Privacy Notice
Effective Date: 11th August 2026
1. Introduction
We are committed to protecting your privacy. This Privacy Notice explains how Transactworld Limited and Payment Infosys Limited process personal data, the purposes for which personal data is processed and the rights available to you under applicable data protection laws.
Transactworld Limited and Payment Infosys Limited are together referred to in this Privacy Notice as “TWPayz”, “we”, “us” or “our”. Where this Privacy Notice relates to processing carried out in connection with a particular Service, the relevant TWPayz entity responsible for that processing will act as the data controller, as described below.
For customers in the United Kingdom
Transactworld Limited is the data controller responsible for processing your personal data in connection with the Services it provides to you.
Transactworld Limited is incorporated in England and Wales under company number 08835541, with its registered office at 5 Technology Park, Colindeep Lane, Colindale, London, United Kingdom, NW9 6BX.
The processing of personal data by Transactworld Limited is subject to applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
If you have any questions about this Privacy Notice, the processing of your personal data or wish to exercise your data protection rights, you may contact the Data Protection Officer at legal@twpayz.com or by post at 5 Technology Park, Colindeep Lane, Colindale, London, United Kingdom, NW9 6BX.
For Customers outside the United Kingdom
Payment Infosys Limited is the data controller responsible for processing your personal data in connection with the Services it provides to you.
Payment Infosys Limited is incorporated in Mauritius under company number C61692 with its registered office at c/o Anagha Capital Ltd, 9th Floor, Mindspace 45 Cybercity, Ebene, Mauritius.
The processing of personal data by Payment Infosys Limited is subject to the Mauritius Data Protection Act 2017 and, where applicable, other data protection laws, including the EU General Data Protection Regulation (“EU GDPR”).
You may contact the Mauritius-based Data Protection Officer (DPO) at legal_mru@twpayz.com or via postal mail to c/o Anagha Capital Ltd, 9th Floor Mindspace 45 Cybercity, Ebene, Mauritius with any questions or to exercise your rights. Where required under the EU GDPR, Payment Infosys Limited has appointed an EU representative. Information regarding the EU representative and how to contact them is available upon request from the Mauritius-based Data Protection Officer.
This Privacy Notice explains how and why we process your personal data. Where we require certain personal data to provide a Service, enter into or perform a contract with you, or comply with our legal or regulatory obligations, failure to provide that information may prevent the relevant TWPayz entity from providing the relevant Service.
This Privacy Notice is effective as of August 11th, 2026. We may update this Privacy Notice from time to time to reflect changes to our processing activities, Services, legal or regulatory requirements or business practices. The latest version will be made available on our Website. Where required by applicable law, we will notify you of material changes before they take effect.
2. Collection and Processing of Personal Data
We process personal data in accordance with applicable data protection laws and implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage.
We may also obtain personal data from third parties and other sources, including identity verification and screening providers, financial institutions, payment partners, fraud prevention providers, public registers, publicly available sources and governmental or regulatory authorities, where permitted or required by applicable law.
We process personal data only where we have an appropriate lawful basis under applicable data protection law. Depending on the processing activity, this may include processing that is necessary to perform a contract with you or take steps at your request before entering into a contract, comply with a legal or regulatory obligation, pursue our legitimate interests or those of a third party where those interests are not overridden by your rights and interests, or where you have provided consent. Other lawful bases may apply where permitted or required by applicable law.
The table below describes the principal categories of personal data that we may process, the purposes for which we may process that data and the lawful bases generally applicable to such processing. The specific personal data processed and the lawful basis relied upon may vary depending on the relevant TWPayz entity, the Service provided, the circumstances of the processing and applicable data protection law.
Personal Data
Purpose of Processing
Lawful Basis
Identity information – name, date of birth, nationality and government-issued identification documents
Identity verification, KYC and customer due diligence
Compliance with legal obligations
Photographs and biometric verification data, where required
Identity verification and customer due diligence
Compliance with legal obligations*
Contact information – residential/business address, email address and telephone number
Account administration, customer support and provision of Services
Performance of a contract
Financial and transaction information – bank account details, payment card details, transaction history, payment and merchant information
Providing payment and electronic money Services; AML, sanctions and fraud monitoring; regulatory reporting
Performance of a contract; Compliance with legal obligations
Corporate information – company registration details, beneficial ownership information, director/shareholder information and business activity information
Customer due diligence, provision of Services and regulatory compliance
Performance of a contract; Compliance with legal obligations
Technical and Website information – IP address, browser type/version, device identifiers, operating system, Website usage and cookie information
Risk management and security; improving products and Services
Legitimate interests; Compliance with legal obligations, where applicable
Compliance and risk information – KYC, AML/CTF, sanctions screening and fraud prevention/detection information
Customer due diligence; AML, sanctions and fraud monitoring; risk management; regulatory reporting and audits
Compliance with legal obligations; Legitimate interests for risk management and security
Marketing information and preferences
Marketing communications, where permitted
Consent or Legitimate interests, as applicable
*Where biometric verification data is processed and such data is subject to additional requirements under applicable data protection law, TWPayz will process such data only where the applicable additional basis or condition for such processing is satisfied.
Where we rely on legitimate interests, these may include protecting TWPayz, our customers and business partners against fraud and financial crime; maintaining the security and integrity of our systems, Website and Services; managing and improving our Services and customer relationships; preventing misuse of our Services; establishing, exercising or defending legal claims; and protecting our legitimate business interests. We rely on legitimate interests only where we consider that those interests are not overridden by your rights and interests under applicable data protection law.
