Data Protection and Privacy Notice

This Notice explains how Orvexa LLC processes personal data when a person visits an Orvexa website, uses an Orvexa-powered checkout or payment interface, communicates with us, or otherwise interacts with our Services. It should be read together with the Terms and Conditions of Service and the Financial Crime Prevention and Customer Verification Standard.

1. Who is responsible for your data

Orvexa LLC, identification number 412800394, registered at 88 Avtomshenebeli Street, Kutaisi 4600, Georgia, acts as a controller of personal data for the processing activities described in this Notice where Orvexa determines the purposes and means of processing.

Some participants in a Transaction, such as a Merchant, bank, payment institution, card scheme, independent Digital-Asset Provider, self-hosted wallet software provider or identity-verification provider, may act as independent controllers for their own processing. Their privacy notices may therefore also apply.

2. Data-protection principles

Orvexa aims to process personal data lawfully, fairly and transparently; to collect data for defined purposes; to limit collection to what is reasonably needed; to keep relevant data accurate; to retain data no longer than necessary; and to use appropriate technical and organisational safeguards.

Orvexa applies the Georgian personal-data protection framework and, where it applies to a particular processing activity or data subject, relevant requirements of the EU General Data Protection Regulation or other applicable privacy law.

3. Information we may collect

• Identity information, such as name, date of birth, citizenship, government identification data, and images or copies of identity documents where verification is required.
• Contact details, such as email address, telephone number and residential or business address.
• Transaction information, including Merchant, amount, currency, payment method, transaction identifier, status, timestamps, refund or chargeback information and related instructions. Where a supported non-custodial payment flow involves a digital asset, this may also include the asset, blockchain network, self-hosted wallet address and public blockchain transaction identifier.
• Payment-method information, such as cardholder name, tokenised card reference, bank account details or other payment identifiers. Full card credentials are generally handled by specialised payment providers rather than retained in Orvexa's ordinary operational databases.
• Compliance information, such as source-of-funds or source-of-wealth evidence, occupation or business information, purpose of a transaction, beneficial ownership details, sanctions-screening results, risk indicators and explanations supplied during enhanced review.
• Technical and security data, including IP address, browser and operating-system information, device identifiers, device fingerprint characteristics, session data, logs and security events.
• Usage data, including pages or interface screens viewed, referral information, interaction timestamps, error logs and similar analytics information.
• Communications, including messages, support requests, complaints, documents and other information you provide when contacting Orvexa or a support channel acting for Orvexa.
• Information obtained from third parties, such as Merchants, Payment Partners, independent Digital-Asset Providers, verification vendors, fraud-prevention databases, blockchain-risk tools, public registries, sanctions lists and legally accessible public sources.

4. Why we use personal data

• To receive, authenticate, process, settle, reconcile and document payment Transactions, including non-custodial payment flows in which an independent third party may deliver a digital asset directly to a Customer-controlled self-hosted wallet.
• To show transaction status, issue confirmations, manage refunds or recalls, and provide customer support.
• To verify identity, assess eligibility, screen against sanctions, prevent fraud and financial crime, investigate unusual activity and protect the Platform.
• To comply with accounting, tax, recordkeeping, court, law-enforcement, regulatory and other legal requirements.
• To manage our relationships with Merchants and service providers, including troubleshooting and dispute resolution.
• To maintain, secure, test and improve the Platform, including analysis of aggregated or pseudonymised usage information.
• To send essential service, security and policy communications.
• To send marketing communications only where a lawful basis exists, including consent where consent is required.

5. Legal grounds for processing

Depending on the context, Orvexa may rely on one or more legal grounds: performance of a contract or steps requested before entering into a contract; compliance with a legal obligation; legitimate interests such as fraud prevention, cybersecurity, service improvement and protection of legal rights; consent where required; and establishment, exercise or defence of legal claims.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before withdrawal and does not prevent processing that is justified by another legal ground.

6. Automated checks and risk decisions

Orvexa and its providers may use automated rules, risk scores, device intelligence, sanctions screening and transaction-monitoring tools to identify potential fraud, prohibited activity or compliance concerns.

An automated alert does not necessarily mean that wrongdoing has occurred. A Transaction may be referred for additional review and Orvexa may ask for further information before deciding whether to proceed.

Where applicable law gives you rights concerning a decision based solely on automated processing that produces legal or similarly significant effects, Orvexa will respect those rights.

7. Cookies and similar technologies

Orvexa may use cookies, local storage, pixels, software development kits, device fingerprinting and comparable technologies to keep sessions working, remember settings, prevent fraud, secure transactions, measure performance and understand how the Platform is used.

Strictly necessary technologies may operate without optional consent where permitted by law. Analytics, advertising or other non-essential technologies will be used in accordance with the consent requirements that apply in the relevant jurisdiction.

You can normally control cookies through browser or device settings. Blocking certain technologies may cause parts of the Platform or a transaction flow to function incorrectly.

