Privacy Policy

VivaPay is incorporated under Estonian law and provides technology solutions primarily for high-risk industries. Our services focus on securely routing payments and tokenizing sensitive card data, helping businesses operate safely and efficiently without ever directly handling or storing full payment card information.

Information You Provide: Contact and identification details (name, email, phone, business contact details), verification documents (government-issued ID, corporate registration, tax ID numbers, ownership information), and business information (articles of incorporation, beneficial ownership).

We never store full card numbers, CVVs, or other sensitive payment data — these are fully tokenized.

Information Collected Automatically: Device and browser details, IP address, operating system, geolocation (where allowed), session information such as pages accessed, clicks, and usage patterns. Analytics and error reporting (no cookies used for tracking).

Information from Third Parties: Identity verification providers, regulatory or public databases for KYC/AML compliance, and payment processors strictly for routing and tokenized transaction processing.

VivaPay uses personal and business information to: provide and maintain our Services, verify identities and comply with legal obligations, detect, prevent, and respond to fraud or unauthorized activity, communicate regarding account issues, security alerts, or Service updates, and improve technology, conduct research, and analyze trends.

We do not sell or rent your personal data.

For individuals in the EEA, processing is based on: Contractual necessity (to deliver requested Services), Legal obligations (compliance with AML/KYC, tax, and other laws), Legitimate interests (fraud prevention, security, and service optimization), and Consent (where explicitly requested for specific processing activities).

VivaPay only shares information when necessary for: service delivery (identity verification, routing, and tokenized processing), regulatory compliance (required by Estonian or international authorities), and corporate transactions (mergers, acquisitions, or asset sales).

All third parties are contractually or legally bound to maintain confidentiality and protect data according to GDPR standards.

VivaPay implements strong security measures including data encryption in transit and at rest, restricted access to authorized personnel, and continuous monitoring and security reviews.

While we take every precaution, no system is entirely risk-free.

We retain data only as long as necessary for providing Services, meeting legal and regulatory requirements (AML/KYC, accounting, tax), and resolving disputes and enforcing agreements. When no longer required, data is securely deleted or anonymized.

Depending on your jurisdiction, you may have the right to: access, correct, or update personal data, request deletion or restriction of processing, object to processing for certain purposes, request portability of your data, withdraw consent where processing is based on consent, and file a complaint with a supervisory authority.

Requests can be submitted to privacy@vivapay.com.

Data may be processed or stored outside your country of residence, including outside the EEA. We implement GDPR-compliant safeguards, such as Standard Contractual Clauses (SCCs), to ensure your information remains protected.

Email: privacy@vivapay.com

Address: VivaPay OÜ, Estonia