VERTAS PULSE PAYMENT SERVICE PROVIDER L.L.C
PRIVACY POLICY
Including the Data Subject’s consent to the collection and processing of personal data
Version 1.0 · Last updated: 25 September 2026 · https://vertaspulse.com/
Vertas Pulse Payment Service Provider L.L.C (LLC – SO) · Office No. M17-201, Hor Al Anz East, Dubai, UAE
DET Licence No. 1648416 · Commercial Register No. 2916823 · [email protected] +971543896894
IMPORTANT NOTICE — PLEASE READ CAREFULLY. This Privacy Policy explains, in a transparent and comprehensive manner, how Vertas Pulse Payment Service Provider L.L.C collects, uses, discloses, transfers, stores, protects and otherwise processes Personal Data in connection with the Website, the Platform and the Services, and describes the rights of Data Subjects in relation to their Personal Data. Article 6 of this Privacy Policy contains the Data Subject’s declaration of consent to the collection and processing of Personal Data. Please read this Privacy Policy in its entirety before submitting any Personal Data to us. If you do not agree with this Privacy Policy, you must not submit any Personal Data, must not register an Account and must not use the Services.
ARTICLE 1 — INTRODUCTION, SCOPE AND IDENTITY OF THE CONTROLLER
1.1 Identity of the Controller
The Controller responsible for the processing of Personal Data described in this Privacy Policy is Vertas Pulse Payment Service Provider L.L.C (in Arabic: فيرتاس بولز موفر خدمات الدفع ذ.م.م), a limited liability company – single owner (LLC – SO) incorporated in the Emirate of Dubai, United Arab Emirates, in accordance with Federal Decree-Law No. (32) of 2021 on Commercial Companies, holding licence No. 1648416 and registered in the Commercial Register under No. 2916823, issued by the Department of Economy and Tourism of Dubai (DET), with the registered activity “Payment Services Provider”, with its registered address at Office No. M17-201, property of Mohammed Salem Bakhit Al Bakhit Al Falasi, Hor Al Anz East, Dubai, United Arab Emirates, telephone +971543896894, email [email protected] (hereinafter the “Company”, “Vertas Pulse”, “we”, “us” or “our”).
1.2 Scope of Application
This Privacy Policy applies to all processing of Personal Data carried out by the Company, whether by automated or non-automated means, in connection with:
(a) any visit to, browsing of or interaction with the Website, including the submission of contact forms, connection requests and registration forms;
(b) the application for, opening, operation and closure of an Account and the Onboarding Procedure;
(c) the provision of the Services, including payment acceptance, B2B payments, Bulk Payments, Recurring Payments, Split Payments, Payment Links, Invoices, customised Payment Pages, reporting, analytics and technical support;
(d) the performance of customer due diligence, anti-money laundering, counter-terrorist financing, Sanctions screening and fraud prevention measures;
(e) communications between the Company and Clients, prospective Clients, Customers, Recipients, Partner Institutions, suppliers and other persons; and
(f) direct marketing, events and business development activities.
1.3 Relationship with the Terms and Conditions
This Privacy Policy forms an integral part of the Terms and Conditions of Use published on the Website (the “Terms”). Capitalised terms used but not defined in this Privacy Policy shall have the meanings given to them in the Terms. In the event of any conflict between this Privacy Policy and the Terms in respect of the processing of Personal Data, this Privacy Policy shall prevail, save where the Terms or a Merchant Agreement expressly provide otherwise.
1.4 Processing on Behalf of Clients
Where the Company processes Personal Data strictly on the documented instructions of a Client, the Company acts as a Processor of that Client, and the Client, as Controller, is responsible for informing the relevant Data Subjects and for establishing a lawful basis for the processing. In such cases, Data Subjects should refer to the privacy notice of the relevant Client and address their requests primarily to that Client. The Company shall assist the Client in responding to such requests to the extent required by the Data Protection Legislation.
1.5 Processing by Partner Institutions
Partner Institutions that perform Regulated Activities in connection with the Services, as well as Card Schemes and Payment Method Providers, process Personal Data as independent Controllers under their own privacy notices and legal obligations. This Privacy Policy does not govern the processing of Personal Data by such third parties, and the Company recommends that Data Subjects consult their respective privacy notices.
ARTICLE 2 — DEFINITIONS
2.1 Definitions
In this Privacy Policy, the following capitalised terms shall have the meanings set out below:
“Account” means the account opened in the name of a Client on the Platform following successful completion of the Onboarding Procedure.
“Automated Processing” means processing of Personal Data carried out wholly by electronic programmes or systems without human intervention, including Profiling.
“Client” means any person who has applied for or has been granted access to the Services, as defined in the Terms, including its representatives.
“Consent” means any freely given, specific, informed, clear and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her, as further described in Article 6.
“Controller” means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
“Cookies” means small text files and similar technologies (including pixels, tags, local storage and software development kits) that are placed on or read from a Data Subject’s device when visiting the Website or using the Platform.
“Customer” means any person who makes or attempts to make a payment to a Merchant by means of the Services.
“Data Office” means the UAE Data Office established pursuant to Federal Decree-Law No. (44) of 2021, or any other authority competent to supervise compliance with the PDPL.
“Data Protection Legislation” means (a) Federal Decree-Law No. (45) of 2021 Regarding the Protection of Personal Data (the “PDPL”) and its Executive Regulations, when and as issued; (b) the data protection, confidentiality and consumer protection provisions of Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business and the regulations, standards and circulars issued or continued in force thereunder, to the extent applicable to the processing of banking and payment data; (c) Regulation (EU) 2016/679 (the “GDPR”), to the extent applicable pursuant to its Article 3; (d) the GDPR as retained in the law of the United Kingdom and the Data Protection Act 2018 (the “UK GDPR”), to the extent applicable; (e) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the “CCPA/CPRA”), to the extent applicable; and (f) any other law on the protection of Personal Data applicable to a given processing operation, in each case as amended or replaced from time to time.
