Who we are. PREFLOOR LTD provides technology and organisational services connected with the interaction between merchants and licensed payment service providers. PREFLOOR LTD may provide technical routing of payment data, reporting, integration and operational support, and may carry out initial and ongoing verification of merchants under its own compliance procedures and the requirements of licensed payment partners.
PREFLOOR LTD is not a bank, an electronic money institution or a licensed payment institution. It does not take deposits, does not hold or safeguard client funds, does not issue payment instruments and does not open or maintain payment accounts for merchants or their customers.
Regulated payment services are provided by the relevant licensed payment institutions, electronic money institutions, acquirers and other licensed payment partners under the applicable contractual structure.
1. Who is responsible for your data
PREFLOOR LTD, a company registered in the Republic of Cyprus under registration number HE496840, with its registered office at Giannou Kranidioti & Pargas 9, Floor 1, Flat/Office 102, 1065 Nicosia, Cyprus, is the controller of personal data in respect of those processing operations whose purposes and means PREFLOOR LTD determines itself.
In certain cases PREFLOOR LTD may also process personal data on behalf of a merchant, a licensed payment partner or another counterparty, in accordance with their documented instructions and the relevant contractual structure.
For questions about this Policy or about the processing of your personal data, contact us at business@prefloorltd.com.
2. Who this Policy applies to
Our services are primarily directed at business clients and counterparties.
This Policy applies to:
- visitors to the website;
- persons who contact PREFLOOR LTD through forms on the website or by e-mail;
- representatives, directors, shareholders, beneficial owners and other connected persons of merchants, partners, suppliers and other counterparties;
- persons whose personal data is processed as part of onboarding, due diligence, compliance checks and ongoing monitoring;
- other persons whose personal data is lawfully provided to PREFLOOR LTD in the course of business relationships.
PREFLOOR LTD does not, as a rule, have direct contractual relationships with the end customers of merchants.
Where data relating to transactions or to a merchant's customers becomes available to PREFLOOR LTD in the course of technical routing, reporting, fraud prevention, compliance, support or other agreed functions, the role of PREFLOOR LTD in respect of that data is determined by the nature of the specific processing and the relevant contractual structure.
3. What personal data we may collect
Depending on the nature of the relationship and the risk level, PREFLOOR LTD may process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, business e-mail address, telephone, company, position | Directly from you or your company |
| Identification data | Passport or other identification data, date of birth, nationality, proof of address | From you or your company as part of due diligence |
| Corporate and ownership data | Details of directors, shareholders, beneficial owners, ownership and control structure | From your company, public registers and other lawful sources |
| Compliance data | Results of sanctions, PEP, adverse media, fraud and other checks | Screening service providers, public sources and registers |
| Source of Funds / Source of Wealth | Information and documents on the source of funds or wealth | Requested where justified by the risk level or partner requirements |
| Business relationship data | Correspondence, applications, meeting records, contractual documentation, interaction history | In the course of the relationship with you |
| Transactional data | Limited payment and transaction information necessary for technical routing, reporting, reconciliation, fraud prevention or compliance | From merchants, licensed payment partners and technical systems |
| Technical data | IP address, browser and device type, pages visited, time of site use, cookies and consent records | Automatically when the website is used |
PREFLOOR LTD does not request special categories of personal data without necessity.
If such data becomes available to PREFLOOR LTD incidentally, it is processed only to the extent necessary and permitted by applicable law.
4. Why and on what basis we process data
PREFLOOR LTD processes personal data only where an appropriate legal basis exists.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and preparing to enter into a contract | Steps taken at the request of the data subject prior to entering into a contract; legitimate interest |
| Providing and supporting services | Performance of a contract; legitimate interest |
| Onboarding, KYB/KYC and due diligence | Legitimate interest of PREFLOOR LTD and its partners in risk management and the prevention of fraud and financial crime; legal obligation where directly applicable |
| Sanctions and PEP screening, adverse media and ongoing monitoring | Legitimate interest in preventing financial crime, sanctions risk, fraud and other compliance risk; requirements of licensed partners; legal obligation where applicable |
| Introducing a merchant or transferring its data to a licensed payment partner | Performance of a contract; steps prior to entering into a contract; legitimate interest |
| Technical routing and processing of limited transactional data | Performance of a contract; legitimate interest; processing on the documented instructions of the relevant party where applicable |
| Security and fraud prevention | Legitimate interest in protecting PREFLOOR LTD, its partners and users |
| Maintaining contractual, financial and corporate records | Performance of a contract; legal obligation; legitimate interest |
| Marketing communications | Consent or another lawful basis where permitted by applicable law |
| Analytics and other non-essential cookies | User consent |
| Responding to public authorities, courts and law enforcement | Legal obligation or another legal interest provided by law |
PREFLOOR LTD may carry out KYC/KYB, sanctions and other compliance checks itself before referring a merchant to a licensed payment partner.
The licensed payment partner may carry out its own independent review and request additional documents and information.
5. Who we may share personal data with
PREFLOOR LTD transfers personal data to third parties only where an appropriate legal basis exists and only to the extent necessary for the relevant purpose.
