This notice explains how LINK4PAY ("we") processes personal data when you pay on the hosted payment page, when a merchant sends your payment through our API, and when you use our API documentation. It applies in addition to the privacy notice of the merchant you are paying.
For the execution of your payment we act as a processor on behalf of the merchant and its acquiring bank or payment institution. For fraud prevention, transaction security, dispute handling and compliance with anti-money-laundering, tax and payment regulation we act as an independent controller. Apple Inc. (Apple Pay) and Google LLC (Google Pay) are independent controllers for the data they process in their wallets.
| Category | Examples | Purpose and legal basis |
|---|---|---|
| Payment data | card number (encrypted in transit; stored only as a masked number and, for saved cards, in encrypted form), expiry, cardholder name, wallet payment tokens | execution of the payment - performance of the contract with the merchant; legal obligations of the acquirer |
| Identification and contact data | name, e-mail address, phone number, billing address | payment execution, 3-D Secure authentication, receipts, dispute handling |
| Technical data | IP address, browser and device characteristics, language, screen size, time zone | 3-D Secure strong customer authentication, fraud prevention and security - legal obligation and legitimate interest |
| Transaction data | amount, currency, merchant, reference, result, timestamps, authentication result | payment execution, accounting, disputes and chargebacks, legal retention obligations |
The acquiring bank or payment institution and the card schemes (Visa, Mastercard and others) that execute the payment; your card issuer and the 3-D Secure directory and access control servers that authenticate you; Apple or Google when you pay with their wallets; the merchant (masked card, result, contact data you entered); our infrastructure, hosting and security providers under data processing agreements; authorities where the law requires it. Data may be transferred outside the European Economic Area only with appropriate safeguards (adequacy decisions or standard contractual clauses).
Transaction records are kept for the period required by payment, accounting and anti-money-laundering law (generally 5 to 10 years). Data kept only for the duration of a payment session (encrypted card data during 3-D Secure) is deleted within minutes. Saved cards are kept until the merchant deletes the token or the card expires.
Card data is encrypted in transit (TLS) and, where saved, at rest with keys managed in a hardware-backed key management service. We operate under PCI DSS controls, authenticate cardholders with 3-D Secure 2 and monitor transactions for fraud. No system is perfectly secure; we cannot guarantee that unauthorised third parties will never defeat our security measures.
The hosted payment page and the 3-D Secure pages do not set cookies and do not use analytics, advertising or social-media trackers. Only strictly necessary technical data is used to complete the payment: the payment session identifier in the page address and the data your browser sends with each request. Third-party components you choose to use (Apple Pay, Google Pay, your bank's 3-D Secure page) may use their own storage under their own notices.
The API documentation stores, in your browser's local storage only, your theme choice and the state of the navigation panel. Nothing is sent to us or to any third party. You can clear this data at any time through your browser settings.
Depending on your location you may have the right to access, rectify, erase or restrict the processing of your personal data, to object to processing based on legitimate interest, to data portability, and to lodge a complaint with a supervisory authority. For data processed on behalf of a merchant, please address your request to that merchant; we support merchants in answering it. For data we process as a controller, write to [email protected]. We will respond within the statutory period after verifying your identity.
Payments are screened automatically for fraud and compliance. A declined payment is not a final decision about you and you can contact the merchant or your bank to pay another way.
We may update this notice; the version published on this address applies. Last updated 2026-10-27.
Questions about this document: [email protected]. Where a translation of this document differs from the English version, the English version prevails.