We value your trust and are committed to ensure proper protection of your personal data. We respect your privacy and pledge to process and protect your personal data in a fair and lawful way in accordance with the applicable legal requirements of the European Union (General Data Protection Regulation 2016/679) (hereinafter referred to as the “GDPR”).
Please note that additional information might be provided in applicable terms and conditions, contracts, and other documents provided by us.
Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Personal data processing
Personal data processing means any operation or set of operations which is performed on personal data or on sets or personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
www.corytech.io is a website operated by Corytech operators (“Company”, “we”, “our”, or “us”). Corytech Operators refer to all parties that provide services available on this website, including but not limited to legal persons, unincorporated organizations and teams that provide services and are responsible for such services and is represented currently by:
Potok Digital Group ltd, a company registered and operating under the laws of England and Wales, company number 14360826, with the registered address at: 63-66 Hatton Garden, Fifth Floor, Suite 23, London, England, EC1N 8LE.
Corytech operators may change as Corytech’s business adjusts, in which case, the changed operators shall perform their obligations under these terms with you and provide services to you, and such change does not affect your rights and interests under these terms. Additionally, the scope of Corytech operators may be expanded due to the provision of new Corytech services. By continuing to use Corytech services, you are deemed to have agreed to execute these terms jointly with the newly added Corytech operators.
Due to the requirements of the GDPR, the Company has appointed a Data protection officer.
You can contact the Company via email: [email protected].
We may collect personal data about you directly from you and from a third party (such as your bank or merchant from who you buy goods or services), where you have given your explicit consent for your information to be transferred to the Company in order to initiate payment and receive bank account information.
Your personal data also might be obtained indirectly from other organisations where you have explicitly consented to your information to be transferred, specific register and information systems.
We will collect and process your personal data in accordance with the applicable laws and regulations.
We may use and transfer your personal data for several different purposes and we rely on different legal grounds while processing it. Depending on whether you are a person who uses payment services, a representative of a current or potential client of ours or a website visitor, the below information sets out what categories of personal data we process, for what purpose and legal ground we rely on when processing the personal data. We also describe how we collect your personal data and who we may transfer it to, as well as the legal ground that allows us to do so.
Personal data collected while processing your payment
If you are a card-holder making a payment to a merchant using our Services to process your payment, we may, directly or through a merchant using our payment processing service, collect, store and process financial and transaction related personal data about you and your transaction. This may include your billing address, delivery address, date of birth, purchase amount, date of purchase, payment method, credit or debit card number, bank account information and additional necessary information required to process your transaction. Merchants are responsible for providing appropriate privacy information to you about our processing of your data.
When securing our website and Services, we may collect details about your device, your transaction, your computer’s internet protocol and other technical information, through our data security and firewall providers.
Implementation of the “Know Your Client” principle and prevention of money laundering and terrorist financing
When required for compliance with applicable laws (including specifically anti-money laundering and counter-terrorism financing laws and regulations), we may verify your information and collect information from publicly available sources, credit reference or fraud prevention agencies or check data against government sanction lists, either directly, or using identity verification providers or due diligence and screening information providers.
For this purpose, we may process the personal data of our client’s representatives, directors and shareholders and / or other persons.
We may process the following personal data: name, surname, a unique sequence of symbols intended to identify the person, date of birth, the number and period of validity of the residence permit and the place and date of its issuance, address, citizenship, the country of issuance of the identification document (in cases of a stateless person), workplace (in cases of client’s director), image, personal identification document details, equity of the legal entity’s shares/voting rights/control (in cases of shareholder and beneficiary), signature, other data required by the Law on Prevention of Money Laundering and Terrorist Financing.
Following the legal requirements related to the implementation of “Know Your Client” principle and prevention of possible money laundering and terrorist financing, prevention of fraud, detection, investigation and informing of such activity, we may process your image (in the form of a photograph or live image) (biometric data) for identification purposes. Your image and personal identification document are combined in order to check if you are the owner of the presented personal identification document.
The Company may also process personal data of people who certify copies of documents or delegation. We may process the following personal data: name, surname, workplace, signature, other data required by the Law on Prevention of Money Laundering and Terrorist Financing.
Personal data are collected and processed on the basis of the legal obligation imposed on the payment initiation service provider, i.e. us. Your biometric data (your image) shall be processed on the basis of your consent (when image is processed for identification purposes). If you do not consent with processing of your biometric data, please contact us (Service provider that provides The Company an identification platform) for another method of identifying your identity.
We will process personal data for as long as we need it to fulfil the purpose the data was collected for and following the legal requirements. Personal data will be stored for 8 years after the termination of the business relationship with the Client. The data retention period may be extended for a period not exceeding 2 years, provided there is a reasoned request from a State Authority.
Performance of the Company‘s agreements
We will process personal data of our clients, its employees as well as our service providers in order to perform the agreements.
In such a case, we may process your personal data such as: name, surname, messaging content.
In cases when the Company enters into Agreements with a natural person, the Company will also process personal identification code, contact details (e-mail address, telephone number, address), other data that may be required to perform an agreement.
The basis for the processing of data is the performance of a contract between you and the Company and legitimate interest of the Company.
Personal data indicated in this section will be processed for as long as the agreement is in effect. If personal data are indicated in the agreement, they will be stored for 10 years as of the date of expiration of the respective agreement.
