Политика за поверителност

This Privacy Policy is valid as from 10.11.2026

1. About us
2. Definitions
3. Data we collect
4. Our purposes for processing your personal data
5. Legal basis
6. Data storage
7. Your rights and how you can exercise them
8. Disclosure of information to third parties
9. Privacy Policy
10. Supervisory body

1. ABOUT US

CRIOPAY AD is a joint stock company incorporated under the laws of the Republic of Bulgaria, UIC 207839409, with its registered office at Office Park Expo 2000, bul. Nikola Vaptsarov 55, Sofia 1407, Bulgaria ("CRIOPAY", "SelfiPay", "we", "our" or "Controller").

SelfiPay enables users to authorise payment transactions using facial recognition technology, providing a secure, fast and contactless payment experience.

Use of SelfiPay's biometric payment functionality is voluntary. Users who do not wish to use biometric payment functionality may use the non-biometric payment methods available at the relevant payment terminal, including payment by card.

In order to provide our services, we process certain categories of personal data, including biometric data used solely for user authentication and transaction authorisation. We process your personal data in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and all other applicable data protection legislation.

This Privacy Policy explains:

• what personal data we collect;
• why we collect it;
• how we use it;
• the legal grounds for processing;
• how long we retain it;
• with whom it may be shared; and
• the rights available to you.

We may update this Privacy Policy from time to time to reflect legal, regulatory, technical or business developments. Where the changes materially affect the way we process your personal data, we will provide appropriate notice and, where required by applicable law, obtain any additional consent before such changes become effective.

The latest version of this Privacy Policy will always be available through SelfiPay.

2. DEFINITIONS

• „Personal Data Controller“ means CRIOPAY AD, acting as the controller of your Personal Data within the meaning of the GDPR.
• „Company“ is the Administrator of SelfiPay “CRIOPAY AD”;
• „Personal Data“ means any information, related to an identified natural person or a natural person, that could be identified („You“,„You“, „Data Subject“ or „User/s“);
• "Biometric Data" means personal data resulting from specific technical processing relating to your physical characteristics, used for the purpose of uniquely verifying your identity.
• "Biometric Template" means the encrypted mathematical representation of your facial characteristics generated from your facial scan and used solely for authentication within the SelfiPay service.
• „Processing“ means any operation or set of operations which is performed on Personal Data or on sets of Personal Data;
• „Personal Data Processor” means any natural person or legal entity, public authority, agency or any other structure that isprocessing Personal Data on behalf of the Controller;
• „Recipient“ means any natural person or legal entity , public authority, agency or any other structure, to which the personal dataare disclosed, whether a third party or not;
• „Personal data breach“ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorizeddisclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
• "Authentication" means the process of verifying your identity through the biometric authentication functionality provided by SelfiPay for the purpose of authorising payment transactions.
• “Account Information” means information relating to your account.

3. DATA WE COLLECT

We collect only the Personal Data that is necessary to provide the SelfiPay services, comply with our legal obligations, maintain the security of the platform and improve the reliability of the authentication process.

Depending on how you use the Services, we may collect the following categories of Personal Data:

Identity Data

• Full name;
• Username;
• Other identification information provided during registration, where applicable.

Contact Data

• E-mail address;
• Contact phone number;
• Address.

Account Data

• Account credentials, including your password (stored in a secure, encrypted form);
• Account preferences and settings.

Biometric Data

To enable biometric payment authentication, you complete a facial scan during enrolment. The facial scan is used to generate an encrypted biometric template representing your facial characteristics. When a payment card is subsequently added to your SelfiPay account, it is associated with your SelfiPay profile.

The biometric template is used to authenticate you when you subsequently authorise payments using SelfiPay.

Following successful biometric authentication, the biometric template may be updated using information derived from the successful authentication event in order to maintain and improve the accuracy and reliability of biometric matching over time.

Biometric data is processed only for biometric enrolment, payment authentication, security and fraud-prevention purposes. It is not used for marketing purposes or behavioural profiling.

Transaction-Related Information

Payment services are provided separately by the relevant payment service provider. Where payment card details are required, they are provided directly to and processed by the relevant payment service provider.

