1. Background
This Privacy Policy has been prepared for Payfuture FS MT Ltd. ("Payfuture", "we", "us" or "our"), company registered under the Laws of Malta, holding company registration number C 107340.
Payfuture provides payment-related services to business clients. As part of its client-onboarding and ongoing due-diligence procedures, Payfuture operates an online onboarding portal known as ID Hub (the "Portal"). The Portal enables prospective and existing business clients to provide application information, identify persons associated with their business, upload supporting documents and arrange identity checks. It enables Payfuture personnel to organise, review and assess the material received.
This Privacy Policy explains how Payfuture processes personal data about the individuals involved in an application or business relationship, including applicants, directors, shareholders, ultimate beneficial owners ("UBOs"), managers, authorised signatories, authorised Portal users and other relevant contacts (together, "Relevant Individuals"). It is intended to provide information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), including where we receive your details from the business applicant rather than from you directly.
The Portal digitises and facilitates an onboarding and AML/KYC process that Payfuture would otherwise carry out through manual collection and review. It does not, on the present understanding, make final onboarding decisions solely by automated means.
2. Information about us
For the purposes of the GDPR, the Data Protection Act, Chapter 586 of the Laws of Malta, and subsidiary legislation (collectively, “Data Protection Legislation”), Payfuture is the controller of the Personal Data covered by this Privacy Policy. A controller is a person or organisation which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
Payfuture may act in a different capacity in relation to other Processing activities. In particular, where Payfuture provides services to another licensed financial institution and Processes Personal Data solely on that institution's behalf and in accordance with its documented instructions, Payfuture may act as processor, while the relevant financial institution acts as controller. Such Processing is governed by the applicable contractual arrangements, including a data processing agreement where required under Data Protection Legislation.
3. Scope of this privacy policy
This Privacy Policy applies only to Personal Data which Payfuture Processes as controller through or in connection with its ID Hub onboarding portal (the “Portal”), including the collection, identification, verification and due diligence of prospective and existing business clients and individuals associated with them. It applies both where Personal Data is provided directly by the individual concerned through the Portal and where such Personal Data is provided by the business client, another person acting on its behalf, or another lawful source in connection with the onboarding process.
This Privacy Policy does not apply to Personal Data Processed through or in connection with Payfuture's general corporate website, which is addressed in its separate Website Privacy Policy. Nor does it govern Personal Data Processed in connection with the general provision, administration and operation of Payfuture's electronic money and payment services, which is addressed in the applicable privacy documentation relating to those services.
4. What is personal data?
Personal data is any information relating to an identified or identifiable natural person. This includes professional and residential details, identity information, ownership and control information, online identifiers and records linked to an individual. Corporate information may also constitute personal data where it relates to an identifiable person, including sole traders, shareholders, directors or contact persons.
5. Your rights
Subject to the conditions and limitations set out in Data Protection Legislation, you have the following rights in relation to your Personal Data:
-
the right to be informed about the collection and use of your Personal Data;
-
the right to access Personal Data held about you;
-
the right to have inaccurate or incomplete Personal Data rectified;
-
the right to erasure, sometimes referred to as the “right to be forgotten”;
-
the right to restrict the Processing of your Personal Data;
-
the right to object to the Processing of your Personal Data in certain circumstances, including where we rely on legitimate interests;
-
where we rely on consent as the lawful basis for Processing, the right to withdraw consent at any time, without affecting the lawfulness of Processing based on consent before withdrawal;
-
the right to data portability, where this applies under Data Protection Legislation; and
-
the right not to be subject to a decision based solely on automated Processing, including profiling, where that decision produces legal effects concerning you or similarly significantly affects you.
For more information about our Processing of Personal Data for ID Hub or the exercise of your rights, please contact Payfuture using the details in section 15. Some rights may be restricted where permitted or required by applicable AML/CFT or financial-services legislation.
It is important that the Personal Data we hold about you is accurate and up to date. Please inform us of any changes to your Personal Data.
