Privacy Policy

This Privacy Policy is issued by NEXORA CONSULTING LTD, business address Regus Limassol, Victory, Limassol, Cyprus, email info@nexorapays.com ("NEXORA", "we", "us" or "our").

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR") and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018, NEXORA CONSULTING LTD is the controller of the personal data described in this policy, except where section 9 states that we act as a processor.

BIGWALLET PAYMENTS (business name registration reference EE 50249) is a sister business related to NEXORA CONSULTING LTD. It is a separate business and is not the controller of personal data processed under this policy.

NEXORA CONSULTING LTD and BIGWALLET PAYMENTS do not act as joint controllers, and personal data collected by NEXORA CONSULTING LTD is not shared with BIGWALLET PAYMENTS merely because the businesses are related. Any sharing between them takes place only where there is a lawful basis and a specific purpose, such as where a Client has asked us to coordinate a service involving that business, and you will be informed where required.

Depending on our relationship with you, we may collect and process:

• names;
• business email addresses;
• telephone numbers;
• company names and job titles;
• corporate details of the organisation you represent;
• director and shareholder information;
• beneficial ownership information, where relevant;
• financial information;
• banking documentation;
• KYC and AML documents, such as identification documents and proof of address, where applicable;
• contractual information;
• invoicing information;
• contact form submissions, including the content of your message; and
• technical information, including IP addresses, browser and device data and security logs.

We collect personal data directly from you, from the organisation you represent, from your professional advisers, and, where lawful, from public registers, sanctions and screening databases and third-party KYC providers.

We do not seek to collect special categories of personal data. Please do not include such data in enquiries submitted through our website.

The website contact form does not transmit or store your information on our servers. When you submit it, the form prepares an email in your own email application, addressed to our business email address. The inquiry reaches us only if you send that email.

When you send an inquiry, we receive your full name and business email address and, if you choose to provide them, your company name, industry, services of interest, selected package and message, together with the information your email provider normally includes in an email.

We process personal data only where we have a legal basis under Article 6 of the GDPR. We do not rely on consent for all processing; the legal bases we use are set out below.

Where processing is necessary to take steps at your request before entering into a contract, or to perform a contract, including:

• responding to business enquiries;
• preparing Commercial Offers;
• entering into agreements; and
• delivering contracted services.

Where processing is necessary to comply with legal obligations, including:

• accounting, tax and invoicing obligations;
• KYC, customer due diligence and anti-money-laundering obligations, where applicable; and
• responding to lawful requests from authorities.

Where processing is necessary for our legitimate interests, which are not overridden by your interests or fundamental rights, including:

• communicating with representatives of clients and prospective clients;
• accounting and financial administration of our business;
• compliance support and due diligence in the course of our services;
• fraud prevention, network and information security;
• establishing, exercising or defending legal claims and resolving disputes; and
• recovering debts, where appropriate.

Where we ask for your consent for a specific purpose, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We do not sell personal data.

Where necessary for the purposes described above, we may share personal data with the following categories of recipients:

• banks;
• EMI providers;
• payment institutions;
• accountants;
• auditors;
• lawyers;
• corporate service providers;
• KYC and AML service providers;
• IT infrastructure and hosting providers;
• email service providers; and
• regulators and public authorities, where required by law.

Service providers acting on our behalf process personal data as our processors under written agreements. Banks, institutions, professional advisers and authorities generally act as independent controllers, and their own privacy notices apply to their processing.

Some recipients may be located, or may process personal data, outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that an appropriate safeguard applies, such as an adequacy decision of the European Commission or Standard Contractual Clauses approved by the European Commission, together with any supplementary measures that are required. You may request further information about the safeguards used.

We retain personal data only for as long as necessary for the purpose for which it was collected and to comply with our legal obligations. The applicable period depends on the category of record:

Website enquiries — retained for as long as needed to respond to and follow up the enquiry, and deleted when no longer required for that purpose.

Prospective client records — retained while discussions about a possible engagement are ongoing and for a limited period afterwards in case discussions resume, unless you ask us to delete them.

Contractual client records — retained for the duration of the engagement and afterwards for as long as required by law or needed to establish, exercise or defend legal claims.

Accounting records — retained for the period required by applicable accounting and tax legislation.

KYC and AML documentation — retained for the period required by applicable anti-money-laundering legislation, where those obligations apply.

Legal dispute records — retained until the dispute is finally resolved and any applicable limitation periods have expired.

When personal data is no longer needed, it is securely deleted or anonymised.

NEXORA CONSULTING LTD acts as an independent controller for its own business operations, including website enquiries, client relationship management, invoicing, its own legal obligations and the security of its systems.

Where NEXORA CONSULTING LTD processes personal data strictly on behalf of and on the documented instructions of a Client — for example, when processing the Client's own customer or employee data in the course of bookkeeping or payment reconciliation — it acts as a processor for that Client. In such cases, the Client is the controller and the parties enter into a separate Data Processing Agreement where required by Article 28 of the GDPR.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including encrypted connections, access controls on a need-to-know basis and confidentiality obligations for personnel and service providers.

No method of transmission or storage is completely secure. Please do not send sensitive documents through the website contact form; secure arrangements for exchanging documents are agreed once an engagement begins.

Subject to the conditions and exemptions in the GDPR, you have the right to:

• access the personal data we hold about you;
• rectification of inaccurate or incomplete personal data;
• erasure of personal data;
• restriction of processing;
• object to processing based on our legitimate interests;
• data portability for data processed by automated means on the basis of consent or contract; and
• withdraw consent at any time, where processing is based on consent.

We respond to requests within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests. We may need to verify your identity before acting on a request. Some rights may be limited where we must retain data to comply with a legal obligation.

You have the right to lodge a complaint with a supervisory authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection. You may also complain to the supervisory authority in the EU Member State in which you live, work or where the alleged infringement took place.

We do not make decisions that produce legal or similarly significant effects concerning you based solely on automated processing.

We may update this Privacy Policy from time to time. The current version and its date of last update are always published on this page.

To ask a question about this policy or to exercise your rights, please contact NEXORA CONSULTING LTD by email to info@nexorapays.com, marking your communication as a privacy request.