“Data Subject” means the identified or identifiable natural person to whom Personal Data relates, including visitors to the Website, individual Clients, representatives, directors, shareholders, Beneficial Owners and Authorised Users of corporate Clients, Customers, Recipients and contact persons of Partner Institutions and suppliers.
“Merchant Agreement”, “Onboarding Procedure”, “Partner Institution”, “Payment Order”, “Platform”, “Recipient”, “Sanctions”, “Services”, “Transaction” and “Website” have the meanings given to them in the Terms.
“Personal Data” means any data relating to an identified natural person, or a natural person who can be identified directly or indirectly by way of linking such data, including name, voice, image, identification number, electronic identifier, geographical location or one or more physical, physiological, economic, cultural or social characteristics, and includes Sensitive Personal Data and Biometric Data.
“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
“Processing” means any operation or set of operations performed on Personal Data, whether or not by electronic means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, transfer, alignment or combination, restriction, erasure or destruction; “process” and “processed” shall be construed accordingly.
“Processor” means a natural or legal person who processes Personal Data on behalf of and in accordance with the instructions of a Controller.
“Profiling” means any form of Automated Processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s economic situation, reliability, behaviour, location or risk.
“Sensitive Personal Data” means Personal Data revealing, directly or indirectly, a natural person’s family, racial or ethnic origin, political, philosophical or religious opinions, criminal records, biometric data, genetic data or health data, or any other data defined as sensitive by the Data Protection Legislation.
“Biometric Data” means Personal Data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which allows or confirms the unique identification of that person, such as facial images used for liveness and identity verification.
ARTICLE 3 — LEGAL FRAMEWORK AND PRINCIPLES OF PROCESSING
3.1 Applicable Legal Framework
The Company processes Personal Data in accordance with the Data Protection Legislation. Where the processing concerns banking, payment or credit data whose protection and processing are specifically regulated by the CBUAE framework, and to the extent that such data is excluded from the scope of the PDPL, the Company processes such data in accordance with the confidentiality and data protection requirements of that framework and of the Partner Institutions. The Company further processes Personal Data in compliance with the record-keeping and reporting obligations imposed by Federal Decree-Law No. (10) of 2025 Regarding the Combating of Money Laundering Crimes, the Combating of the Financing of Terrorism and the Financing of Proliferation and its Executive Regulations, and with the confidentiality requirements of the Scheme Rules and PCI DSS.
3.2 Principles
The Company undertakes that Personal Data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the Data Subject;
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes, save for archiving, statistical or research purposes subject to appropriate safeguards;
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation);
(d) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that inaccurate Personal Data are erased or rectified without delay;
(e) kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which they are processed, in accordance with Article 12;
(f) processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures; and
(g) processed in accordance with the rights of Data Subjects, with the Company being responsible for, and able to demonstrate, compliance with these principles (accountability).
ARTICLE 4 — CATEGORIES OF DATA SUBJECTS
4.1 Data Subjects Concerned
The Company processes Personal Data relating to the following categories of Data Subjects:
(a) visitors to the Website and persons who submit contact forms, connection requests or enquiries;
(b) individual Clients, including sole proprietors, freelancers and individual entrepreneurs;
(c) directors, officers, shareholders, Beneficial Owners, authorised signatories, Authorised Users, employees and other representatives of corporate Clients and prospective Clients;
(d) Customers who make payments to Merchants through the Services;
(e) Recipients of Bulk Payments, pay-outs, B2B payments and Split Payments;
(f) contact persons of Partner Institutions, suppliers, service providers and business partners; and
(g) any other person whose Personal Data is provided to the Company by a Client or obtained lawfully from third-party sources in connection with the Services.
ARTICLE 5 — CATEGORIES OF PERSONAL DATA COLLECTED
5.1 Identification and Contact Data
Full name, former names, date and place of birth, nationality, gender, residential and business addresses, email addresses, telephone and mobile numbers, messenger identifiers, job title and position, signature, photograph, and copies, numbers and details of passports, national identity cards, Emirates ID, residence permits, driving licences and other identity documents.
5.2 Corporate and Relationship Data
Information on the legal entity represented by the Data Subject, including trade name, registration and licence numbers, shareholding and control structure, the Data Subject’s role, authority and percentage of ownership, powers of attorney, board resolutions, and the history of the Data Subject’s relationship with the Company.
5.3 Due Diligence and Compliance Data
Tax residence and tax identification numbers; source of funds and source of wealth information; occupation and employment; information on politically exposed person status and close associates; results of Sanctions, watch-list and adverse media screening; information contained in public registers and commercial databases; and, where strictly required by the AML/CFT Legislation, information relating to criminal convictions, offences, investigations and proceedings.
5.4 Biometric Data
Facial images, “selfie” photographs and video recordings captured during remote identity verification and liveness detection, and the biometric templates derived from them, processed solely for the purpose of verifying the identity of the Data Subject and preventing identity fraud, and only on the basis of the Data Subject’s explicit Consent or as otherwise permitted by the Data Protection Legislation.
5.5 Financial and Transaction Data
Bank account details, IBANs, card data (processed exclusively in tokenised or masked form save within PCI DSS-certified environments), e-wallet identifiers, Settlement details, Transaction amounts, currencies, dates, times, descriptors, statuses, the identity of payers and payees, Payment Order details, Chargeback and refund data, Fees, invoices, balances and financial statements.