6. Personal data we collect and how we collect it
Where the information is not collected directly from you, it may come from the business applicant, its representatives, other group entities, the relevant person, official corporate or regulatory registers, verification/screening providers and other lawful public or commercial sources. The precise source depends on the relevant check.
| Category of personal data | Examples and source |
|---|---|
| Identity and biographical details | Full name, nationality/citizenship, date and place of birth, country of residence, identification document number and, where necessary, copies of identification documents. Supplied by you, the applicant or a verification provider. |
| Contact and role details | Email, telephone number, residential or business address, title, position, director/manager/authorised signatory status, Portal user credentials and contact details. Supplied by you or the applicant. |
| Ownership and control information | Direct or indirect shareholding percentages, ownership/control charts, UBO or senior-management status, links to corporate shareholders, nominee arrangements and supporting registers. Supplied by the applicant and verified against lawful sources. |
| Due diligence and risk information | PEP declarations, citizenship-by-investment/residence-by-investment indicators where relevant, screening matches, sanctions/adverse-media findings, risk flags, verification outcomes and compliance review notes. Generated from declarations, checks and lawful third-party sources. |
| Business and financial context linked to people | Applicant-related business activities, source of wealth/funds, jurisdictions, anticipated payment corridors, counterparties, transaction patterns and corporate supporting documents where these identify or relate to individuals. |
| Identity verification data | Hosted verification requests, completion status, identity-document images and possibly facial images, liveness results or biometric comparison results if used by the verification provider. |
| Electronic-signature and declaration data | Name, capacity, email, recorded acceptance/declaration, date/time, typed signature, application submission and related evidence. |
| Technical, access and security data | IP address, browser/device information, login/session information, authentication and activity records, audit trails, incident and support records; cookie and browser-storage identifiers explained in the separate Cookie Policy. |
Special Category Data
We do not ordinarily seek special-category data unless specifically necessary and lawful. Identity verification involving biometric processing for the purpose of uniquely identifying an individual, or checks involving criminal-offence data, require additional legal assessment and safeguards.
Data concerning criminal convictions
In the course of our onboarding, identification, verification and due diligence activities, we may collect or otherwise Process Personal Data relating to criminal convictions and offences where this is necessary to comply with our applicable legal and regulatory obligations, including those relating to anti-money laundering and counter-terrorist financing.
The Processing of Personal Data relating to criminal convictions and offences is subject to specific restrictions under Data Protection Legislation, including Article 10 GDPR.
Such information may be obtained through due diligence questionnaires, supporting documentation, screening against relevant databases, adverse media checks or other verification procedures. We do not routinely request criminal record certificates or equivalent documentation unless this is necessary and justified having regard to applicable legal requirements and our internal risk-based due diligence procedures.
Any such Processing shall be limited to what is necessary for the relevant purpose and carried out in accordance with applicable legal requirements and appropriate safeguards.
7. How we use personal data and legal bases
We process personal data only where an appropriate legal basis applies. The principal purposes and anticipated bases are below. Specific obligations and any use of special-category or criminal-offence data should be confirmed against the exact checks deployed.
| Purpose | GDPR Article 6 basis |
|---|---|
| Receiving and assessing corporate applications; identifying the applicant and Relevant Individuals | Legal obligation – Article 6(1)(c), to the extent required by applicable AML/CFT and financial-services obligations; Legitimate interests – Article 6(1)(f) for associated business administration beyond those obligations. |
| Verifying identity, ownership and control; UBO, PEP, sanctions and risk checks; enhanced due diligence | Legal obligation – Article 6(1)(c), where required by AML/CFT, sanctions or other applicable legal duties. Any additional purpose requires separate justification. |
| Requesting documents, correcting and validating submissions, undertaking human compliance review and making onboarding decisions | Legal obligation – Article 6(1)(c) for regulated due diligence; Legitimate interests – Article 6(1)(f) where needed for legitimate account-administration and operational risk-management purposes. |
| Creating Portal accounts, authenticating users, managing permissions and providing assistance | Legitimate interests – Article 6(1)(f), namely administering a secure B2B Portal and supporting applications; Legal obligation – Article 6(1)(c) where specific security duties apply. |
| Communicating with applicant representatives, issuing operational notices and managing the business relationship | Legitimate interests – Article 6(1)(f), namely managing B2B relationships and correspondence; Legal obligation – Article 6(1)(c) for legally required notices. |
| Maintaining audit trails, preventing fraud/misuse, responding to regulatory requests, preserving records and addressing disputes | Legal obligation – Article 6(1)(c) for regulatory and record-keeping requirements; Legitimate interests – Article 6(1)(f) for protecting systems, investigating misuse and establishing, exercising or defending legal claims, where appropriate. |
Where we rely on our legitimate interests, we consider whether those interests are appropriate having regard to the nature of the Personal Data, the context in which it was obtained, our relationship with the Enterprise Client and the potential impact of the Processing on your rights and interests.
