Data Processing Addendum
This summary describes how PayColab processes personal data on behalf of merchants. The full executable DPA is available on request and is incorporated into enterprise agreements.
Roles
For end-customer payment data processed through the platform, the merchant is the data controller and PayColab is the data processor, acting only on the merchant's documented instructions as expressed through API calls and dashboard configuration.
Scope of Processing
Categories of data: payment credentials (tokenized), transaction details, and related customer identifiers supplied by the merchant. Purpose: executing, routing, securing, and reporting on payment transactions. Duration: the term of the service agreement plus legally required retention.
Sub-Processors
We engage vetted sub-processors for cloud infrastructure, communications, and support tooling, each bound by equivalent data-protection obligations. A current list is available on request; customers are notified 30 days before any addition, with the right to object.
International Transfers
Where personal data is transferred outside the EEA/UK, transfers are protected by the EU Standard Contractual Clauses (2021) and the UK Addendum, supplemented by encryption and access controls.
Security Measures
Technical and organizational measures include PCI-DSS Level 1 controls, AES-256 encryption at rest, TLS 1.2+ in transit, HSM-backed key management, SOC 2 Type II audited access controls, and 24/7 security monitoring.
Data Subject Rights & Incidents
We assist merchants in fulfilling access, deletion, and portability requests, and notify affected merchants without undue delay — and in any case within 72 hours — after confirming a personal data breach.
Deletion & Return
On termination, merchant data is returned or deleted per the agreement, subject to statutory retention. Vaulted tokens are portable to a successor provider through our documented migration process. Contact: [email protected].
Last updated: October 31, 2026