Privacy policy

1. Who we are

Novella Technologies Limited (“Paydex”) is the data controller for personal data processed in connection with this website and the merchant dashboard, and a data processor for cardholder data processed on behalf of merchants.

2. What data we collect

• Merchant account data: names and contact details of representatives, corporate documents, beneficial owner information.
• Transaction data: amounts, currencies, payment method, tokenised card references, IP address and device data used for risk scoring.
• Website data: pages visited, referrer, browser and device characteristics, cookie identifiers.
• Support data: correspondence with our team via email, chat and Telegram.

3. Why we process it

• To provide the Services and execute the Merchant Agreement.
• To comply with anti-money laundering, counter-terrorist financing and card scheme obligations.
• To prevent fraud and protect the integrity of the payment system (legitimate interest).
• To improve the Services and communicate product updates (legitimate interest or consent).

4. Cardholder data

Card data is captured on PCI DSS Level 1 certified infrastructure and immediately tokenised. Full card numbers are never stored on merchant systems or transmitted in plain text. Access to the token vault is logged and restricted.

5. Sharing and transfers

We share data with acquiring banks, card schemes, fraud-prevention providers, cloud infrastructure providers and regulators where required by law. Transfers outside the EEA and the UK are protected by standard contractual clauses or adequacy decisions.

6. Retention

Transaction records are retained for the period required by applicable law and scheme rules (typically 5–7 years). Website analytics data is retained for 26 months. Support correspondence is retained for 3 years after the account is closed.

7. Your rights

Depending on your jurisdiction you may have the right to access, rectify, erase or port your data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Requests can be sent to privacy@paydex.co.uk.

8. Security

We apply encryption in transit and at rest, multi-factor authentication, role-based access control, continuous monitoring and annual penetration tests. Incidents affecting personal data are reported to authorities and affected parties within the statutory deadlines.

9. Contact

Data Protection Officer: privacy@paydex.co.uk. Postal address: Room 606, 6/F, Hollywood Centre, 77-91 Queen's Road West, Sheung Wan, Hong Kong.