their users, directors, ultimate beneficial owners and Authorised Signatories;
   2. b.the data of visitors to our website;
   3. c.the limited set of shopper data that we process for our own purposes, set out in article 5.3 and article 5.4.
4. 3.4
   Our acquiring partners and the Card Schemes are controllers in their own right. They process the data they receive from us under their own privacy terms. An acquiring partner whose terms a merchant accepts provides a link to its privacy terms at that moment.

4. Merchants and the people behind them

1. 4.1
   What we process. We process:

   1. a.account and contact data: name, business email address, telephone number, role, login details;
   2. b.company data: legal name, address, registration number, VAT number, legal form, ownership and control structure, website and store details;
   3. c.data of directors, ultimate beneficial owners and Authorised Signatories: name, date of birth, nationality, residential address, ownership percentage, role, and copies of identity documents and proof of address where an acquiring partner requires them;
   4. d.bank account details for payouts, and the payment method you register for our invoices;
   5. e.commercial data: your plan, invoices, fees, payouts, balances and the Transactions of your Store;
   6. f.records of what you accept and sign, as set out in paragraph 6;
   7. g.messages and support conversations with us;
   8. h.technical data: IP address, browser and device details, login times and activity in the Dashboard.
2. 4.2
   Where it comes from. Most of this data you give us yourself. The data of directors, ultimate beneficial owners and Authorised Signatories is given to us by the merchant during onboarding; under our Terms of Service the merchant informs these people and refers them to this policy. We also receive information about the status of an application and about Transactions from our acquiring partners, and we may check company information in public registers such as the trade register.
3. 4.3
   Documents for our acquiring partners. During onboarding we ask, in one round, for the documents and information that each acquiring partner to which we may submit your application requires. We submit them only to the acquiring partner we choose for your Store, and to a further acquiring partner where your payments are routed to one, as set out in article 4 of the Terms of Service. We keep the rest of your file so that we can do so without asking you again.
4. 4.4
   National identification numbers. You mask the citizen service number (BSN) or comparable national identification number on a copy of an identity document, unless we tell you that an acquiring partner requires it. Where we receive an unmasked copy that we do not need, we mask or delete it.
5. 4.5
   Sharing with acquiring partners. To provide Payments we share your onboarding file and information about your Transactions with the acquiring partner to which we submit your application. Where you accept the terms of an acquiring partner through its own systems at the end of onboarding, we share with it, at that moment, the details of your company and of your Authorised Signatory that it needs for that acceptance. The acquiring partner decides whether to accept you and is a controller for its own processing, including the checks it is required by law to carry out.
6. 4.6
   Acceptance and signature records. When you accept our Terms of Service, sign the Merchant Agreement or accept the terms of an acquiring partner, we record who accepted, in which role, which document and version, the date and time, the IP address and the browser used. We keep these records as evidence of the agreement, and because our acquiring partners require us to be able to show them.
7. 4.7
   Collection. Where an invoice remains unpaid, we may use the payment method you registered, and we may instruct a collection agency or a bailiff. We give them the data they need to collect the amount.

5. Shoppers

1. 5.1
   When we process your data for the store. When you pay in a store that uses our Checkout, we process your data for that store: your name, email address, billing and delivery address, telephone number where the store asks for it, the items and amount of your order, the payment method, the status of the payment and of any refund or dispute, and technical data such as your IP address and device details. The store decides what happens with that data. For questions or requests, contact the store first; we pass on any request we receive to the store.
2. 5.2
   Payment disputes. Where your card issuer reports a possible dispute about a payment, we receive that alert through the alert networks of the Card Schemes and present it to the store, so that the store can resolve it, for example by a refund.
3. 5.3
   Fraud prevention and security, for our own purposes. We also use shopper data, such as IP address, device details, email address and payment outcomes, to detect and prevent fraud and misuse across the stores that use our Checkout and to keep the Platform secure. For this purpose we are the controller, and our legitimate interest, and that of the stores and our acquiring partners, in preventing fraud is the legal basis.
4. 5.4
   How the Checkout is used. We measure how the Checkout is used, for example which steps are completed and where errors occur, to improve it. This includes recordings of how the pages of the Checkout are used, in which the details you enter, such as your name, address and card details, are hidden. For this purpose we are the controller, and our legitimate interest in improving the Checkout is the legal basis. We do not place cookies or store other information on your device for this purpose.
5. 5.5
   Card details. Card numbers and security codes are entered in payment fields provided by our acquiring partners or by the payment gateways that connect us to them, and are stored by them. They do not reach our systems. We receive only a token and limited details, such as the card brand and the last four digits.

6. Website visitors

1. 6.1
   On our website we process the data you enter in a form, such as a contact or partnership request, to respond to it.
2. 6.2
   With your consent, we and our advertising partners use cookies and similar technologies to measure visits and the effect of our advertising, and we record through which partner link or campaign you reached us, so that a partner who introduced you can be credited if you sign up. Our Cookie Policy describes which technologies we use, for what purpose and for how long, and how you can withdraw your consent.