5.6 Customer and Recipient Data Processed Through the Services
In respect of Customers: name, email address, telephone number, billing and shipping address, masked card number, card expiry date, card issuer and country, Payment Method details, order identifiers, IP address, device and browser data, 3-D Secure authentication results and fraud scores. In respect of Recipients: name, bank or card or wallet identifier, amount, currency, payment purpose and, where required, identification and address details.
5.7 Technical and Usage Data
IP address, geolocation derived from the IP address, device identifiers, device fingerprint, operating system, browser type and version, language settings, time zone, referring URLs, pages visited, clickstream, date and time of access, session duration, log-in history, API call logs, error logs and security event logs.
5.8 Communications Data
The content of emails, chat messages, support tickets, messenger communications, recorded telephone calls, complaints, feedback and survey responses, together with related metadata.
5.9 Marketing and Preference Data
Marketing preferences, Consents and their withdrawal, subscription status, participation in events and responses to marketing communications.
5.10 Personal Data Provided by Third Parties
Where a Client provides the Company with Personal Data relating to other individuals (for example, directors, Beneficial Owners, Authorised Users, Customers or Recipients), the Client shall ensure that it is entitled to do so, that the individuals concerned have been informed of the disclosure and of this Privacy Policy, and that any Consent required by the Data Protection Legislation has been obtained.
ARTICLE 6 — CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA
This Article sets out the Data Subject’s consent to the collection and processing of Personal Data. Consent is requested by means of an unticked checkbox or an equivalent clear affirmative action on the Website and in the Account. Consent is never inferred from silence, inactivity or pre-ticked boxes.
6.1 Declaration of Consent
By ticking the consent checkbox on the relevant form of the Website or of the Account, by clicking “I agree”, “Submit”, “Register”, “Sign up” or an equivalent button accompanied by a reference to this Privacy Policy, or by otherwise clearly and affirmatively indicating agreement, the Data Subject declares that he or she:
(a) has read and understood this Privacy Policy in its entirety, including the information on the identity of the Controller, the purposes of processing, the categories of Personal Data, the recipients, the international transfers, the retention periods and the Data Subject’s rights;
(b) freely, specifically, knowingly and unambiguously consents to the collection and processing by the Company of his or her Personal Data for the purposes described in Article 8 for which Consent is the applicable legal basis, as indicated in that Article;
(c) consents to the disclosure of his or her Personal Data to the categories of recipients described in Article 10, including Partner Institutions, Card Schemes, Payment Method Providers, identity verification providers and service providers, to the extent necessary for such purposes;
(d) consents to the transfer of his or her Personal Data outside the UAE in accordance with Article 11, having been informed of the possible risks of such transfers to countries which may not provide a level of protection equivalent to that of the UAE, in the absence of an adequacy decision or appropriate safeguards;
(e) where he or she undergoes remote identity verification, explicitly consents to the processing of his or her Biometric Data for the sole purpose of identity verification and fraud prevention as described in Article 5.4; and
(f) confirms that all Personal Data he or she provides is true, accurate, complete and current, and undertakes to notify the Company of any change.
6.2 Conditions of Valid Consent
In accordance with Article 6 of the PDPL and Article 7 of the GDPR, the Company shall rely on Consent only where: (a) the Company is able to demonstrate that the Data Subject has given Consent; (b) the request for Consent is presented in a clear, specific and unambiguous manner, clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language; (c) the Consent is given by a statement or a clear affirmative action; and (d) the Data Subject has been informed of his or her right to withdraw Consent at any time and of the manner of doing so. The Company keeps a record of each Consent, including the date, time, version of this Privacy Policy, the purposes consented to, the method of collection and the IP address or other identifier from which it was given.
6.3 Granular and Separate Consents
The Company requests separate Consents for distinct purposes. In particular, Consent to direct marketing communications, Consent to non-essential Cookies and Consent to the processing of Biometric Data are requested separately from the acceptance of the Terms and are not a condition of access to the Services. The Data Subject may give or refuse each such Consent independently.
6.4 Right to Withdraw Consent
The Data Subject may withdraw any Consent at any time, free of charge, by sending an email to [email protected] with the subject line “Withdrawal of Consent”, by changing the relevant settings in the Account, by using the unsubscribe link contained in each marketing communication, or by adjusting Cookie preferences through the Cookie banner or settings tool. Withdrawal of Consent shall be as easy as giving it. Withdrawal shall not affect the lawfulness of processing carried out on the basis of Consent before its withdrawal, nor the processing of Personal Data on any other legal basis described in Article 8, including compliance with legal obligations under the AML/CFT Legislation. Where the Data Subject withdraws Consent that is necessary for the provision of a particular Service, the Company may be unable to continue to provide that Service.
6.5 Processing Without Consent
The Data Subject is informed that, in accordance with Article 4 of the PDPL and Article 6 of the GDPR, the Company may process Personal Data without Consent where the processing is, among other cases: (a) necessary for the performance of a contract to which the Data Subject is a party, or to take steps at the request of the Data Subject prior to entering into a contract; (b) necessary for compliance with a legal obligation to which the Company is subject, including obligations under the AML/CFT Legislation and tax legislation; (c) necessary to protect the vital interests of the Data Subject or another person; (d) necessary for the establishment, exercise or defence of legal claims or in connection with judicial or security procedures; (e) necessary for the purposes of the legitimate interests pursued by the Company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject, to the extent this legal basis is recognised by the applicable Data Protection Legislation; or (f) relating to Personal Data made public by the Data Subject. The acceptance of the Terms is not in itself a Consent to processing, and Consent under this Article 6 is additional to, and does not replace, these other legal bases.
