Privacy policy

1. Data controller

The data controller is [to complete: legal name], whose registered office is located at [to complete: full address].

For any question about your data, you can write to contact@nexet.io. [to complete: data protection officer contact details, if appointed].

2. Data we process

Depending on your relationship with Nexet Pay, we process the following categories of data:

• Site visitors: browsing data strictly necessary for the website to work, and information you voluntarily send us through the contact form (name, company, email, phone, message).
• Merchants: identification data of the company and its representatives, supporting documents requested when the account is opened, settlement bank details, connection and activity logs on the merchant space.
• Transactions: amount, currency, timestamp, status, payment method used and related technical data. Card numbers are not stored by the merchant: they are handled by the PCI DSS certified payment infrastructure and replaced by tokens.

3. Purposes and legal bases

We process this data in order to:

• provide and perform the payment services subscribed to — performance of the contract;
• verify merchants' identity and meet our anti-fraud and anti-money-laundering obligations — legal obligation;
• keep the platform secure, prevent and detect fraud — legitimate interest;
• answer requests sent through the contact form — legitimate interest or pre-contractual steps;
• improve our services and produce aggregated statistics — legitimate interest.

4. Cookies and local storage

The nexet.io website sets no advertising cookie and uses no behavioural tracking tool. Local storage is used to remember your language choice so the site is displayed again in the language you selected; this information stays on your device and is not sent to anyone.

The merchant space, hosted on a different domain, uses technical cookies required for authentication.

5. Recipients and processors

Your data is accessible to the Nexet Pay teams that need it, and shared with the third parties strictly necessary to deliver the service: financial institutions and card networks, infrastructure and hosting providers, communication and support tools.

Main processors: [to complete: host, payment provider, emailing tool, etc.]. These third parties are bound by contractual confidentiality and security commitments.

We do not sell your personal data and do not share it for advertising purposes.

6. Data transfers

Some data may be hosted or processed outside [to complete: country of establishment]. In that case, such transfers are covered by the appropriate safeguards provided for by the applicable regulation: [to complete: transfer mechanism used].

7. Retention periods

Data is kept for as long as necessary for the purposes described, then archived or deleted:

• messages sent through the contact form: [to complete: period];
• merchant account data: for the duration of the contractual relationship, then [to complete: legal archiving period];
• identity documents and compliance records: [to complete: period required by regulation];
• transaction data and accounting records: [to complete: statutory accounting retention period].

8. Security

We implement appropriate technical and organisational measures: encryption of data at rest and in transit, tokenisation of payment methods, environment segregation, access logging, permission control and real-time risk analysis on transactions.

Card data is handled by PCI DSS level 1 certified infrastructure.

9. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as a right to portability where it applies. You can exercise these rights by writing to contact@nexet.io, providing proof of your identity.

Some requests may be limited by our legal obligations, in particular regarding the retention of accounting records and anti-money-laundering rules.

You may also lodge a complaint with the competent data protection authority: [to complete: supervisory authority — for example the CNDP in Morocco].

10. Changes to this policy

This policy may change to reflect developments in our services or in regulation. The date of the last update appears at the top of the page; in the event of a substantial change, merchants are informed directly.

11. Contact

For any question about this policy or your personal data, write to us at contact@nexet.io or through the contact form on the website.