Recipients may include:
- Licensed payment partners - payment institutions, electronic money institutions, acquirers, banks and other licensed payment service providers to which PREFLOOR LTD introduces a merchant or with which it interacts in providing technical and organisational services.
- Screening and verification service providers - for sanctions, PEP, adverse media, identity verification and other compliance checks.
- Technical service providers - hosting, e-mail, cloud storage, IT infrastructure, security and supporting tools.
- Professional advisers - lawyers, auditors, accountants and other professional advisers.
- Public authorities and courts - where disclosure is required or permitted by applicable law.
- Other counterparties - where the transfer is necessary to perform the relevant contractual relationship and is made on a lawful basis.
Licensed payment partners may act as independent controllers of personal data or in another capacity, depending on the nature of the specific processing and the relevant contractual structure.
Where a third party acts as a processor on behalf of PREFLOOR LTD, processing is carried out on the basis of the corresponding contractual obligations and the instructions of PREFLOOR LTD.
PREFLOOR LTD does not sell personal data and does not transfer it to third parties for their own independent marketing without an appropriate lawful basis.
6. International data transfers
Some partners and suppliers of PREFLOOR LTD may be located outside the European Economic Area.
Where personal data is transferred to a country in respect of which the European Commission has not adopted an adequacy decision, PREFLOOR LTD applies appropriate safeguards, including the European Commission's standard contractual clauses and, where necessary, additional technical, organisational or contractual measures.
On request, PREFLOOR LTD may provide further information about the transfer mechanism applied, where such disclosure is permitted by applicable law and contractual obligations.
7. How long we keep data
PREFLOOR LTD retains personal data no longer than necessary for the purposes for which it was collected, taking into account contractual, legal, regulatory and reasonable business requirements.
In particular:
| Category | Indicative period |
|---|---|
| Enquiries that did not lead to a business relationship | Up to 12 months after the last interaction |
| Due diligence, KYC/KYB and compliance records | As a rule, up to 5 years after the end of the relationship, or another period required by applicable law, partner requirements or reasonable compliance purposes |
| Transactional and related operational data | For the period necessary for contractual, reporting, fraud prevention, dispute and compliance purposes |
| Contracts, financial and accounting records | For the period established by applicable law and internal retention requirements |
| Marketing consent records | Until consent is withdrawn and thereafter for a reasonable period to evidence the giving or withdrawal of consent |
| Cookie consent records | In accordance with the settings of the consent management platform used and applicable requirements |
| Server and security logs | As a rule, up to 12 months, unless a longer period is required to investigate a security incident or for another lawful purpose |
On expiry of the applicable retention period, data is deleted, anonymised or otherwise removed from active processing, unless further retention is required or permitted by law.
8. Your rights
Depending on the circumstances, the nature of the processing and the applicable legal basis, you may have the right to:
- obtain confirmation as to whether your personal data is being processed;
- obtain access to your personal data and a copy of it;
- request rectification of inaccurate or incomplete data;
- request erasure of data in the cases provided by law;
- request restriction of processing;
- object to processing based on legitimate interest;
- receive the data you provided in a portable format, where the conditions for the right to portability apply;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with the competent supervisory authority.
In Cyprus the supervisory authority is the Office of the Commissioner for Personal Data Protection.
To exercise your rights, write to business@prefloorltd.com.
PREFLOOR LTD handles requests within the periods provided by applicable law and may request reasonable information to verify the identity of the applicant.
Certain rights may be restricted where retention or further processing is required by applicable law, for the establishment, exercise or defence of legal claims, or for another reason provided by law.
9. Security
PREFLOOR LTD applies reasonable technical and organisational measures to protect personal data, taking into account the nature of the data and the level of the relevant risk.
Such measures may include:
- restriction of access on a need-to-know basis;
- control of accounts and access rights;
- encryption of data in transit;
- logging of access to certain systems and documents;
- confidentiality requirements for employees, contractors and suppliers;
- technical and organisational measures to protect the infrastructure.
No information system can guarantee absolute security.
In the event of a personal data breach, PREFLOOR LTD acts in accordance with applicable law, including notification of the competent supervisory authority and/or the affected persons where such notification is required.
10. Automated processing and profiling
PREFLOOR LTD may use screening, fraud detection and other automated tools to identify potential risks.
Such tools may generate alerts, risk indicators or otherwise assist in due diligence and ongoing monitoring.
PREFLOOR LTD does not take decisions producing legal or similarly significant effects for an individual solely on the basis of automated processing, except where such processing is permitted by applicable law and the safeguards provided by law are in place.
A decision to accept, decline, restrict or continue a business relationship may also depend on the independent decision of the relevant licensed payment partner.
11. Changes to this Policy
PREFLOOR LTD may update this Policy from time to time in light of changes in legislation, business processes, technology or the partner solutions used.
The current version is always published on the website with its version number and effective date.
Where changes materially affect the nature of processing or the rights of data subjects, PREFLOOR LTD takes reasonable steps to provide additional notice where such notice is required by applicable law.
12. Contact
For questions about this Policy, about the processing of personal data or about exercising your rights, contact:
PREFLOOR LTD
Giannou Kranidioti & Pargas 9,
Floor 1, Flat/Office 102,
1065 Nicosia, Cyprus
E-mail: business@prefloorltd.com