Privacy Policy

Privacy Policy – VeePay Technical Infrastructure

1. Scope and Roles

This Privacy Policy applies to merchants and their authorized users who register for and operate a VeePay account, to individuals who make payments using VeePay-powered payment experiences and to visitors to our websites and dashboards. In some situations VeePay acts as a data controller, for example when we determine the purposes and means of processing in the context of merchant onboarding, risk management or our own analytics. In other situations we act as a data processor, for example when we process payment data strictly on behalf of merchants in connection with their customer transactions. Merchants and platforms remain responsible for their own privacy notices and for complying with applicable data protection laws in their capacity as controllers.

2. Personal Data We Collect

We collect personal and financial information necessary to deliver our financial infrastructure and meet statutory obligations:

• Merchant Profile & KYB Verification: Legal company name, commercial registration certificate, tax identification, government-issued IDs/passports of directors and beneficial owners, verified phone numbers, and official corporate email.
• Settlement & Banking Information: Commercial bank account numbers, IBANs, and merchant wallet addresses designated for automated financial payouts.
• Transaction & Payment Processing Data: Transaction amounts (IQD/USD), timestamp, merchant reference, selected payment rails (First Iraqi Bank (FIB), FastPay, ZainCash, Super Qi, Visa/Mastercard), and encrypted token identifiers.
• Third-Party Authentication (OAuth / SSO): When authenticating via Google OAuth or SSO, we receive verified email addresses and basic profile tokens strictly for account access verification.
• Technical & Telemetry Data: IP addresses, browser client user-agents, operating system identifiers, API request logs, and cryptographically signed HMAC transmission headers.

3. How We Use Personal Data

We use personal data to provide, maintain and improve our Services, to process and route payments, to transmit real-time transaction notifications via webhooks and WhatsApp alerts, to verify merchant identity and comply with Anti-Money Laundering (AML) laws and Central Bank of Iraq (CBI) directives, to monitor and prevent fraud using automated risk scoring and 3D Secure 2.0 validation, to reconcile accounting ledgers, and to provide merchant customer support.

4. How We Share and Disclose Personal Data

We do not sell personal data. We share personal data only with authorized acquiring banks, financial institutions, and digital wallet operators (such as First Iraqi Bank, FastPay, ZainCash, Super Qi, and Visa/Mastercard networks) to facilitate transaction clearing and settlement, with regulatory bodies including the Central Bank of Iraq (CBI) and judicial authorities when legally mandated, and with audited technical infrastructure service providers bound by strict confidentiality and data protection obligations.

5. Data Security and Technical Measures

We maintain administrative, technical and physical safeguards compliant with PCI-DSS Level 1 standards. All sensitive data in transit is encrypted using TLS 1.3 and data at rest is encrypted using AES-256. We never store raw Primary Account Numbers (PAN), CVV codes or banking PINs in plain text. We enforce mandatory Two-Factor Authentication (2FA) on merchant portals, role-based access limitations (RBAC), and continuous intrusion detection monitoring.

6. Data Retention and Archiving

We retain personal data for as long as necessary to fulfill the purposes outlined in this policy. Pursuant to Central Bank of Iraq (CBI) banking directives and statutory anti-money laundering requirements, financial transactions, ledger journals, and merchant KYB compliance records are retained for a mandatory statutory period of seven (7) years in an immutable, audited repository.

7. Your Rights and Choices

You have the right to request access to the personal data we hold about you, to update or correct inaccurate profile and banking information via your dashboard, to request data portability in a structured format, and to request closure of your account (subject to applicable statutory financial record-retention requirements under CBI regulations). To exercise any of these rights, please contact our compliance team.

8. Cookies and Similar Technologies

Our websites and applications use essential cookies and similar technical identifiers to enable secure authentication, maintain active sessions, prevent Cross-Site Request Forgery (CSRF), and optimize gateway response latency. We do not deploy third-party advertising tracking cookies.

9. Children's Privacy

VeePay services and payment infrastructure are intended exclusively for legally qualified businesses and individuals who are at least 18 years of age. We do not knowingly collect or solicit personal information from minors. If we learn that personal data of a minor has been collected, we will take immediate steps to delete such data.

10. International Data Transfers

Financial data is processed and stored within VeePay's secure, audited cloud infrastructure in full compliance with CBI regulatory guidelines. When international payment schemes (such as Visa and Mastercard) require cross-border token routing, data is transmitted under rigorous cryptographic safeguards and international data processing standards.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable legal and regulatory requirements. We will post the updated policy on our website with a revised effective date. If changes are material, we will provide notice to merchants via registered email or dashboard alerts.

12. Contact Information and Headquarters

If you have any questions or concerns regarding this Privacy Policy or our data handling practices, please contact us: