References to “you” or “your” mean the individual whose personal data is being processed. Depending on the context, this may include a website visitor, representative of a Customer, prospective Customer, business contact, partner, supplier, developer, authorised user, person making or attempting to make a payment, or another individual who interacts with Wetapo.
References to “Customer” mean a business, company, organisation or other legal entity that uses, integrates with, evaluates or otherwise enters into a business relationship concerning Wetapo services.
References to “End User” mean an individual who interacts with a payment journey or another customer-facing functionality made available through or in connection with Wetapo.
Where a Wetapo service involves independent banks, regulated payment service providers or other organisations, those organisations may process personal data for their own purposes and under their own legal responsibilities.
This Privacy Policy should therefore be read together with any additional privacy information presented within the relevant payment journey or by another organisation participating in that journey.
1. Scope of this Privacy Policy
Wetapo is a European payment technology business focused on Pay by Bank, Open Banking payments and related payment functionality for businesses.
Wetapo technology may be used by merchants, payment service providers, fintech companies and other businesses seeking to incorporate modern bank payment functionality into websites, applications, payment environments or other digital products.
The nature of our business means that personal data may arise in several different contexts.
We may process personal data relating to:
- representatives, directors, employees and authorised users of Customers;
- prospective Customers and other business contacts;
- individuals making or attempting to make payments;
- developers and technical personnel integrating with Wetapo;
- representatives of business partners, suppliers and service providers;
- visitors to Wetapo websites;
- individuals submitting enquiries or complaints;
- and other persons who interact with Wetapo in a professional or payment-related context.
The precise categories of personal data processed, the purposes for which they are processed and Wetapo's role under applicable data protection law may depend on the particular service and relationship involved.
Under the GDPR, a controller is generally the person or organisation that determines the purposes and means of processing personal data, while a processor processes personal data on behalf of a controller.
Wetapo may act as a controller for certain processing activities, for example where we determine how personal data relating to our own website visitors, prospective Customers, business contacts or security operations is used.
In other circumstances, Wetapo may process personal data on behalf of another organisation, depending on the contractual and technical structure of the relevant service.
Where necessary, the respective responsibilities of the parties may be described further in contractual arrangements or other applicable privacy information.
2. What is personal data?
Personal data means information relating to an identified or identifiable natural person.
An individual may be identified directly, for example through a name or contact information, or indirectly through an identifier, transaction information, online identifier or other information that can reasonably be linked to them. This follows the definition used in Article 4 GDPR.
Not all information handled by Wetapo necessarily constitutes personal data.
Information that has been anonymised in such a manner that an individual is no longer identifiable may be used for statistical, analytical, security, operational or service-development purposes where permitted by law.
Pseudonymised information may still constitute personal data where an individual can be re-identified using additional information.
3. Personal data we may collect
The personal data we process depends on how you interact with Wetapo.
We do not necessarily collect every category described below in every situation.
Identity and contact information
We may collect:
- first name and last name;
- business email address;
- telephone number;
- company name;
- job title or professional position;
- country;
- business address;
- and other information provided when contacting or communicating with Wetapo.
Such information may be collected when you submit an enquiry, represent a Customer, participate in onboarding, communicate with our team or otherwise enter into a business relationship with Wetapo.
Business and professional information
Where you act on behalf of an organisation, we may process information concerning your relationship with that organisation.
This may include:
- employer or company name;
- professional role;
- authority to represent or act for the organisation;
- business contact details;
- information concerning the organisation's activities;
- information relating to proposed use of Wetapo;
- and records of communications relating to the commercial relationship.
Information relating exclusively to a legal entity may not itself constitute personal data. However, where such information identifies or relates to a natural person, it may fall within the scope of applicable data protection law.
Onboarding and due diligence information
Where reasonably necessary to establish or manage a business relationship, Wetapo may collect information relating to individuals connected with a Customer.
Depending on the circumstances, this may include:
- directors;
- authorised representatives;
- shareholders;
- beneficial owners;
- professional contact details;
- identity or verification information;
- information regarding authority to act;
- and other information reasonably required for onboarding, risk management, compliance or fraud-prevention purposes.