6.6 Consent on Behalf of Other Persons
A person who submits Personal Data relating to another individual declares and warrants that he or she is authorised to do so and that the individual concerned has been informed of this Privacy Policy and, where required, has given his or her Consent. The Company may request evidence of such authorisation or Consent at any time.
6.7 Age Restriction
The Website and the Services are not directed at persons under eighteen (18) years of age, and Consent may be given only by persons who have attained the age of eighteen (18) years and have full legal capacity. The Company does not knowingly collect Personal Data from minors. If the Company becomes aware that it has collected Personal Data from a minor without the verified consent of a parent or legal guardian, it shall delete such data without undue delay, save where retention is required by law.
6.8 Recommended Consent Wording
For the purposes of transparency, the consent checkboxes displayed on the Website and in the Account shall contain wording substantially as follows:
(a) Account registration and connection requests: “I have read the Privacy Policy and I consent to the collection and processing of my personal data by Vertas Pulse Payment Service Provider L.L.C for the purposes described therein, including the transfer of my personal data to Partner Institutions and service providers located inside and outside the UAE.”
(b) Contact form: “I consent to the processing of the personal data provided in this form for the purpose of responding to my enquiry, in accordance with the Privacy Policy.”
(c) Identity verification: “I explicitly consent to the processing of my facial image and biometric data for the sole purpose of verifying my identity and preventing fraud, in accordance with Article 5.4 of the Privacy Policy.”
(d) Marketing: “I would like to receive news, offers and information about Vertas Pulse services by email and messaging. I may unsubscribe at any time.”
ARTICLE 7 — SOURCES AND METHODS OF COLLECTION
7.1 Direct Collection
The Company collects Personal Data directly from the Data Subject when he or she visits the Website, completes a contact form, connection request or registration form, undergoes the Onboarding Procedure, uploads documents, uses the Account or the API, submits Payment Orders, communicates with the Company by email, telephone, chat or messaging applications, attends meetings or events, or otherwise interacts with the Company.
7.2 Collection from Clients
The Company collects Personal Data of directors, Beneficial Owners, Authorised Users, Customers and Recipients from Clients, including through the Client’s integration with the API, Payment Pages, Bulk Payment files and Split Payment instructions.
7.3 Collection from Third Parties and Public Sources
The Company may collect Personal Data from Partner Institutions, Card Schemes, Payment Method Providers, identity verification and electronic KYC providers, fraud prevention services, Sanctions and politically exposed persons screening databases, credit reference agencies, commercial registers, public registers, court records, official gazettes, reputable media sources, professional networking websites and other publicly available sources, to the extent permitted by the Data Protection Legislation.
7.4 Automatic Collection
The Company automatically collects Technical and Usage Data through server logs, Cookies and similar technologies when a Data Subject accesses the Website, the Account, the Payment Pages or the API, as further described in Article 16.
7.5 Consequences of Not Providing Personal Data
The provision of Personal Data requested during the Onboarding Procedure and for the execution of Transactions is a contractual and statutory requirement. If the Data Subject does not provide the Personal Data requested, the Company may be unable to open an Account, to provide the Services, to execute Transactions or to continue the business relationship, and may be required by the AML/CFT Legislation to refuse or terminate the relationship. The provision of Personal Data for marketing purposes is voluntary.
ARTICLE 8 — PURPOSES AND LEGAL BASES OF PROCESSING
8.1 Purposes and Legal Bases
The Company processes Personal Data for the following purposes and on the following legal bases:
| Purpose of processing | Categories of Personal Data | Legal basis |
| Responding to enquiries, contact forms and connection requests; pre-contractual communications | Identification and Contact Data; Corporate Data; Communications Data | Consent (Article 6); steps taken at the request of the Data Subject prior to entering into a contract |
| Onboarding, identification and verification of Clients, directors, Beneficial Owners and Authorised Users; customer due diligence and enhanced due diligence | Identification, Corporate, Due Diligence and Compliance Data; Biometric Data | Compliance with legal obligations under the AML/CFT Legislation; performance of contract; explicit Consent for Biometric Data |
| Opening, administration and operation of the Account; provision of the Services; execution of Payment Orders, Bulk Payments, Recurring Payments and Split Payments; Settlement | Identification, Financial and Transaction, Customer and Recipient, Technical Data | Performance of contract; compliance with legal obligations; Consent where required |
| Transaction monitoring, Sanctions screening, detection and reporting of suspicious transactions; record-keeping | Due Diligence and Compliance Data; Financial and Transaction Data; Technical Data | Compliance with legal obligations; substantial public interest in the prevention of financial crime |
| Fraud prevention, risk scoring, 3-D Secure authentication, Chargeback management and dispute handling | Financial and Transaction, Customer, Technical Data | Performance of contract; compliance with Scheme Rules and legal obligations; legitimate interests in preventing fraud and losses |
| Information security, prevention of cyber-attacks, access control, logging and incident response | Technical and Usage Data; Communications Data | Legitimate interests; compliance with legal obligations |
| Billing, invoicing, accounting, tax reporting and debt recovery | Identification, Corporate, Financial and Transaction Data | Performance of contract; compliance with legal obligations; establishment, exercise and defence of legal claims |
| Customer support, account management, complaint handling, quality assurance and training, including call recording | Identification, Communications, Transaction Data | Performance of contract; legitimate interests; Consent where required by law |
| Analytics, reporting, improvement and development of the Website, the Platform and the Services, including aggregated and anonymised statistics | Technical and Usage Data; Transaction Data in aggregated form | Legitimate interests; Consent for non-essential Cookies |
| Direct marketing of the Company’s own services, newsletters and events | Identification and Contact Data; Marketing and Preference Data | Consent; legitimate interests for existing business Clients where permitted by law, subject to the right to object |
| Compliance with requests and orders of Competent Authorities, courts and law enforcement | All relevant categories | Compliance with legal obligations |
| Establishment, exercise or defence of legal claims; audits; corporate transactions such as mergers, acquisitions or restructurings | All relevant categories | Legitimate interests; establishment, exercise or defence of legal claims |
8.2 Sensitive Personal Data
The Company processes Sensitive Personal Data only where strictly necessary and on one of the following bases: (a) the explicit Consent of the Data Subject (in particular for Biometric Data); (b) where the processing is necessary for compliance with obligations under the AML/CFT Legislation, including the processing of data relating to criminal convictions and offences for the purposes of due diligence and Sanctions screening; (c) where the processing is necessary for the establishment, exercise or defence of legal claims; or (d) where the Data Subject has manifestly made the data public.
