Privacy Policy

1. Introduction and Scope

1.1 This Privacy Policy explains how B7 Club, the payment orchestration and merchant services platform (“B7 Club”, “Company”, “we”, “our”, “us”), collects and processes Personal Data when you access our website, platform or use our Services.

1.2 This Policy is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Cyprus data protection legislation.

1.3 This Privacy Policy should be read together with our Terms of Use and Cookies Policy.

2. Data Controller and Contact

2.1 For the purposes of the GDPR, B7 Club is the Data Controller responsible for the processing of Personal Data described in this Policy.

2.2 Office:

2.3 Privacy contact: [email protected]

3. Definitions

3.1 “Personal Data” has the meaning given to it under Article 4(1) GDPR.

3.2 “Processing” has the meaning given to it under Article 4(2) GDPR.

3.3 “Applicable Law” means the GDPR, applicable Cyprus data protection legislation and other applicable laws governing the processing of Personal Data.

4. Personal Data We Collect

4.1 We may collect identity and contact information, including name, business details, email address, telephone number, business address and account information.

4.2 Where required for merchant onboarding, verification, compliance or risk management, we may process business registration information, director and beneficial ownership information, identification information, sanctions screening results and other relevant due diligence information.

4.3 We may collect technical and usage information, including IP address, device information, browser characteristics, log data, referring URLs and pages viewed.

4.4 We may receive information from third parties, including Payment Providers, identity verification providers, fraud prevention providers, public registers and other business or compliance partners.

4.5 When you submit the contact form on our Website, we collect your name, company name, work email address and message and, if you choose to provide them, your company website and approximate monthly card volume.

4.6 Our Website uses only strictly necessary cookies, as described in our Cookies Policy. We do not use analytics or advertising cookies.

5. Purposes and Legal Bases of Processing

5.1 We process Personal Data where necessary to provide and administer the B7 Club Services and to perform our contractual obligations.

5.2 We may process Personal Data to conduct merchant onboarding, verification, KYB/KYC checks, risk assessment and compliance monitoring where required by Applicable Law or contractual obligations.

5.3 We may process Personal Data to prevent and detect fraud, abuse, security incidents and other unlawful activity, based on our legitimate interests and/or legal obligations.

5.4 We may use Personal Data to communicate with Users regarding accounts, Services, technical matters, security notices and important service updates.

5.5 We may process Personal Data to comply with legal obligations and lawful requests from competent authorities.

5.6 We may process certain information to improve, maintain and develop our Website, Platform and Services.

5.7 Where required, marketing communications will be sent only where we have an appropriate legal basis, including consent where applicable.

5.8 We process contact form submissions to respond to your enquiry. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR). We do not add you to marketing lists because you contacted us.

6. Processing and Security

6.1 We process Personal Data using electronic and, where appropriate, physical means and apply appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, loss, alteration or disclosure.

6.2 Such measures may include access controls, encryption where appropriate, logging and monitoring, secure development practices, vendor due diligence and employee confidentiality obligations.

6.3 Access to Personal Data is limited to authorised personnel and service providers who require access for legitimate business purposes.

7. Sharing and Disclosure

7.1 Personal Data may be shared with independent Payment Providers, acquirers, processors and other financial or technology partners where necessary to provide the Services.

7.2 We may engage third-party service providers for hosting, email delivery, technology, identity verification, compliance screening, fraud prevention, customer support and other business functions.

7.3 We may disclose Personal Data to competent authorities, courts, regulators or law enforcement bodies where required by Applicable Law or necessary to protect our rights, Users or the public.

7.4 We do not sell Personal Data.

8. International Transfers

8.1 Personal Data may be processed in Cyprus, within the European Economic Area (EEA), and where necessary in other jurisdictions in which our service providers operate.

8.2 Where Personal Data is transferred outside the EEA, we will implement appropriate safeguards in accordance with Chapter V of the GDPR, where applicable.

9. Data Retention

9.1 We retain Personal Data only for as long as reasonably necessary to fulfil the purposes described in this Policy and to comply with applicable legal, regulatory, tax, accounting or contractual requirements.

9.2 Where specific retention periods are required by law or by our contractual obligations with Payment Providers, the relevant data may be retained for the applicable period.

9.3 Contact form enquiries that do not lead to a business relationship are deleted no later than twenty-four (24) months after our last communication with you.

10. Your Rights

10.1 Subject to applicable legal limitations, you may have the right to access, rectify, erase, restrict or object to the processing of your Personal Data, as well as the right to data portability.

10.2 Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

10.3 You may exercise your rights by contacting us at [email protected].

10.4 We may need to verify your identity before processing certain requests.

11. Automated Decision-Making and Profiling

11.1 B7 Club does not intend to make solely automated decisions that produce legal or similarly significant effects on individuals, except where permitted by Applicable Law and subject to appropriate safeguards.

11.2 Fraud prevention, security and risk management tools may be used to identify potentially suspicious activity and protect the Platform and its Users.

12. Children

12.1 The Services are not directed to persons under eighteen (18) years of age.

12.2 We do not knowingly collect Personal Data from children through the Services.

13. Third-Party Websites and Services

13.1 Our Website or Platform may contain links to or integrations with third-party websites and services.

13.2 Such third parties operate under their own privacy policies and terms. We are not responsible for the privacy practices of independent third parties.

14. Complaints and Supervisory Authority

14.1 You have the right to lodge a complaint with the competent data protection supervisory authority in Cyprus or, where applicable, with the supervisory authority in your country of residence or place of work.

14.2 We encourage you to contact us first so that we can attempt to resolve your concerns directly.

15. Changes to This Policy

15.1 We may update this Privacy Policy from time to time to reflect changes in our Services, processing activities, technology or Applicable Law.

15.2 Any updated version will be published on our Website together with a revised “Last updated” date.

16. Contact Us

If you have any questions regarding this Privacy Policy or our processing of Personal Data, please contact us:

Email: [email protected]