Additional information may be requested where necessary under applicable law, contractual requirements or the requirements of relevant regulated service providers.
Payment and transaction information
Where an End User interacts with a payment journey involving Wetapo, we may process information relating to that payment.
Depending on the payment flow, this may include:
- transaction amount;
- currency;
- payment reference;
- transaction identifiers;
- merchant or beneficiary information;
- date and time;
- payment status;
- selected bank or financial institution;
- technical information concerning the payment journey;
- and related information necessary to support the payment process.
Wetapo does not necessarily receive or store all information held by an End User's bank or another payment service provider.
The information available to Wetapo depends on the service, technical architecture and parties involved.
Bank-related information
Where relevant to an Open Banking or Pay by Bank journey, Wetapo may process information identifying the bank or financial institution selected by an End User.
Relevant payment information may also be received from banks, regulated payment service providers or other financial infrastructure providers.
Wetapo does not require End Users to provide their online banking password directly to Wetapo as part of a standard Pay by Bank authentication flow.
Authentication is generally carried out through the environment or mechanism provided or supported by the relevant bank or authorised payment service provider.
Technical and device information
When individuals interact with Wetapo websites or services, certain technical information may be collected automatically.
This may include:
- IP address;
- browser type and version;
- device type;
- operating system;
- session identifiers;
- approximate location derived from technical data;
- language settings;
- date and time of access;
- pages or functions accessed;
- log information;
- error information;
- security-related events;
- and other information necessary to operate, protect and troubleshoot our systems.
Website usage information
Wetapo may collect information concerning how visitors interact with our website.
This may include:
- pages viewed;
- navigation patterns;
- referring pages;
- time spent on particular sections;
- interaction with forms;
- and other website usage information.
Where cookies or similar technologies are used, further information will be made available in our Cookie Policy.
Communications
If you communicate with Wetapo, we may process and retain information relating to that communication.
This may include:
- email correspondence;
- contact form submissions;
- support enquiries;
- sales communications;
- partnership enquiries;
- complaint correspondence;
- technical enquiries;
- and other communications with our team.
We may retain relevant correspondence where reasonably necessary for customer service, legal, contractual, compliance, security or dispute-resolution purposes.
4. How we obtain personal data
Personal data may be obtained from several sources.
Directly from you
We may receive information when you:
- contact Wetapo;
- submit a website form;
- represent a prospective or existing Customer;
- participate in onboarding;
- use Wetapo functionality;
- interact with a payment journey;
- submit a complaint;
- or otherwise provide information to us.
From our Customers
A Customer may provide personal data relating to its employees, representatives, authorised users, customers or other relevant individuals where this is necessary to use Wetapo services.
Customers remain responsible for ensuring that personal data supplied by them is collected, processed and disclosed lawfully.
From banks and payment service providers
Where relevant to a payment journey, Wetapo may receive payment-related information from banks, regulated payment service providers or other parties involved in the financial infrastructure supporting the payment.
From service providers and business partners
Wetapo may receive information from organisations supporting our operations, including providers involved in areas such as security, technical infrastructure, communications, verification or fraud prevention.
From publicly available sources
Where reasonably necessary for onboarding, fraud prevention, compliance or business verification, Wetapo may obtain information from publicly available sources.
These may include corporate registers, regulatory registers, company websites and other legitimate public sources.
5. Purposes for which we process personal data
Wetapo processes personal data only where there is a legitimate and lawful reason to do so.
The purposes may include the following.
Providing and operating services
We may process personal data where necessary to provide, administer and support Wetapo services.
This can include:
- supporting payment journeys;
- managing technical integrations;
- maintaining Customer relationships;
- providing payment status information;
- operating accounts or interfaces;
- and communicating about the Services.
Supporting payment journeys
Personal data may be processed where necessary to support Pay by Bank or Open Banking payment functionality.
This may include:
- identifying a payment;
- transmitting payment-related information between relevant systems;
- directing an End User to the appropriate payment environment;
- receiving payment status information;
- and enabling the Customer to understand the progress of a payment.
Managing Customers and business relationships
We may process personal data for:
- evaluating business enquiries;
- onboarding Customers;
- negotiating commercial arrangements;
- communicating with Customer representatives;
- providing customer support;
- managing billing and administration;
- maintaining business records;
- and managing ongoing commercial relationships.