8.3 Compatible Further Processing
The Company shall not process Personal Data for any purpose incompatible with the purposes for which it was collected. Where the Company intends to process Personal Data for a new purpose, it shall inform the Data Subject in advance and, where required, obtain his or her Consent.
ARTICLE 9 — AUTOMATED PROCESSING, PROFILING AND DECISION-MAKING
9.1 Use of Automated Processing
The Company and its Partner Institutions use Automated Processing, including Profiling, for: (a) fraud scoring of Transactions in real time, taking into account the Transaction amount, Payment Method, device, IP address, geolocation, velocity and behavioural patterns; (b) Sanctions and politically exposed persons screening; (c) Transaction monitoring for the detection of unusual or suspicious activity; (d) smart routing of Transactions to Partner Institutions; and (e) assessment of the risk profile of Clients during onboarding and ongoing monitoring.
9.2 Consequences
Automated Processing may result in a Transaction being declined, held for review or subjected to additional authentication, in an application being referred for manual review, or in limits being applied to an Account. The Company does not make decisions producing legal effects concerning a Data Subject, or similarly significantly affecting him or her, based solely on Automated Processing, save where such decision is necessary for entering into or performing a contract, is authorised by Applicable Law, or is based on the Data Subject’s explicit Consent.
9.3 Rights of the Data Subject
Where a decision is based solely on Automated Processing, the Data Subject has the right, in accordance with Article 18 of the PDPL and Article 22 of the GDPR, to obtain human intervention, to express his or her point of view and to contest the decision, by contacting the Company in accordance with Article 21, subject to the restrictions imposed by the AML/CFT Legislation, in particular the prohibition on tipping-off.
ARTICLE 10 — DISCLOSURE OF PERSONAL DATA AND CATEGORIES OF RECIPIENTS
10.1 Principle
The Company does not sell, rent or trade Personal Data. The Company discloses Personal Data only to the extent necessary for the purposes described in Article 8 and only to the following categories of recipients, each of which is bound by confidentiality obligations and, where acting as Processor, by a written data processing agreement:
(a) Partner Institutions, including Acquirers, banks, payment institutions, electronic money institutions, stored value facility providers and money transfer operators involved in the execution of Transactions and Settlement;
(b) Card Schemes (including Visa and Mastercard), Payment Method Providers, e-wallet operators, 3-D Secure directory servers and access control servers, and correspondent banks and payment messaging networks such as SWIFT;
(c) identity verification, electronic KYC, Sanctions screening, politically exposed persons screening, adverse media and fraud prevention service providers;
(d) information technology service providers, including cloud hosting and data centre providers, software and platform developers, customer relationship management and ticketing systems, communication and email delivery providers, and IT security providers;
(e) professional advisers, including lawyers, auditors, accountants, tax advisers, compliance consultants and insurers;
(f) debt collection agencies, where the Client fails to pay amounts due;
(g) Competent Authorities, including the CBUAE, the UAE Financial Intelligence Unit, the Executive Office for Control and Non-Proliferation, the Data Office, the Department of Economy and Tourism of Dubai, tax authorities, courts, arbitral tribunals, public prosecutors and law enforcement agencies, where required or permitted by Applicable Law;
(h) the Client, in respect of Personal Data of Customers and Recipients relating to Transactions processed for that Client, and the Customer’s Issuer in the context of Chargebacks and disputes;
(i) affiliates of the Company, for the purposes of internal administration, risk management and group compliance, to the extent permitted by law; and
(j) potential or actual acquirers, investors, successors or transferees in the context of a merger, acquisition, restructuring, transfer of business or change of licensing structure, subject to strict confidentiality undertakings.
10.2 Disclosure Required by Law
The Company may disclose Personal Data without the Data Subject’s Consent and without notice where required by Applicable Law, including where the Company files a suspicious transaction report or responds to a binding request of a Competent Authority. In such cases, the Company may be prohibited from informing the Data Subject of the disclosure.
10.3 Processors
The Company engages Processors only where they provide sufficient guarantees to implement appropriate technical and organisational measures, and requires them, by written contract, to process Personal Data only on documented instructions, to ensure confidentiality, to implement appropriate security measures, to engage sub-processors only with authorisation, to assist the Company in responding to Data Subject requests and Personal Data Breaches, and to delete or return Personal Data at the end of the services.
ARTICLE 11 — INTERNATIONAL TRANSFERS OF PERSONAL DATA
11.1 Transfers Outside the UAE
Given the international nature of the Services, Personal Data may be transferred to, stored in or accessed from countries outside the UAE, including countries where Partner Institutions, Card Schemes, Payment Method Providers, correspondent banks, cloud hosting providers and other recipients are located, including in the European Economic Area, the United Kingdom, the United States of America, Switzerland, Hong Kong and other jurisdictions in which Customers and Recipients are located.
