Privacy policy.

01Who we are

1.1 [Company legal name], a company registered in [Jurisdiction] under number [Registration no.] with its registered office at [Registered address] ("Zonipay", "we", "us"), is the controller of the personal data described in this policy, except where section 2 says otherwise.

1.2 Zonipay is a merchant of record for suppliers of research-use-only materials. When you buy from a store that uses Zonipay, Zonipay is the seller on your order and takes your payment. Card payments are processed by Stripe.

1.3 Questions about this policy or your personal data can be sent to privacy@zonipay.com.

02Scope

2.1 This policy covers:

• Merchants: people who apply for or manage a Zonipay account, and the directors, beneficial owners and representatives of merchant businesses;
• Buyers: people who place an order through a checkout operated by Zonipay;
• Visitors: people who use zonipay.com, hub.zonipay.com or contact us.

2.2 Stores. The store you buy from receives the information it needs to ship your order and support you (your name, shipping address, contact details and order contents). The store uses that information as an independent controller under its own privacy policy. This policy does not cover how a store uses data it collects on its own website.

2.3 Stripe. Stripe processes card payments and operates merchants' payout accounts. For some purposes, such as its own fraud prevention and its legal obligations, Stripe acts as an independent controller under its own privacy policy, available on its website.

03Data we collect

Merchants

• Contact and account data: name, business email, phone number, job title, login details and account preferences.
• Business data: legal name, registration and tax numbers, addresses, storefront domains, product information and expected volumes. Much of this concerns a business rather than a person, but it may identify individuals.
• Identity and verification data: for directors, beneficial owners and representatives, full name, date of birth, nationality, home address, government identification numbers and copies of identity documents, and the results of identity, sanctions, politically exposed person and adverse media checks.
• Financial data: payout bank account details, transaction and payout history, fees, reserves and disputes.
• Compliance data: storefront scan results and the evidence archived with them (screenshots and page snapshots), and correspondence about findings.

Buyers

• Order data: name, email address, phone number, billing and shipping addresses, the products ordered, prices and taxes.
• Attestation data: your confirmation that the purchase is for laboratory research use only and that you meet the age requirement, with the date, time, IP address and order it relates to.
• Payment data: payment method type, card brand, last four digits, expiry date, billing country and the result of the payment and of any 3-D Secure check. Full card numbers are entered into fields hosted by Stripe; Zonipay never sees or stores them.
• Fraud screening data: IP address, approximate location derived from it, device and browser information, and signals about how the checkout was used.
• Service data: messages you send us, refund requests, dispute information and delivery evidence supplied by the store.

Visitors

• Technical data: IP address, browser type, pages requested and timestamps, recorded in server logs for security and to keep the site running.
• Contact data: what you send us through a contact form or by email.

Sources. We collect data from you directly; from the store you buy from; from merchants about their owners and representatives; from Stripe; from identity, business verification and sanctions screening providers; and from public sources such as company registries and the merchant's own storefront.

04Purposes and legal bases

4.1 Where data protection laws such as the GDPR or UK GDPR apply, we rely on the legal bases shown below.

4.2 We do not use buyer data for advertising, and we do not sell personal data.

4.3 Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for more detail and you can object (section 9).

05Who we share data with

5.1 We share personal data only as needed for the purposes above, with:

• Stripe, our payment processor, which processes card payments, runs fraud checks, operates merchants' payout accounts and verifies merchant identity for those accounts;
• the store you buy from, for fulfilment and support (section 2.2);
• service providers acting on our instructions: cloud hosting, email delivery, identity and business verification, sanctions screening, customer support tools and storefront scanning infrastructure;
• card networks and issuing banks, when answering disputes or as network rules require;
• professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality;
• authorities, such as tax authorities, regulators, law enforcement and courts, where the law requires it or to protect rights, safety or property;
• a successor business, if Zonipay is involved in a merger, acquisition or sale of assets, subject to this policy.

5.2 Our service providers may use personal data only to provide services to us and must protect it under written agreements.