Compliance and risk management
Wetapo may process personal data where reasonably necessary to comply with applicable legal requirements or manage fraud, financial crime, security, operational or regulatory risks.
This may include:
- verifying information;
- reviewing business activity;
- conducting due diligence;
- investigating unusual activity;
- responding to lawful requests;
- and maintaining records required for legal or regulatory purposes.
Fraud prevention and security
Wetapo may process personal data to protect our systems, Customers, End Users and other relevant parties against fraud, unauthorised access, misuse and cyber threats.
This may include analysing technical and transactional information in order to detect:
- suspicious activity;
- unusual payment patterns;
- unauthorised access;
- compromised credentials;
- malicious activity;
- and other security events.
Maintaining and improving services
We may process information to:
- diagnose technical issues;
- monitor system performance;
- understand usage patterns;
- improve user experience;
- improve security;
- develop new functionality;
- and maintain the reliability of our services.
Where appropriate, information used for analytics or development may be aggregated, anonymised or otherwise minimised.
Communications and customer support
We process contact information and correspondence in order to:
- respond to enquiries;
- provide support;
- investigate technical issues;
- manage complaints;
- communicate operational information;
- and maintain Customer relationships.
Business development
Wetapo may process professional contact information in connection with legitimate B2B business development.
This may include:
- responding to commercial enquiries;
- discussing products and services;
- exploring potential partnerships;
- maintaining professional relationships;
- and communicating information relevant to existing or prospective business contacts.
Legal rights
Personal data may be processed where necessary to establish, exercise or defend legal claims, resolve disputes, enforce agreements or protect Wetapo and other relevant parties.
6. Legal bases for processing
Where the GDPR applies, Wetapo will rely on an appropriate legal basis for processing.
The legal basis will depend on the particular circumstances.
Performance of a contract
Personal data may be processed where necessary for the performance of a contract with an individual or in order to take steps at the individual's request before entering into a contract.
In many B2B relationships, however, the contract will be between Wetapo and a company rather than between Wetapo and an individual employee or representative.
Legitimate interests
Wetapo may process personal data where necessary for our legitimate interests or those of another party, provided those interests are not overridden by the rights and freedoms of the individual.
Legitimate interests may include:
- operating and developing our business;
- managing professional relationships;
- ensuring information and network security;
- preventing fraud;
- protecting payment infrastructure;
- improving services;
- maintaining records;
- and establishing or defending legal claims.
Where we rely on legitimate interests, we consider the relevant purpose, necessity of the processing and potential impact on affected individuals.
Compliance with legal obligations
We may process personal data where necessary to comply with applicable legal or regulatory obligations.
Such obligations may relate to areas including:
- financial services;
- fraud prevention;
- sanctions;
- accounting;
- taxation;
- security;
- record keeping;
- and lawful requests from competent authorities.
Consent
Where required, Wetapo may process personal data on the basis of consent.
Consent may be relevant, for example, to certain non-essential cookies or specific marketing activities.
Where processing is based on consent, consent may be withdrawn at any time.
Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.
Other lawful grounds
In limited circumstances, Wetapo may process personal data on another legal basis available under applicable data protection law.
7. Personal data in payment journeys
A modern bank payment journey may involve several different organisations.
Depending on the payment flow, these may include:
- the Customer;
- the End User;
- Wetapo;
- a regulated payment service provider;
- the End User's bank;
- the receiving bank;
- and technical or financial infrastructure providers.
These organisations may process different categories of personal data for different purposes.
Wetapo may process information necessary to support the payment journey, identify the relevant transaction, enable systems to communicate and provide payment-related status information.
Banks and regulated payment service providers may process personal data independently where necessary to provide their own services, authenticate customers, execute payments, prevent fraud or comply with legal obligations.
Where another organisation independently determines the purposes and means of its processing, that organisation will normally be responsible for providing its own privacy information.
Wetapo is not responsible for the independent privacy practices of third-party banks or other organisations acting as separate controllers.
8. Disclosure of personal data
Wetapo does not sell personal data.