11.2 Safeguards
The Company transfers Personal Data outside the UAE only in accordance with Articles 22 and 23 of the PDPL and, where applicable, Chapter V of the GDPR and UK GDPR, namely: (a) to countries or territories recognised by the Data Office or the relevant authority as providing an adequate level of protection; (b) on the basis of appropriate safeguards, including standard contractual clauses or other contractual commitments ensuring a level of protection not less than that required by the Data Protection Legislation; (c) where the transfer is necessary for the performance of a contract between the Data Subject and the Company, or for the conclusion or performance of a contract concluded in the interest of the Data Subject, including the execution of a cross-border Transaction ordered by or for the benefit of the Data Subject; (d) where the transfer is necessary for the establishment, exercise or defence of legal claims, or for international judicial cooperation; (e) where the transfer is necessary for compliance with obligations under the AML/CFT Legislation or the Scheme Rules; or (f) on the basis of the Data Subject’s express Consent given in accordance with Article 6.1(d), in a manner that does not conflict with the public or security interests of the UAE.
11.3 Information on Transfers
The Data Subject may request further information on the international transfers applicable to his or her Personal Data, and a copy of the relevant safeguards, by contacting the Company in accordance with Article 21, subject to the redaction of commercially confidential information.
ARTICLE 12 — RETENTION OF PERSONAL DATA
12.1 General Principle
The Company retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, tax, accounting, reporting and Scheme requirements, and for the establishment, exercise or defence of legal claims.
12.2 Retention Periods
The following retention periods apply as a rule, unless a longer period is required by Applicable Law, requested by a Competent Authority, or necessary in connection with pending or anticipated litigation, investigation or dispute:
| Category of data | Retention period |
| Customer due diligence documents, Beneficial Owner information, Transaction records and correspondence relating to the business relationship | Not less than five (5) years from the end of the business relationship or the date of completion of the occasional Transaction, or such longer period as required by the AML/CFT Legislation or a Competent Authority |
| Accounting, invoicing and tax records | Not less than five (5) years from the end of the relevant financial or tax period, or longer as required by tax and commercial legislation |
| Chargeback, dispute and fraud records | For the duration of the applicable Scheme Rules dispute cycle and thereafter for not less than five (5) years |
| Records of Consent and its withdrawal | For the duration of the processing based on such Consent and thereafter for five (5) years as evidence of compliance |
| Biometric Data and liveness verification recordings | Deleted or irreversibly anonymised as soon as identity verification has been completed, save for the verification result and any data required to be retained under the AML/CFT Legislation |
| Contact form and enquiry data of persons who do not become Clients | Up to two (2) years from the last communication |
| Marketing data | Until Consent is withdrawn or the Data Subject objects, and in any event not longer than three (3) years from the last interaction |
| Recorded calls and chat logs | Up to five (5) years, or longer where related to a Transaction or dispute |
| Technical logs and security logs | Up to twelve (12) months, or longer where required for the investigation of an incident |
| Cookies | As indicated in the Cookie banner and Cookie settings tool for each Cookie |
12.3 Deletion and Anonymisation
Upon expiry of the applicable retention period, the Company shall securely delete, destroy or irreversibly anonymise the Personal Data. Anonymised data, from which no Data Subject can be identified, may be retained and used for statistical purposes without limitation.
ARTICLE 13 — SECURITY OF PERSONAL DATA
13.1 Technical and Organisational Measures
The Company implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks for the rights of Data Subjects, including:
(a) encryption of Personal Data in transit using TLS and, where appropriate, at rest;
(b) tokenisation and masking of card data, and processing of full card data exclusively within PCI DSS-compliant environments;
(c) two-factor authentication for access to the Account and to internal systems, role-based access controls, the principle of least privilege and regular review of access rights;
(d) resilient infrastructure with redundancy and failover arrangements, backups and business continuity and disaster recovery plans;
(e) firewalls, intrusion detection and prevention systems, anti-malware protection, vulnerability management, patch management and periodic penetration testing;
(f) logging and monitoring of access to Personal Data and of security events;
(g) confidentiality undertakings, background checks where permitted by law and regular data protection and information security training for personnel; and
(h) due diligence on, and contractual security obligations for, Processors and Partner Institutions.
13.2 Responsibility of the Data Subject
The Data Subject is responsible for keeping his or her Credentials confidential and for using secure devices and networks. No method of transmission over the internet or of electronic storage is completely secure, and the Company cannot guarantee absolute security; however, the Company shall respond to any Personal Data Breach in accordance with Article 14.
ARTICLE 14 — PERSONAL DATA BREACH
14.1 Notification to Authorities
In the event of a Personal Data Breach that is likely to prejudice the privacy, confidentiality or security of Personal Data, the Company shall notify the Data Office in accordance with Article 9 of the PDPL immediately upon becoming aware of it and within the time limits set by the Executive Regulations, and, where the GDPR or UK GDPR applies, shall notify the competent supervisory authority without undue delay and, where feasible, not later than seventy-two (72) hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of Data Subjects. The Company shall also notify Partner Institutions and Card Schemes where required by the Scheme Rules.
14.2 Notification to Data Subjects
Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of Data Subjects, or where otherwise required by the Data Protection Legislation, the Company shall inform the affected Data Subjects without undue delay, describing in clear and plain language the nature of the breach, its likely consequences, the measures taken or proposed and the contact point for further information.
14.3 Records
The Company documents all Personal Data Breaches, including the facts, effects and remedial action taken.