We value your feedback and we want to understand what we can do to improve our services. Therefore, you can contact us in order to receive assistance on your question or concern as well as any time that you are seeking to implement your rights.
If you contact us, we will process your personal data by collecting your contact details through the source you chose to contact us (via e-mail, post or any other way).
All personal data will be processed on the basis of your consent which is expressed by your actions by sending us a question, concern or request
Your personal data will be stored for 1 year after certain question, concern or request was sent to us. In some individual cases, in accordance with the applicable legal requirements, your personal data might be stored longer.
In cases you provided your contact information and expressed explicit consent to receive marketing information from us, the Company’ may contact you by phone or via e-mail providing you with the information about the Company’s services or submit other promotional material, e-mail send out commercial offers, newsletters and other advertising material.
We may process the following personal data for direct marketing purposes: name, surname, workplace, phone number, e-mail address, other information that person may provide, date of consent.
If you are our client and have not objected to our direct marketing messaging (by phone or email), we may use your personal data without explicit consent offering you similar products and/or services for which your personal data were originally collected via e-mail or phone. In such a case your personal data will be processed on the basis of our legitimate interest.
Your data will be used for direct marketing purposes for 1 (one) year as of the receipt of your consent or after provision of services.
You have the right to refuse direct marketing at any time by contacting us via e-mail on [email protected].
Data processors. data recipients
We can disclose your personal data to our employees, managers, service providers such as auditors, your bank or merchant.
Moreover, we can disclose information about you:
- If we must do this under the law (state institutions, law enforcement institutions and other persons in accordance with the applicable procedure;
- In order to protect our rights or interests (including the provision of your data to third parties in order to recover your debts to us);
- In order to sell a part of Company’s activities or assets, where we disclose your personal data to the potential buyer of the activities or a part thereof;
- Having sold the activities of the Company or a substantial part thereof to third parties.
We may also provide personal data to other persons upon receiving your written consent.
Transfer of Personal Data to Third Parties
Clients’ Personal data is stored and processed by the Company, and its cooperation partners within the EU.
The Company reserves the right to disclose Clients’ Personal data to the following entities insofar as such data is necessary for the performance of their delegated functions and there is an adequate legal basis for a lawful disclosure of Personal data:
- to selected and designated third parties, including Company’s partners, affiliates, providers that perform services on behalf of the Company under a written agreement, which ensures proper safeguards and limitations with regards to Processing. This may include companies providing IT, audit, identity verification, marketing, translation and/or due diligence services, data analysis, cloud service providers and others;
- to government, regulatory or other law enforcement agencies/authorities in cases specified by law and regulatory enactments.
Transfer of Personal Data Outside the EU
Personal data may be transferred by the Company outside the EU only when appropriate security measures have been taken and if at least one of the following applies:
- Personal data transfer is required under the laws and regulatory enactments being in force in the EU;
- Personal data transfer is necessary for the Company to enter into or perform an agreement with Clients for the provision of Services;
- In other cases, where the Client has given express consent to the Processing outside the EU.
Security of your personal data
Your personal data will be processed pursuant to the requirements set out in GDPR and other applicable legal acts.
In the course of processing your personal data, we implement organizational and technical measures which ensure the protection of personal data from an accidental or unlawful destruction, alteration, disclosure and any other unlawful processing. These measures may include, among other, encryption, physical access security, auditing and other appropriate technologies.
We will provide information on actions taken on a request with regard to implementation of your rights within 1 (one) month of receipt of the request. In consideration of the request complexity and the number of received requests, the aforementioned term may be extended for 2 (two) further months. In this case, we will notify you of such term extension and reasons for it within 1 (one) month as of the receipt of request. We will refuse to implement your rights only in cases provided for in the legal acts.
Your rights are as follow:
The right to be informed
The right of access
We want you to fully understand how we use your personal data and not to experience any inconvenience because of that. You can contact us at any time and ask if we process any of your personal data. If we store or use your personal data in any way, you have the right to access them.
We will provide access to the personal data we hold about you as well as the following information: the purposes of the processing, the categories of personal data concerned, the recipients to whom the personal data has been disclosed, the retention period or envisioned retention period for that personal data, when personal data has been collected from a third party, the source of the personal data.
The right to rectification
When you think we process inaccurate or incomplete personal information about you, you may exercise your right to correct or complete certain personal data. This may be used with the right to restrict processing to make sure that incorrect/incomplete personal data is not processed until it is corrected.
The right to restrict processing
You have the right to ask us to restrict the processing of your personal data or to object to their processing:
- During the period required for us to verify the accuracy of your personal data when you submit claims with regard to data accuracy;
- During the period required to determine if we have an overriding legal basis to continue processing your personal data if you exercise your right to object to the processing of your personal data.
The right to data portability
You have the right to the portability of data obtained by us under your consent or for the purpose of agreement conclusion. If you exercise this right, we will transfer a copy of the data provided by you.
The right to object
You have the right to object to the use of your personal data by us:
- In cases where we use such data in order to implement our legitimate interests but we do not have an overriding legal basis to continue using your personal data; or
- At any time when we use your personal data to send newsletters or for direct marketing purposes. In such a case, the data will not be used for these purposes anymore; however, they may be used for other legitimate purposes.