Account privacy notice

Responsibility depends on what the data is used for:

The privacy notice that applies to a service is shown before you activate it. Companies on Who provides your service are not described as one corporate group; each acts in its own capacity.

We may receive data about people we do not deal with directly: directors, beneficial owners and authorised users of a business, payees and payers of a business account, and senders of payments to you. Their data is used only to provide the service, verify the business and meet legal obligations. A business that gives us this data must make sure those people know about this policy.

Where the GDPR, UK GDPR or similar laws apply, the responsible company relies on these bases. The basis depends on the processing, not on which company does it.

Verification and screening tools produce automated results, such as a document check, an identity match or a risk flag on a transfer. If a decision about you is made solely by automated means with a legal or similarly significant effect, you can ask for human review, give your view and contest it by writing to privacy@novapayx.com. We cannot disclose details that would undermine fraud or financial-crime controls.

• Providers of your services, including banks, payment and custody providers and, in the European Economic Area, the authorised crypto-asset service provider.
• Axora Payments LLC, as technology provider.
• Service providers that help us provide the service, in these categories: identity verification and screening; blockchain analytics; digital-asset wallet infrastructure; payment-account providers; liquidity providers; and website hosting. They receive only the data they need for those services.
• Payment recipients and their banks or wallet providers, with the information a payment or transfer requires.
• Web3Forms, the form service that receives contact-form submissions and forwards them to us by email.
• Professional advisers and auditors.
• Authorities, regulators, financial intelligence units, tax authorities and courts where the law requires.

We do not sell personal data.

Data may be processed outside the country where you live, including in Canada, the European Union and the United States, where a provider or service operates. Where the law requires it, a recognised transfer mechanism, such as an adequacy decision or standard contractual clauses, is used. You can ask for information about the safeguard used for your data.

Data is kept while your account is open and afterwards for as long as needed for these reasons:

• anti-money-laundering and record-keeping laws that apply to the responsible company, which commonly require records for several years after the relationship ends;
• tax and accounting law;
• handling complaints and legal claims;
• a legal hold or a request from an authority.

Then it is deleted or anonymised. Information you asked us to delete may still be kept where one of these reasons applies.

Transactions on public blockchains are recorded permanently and can be seen by anyone. They cannot be changed or deleted, including at your request. We do not add your name or contact details to a public blockchain.

Data is protected with technical and organisational measures appropriate to the risk, and access is limited to people who need it. Providers are required to protect data under their agreements. No system is completely secure; keep your credentials safe. If a personal data breach is likely to put you at high risk, you are told as the law requires.

Depending on where you live, you can ask to access, correct or delete your data, restrict or object to its use, receive it in a portable format, and withdraw consent. Residents of Canada and some US states have rights under their local laws.

Some rights are limited by law. For example, records that must be kept to prevent financial crime cannot be deleted before the legal period ends, and the law may prevent us from telling you about a report to an authority.

To make a request, email privacy@novapayx.com. We confirm your identity, pass the request to the responsible company where needed and respond within the time the law sets. Requests about data held by the authorised crypto-asset service provider in the European Economic Area can also be made to it directly.

We send marketing only with your consent. You can withdraw it at any time with the link in each message or in the app. Messages about your account, security and transactions are part of the service.

The NovaPayx website sets one cookie only when you choose a language, and keeps your language and appearance choices in your browser's storage. It does not use analytics or advertising cookies. The app at app.novapayx.com is a separate application. See the Cookie policy.

NovaPayx is for people aged 18 and over. If we learn that a child's data was collected, we delete it unless the law requires us to keep it.

Privacy and data requests, including automated decisions: privacy@novapayx.com. Our Data Protection Officer can be contacted at dpo@novapayx.com. You can complain to the data-protection authority where you live or work, or where the issue arose.

Updates are published on this page with their effective date. We tell you about material changes by email or in the app at least 30 days before they take effect. Previous version: version 1.0 (effective from 1 July 2026).