ARTICLE 15 — RIGHTS OF DATA SUBJECTS
15.1 Rights Under the PDPL
Subject to the conditions and exceptions set out in the Data Protection Legislation, each Data Subject has the following rights:
(a) Right to information and access (Article 13 of the PDPL): to obtain, free of charge, information on the categories of Personal Data processed, the purposes of processing, the decisions made on the basis of Automated Processing including Profiling, the recipients inside and outside the UAE, the controls and standards applied to cross-border transfers, the retention period, the procedures for correction, erasure and restriction, the protection measures applied, the procedures for dealing with Personal Data Breaches and the procedure for submitting a complaint to the Data Office, and to receive a copy of his or her Personal Data;
(b) Right to data portability (Article 14 of the PDPL): to receive the Personal Data provided to the Company in a structured, clear and machine-readable format and to request its transmission to another Controller, where technically feasible;
(c) Right to rectification and erasure (Article 15 of the PDPL): to request the correction of inaccurate Personal Data, the completion of incomplete Personal Data, and the erasure of Personal Data where it is no longer necessary for the purposes for which it was collected, where Consent has been withdrawn and there is no other legal basis, where the Data Subject has objected to the processing, or where the processing is unlawful, save where retention is required by law, including the AML/CFT Legislation;
(d) Right to restriction of processing (Article 16 of the PDPL): to request the restriction of processing where the accuracy of the data is contested, where the processing is unlawful, where the data is required for legal claims or where an objection is pending;
(e) Right to stop or object to processing (Article 17 of the PDPL): to object to or request the cessation of processing for direct marketing purposes, for statistical surveys, or where the processing violates the principles of processing, save where the processing is required by law;
(f) Right in relation to Automated Processing (Article 18 of the PDPL): to object to decisions based solely on Automated Processing, including Profiling, which produce legal consequences or seriously affect the Data Subject, as described in Article 9; and
(g) Right to withdraw Consent at any time, as described in Article 6.4.
15.2 Additional Rights Under the GDPR and UK GDPR
Where the GDPR or UK GDPR applies, the Data Subject additionally has the rights set out in Articles 15 to 22 of the GDPR, including the right to object at any time, on grounds relating to his or her particular situation, to processing based on legitimate interests, and the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, or, in the United Kingdom, with the Information Commissioner’s Office.
15.3 Rights of California Residents
Where the CCPA/CPRA applies, California residents have the right to know the categories and specific pieces of personal information collected, the sources, the business purposes and the categories of third parties to whom it is disclosed; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right not to be discriminated against for exercising these rights. The Company does not sell personal information and does not share personal information for cross-context behavioural advertising within the meaning of the CCPA/CPRA. The Company uses sensitive personal information only for purposes permitted by the CCPA/CPRA, including verifying identity, preventing fraud and complying with legal obligations. California residents may exercise their rights, or designate an authorised agent to do so, by contacting the Company in accordance with Article 21.
15.4 Exercise of Rights
Requests shall be submitted in writing by email to [email protected] or by post to the Company’s registered address, indicating the right being exercised and enabling the Company to identify the Data Subject. The Company may request additional information to verify the identity of the requester before acting on a request, in order to protect Personal Data against unauthorised disclosure.
15.5 Response Time
The Company shall respond to requests without undue delay and within the period prescribed by the Data Protection Legislation, and in any event within thirty (30) days of receipt of a verified request. This period may be extended by a further sixty (60) days where necessary, taking into account the complexity and number of requests, in which case the Company shall inform the Data Subject of the extension and the reasons for it within the initial period. Responses shall be provided free of charge, save that the Company may charge a reasonable fee or refuse to act on requests that are manifestly unfounded, excessive or repetitive, to the extent permitted by the Data Protection Legislation.
15.6 Limitations
The rights described in this Article 15 are not absolute. The Company may refuse or restrict a request where: (a) the request is not related to the Data Subject’s own Personal Data or is manifestly unfounded or excessive; (b) compliance would conflict with judicial proceedings or investigations, with the AML/CFT Legislation or with other legal obligations, including record-keeping obligations and the prohibition on tipping-off; (c) compliance would adversely affect the rights and freedoms of others, including trade secrets and intellectual property; or (d) the processing is necessary for the establishment, exercise or defence of legal claims. In such cases, the Company shall inform the Data Subject of the reasons for the refusal, save where doing so is prohibited by law.
ARTICLE 16 — COOKIES AND SIMILAR TECHNOLOGIES
16.1 Use of Cookies
The Website, the Account and the Payment Pages use Cookies. The Company uses the following categories of Cookies:
(a) Strictly necessary Cookies, which are essential for the operation of the Website and the Platform, including session management, authentication, load balancing, security, fraud prevention and the storage of Cookie preferences. These Cookies do not require Consent;
(b) Functional Cookies, which remember the Data Subject’s choices, such as language and display preferences;
(c) Analytics and performance Cookies, which collect information about how visitors use the Website in order to measure and improve its performance; and
(d) Marketing Cookies, which may be used to measure the effectiveness of campaigns and to display relevant content.
16.2 Consent to Cookies
Functional, analytics and marketing Cookies are placed only with the Data Subject’s prior Consent, given through the Cookie banner displayed on the first visit to the Website. The Data Subject may accept all Cookies, reject all non-essential Cookies or select specific categories, and may change or withdraw his or her Consent at any time through the Cookie settings tool accessible from the Website footer or through the settings of his or her browser. Rejecting Cookies may affect the functionality of certain parts of the Website.
16.3 Device Fingerprinting on Payment Pages
For the purposes of fraud prevention and 3-D Secure authentication, the Payment Pages collect device and browser information required by the Scheme Rules. This processing is necessary for the performance of the payment Transaction requested by the Customer and for compliance with legal obligations, and does not require Cookie Consent.