We may disclose personal data where reasonably necessary to provide services, operate our business, comply with law, protect our systems or manage legitimate business relationships.
Potential recipients may include the following categories.
Customers
Where an End User interacts with a payment journey connected with a Customer, relevant payment information may be made available to that Customer.
The Customer may use that information for purposes such as managing an order, transaction, invoice or its relationship with the End User.
Banks and regulated payment service providers
Relevant information may be disclosed to banks, payment service providers or other financial institutions where necessary for:
- payment initiation;
- payment execution;
- authentication;
- payment status processing;
- fraud prevention;
- compliance;
- and payment-related investigations.
Technology and operational service providers
Wetapo may use external providers supporting our operations.
These may include providers of:
- cloud infrastructure;
- communications;
- technical monitoring;
- information security;
- fraud prevention;
- verification;
- customer support;
- data storage;
- analytics;
- and other technology services.
Where a service provider processes personal data on behalf of Wetapo, appropriate contractual and data protection arrangements will be implemented where required.
Professional advisers
Information may be disclosed to lawyers, auditors, accountants, insurers, consultants and other professional advisers where reasonably necessary.
Public authorities
Wetapo may disclose personal data to courts, regulators, supervisory authorities, law enforcement agencies, tax authorities or other competent public bodies where disclosure is required or legally permitted.
Corporate transactions
Information may be disclosed in connection with a potential or completed:
- merger;
- acquisition;
- financing;
- restructuring;
- transfer of assets;
- investment;
- or similar corporate transaction.
Appropriate confidentiality or data protection safeguards will be applied where appropriate.
9. International transfers
Wetapo intends to operate within the European market, although some service providers or recipients may be located outside the European Economic Area.
Where personal data is transferred outside the EEA, we will take steps required by applicable data protection law to ensure an appropriate level of protection.
Depending on the circumstances, this may include reliance on:
- an adequacy decision;
- Standard Contractual Clauses;
- additional technical or organisational safeguards;
- or another legally recognised transfer mechanism.
The transfer mechanism used will depend on the destination, recipient and nature of the processing.
10. Data retention
Wetapo will retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required or permitted by applicable law.
We do not apply one universal retention period to every category of personal data.
Relevant factors may include:
- the nature of the information;
- the duration of the Customer relationship;
- legal and regulatory retention requirements;
- contractual obligations;
- accounting and taxation requirements;
- fraud-prevention needs;
- security requirements;
- complaint handling;
- limitation periods for legal claims;
- and whether information is required in connection with an ongoing dispute or investigation.
For example, an unsuccessful general business enquiry may reasonably require a shorter retention period than information associated with an established commercial relationship or a payment transaction.
Where personal data is no longer required, Wetapo will take appropriate steps to delete, anonymise or restrict it in accordance with applicable legal and technical requirements.
11. Security and confidentiality
Wetapo takes the protection of personal data seriously.
We intend to maintain technical and organisational measures appropriate to the nature of the data and the risks associated with its processing.
Depending on the relevant systems and information, measures may include:
- access controls;
- authentication;
- encryption and secure communication;
- logging and monitoring;
- infrastructure protection;
- vulnerability management;
- internal restrictions on access;
- backup and recovery arrangements;
- incident response procedures;
- secure development practices;
- and assessment of relevant service providers.
Access to personal data should be limited to persons who reasonably require access for legitimate professional purposes.
Personnel and relevant service providers may be subject to confidentiality obligations.
No online or electronic system can be guaranteed to be entirely free from security risk.
Customers and users should therefore also take appropriate measures to protect their own credentials, devices, applications and systems.
Further information about Wetapo's security approach is available on our Security page.
12. Automated processing and fraud-prevention tools
Wetapo or other organisations involved in providing payment functionality may use automated systems to support fraud prevention, security, risk assessment and operational monitoring.
Automated tools may analyse relevant technical, transactional or behavioural information to identify unusual patterns or circumstances that may require additional review.
The use of automation does not necessarily mean that a legally significant decision about an individual is made solely by automated means.
Where Wetapo carries out solely automated decision-making that produces legal effects or similarly significantly affects an individual, and where the GDPR grants additional rights in relation to that decision, Wetapo will provide the information and safeguards required by applicable law.
