GDPR Compliance

1. Our Commitment to GDPR

Paybis is fully committed to complying with the General Data Protection Regulation (GDPR) (EU) 2016/679. We respect your privacy and are dedicated to protecting your personal data in accordance with GDPR requirements.

2. Lawful Basis for Processing

We process your personal data based on the following lawful bases:

• Contractual Necessity: Processing necessary for the performance of our services
• Legal Obligation: Compliance with anti-money laundering and financial regulations
• Legitimate Interests: Improving our services and preventing fraud
• Consent: For marketing communications (where required)

3. Your Rights Under GDPR

Under GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing
• Rights Related to Automated Decision Making: Not be subject to automated decisions

4. Data Subject Access Requests (DSAR)

To exercise your rights, you can submit a Data Subject Access Request. We will respond within 30 days. Requests can be submitted to: dpo@paybis-refunds.com

5. Data Protection Officer (DPO)

We have appointed a Data Protection Officer who oversees our GDPR compliance. You can contact our DPO at: dpo@paybis-refunds.com

6. International Data Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (BCRs)
• Adequacy decisions from the European Commission
• Explicit consent from data subjects

7. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the relevant supervisory authority within 72 hours
• Inform affected individuals when there is a high risk to their rights
• Document all breaches and remediation actions
• Implement measures to prevent future breaches

8. Data Protection Impact Assessments (DPIA)

We conduct Data Protection Impact Assessments for high-risk processing activities to identify and mitigate privacy risks before implementation.

9. Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.