ARTICLE 17 — DIRECT MARKETING
17.1 Marketing Communications
The Company sends marketing communications by email, SMS, messaging applications or telephone only with the prior Consent of the Data Subject or, in respect of existing business Clients, where permitted by Applicable Law and subject to the right to object. The Company complies with applicable rules on unsolicited electronic communications.
17.2 Right to Object
The Data Subject may object at any time, free of charge, to the processing of his or her Personal Data for direct marketing purposes, by using the unsubscribe link in each communication, by changing the Account settings or by contacting the Company. Following an objection, the Personal Data shall no longer be processed for such purposes. Service, security, regulatory and transactional communications are not marketing communications and will continue to be sent where necessary for the provision of the Services.
ARTICLE 18 — CONFIDENTIALITY OF PERSONAL DATA
18.1 Duty of Confidentiality
All Personal Data processed by the Company is treated as strictly confidential. Access to Personal Data is limited to employees, officers, contractors and Processors who need such access for the purposes described in this Privacy Policy and who are bound by contractual or statutory confidentiality obligations that survive the termination of their engagement.
18.2 Banking and Payment Secrecy
Personal Data relating to Transactions, accounts and balances is additionally protected by the confidentiality obligations applicable to Partner Institutions under the CBUAE framework and to all participants in the Card Schemes, and is disclosed only in the circumstances permitted by those obligations and by this Privacy Policy.
ARTICLE 19 — THIRD-PARTY WEBSITES AND SERVICES
19.1 Links
The Website may contain links to websites, applications and services operated by third parties, including Partner Institutions, Payment Method Providers and messaging applications. The Company is not responsible for the privacy practices of such third parties, and this Privacy Policy does not apply to them. Data Subjects are encouraged to read the privacy notices of every website and service they visit.
19.2 Communications via Messaging Applications
Where the Data Subject chooses to communicate with the Company, or to receive Payment Links, through third-party messaging applications such as Telegram, WhatsApp or Viber, the providers of those applications process Personal Data in accordance with their own terms and privacy policies, and the Company has no control over such processing.
ARTICLE 20 — CHANGES TO THIS PRIVACY POLICY
20.1 Amendments
The Company may amend this Privacy Policy at any time to reflect changes in its processing activities, in the Services or in the Data Protection Legislation, by publishing the amended version on the Website with an indication of the version number and the date of the last update.
20.2 Notification of Material Changes
Where an amendment materially changes the purposes of processing, the categories of Personal Data processed or the recipients, the Company shall inform registered Clients by email or through the Account before the amendment takes effect and, where the amendment affects processing based on Consent, shall request a new Consent where required by the Data Protection Legislation.
ARTICLE 21 — CONTACT, DATA PROTECTION OFFICER AND COMPLAINTS
21.1 Contact
All questions, requests and complaints concerning this Privacy Policy or the processing of Personal Data should be addressed to:
Vertas Pulse Payment Service Provider L.L.C — Data Protection
Address: Office No. M17-201, property of Mohammed Salem Bakhit Al Bakhit Al Falasi, Hor Al Anz East, Dubai, United Arab Emirates
Email: [email protected] (subject line: “Data Protection”)
Telephone: +971543896894
21.2 Data Protection Officer
Where required by Article 10 of the PDPL or Article 37 of the GDPR, the Company shall appoint a Data Protection Officer, whose contact details shall be published on the Website. Until such appointment is published, all data protection enquiries shall be handled by the Company’s designated data protection contact at the address above.
21.3 Complaints
The Data Subject may submit a complaint to the Company, which shall acknowledge receipt within five (5) Business Days and respond within the time limits set out in Article 15.5. Without prejudice to any other administrative or judicial remedy, the Data Subject has the right to lodge a complaint with the Data Office in accordance with Article 24 of the PDPL if he or she believes that the processing of his or her Personal Data infringes the PDPL, and, where applicable, with the competent supervisory authority under the GDPR or UK GDPR.
21.4 Governing Law
This Privacy Policy is governed by the laws of the United Arab Emirates, without prejudice to the mandatory provisions of the Data Protection Legislation of the Data Subject’s country of residence that confer greater protection. Disputes shall be resolved in accordance with Article 26 of the Terms, without prejudice to the Data Subject’s right to lodge a complaint with a supervisory authority.
ARTICLE 22 — CONSENT DECLARATION
CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA. I, the undersigned Data Subject, having read and understood the Privacy Policy of Vertas Pulse Payment Service Provider L.L.C (DET licence No. 1648416, Commercial Register No. 2916823, Office No. M17-201, property of Mohammed Salem Bakhit Al Bakhit Al Falasi, Hor Al Anz East, Dubai, UAE), hereby freely, specifically, knowingly and unambiguously consent to the collection, recording, storage, use, disclosure and transfer, including outside the United Arab Emirates, of my Personal Data for the purposes, to the recipients and for the retention periods described in the Privacy Policy. I understand that I may withdraw this consent at any time by writing to [email protected], that withdrawal will not affect the lawfulness of processing carried out before withdrawal or processing carried out on another legal basis, including the fulfilment of legal obligations, and that I may exercise my rights of access, portability, rectification, erasure, restriction, objection and complaint as described in Article 15 of the Privacy Policy.
22.1 Form of the Declaration
The Consent Declaration above is presented to the Data Subject in electronic form by means of an unticked checkbox, together with a hyperlink to this Privacy Policy, at the point of collection of Personal Data on the Website and in the Account. The Declaration may also be executed in written form where the Company collects Personal Data offline.
— END OF DOCUMENT —