06Retention

6.1 We keep personal data only as long as we need it for the purposes above.

• Transaction, attestation and verification records: kept for as long as the law requires, typically up to 7 years after the transaction or after the end of the merchant relationship, to meet tax, accounting, anti-money laundering and payment network obligations.
• Storefront scan evidence: kept for the life of the merchant relationship and for the same period as verification records after it ends.
• Applications that are not approved: kept for as long as the law requires for verification records, and otherwise deleted.
• Correspondence: kept for up to 3 years after the matter closes, or longer where it forms part of a transaction or dispute record.
• Server logs: kept for a short period, typically no more than 90 days, unless needed to investigate a security incident.

6.2 We may keep data longer where needed to establish, exercise or defend legal claims. When data is no longer needed, we delete or anonymize it.

07International transfers

7.1 Zonipay and its service providers may process personal data in the United States and other countries. Those countries may not have the same data protection laws as the country where you live.

7.2 Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use safeguards recognized by law, such as the European Commission's standard contractual clauses and the UK addendum, or rely on a provider's certification under an applicable data privacy framework. You can ask us for a copy of the relevant safeguards.

08Security

8.1 We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls based on role, logging of access to verification data and regular review of our service providers.

8.2 Card details are entered into fields hosted by Stripe, a PCI DSS Level 1 service provider. Zonipay never sees or stores full card numbers.

8.3 No system is completely secure. If a personal data breach occurs, we will notify affected people and authorities where the law requires. To report a security issue, write to security@zonipay.com. More detail is on our security page.

09Your rights

9.1 Depending on where you live, you may have the right to:

• know what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our use of your data, including use based on legitimate interests and any direct marketing;
• receive data you gave us in a portable format;
• withdraw consent where we rely on it, without affecting earlier use;
• complain to a data protection authority, such as the authority where you live or work.

9.2 Some rights are limited. For example, we cannot delete transaction, attestation or verification records we must keep by law, and we may need to keep data needed for an open dispute.

9.3 To exercise a right, write to privacy@zonipay.com. We will verify your identity, normally by matching details you give with what we hold, and answer within one month (or 45 days where US state law applies), extendable where the law allows. We do not charge for requests unless they are clearly unfounded or excessive.

9.4 If your request concerns data a store holds about you, we will tell you and, where appropriate, pass the request to the store.

10US state privacy rights

10.1 If you live in a US state with a consumer privacy law, such as California, you may have rights to know, access, correct and delete personal information, to receive it in a portable format, and to opt out of the sale of personal information, sharing for cross-context behavioral advertising, and certain profiling.

10.2 We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We use sensitive personal information (such as government identification numbers collected during merchant verification) only for purposes permitted by law, such as verifying identity, preventing fraud and meeting legal obligations.

10.3 The categories of personal information we collect, their sources, purposes and recipients are described in sections 3 to 5. Retention is described in section 6.

10.4 You may use an authorized agent to make a request, and we may ask for proof of the agent's authority. We will not treat you differently for exercising your rights. If we decline your request, you may appeal by replying to our decision; if your appeal is declined, you may contact your state attorney general.

10.5 Much of the information in this policy concerns people acting for a business. Where a state law treats such information differently, we will apply the law as it stands.

11Cookies

11.1 Our websites use essential cookies only, and no advertising or cross-site tracking. Checkout pages may use cookies set by Stripe for fraud prevention. Details are in our cookie policy.

12Children

12.1 Our services are not directed to children. Buyers must be at least 21 years old and merchants must be businesses. We do not knowingly collect personal data from anyone under 18. If you believe we have, write to privacy@zonipay.com and we will delete it.

13Automated decisions

13.1 Fraud screening at checkout is partly automated and may cause a payment to be held or declined. Merchant applications are reviewed by people; automated checks such as sanctions screening inform that review. Where the law gives you the right, you can ask for a person to review an automated decision that significantly affects you, and to explain it, by writing to privacy@zonipay.com.

14Changes to this policy

14.1 We may update this policy. We will change the effective date above and, for significant changes, notify merchants by email and show a notice on our website before the change takes effect.

15Contact

Privacy questions and requests: privacy@zonipay.com. Security issues: security@zonipay.com. By post: [Company legal name], [Registered address]. We answer Monday to Friday, 9:00 to 18:00 ET.