We use Personal Data for the purposes for which it was collected. Where we need to use Personal Data for another purpose that is compatible with the original purpose, we will do so in accordance with Data Protection Legislation. Where we need to Process Personal Data for an unrelated purpose, we will provide further information where required by law.
In certain circumstances, Data Protection Legislation permits or requires us to Process Personal Data without prior notice or consent, including where this is necessary to comply with legal obligations, protect rights, investigate misuse, handle legal claims or cooperate with competent authorities.
8. How long we keep your personal data
We retain information for no longer than necessary for the relevant purposes and any mandatory legal or regulatory period, including AML/CFT record-keeping obligations applicable to Payfuture. The applicable period may differ depending on whether an application is approved, rejected, withdrawn or abandoned, and on the type of record (identity verification evidence, uploaded documentation, correspondence, activity logs or technical backups).
Where a record is needed for a regulatory investigation, legal dispute or other lawful preservation requirement, retention may continue for the relevant period. Otherwise, records should be securely deleted or anonymised in accordance with our retention schedule.
9. Where we store and transfer your personal data
Personal data may be processed through Payfuture’s systems and approved service providers for hosting, storage, identity verification, screening, communications and secure Portal administration.
Where information is transferred to a country outside the EEA, we will use an appropriate Chapter V GDPR mechanism, such as an adequacy decision or Standard Contractual Clauses together with supplementary safeguards where required. Details of applicable safeguards and how to obtain a copy may be requested using section 15.
10. Sharing your personal data
We share Personal Data with third parties only where this is necessary for the purposes described in this Privacy Policy, where we are legally required to do so, or where another lawful basis applies. The table below sets out the principal categories of third parties with whom we may share Personal Data, together with the purposes for which such disclosures may take place.
| Recipient category | Reason for disclosure |
|---|---|
| Identity-verification, KYC and screening providers | To perform identification, document/liveness checks where used, screening, verification and return results for compliance review. |
| IT, cloud, hosting, storage, cybersecurity and authentication providers | To operate and protect ID Hub, store submitted material, authenticate users and maintain platform integrity. |
| Payfuture authorised compliance, risk, operations and other personnel | To assess and approve/reject applications, administer accounts and perform ongoing due diligence, in accordance with access permissions. |
| Group entities and contracted support providers, if applicable | For appropriately authorised administration and compliance support, subject to identified roles and safeguards. |
| Regulators, financial intelligence authorities, law-enforcement bodies, courts and other competent authorities | Where authorised or required under law, regulatory supervision, lawful demands, investigations or proceedings. |
| Professional advisers, auditors, insurers and counterparties to lawful transactions | For legal advice, audit, security, dispute resolution, insurance or legitimate corporate transactions, as applicable. |
Where a third party Processes Personal Data on our behalf, we require that third party to Process Personal Data only on our documented instructions and to implement appropriate confidentiality, security and data protection safeguards. Certain third parties may Process Personal Data as independent controllers, in which case their Processing is subject to their own data protection obligations.
Where we sell, transfer, restructure or merge any part of our business or assets, Personal Data relevant to that transaction may be disclosed to the relevant third party, subject to appropriate safeguards. The new owner or successor may use the Personal Data in the same way as described in this Privacy Policy, unless you are informed otherwise.
We may disclose Personal Data where this is required by law, court order, regulatory requirement or the instructions of a competent public authority, and where this is necessary in connection with legal proceedings or the establishment, exercise or defence of legal claims.
11. How you can control your personal data
You may request correction or raise a query using the contact details in section 15. Where information was submitted by an applicant, we may need to verify the amendment with that applicant or through independent documentary evidence, particularly for statutory due diligence records. Rights are exercised directly against Payfuture as controller, although some information may be subject to lawful restrictions.
12. Information you choose not to provide
Some information is mandatory under applicable AML/CFT, financial-services, sanctions or other legal requirements. Without it, Payfuture may be unable to complete due diligence, evaluate an application, establish or maintain a business relationship or grant Portal access. Other fields may be required for operational purposes. The Portal should distinguish mandatory information from optional information and explain applicable consequences.