8. Who may receive your data

• Merchants involved in the underlying purchase or transaction relationship.
• Payment Partners, acquiring banks, card schemes, e-money institutions and other participants needed to process or settle fiat payments.
• Independent Digital-Asset Providers and blockchain infrastructure providers used, where relevant, for a separate third-party service connected to a non-custodial payment flow. Orvexa does not disclose data to such providers for the purpose of operating a hosted wallet or maintaining a customer crypto balance.
• Identity-verification, sanctions-screening, transaction-monitoring, blockchain-risk-screening, fraud-prevention and cybersecurity providers.
• Cloud hosting, communications, support, analytics and other technology providers acting for Orvexa.
• Professional advisers, auditors, insurers and prospective or actual transaction parties in a corporate restructuring, financing, merger or sale, subject to appropriate confidentiality and legal safeguards.
• Courts, regulators, law-enforcement agencies, tax authorities and other public bodies where disclosure is required or lawfully permitted.
• Other recipients where you have instructed or expressly authorised the disclosure.

Orvexa does not sell personal data as a commodity. A third party that acts as Orvexa's processor is required to process data only for authorised purposes and with appropriate safeguards. Independent controllers process information under their own legal obligations and privacy notices.

9. International transfers

Payment services and related third-party processing frequently involve providers located in more than one country. Your data may therefore be transferred to or accessed from jurisdictions outside Georgia or outside the country where you are located.

When a cross-border transfer requires a specific safeguard, Orvexa will use an available lawful transfer mechanism, contractual protection, adequacy mechanism or other measure recognised by applicable data-protection law. We also assess the nature of the data, purpose of the transfer and protections available at the destination.

10. Security

Orvexa uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, misuse and disclosure. Depending on the system and data, these measures may include encryption in transit, access controls, role separation, logging, authentication controls, vendor due diligence, security monitoring, vulnerability management and incident-response procedures.

Payment-card processing may rely on tokenisation or other mechanisms that reduce storage of sensitive card information in Orvexa systems. Where a specialist processor handles card data, that processor's security environment is used for the relevant payment credentials.

No internet or storage system can provide absolute security. You should protect your own devices and credentials and should not send private keys, seed phrases, banking passwords or complete card details through ordinary support communications.

11. How long we keep data

Retention periods depend on the reason for processing, the type of data, legal recordkeeping requirements, limitation periods, fraud-prevention needs and whether a dispute or investigation is ongoing.

Transaction and compliance records may be kept for the period required under applicable financial-crime, tax, accounting, contractual or other legal requirements. In many financial-services contexts, this can mean several years after the transaction or end of the relationship.

Technical logs and cookies are usually retained for shorter operational periods unless they are needed for security investigation, evidence or legal claims. Communications may be kept for as long as reasonably necessary to handle the request and maintain an appropriate record.

When information is no longer required, Orvexa will delete it, securely dispose of it, or anonymise it so that it is no longer personal data, subject to legal and technical constraints.

12. Your privacy rights

• To ask whether Orvexa processes your personal data and to request access to it.
• To request correction of inaccurate or incomplete data.
• To request deletion where the legal conditions for erasure are met.
• To request restriction of processing in circumstances provided by law.
• To object to processing based on legitimate interests where applicable.
• To withdraw consent where processing relies on consent.
• To request data portability where the applicable law provides that right.
• To complain to the competent data-protection authority.

These rights are not absolute. For example, Orvexa may need to retain transaction or verification records despite a deletion request where retention is required by law, necessary to prevent fraud, or needed to establish or defend a legal claim. Orvexa may also verify your identity before responding to a rights request.

13. Children

The Services are not directed to persons under 18. Orvexa does not knowingly intend to provide payment-facilitation services to minors. If Orvexa learns that personal data of a minor has been collected in circumstances where it should not have been, appropriate steps will be taken in accordance with applicable law.

14. Merchant and partner interfaces

An Orvexa service can appear within a third-party Merchant website or application. The Merchant may collect information independently before it is sent to Orvexa. The Merchant's own privacy policy governs data that the Merchant controls for its own purposes.

Orvexa may receive transaction and customer information from the Merchant in order to process the requested service, investigate issues and meet compliance requirements.

15. Changes to this Notice

Orvexa may revise this Notice when services, technology, vendors or legal requirements change. The effective date at the beginning of the document will be updated. Material changes may also be highlighted through a website or transaction interface where appropriate.

The version in force at the time of processing will apply, subject to any mandatory legal requirements.

16. How to contact Orvexa about privacy

Privacy questions and data-subject requests may be sent using the contact method published on the Orvexa website or the Orvexa-powered interface through which you used the Service. You may also write to Orvexa LLC at 88 Avtomshenebeli Street, Kutaisi 4600, Georgia.

Where you are entitled to complain to a supervisory authority, you may contact the competent authority in Georgia or, where applicable, the authority in the jurisdiction whose data-protection law applies to you.