7. Purposes and legal bases

1. 7.1
   We process personal data only for the purposes below, each on the legal basis stated.

2. 7.2
   Where we rely on legitimate interest, we have weighed that interest against your interests and rights. You can ask us how we did that, and you can object at any time under article 13.
3. 7.3
   Providing the data we ask for during onboarding is necessary to apply for Payments. Without it we cannot submit an application to an acquiring partner.

8. Who we share data with

1. 8.1
   We share personal data only where a purpose in article 7 requires it, and only with:

   1. a.our acquiring partners, and through them the Card Schemes and banks involved in a payment, each as a controller in its own right;
   2. b.payment gateways and other technical service providers that connect the Checkout to our acquiring partners;
   3. c.the providers that host and run our Platform, and our providers for analytics, error monitoring, email, messaging, customer support, customer relationship management and electronic signatures;
   4. d.the alert networks of the Card Schemes and the service providers that connect us to them, for the alerts described in article 5.2;
   5. e.the payment processor that collects our invoices;
   6. f.collection agencies and bailiffs, under article 4.7;
   7. g.our accountants, auditors and legal advisers, who are bound by confidentiality;
   8. h.supervisory authorities, tax authorities, the police and the courts, where the law requires us to;
   9. i.a buyer of or investor in our business, where that is necessary for a merger, acquisition or similar transaction, under confidentiality;
   10. j.advertising platforms, for visitors to our website who consented to marketing cookies, as described in our Cookie Policy;
   11. k.the partner who introduced a merchant to us, limited to the information needed to calculate and check the partner's commission.
2. 8.2
   Our service providers process personal data on our instructions under a data processing agreement, unless they act as a controller in their own right.
3. 8.3
   The service providers that process shopper data for a store are listed in the Data Processing Agreement.
4. 8.4
   We do not sell personal data.

9. Transfers outside the European Economic Area

1. 9.1
   We host the Platform within the European Economic Area.
2. 9.2
   Some recipients, such as Card Schemes, acquiring partners and some of our service providers, process data outside the European Economic Area. In that case we transfer the data only to a country for which the European Commission has decided that it ensures an adequate level of protection, or on the basis of the standard data protection clauses adopted by the European Commission.
3. 9.3
   You can ask us for information about these safeguards and for a copy of them.

10. How long we keep data

1. 10.1
   We keep personal data no longer than we need it for the purposes in article 7, or than the law requires.

2. 10.2
   A period may be longer where we need the data to deal with a dispute, a claim or a request from an authority, for as long as that lasts.
3. 10.3
   When a period ends we delete the data or make it anonymous.

11. Security

1. 11.1
   We protect personal data with technical and organisational measures that fit the risk, including encryption of data in transit, access rights based on role and need, and logging of access to personal data.
2. 11.2
   We have the Platform tested by means of penetration tests, and we have completed a PCI DSS self-assessment questionnaire (SAQ D).
3. 11.3
   Where a personal data breach occurs, we notify the Dutch Data Protection Authority where the law requires us to, and we inform the merchants concerned without undue delay so that they can meet their own obligations.

12. Automated decisions

1. 12.1
   We do not take decisions about you based solely on automated processing that have legal effects for you or similarly significantly affect you, with one exception.
2. 12.2
   Where Checky Pro manages the payouts of an account, its reserve level is adjusted automatically on the basis of its chargeback ratio, as set out in our Settlement and Reserve Policy. Where you are a sole trader, this affects you personally. This is necessary for the performance of our agreement with you. You can ask for a review by one of our staff, give your view and contest the outcome, as set out in article 7.4 of the Settlement and Reserve Policy.
3. 12.3
   Acquiring partners decide whether to accept a merchant and may use automated tools in doing so. They are responsible for that under their own privacy terms.

13. Your rights

1. 13.1
   You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a structured, commonly used and machine-readable format, and to object to processing based on our legitimate interest. Where we process data on the basis of your consent, you may withdraw that consent at any time; this does not affect processing that took place before.
2. 13.2
   To exercise a right, contact us at the address in article 2. We respond within one month. Where a request is complex or we receive many requests, we may extend this by two further months, and we tell you so within the first month. We may ask you to confirm your identity.
3. 13.3
   A right may be limited where we must keep the data by law, or need it to establish, exercise or defend a legal claim. In that case we tell you which reason applies.
4. 13.4
   Where we process your data for a store as its processor, we pass your request on to that store and help it to respond.
5. 13.5
   You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority in the country where you live or work.

14. Changes to this policy

1. 14.1
   We may change this policy. The version in force is published on our website with its version number and date.
2. 14.2
   We inform merchants by email or in the Dashboard of a change that materially affects how we process their data, before it takes effect.

Version 3.3 · Effective 1 November 2026 · Checky Pro B.V., Brandweerstraat 20, 7514 AE Enschede, the Netherlands · Chamber of Commerce 42000293