Privacy Policy

NexliPay is a payment orchestration platform operated by LEGAL ENTITY NAME, a company registered in JURISDICTION under company number COMPANY NUMBER, with its registered office at REGISTERED ADDRESS. In this policy, “NexliPay”, “we” and “us” mean that entity.

For the purposes of UK GDPR and EU GDPR, we act as data controller for the personal data described below. Where we process payment data on behalf of a merchant customer, we act as data processor and the merchant is the controller. Our data protection contact is DPO OR PRIVACY CONTACT NAME, reachable at privacy@nexlipay.com.

We do not store full primary account numbers (PANs) or card verification values. Card data is handled by your connected processors within their own PCI DSS environments; NexliPay receives only tokenised references and the metadata listed above.

• Performance of a contract — providing the orchestration service you signed up for, including routing, settlement reporting and support.
• Legal obligation — identity verification, sanctions screening, AML monitoring, tax and record-keeping requirements.
• Legitimate interests — securing the platform, preventing fraud and abuse, and improving the product, balanced against your rights.
• Consent — marketing communications and non-essential cookies only. You can withdraw consent at any time without affecting the service.

We share personal data only where it is necessary to deliver the service or meet a legal duty. We do not sell personal data, and we do not share it for third-party advertising.

• Payment processors and acquirers you have connected, for the purpose of routing your own transactions.
• Identity, sanctions and AML screening providers: SCREENING PROVIDER(S).
• Infrastructure and hosting providers: HOSTING PROVIDER, located in HOSTING REGION.
• Professional advisers, auditors and insurers, under duties of confidentiality.
• Regulators, law enforcement and courts, where we are legally required to disclose.

Where personal data leaves the UK or EEA, we rely on an adequacy decision where one exists, and otherwise on UK International Data Transfer Agreements or EU Standard Contractual Clauses together with a transfer risk assessment. Our current transfer destinations are TRANSFER DESTINATIONS. You can request a copy of the safeguards in place.

Subject to legal limits — AML records in particular cannot simply be deleted on request — you have the right to access your data, correct it, erase it, restrict or object to processing, receive it in a portable format, and withdraw consent. You may also object to automated decision-making that has a legal or similarly significant effect on you.

To exercise any right, contact privacy@nexlipay.com. We respond within one month. If you are unhappy with our response you can complain to the SUPERVISORY AUTHORITY, e.g. UK ICO at AUTHORITY CONTACT DETAILS.

NexliPay scores transactions and selects a processor account automatically. These decisions concern which of your own accounts handles a payment; they do not profile individual cardholders or determine whether a person may access credit or a service. Where a transaction is declined, the decline originates from the processor or issuer, not from NexliPay. You can request an explanation of a routing decision at any time.

We use strictly necessary cookies for authentication and security, and — only with your consent — analytics cookies to understand how the site is used. You can change your choices at any time through the cookie settings link in the footer. A full cookie inventory is maintained at COOKIE INVENTORY LOCATION.

We will post any changes on this page and update the date above. Where a change materially affects your rights we will notify you by email at least NOTICE PERIOD before it takes effect.