We may use automated systems to support fraud detection, transaction monitoring, sanctions screening, risk assessment and financial crime prevention. These systems assist our compliance and risk management processes and may identify transactions or applications requiring further review. Where required by applicable law, you may request further information regarding significant decisions made through automated processing and may request that such a decision is reviewed by an appropriately authorised member of staff.
3. Cookies and Data Tracking
We use cookies and similar technologies on our Website, which may involve the collection and processing of personal data, including technical and Website usage information as described in this Privacy Notice.
We use such technologies to operate and secure our Website, remember user preferences, understand how our Website is used and improve our Website and Services. Where required by applicable law, we will obtain your consent before using non-essential cookies or similar technologies.
Further information about the cookies and similar technologies we use, the personal data they may collect, their purposes and the choices available to you is provided in our Cookie Notice.
4. With Whom We Share Your Personal Data
We may share personal data where necessary for the provision of our Services, the operation of our business, compliance with legal or regulatory obligations, or for the other purposes described in this Privacy Notice.
We may share personal data with:
Banking partners, payment schemes and card networks
Identity verification providers
Credit reference agencies and fraud prevention agencies
Regulators, law enforcement agencies and other competent authorities where required or permitted by law
Professional advisers and auditors
Other TWPayz group companies and affiliates, where necessary for the provision and administration of Services, compliance, risk management or operational support
Other authorised service providers that support the provision, operation or security of our Services
We may also disclose personal data where reasonably necessary to establish, exercise or defend legal claims, resolve disputes, enforce contractual rights or comply with applicable legal or regulatory requirements.
Where required by applicable law and appropriate to the nature of the recipient, we implement contractual, confidentiality, data protection or other appropriate safeguards in connection with the sharing of personal data.
5. Where your personal data is held
We and our authorised service providers may store and process personal data using cloud infrastructure and other systems located in the United Kingdom, Mauritius and other jurisdictions. Any international transfers will be made in accordance with applicable data protection law as described in Clause 6 below.
6. Transfers of your personal data
Where personal data is transferred outside the United Kingdom, Mauritius or the European Economic Area, as applicable, we will ensure that the transfer is made in accordance with applicable data protection law and that appropriate safeguards are implemented where required. Such safeguards may include an applicable adequacy decision or regulation, approved contractual safeguards or other legally recognised transfer mechanisms.
7. Personal Data retention period
Subject to your rights under applicable data protection law, we retain your personal data for as long as necessary to provide our Services, comply with applicable legal and regulatory record-keeping requirements, and address any questions, complaints or claims. We may therefore retain certain personal data after our relationship with you has ended where necessary for these purposes. We will not collect more data than we require or retain your data for longer than necessary to fulfil the purposes outlined in this notice.
We may also retain personal data where necessary to establish, exercise or defend legal claims or in connection with litigation, investigations or other legal or regulatory proceedings.
Should you require information about how long we hold your personal data, please do not hesitate to contact us in order to assist you with any information or clarifications you may have.
8. Your rights with respect to Personal Data
Subject to applicable data protection law and depending on the circumstances, you may have some or all of the following rights in relation to your personal data:
Right of access – the right to request access to and obtain a copy of the personal data we hold about you
Right to rectification – the right to request correction of personal data that is inaccurate or incomplete
Right to erasure – the right to request deletion of your personal data in certain circumstances
Right to restriction of processing – the right to request that we restrict the processing of your personal data in certain circumstances
Right to object – the right to object to certain processing of your personal data, including processing based on legitimate interests and, where applicable, processing for direct marketing purposes
Right to data portability – where applicable, the right to receive certain personal data in a structured, commonly used and machine-readable format and to request its transfer to another controller
Right to withdraw consent – where we rely on your consent to process personal data, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Rights relating to automated decision-making – where applicable, the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you, subject to applicable law
To exercise any of these rights, please contact the Data Protection Officer of the relevant TWPayz entity using the contact details set out in this Privacy Notice.
We may request additional information reasonably necessary to verify your identity before responding to your request. We will respond to requests within the timeframe required by applicable data protection law.
These rights may be subject to limitations, conditions or exemptions under applicable law.
9. Third Party Websites
Our Website may contain links to third-party websites. We do not control how third-party websites collect, use, store or otherwise process your personal data. We encourage you to review the applicable privacy notice of any third-party website before providing personal data.
10. Protecting your Personal Data
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, encryption, secure infrastructure, monitoring and other security measures appropriate to the nature of the personal data processed and the risks associated with the processing.
Access to personal data is limited to personnel and authorised service providers who require access for legitimate business purposes and who are subject to appropriate confidentiality and security obligations.
We regularly review our security measures and update them where appropriate.
In the event of a personal data breach, the relevant TWPayz entity will assess the nature and potential impact of the breach and will notify affected individuals and/or the relevant supervisory or regulatory authorities where required by applicable data protection law.
11. Complaints
If you have any concerns about how we process your personal data or believe that your data protection rights have been infringed, you may contact the Data Protection Officer of the relevant TWPayz entity using the contact details set out in this Privacy Notice.
You also have the right to lodge a complaint with the relevant data protection authority.
For Transactworld Limited (United Kingdom)
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk
For Payment Infosys Limited (Mauritius)
Data Protection Office
Level 5, SICOM Tower, Wall Street, Ebene Cyber City, Ebene, Republic of Mauritius
Telephone: +230 460 0251
Email: dpo@govmu.org
Website: dataprotection.govmu.org
Where the EU GDPR applies to the processing of your personal data, you may also have the right to lodge a complaint with the competent supervisory authority in accordance with applicable law.
You may contact the relevant data protection authority directly. However, we encourage you to contact us first so that we have an opportunity to address your concerns.