13. How you can access your personal data
You can ask us for details of the Personal Data we hold about you and for a copy of that Personal Data, where such data is held by Payfuture as controller and the right of access applies under Data Protection Legislation. This is known as a subject access request.
Subject access requests should be sent to the email or postal address set out in section 15. We ask that requests are submitted in writing, where possible, as this assists us in verifying and processing the request.
There is normally no charge for a subject access request. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request in accordance with Data Protection Legislation.
We respond to subject access requests without undue delay and in any event within one month of receipt of the request. Where a request is complex or where we receive a number of requests, this period may be extended by up to two further months in accordance with Data Protection Legislation. We will inform you of any extension and the reasons for it.
14. Is there any automated-decision making or profiling?
As part of our onboarding and due diligence procedures, we may use automated tools and systems to assist us in identifying, verifying and assessing prospective and existing business clients and individuals associated with them. These tools may include identity verification systems, sanctions and politically exposed person (PEP) screening, adverse media checks and other risk-assessment mechanisms.
Such tools may automatically process Personal Data to identify potential matches, inconsistencies, risk indicators or other matters requiring further assessment. Depending on the nature of the assessment, certain activities may constitute profiling within the meaning of Article 4(4) GDPR.
However, we do not rely on solely automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. While automated tools may generate results, alerts or recommendations, these are subject to human review, and decisions concerning the acceptance, rejection or continuation of a business relationship are made by appropriately authorised personnel.
Our personnel are responsible for assessing the relevant information, considering any system-generated results or recommendations and making the final decision in accordance with our applicable legal, regulatory and internal compliance requirements.
15. How to contact us
For enquiries about this Policy, requests to exercise data protection rights or requests for additional information about relevant safeguards, please contact:
We normally respond to access requests within one month, subject to lawful extensions, verification of identity and any applicable statutory limitations.
| Contact | Details |
|---|---|
| Controller | Payfuture FS MT Ltd. |
| Privacy / DPO email | Karl Sammut, karl.sammut@payfuture.net |
| Registered / postal address | Quad Central Business District, Q2, Level 1, Triq L-Esportaturi, Malta |
16. Complaints
You may lodge a complaint with an EU supervisory authority, including the supervisory authority of the Member State of your habitual residence, place of work or alleged infringement. In Malta, the competent supervisory authority is the Information and Data Protection Commissioner (IDPC), https://idpc.org.mt/. We welcome the opportunity to address any concern directly before a complaint is made.
| Contact method | Details |
|---|---|
| Address | Information and Data Protection Commissioner, Floor 2, Airways House, High Street, Sliema, SLM 1549, Malta |
| Telephone | (+356) 2328 7100 |
| idpc.info@idpc.org.mt |
17. Making this privacy policy available to relevant individuals
Where a business client or applicant (the “Applicant”) provides Payfuture with Personal Data relating to any Relevant Individual, the Applicant shall ensure that this Privacy Policy is provided or otherwise made readily available to that Relevant Individual on Payfuture’s behalf.
The Applicant represents and warrants that it is entitled to disclose such Personal Data to Payfuture for the purposes contemplated by the onboarding and due diligence process and that the Relevant Individual has been appropriately informed of such disclosure and of the Processing described in this Privacy Policy.
Where any consent, authorisation or other approval from a Relevant Individual is required under applicable Data Protection Legislation for the disclosure or Processing of their Personal Data, the Applicant shall be responsible for obtaining and maintaining such consent, authorisation or approval before providing the Personal Data to Payfuture.
The Applicant shall provide this Privacy Policy to the Relevant Individual:
(a) where the Personal Data is collected from that person for the purpose of being provided to Payfuture, at or before the time of collection; or
(b) where the Personal Data has not been obtained directly from that person, as soon as reasonably practicable and, in any event, within the period required under applicable Data Protection Legislation.
The Applicant shall also ensure that any updated version of this Privacy Policy notified to it by Payfuture is made available to the Relevant Individuals where required.
Payfuture shall be entitled to rely on the Applicant’s compliance with the obligations set out above unless Payfuture has reason to believe otherwise. The Applicant shall, upon reasonable request, provide Payfuture with information reasonably necessary to demonstrate compliance with such obligations.
18. Changes to this privacy policy
We may amend this Policy when the Portal, service providers, legal requirements or our processing activities change. The latest version will be made available through an appropriate channel, and material changes will be brought to relevant individuals’ attention where required.