13. Your rights
Depending on applicable law and the circumstances of the processing, you may have rights concerning your personal data.
These rights are not absolute and may be subject to conditions, restrictions or exemptions provided by law.
Right of access
You may have the right to obtain confirmation as to whether Wetapo processes your personal data and to receive access to relevant personal data together with information about the processing.
Right to rectification
You may request correction of inaccurate personal data and completion of incomplete information.
Right to erasure
In certain circumstances, you may request deletion of personal data.
The right to erasure does not automatically require deletion of all information.
Wetapo may continue to retain information where necessary to comply with a legal obligation, protect against fraud, maintain required records or establish, exercise or defend legal claims.
Right to restriction of processing
In certain circumstances, you may ask Wetapo to restrict the way your personal data is processed.
Right to object
Where processing is based on legitimate interests, you may have the right to object based on your particular circumstances.
Wetapo may continue processing where permitted by law, including where there are compelling legitimate grounds or where processing is necessary for legal claims.
You may object at any time to processing of personal data for direct marketing purposes.
Right to data portability
Where the applicable legal requirements are met, you may have the right to receive certain personal data in a structured, commonly used and machine-readable format.
Right to withdraw consent
Where processing is based on consent, you may withdraw consent at any time.
Rights concerning automated decision-making
Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
14. Exercising your rights
Requests concerning personal data may be submitted to:
info@wetapo.com
To protect personal data against unauthorised disclosure, Wetapo may request information reasonably necessary to confirm your identity or authority to make a request.
We may also ask for additional details where necessary to identify the information concerned or understand the scope of a request.
Wetapo will respond within the timeframe required by applicable law.
Under the GDPR, the ordinary response period for data subject requests is generally one month, subject to permitted extensions in appropriate cases.
Where a request is manifestly unfounded or excessive, applicable law may permit the request to be restricted, refused or subject to a reasonable fee.
Where a request cannot be fulfilled, Wetapo will provide an explanation where required by law.
15. Where your relationship is primarily with a Wetapo Customer
If you interact with Wetapo because you make or attempt to make a payment to a business using Wetapo functionality, the relevant Customer may separately process personal data concerning its own commercial relationship with you.
For example, the Customer may independently hold information concerning:
- an order;
- invoice;
- product or service purchased;
- delivery;
- refund;
- account;
- or customer support history.
Wetapo may not receive or have access to all information held by the Customer.
Accordingly, where your request relates primarily to the underlying purchase or commercial relationship rather than the Wetapo payment functionality, the relevant Customer may be the appropriate organisation to contact.
Where appropriate and legally required, Wetapo may cooperate with the relevant Customer or another organisation to facilitate the handling of a valid privacy request.
16. Persons under 18 years of age
Wetapo services are primarily designed for businesses and for payment environments operated by our Customers.
Wetapo does not intentionally offer its B2B services directly to persons under 18 years of age.
Where a person under 18 interacts with a payment journey, such interaction may depend on the rules and eligibility requirements of the relevant Customer, bank, payment service provider and applicable law.
Wetapo does not intentionally seek to collect personal data from persons under 18 except where such processing is lawful, necessary and connected with a legitimate payment, legal or business process.
If we become aware that personal data relating to a person under 18 has been collected in circumstances where it should not have been collected, we will review the matter and take appropriate steps, which may include deletion or restriction of the relevant information where required.
For clarity, the age threshold used in this section is Wetapo's service-positioning rule and should not be interpreted as replacing the specific age rules applicable to consent under data protection law. GDPR rules concerning a child's consent to certain information-society services use a separate framework under Article 8, under which Member States may provide for an age between 13 and 16.
17. Marketing communications
Wetapo may send business-related marketing communications where permitted by applicable law.
Such communications may include information regarding:
- Wetapo services;
- product developments;
- payment technology;
- relevant industry topics;
- events;
- and other information that may be of professional interest.
Where required, marketing communications will be sent only with appropriate consent.
Recipients may opt out of direct marketing communications at any time.
Opting out of marketing does not prevent Wetapo from sending communications that are necessary for contractual, operational, service, security or legal purposes.
