Version 1.0 | Effective Date: 05 July 2026

This privacy notice is issued by Ganaire Finance Limited, trading as GanairePay ("GanairePay", "we", "us" or "our"), a company registered in England and Wales. We are the data controller of the personal data described in this notice.

GanairePay is a payment orchestration and merchant onboarding platform that enables businesses to access payment processing services through a network of licensed acquiring banks, payment institutions, electronic money institutions and payment service providers. GanairePay facilitates merchant onboarding, compliance, payment orchestration and technical integrations but does not itself hold customer funds unless expressly stated under applicable regulatory permissions.

If you have questions about this policy or how we process personal data, please contact privacy@ganairepay.com.

Summary of Key Points

• We collect business, contact, identity, verification, technical and onboarding information from merchants, partners and authorised representatives.
• We process KYB/KYC information, sanctions and PEP screening results, uploaded documents and audit records to assess, onboard and monitor merchants.
• We share information with technology providers, verification providers, acquiring banks, payment partners, card schemes, banking partners, professional advisers and regulators where necessary.
• We do not sell personal data and we do not share personal data with third parties for their own marketing purposes.
• We use security controls including access restrictions, audit logs, encrypted transmission and secure document storage.
• You may have rights to access, correct, restrict, delete, object to or request portability of your personal data under applicable data protection law.

1. What Information Do We Collect?

Information you or your business provide to us. When you apply to become a GanairePay merchant or partner, use our Merchant Hub, access our Merchant Portal, or communicate with us, we may collect:

• Business details: Legal and trading names, registration and tax identification numbers, registered and operating addresses, websites, mobile applications, business descriptions, merchant category codes, processing history, expected volumes, settlement details, markets served and currencies required.
• People connected to the business: Names, dates of birth, nationalities, residential addresses, ownership percentages and roles of directors, shareholders, ultimate beneficial owners, authorised representatives and nominated contacts.
• Identity and verification documents: Passports, national identity documents, proof of address, corporate documents, licences, policies, bank letters, financial statements, processing statements and any other documents submitted during onboarding or review.
• Merchant onboarding information: Onboarding forms, due diligence questionnaires, compliance responses, supporting documentation, reviewer notes, approval history, audit records, application status, risk indicators and internal decision records generated through the GanairePay Merchant Hub.
• Contact details: Primary, technical, compliance, finance, support and operations contacts.
• Technical and integration information: Website URLs, processing URLs, callback URLs, webhook URLs, API endpoints, IP addresses, integration preferences, payment methods required and environment settings.
• Declarations and communications: Declarations, signatures and communications submitted through our platform, email, messaging tools or other channels.

Information collected automatically. When you visit our websites, use our Merchant Hub or access our platform, we may automatically collect IP address, browser and device characteristics, operating system, language preferences, referring URLs, log data, usage data, security events and approximate location derived from IP address. We use this information for security, fraud prevention, service operation, analytics and platform improvement.

Information from other sources. We may receive information about your business and connected persons from sanctions, PEP and adverse-media screening providers, official company registries, acquiring partners, payment partners, card schemes, banking partners and publicly available sources.

You must ensure that all information provided to us is true, complete and accurate, and you must notify us promptly of any changes.

2. Sensitive and Criminal-Offence Data

Our financial-crime controls, including sanctions, PEP and adverse-media screening, may reveal information relating to alleged or actual criminal convictions and offences, regulatory action, political exposure or other sensitive information about connected persons. We process this information only:

• To the extent necessary to comply with our legal obligations and the standards required by our acquiring, card scheme, settlement and banking partners.
• Where permitted under UK data protection law and, where applicable, EU data protection law.
• With human review of potential matches. We do not reject an application solely by automated means.

3. How and Why Do We Process Your Information?

• Merchant onboarding and due diligence: Verifying the identity and legitimacy of applicant businesses and their connected persons, assessing risk and deciding whether to provide services.
• Sanctions, PEP and adverse-media screening: Screening connected persons at application stage and periodically during the business relationship.
• Providing and administering our services: Account management, application status communications, technical support, merchant provisioning and payment services through our licensed partners.
• Merchant Portal and API services: Creating and administering merchant accounts, provisioning sandbox and production environments, generating API credentials, webhook secrets and merchant identifiers, and providing secure access to the GanairePay Merchant Portal.
• Legal and regulatory compliance: Anti-money-laundering, counter-terrorist-financing, record-keeping, tax, card scheme obligations and responding to lawful requests from regulators, law enforcement and courts.
• Security and fraud prevention: Protecting our platform and users, detecting and preventing misuse, maintaining audit records and monitoring onboarding decisions.
• Ongoing merchant monitoring: Reviewing merchant information throughout the relationship, including document renewal, ownership verification, transaction monitoring, sanctions screening and regulatory compliance reviews.
• Service improvement: Analysing platform usage and onboarding performance to improve our services.
• Business administration: Managing relationships with partners, suppliers, advisers, insurers and in connection with corporate transactions.

We may contact authorised merchant representatives regarding onboarding updates, compliance requests, document verification, technical integration, production activation, security notifications and important operational announcements.

4. What Legal Bases Do We Rely On?

Under UK GDPR and, where applicable, EU GDPR, we rely on the following legal bases:

• Performance of a contract: Where processing is necessary to assess your application or provide services under our agreement with your business.
• Legal obligation: Where processing is necessary to comply with financial crime, tax, record-keeping, regulatory or court obligations.
• Legitimate interests: Where processing is necessary for due diligence, fraud prevention, security, service administration, partner requirements and business operations, balanced against the rights and interests of individuals.
• Consent: Where we rely on consent, such as for non-essential cookies or certain marketing communications, you may withdraw consent at any time.