18. Cookies and similar technologies
The Wetapo website may use cookies and similar technologies to operate correctly, protect the website, remember preferences, understand website usage and support other functionality.
Certain cookies may be strictly necessary for the operation of the website.
Other cookies or technologies may require consent before being activated.
Where consent is required, appropriate mechanisms will be provided so that users can make or change their choices.
Further information will be provided in our Cookie Policy.
19. Third-party websites and external environments
Wetapo services may include links or redirects to websites, applications or interfaces operated by independent third parties.
These may include:
- banking environments;
- Customer websites;
- payment service providers;
- and other technology or financial services.
Wetapo does not control the privacy practices of independent third parties.
Where you enter a third-party environment, that organisation's privacy notice and other terms may apply.
Users should review relevant privacy information provided by those organisations where appropriate.
20. Business contacts, partners and suppliers
Wetapo may process personal data relating to employees, representatives and other contacts of:
- business partners;
- suppliers;
- professional advisers;
- technology providers;
- financial institutions;
- and other organisations with which Wetapo has or considers establishing a business relationship.
Such information may be processed for purposes including:
- communicating about the relationship;
- negotiating and managing agreements;
- coordinating operational or technical matters;
- carrying out due diligence;
- exploring commercial opportunities;
- maintaining business records;
- and protecting legitimate business interests.
Relevant information may continue to be retained after the relationship ends where reasonably necessary for legal, contractual, record-keeping or legitimate business purposes.
21. Complaints, disputes and investigations
If you submit a complaint, privacy concern, security report or other formal enquiry, Wetapo may process the personal data contained in the submission and information necessary to investigate the matter.
This may include:
- identity information;
- contact information;
- payment information;
- transaction references;
- correspondence;
- technical information;
- and information obtained during the investigation.
Where a matter concerns a payment service or transaction involving another regulated service provider, bank or Customer, relevant information may be disclosed to that organisation where necessary and lawful to investigate or resolve the matter.
Wetapo may retain complaint and dispute records where necessary to comply with legal requirements, demonstrate how the matter was handled or establish, exercise or defend legal rights.
22. Legal and regulatory disclosures
Wetapo may process, retain or disclose personal data where required by applicable law or a legally binding request.
This may include disclosures to:
- courts;
- regulators;
- data protection supervisory authorities;
- law enforcement agencies;
- tax authorities;
- financial intelligence authorities;
- or other competent public bodies.
Where legally permitted, Wetapo will seek to ensure that disclosures are proportionate and limited to information reasonably necessary for the relevant purpose.
There may be circumstances where Wetapo is prohibited from informing an individual about a disclosure.
23. Changes to this Privacy Policy
Wetapo may update this Privacy Policy from time to time.
Changes may be made to reflect:
- changes in applicable law;
- regulatory developments;
- new or modified services;
- changes to our technical infrastructure;
- changes in our business relationships;
- security improvements;
- or changes in how personal data is processed.
The latest version will be published through the Wetapo website.
The date shown at the beginning of this Privacy Policy indicates when it was most recently updated.
Where required by applicable law, additional notice will be provided in relation to material changes.
24. Contact Wetapo
If you have questions about this Privacy Policy, how Wetapo processes personal data or wish to exercise a data protection right, please contact:
Additional corporate information concerning the Wetapo entity responsible for relevant processing activities will be included where applicable.
25. Right to lodge a complaint
If you believe that personal data relating to you has been processed in breach of applicable data protection law, you may have the right to lodge a complaint with a competent supervisory authority.
Where Wetapo's relevant establishment and data controller are located in Latvia, the relevant Latvian supervisory authority is the Data State Inspectorate (Datu valsts inspekcija), which acts as Latvia's supervisory authority for personal data processing under the GDPR.
You may also be entitled to approach another competent supervisory authority depending on your place of residence, place of work or the circumstances of the alleged infringement.
We encourage individuals to contact Wetapo first where appropriate so that we have an opportunity to understand and address the issue.
Doing so does not limit your right to lodge a complaint with a supervisory authority or pursue another remedy available under applicable law.
Effective date
This Privacy Policy is effective from the date stated at the beginning of the document and remains in effect until replaced or amended by a later version.