5. When and With Whom Do We Share Your Information?

We may share personal data with:

• Technology and infrastructure providers that support our Merchant Hub, Merchant Portal, payment orchestration, hosting, databases, document storage, email delivery, security and platform operations.
• Acquirers, payment partners, card schemes and banking partners, including licensed acquiring and settlement institutions, where merchant due diligence information is required to approve, maintain or monitor processing arrangements.
• Verification and screening providers, including sanctions, PEP, adverse-media and registry-lookup services.
• Professional advisers, including lawyers, auditors, accountants, insurers and consultants where necessary.
• Regulators, law enforcement, courts and public authorities where disclosure is required or permitted by law.
• Business transfer parties in connection with any merger, acquisition, financing, reorganisation or sale of assets, subject to appropriate confidentiality and data-protection safeguards.

We share only information that is necessary for the relevant purpose and record disclosures where appropriate. We do not sell personal data and we do not share personal data with third parties for their own marketing purposes.

6. International Transfers

We operate globally and some service providers, payment partners and acquiring partners may be located outside the United Kingdom or the European Economic Area. Where personal data is transferred internationally, we implement safeguards recognised by applicable law, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other appropriate contractual, organisational and technical safeguards.

Before transferring personal data internationally, GanairePay conducts due diligence on service providers and implements appropriate safeguards to protect personal information. You may request further details by contacting privacy@ganairepay.com.

Merchant documentation may be securely stored within the United Kingdom, the European Economic Area or other approved jurisdictions that provide appropriate safeguards under applicable data protection legislation.

7. How Long Do We Keep Your Information?

Merchant onboarding and due-diligence records, including identity documents, screening results and decision audit trails, are retained for the duration of our relationship with your business and for at least five years after it ends, in line with anti-money-laundering record-keeping requirements, unless a longer period is required by law.

Unsuccessful, declined or abandoned merchant applications are retained for 12 months from the date of the final decision or last recorded activity, unless a longer retention period is required to comply with legal, regulatory or financial crime obligations.

Technical logs, security logs and analytics are retained for shorter operational periods appropriate to their purpose, unless required for security, legal or compliance purposes.

When retention periods expire, we securely delete or anonymise the data. Where deletion from backups is not immediately possible, data is isolated from further processing until deletion occurs.

8. How Do We Keep Your Information Safe?

We apply appropriate technical and organisational measures, including encryption of data in transit and at rest, role-based access controls, restricted administrative access, audit logging, secure document storage, server-side validation of uploads and administrative security controls.

Access to the Merchant Hub, Merchant Portal and administrative tools requires authenticated user accounts. Administrative actions, document uploads, document reviews, approval decisions, account changes and security-sensitive events are logged for security, audit and compliance purposes.

Documents uploaded through our onboarding platform may be automatically scanned for malware and other security threats before storage. We may also notify merchants when submitted compliance documents are approaching expiry to assist with ongoing compliance.

Following approval, we may generate merchant identifiers, API credentials, API secrets and webhook secrets. These credentials are issued securely and should be stored confidentially by authorised merchant personnel.

No electronic transmission or storage technology is completely secure. You should access our services only through secure networks and protect your login credentials.

9. What Are Your Privacy Rights?

Depending on your location and the applicable law, you may have the right to access your personal data, rectify inaccurate data, request erasure, restrict processing, object to processing based on legitimate interests, request data portability and challenge solely automated decisions.

To exercise any right, email privacy@ganairepay.com. We may need to verify your identity before acting on a request. We will respond within one month unless the request is complex, in which case we may extend the response period as permitted by law.

Some information must be retained despite an erasure request, for example AML records we are legally required to keep. Where a legal restriction applies, we will explain it in our response.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or, if you are in the EEA, to your national supervisory authority. We would appreciate the opportunity to address your concerns first, so please contact us at privacy@ganairepay.com.

10. Data Provided About Other People

If you provide personal data about individuals other than yourself, such as directors, shareholders, UBOs, employees, contractors, advisers or nominated contacts, you confirm that you are authorised to do so and that you have made this privacy policy available to them. We process their data as described in this policy.

11. Cookies and Tracking Technologies

Our websites use cookies and similar technologies for essential operation, security and analytics. Essential cookies cannot be switched off. Non-essential cookies are used only with consent where required by law.

Where required by law, users will be presented with a cookie preference banner allowing consent preferences to be managed. For details of the cookies we use and how to manage your preferences, use the cookie preference settings on our website or contact privacy@ganairepay.com.

12. Marketing Communications

Where we send marketing about our services, we do so in accordance with applicable law, including obtaining consent where required. Every marketing email includes an unsubscribe link and you can opt out at any time by contacting privacy@ganairepay.com.

Opting out of marketing does not affect service communications about your application, onboarding, compliance, integration, account security, production activation or operational notices that we need to send in order to provide our services.

13. Third-Party Websites

Our websites and communications may link to third-party sites and services that we do not control. This policy does not cover those third parties and we are not responsible for their privacy practices. You should review the privacy notice of any third-party site you visit.

14. Do We Collect Information from Minors?

Our services are intended for businesses and their authorised representatives. We do not knowingly collect personal data from, or market to, anyone under the age of 18. If we learn that we have collected such data, we will delete it promptly. If you believe we hold data about anyone under 18, please contact privacy@ganairepay.com.

15. Automated Decision-Making

Our screening tools may automatically flag potential sanctions, PEP or adverse-media matches for review, and our platform may generate risk indicators to assist our reviewers. Every onboarding decision is made by a human reviewer. We do not make decisions that produce legal or similarly significant effects about individuals solely by automated means.

16. Changes to This Policy

We may update this policy from time to time. The revised version takes effect from the date shown at the top of the policy. Material changes will be highlighted on our website or notified to affected users directly where appropriate. We encourage you to review this policy regularly.

17. How to Contact Us