CRIOPAY does not collect, receive or store your payment card details. The relevant payment service provider processes such information in accordance with its own privacy notice and applicable payment services and data protection requirements.

Communications

We collect information that you voluntarily provide when:

• contacting our customer support;
• submitting enquiries;
• completing contact forms;
• otherwise communicating with us.

Other Information

We may also process any additional information that you voluntarily choose to provide to us in connection with your use of the Services.

4. PURPOSES FOR PROCESSING YOUR PERSONAL DATA

We process Personal Data only where necessary for specified, explicit and legitimate purposes. Depending on the category of Personal Data involved, we may process your information for the following purposes:

5. LEGAL BASIS

In order to process your personal data, we must have legal basis, which may differ depending on the purpose for which they are collected. Our legal basis could be based on the execution and performance of a contract, in order to comply with the legal requirements or to protectour legitimate interest. Additionally, for some of the services, you provide the information yourself and give your consent to its processing.

• Processing of the data, necessary for the conclusion and the performance of contracts in order to execute obligations fromconcluded contracts for providing the Services; Providing comprehensive services and administration;
• Processing of the data that we need in order to comply with legal obligation;
• Processing of data based on Your consent - direct marketing, Biometric payment enrolment/authentication/template updating;
• Processing of data in order to protect our legitimate interest to ensure that we can provide our Services to you.

Where your Personal Data is processed on the basis of your consent, you have the right to withdraw your consent at any time and such withdrawal will not affect the lawfulness of the processing carried out prior to such withdrawal.

In order to support some of our contractual activities or where it is necessary to comply with some legal obligation, SelfiPay engages third parties. Your Personal Data is not disclosed to third parties until we are assured that all technical and organisational measures have been taken to protect that Personal Data.

6. DATA STORAGE

Since your data and its security are of the utmost importance to us, we implement all appropriate technical and organizational means at our disposal to prevent unauthorized access, unauthorized or malicious use, loss or premature deletion of information. In addition, we implement measures to protect your personal information from accidental loss, unauthorized access, use or alteration. To protect information from loss, misuse and unauthorized disclosure, we have policies and procedures that are implemented. We also take additional information security measures, including access controls, strong physical security and robust information collection, storage and processing practices.

Upon expiration of the retention period, all Personal Data and available copies will be deleted by us unless European Union or Bulgarian data protection legislation requires that the data be retained due to legal obligations, legal requirements, public investigations, investigations of possible breaches of our Terms and Conditions or to prevent damage to the Controller.

Where the processing of Personal Data is based on your consent, the Personal Data will be deleted once you have withdrawn your consent or unsubscribed from receiving the relevant information. You may withdraw your consent at any time by clicking on the "unsubscribe “button where available or by sending an email to: support@criopay.com.

7. YOUR RIGHTS AND HOW YOU CAN EXCERSICE THEM

You have the legal right to:

• To unsubscribe from receiving commercial messages;
• To have access to the personal information that we store for you, in a convenient digital form;
• To edit, add, delete and manage the information in Your profile at any time;
• To require correction of the collected Personal Data, if they are incorrect;
• To receive a copy of your Personal Data in a digital form;
• You are entitled to require deletion of your Personal Data – i.e.. „the right to be forgotten“, however, this right is not absolute(exceptions – the available Personal Data is necessary for exercising the right of free speech; there is a legal obligation to store this data; from reasons of public interest);
• To receive from us information about our actions with regard to Your Personal Data, inclusive the purpose of collection and storage, storage period, collection method, etc.;
• To receive Your data and to transfer them to another Personal Data Controller;
• To contact us in case of questions, complaints or other problems, occurred with the processing of Your Personal Data;
• You may submit a complaint to a supervisory body, in particular in the member country of your permanent residence, employment or the location of the presumable violation, if you consider that there is Personal Data breach.

Can an individual make a request on behalf of someone?

A third party may exercise these rights on your behalf (eg a relative, friend or solicitor), however a proof is required to be provided that the third party making the request is entitled to act on your behalf. For example, by providing a written authority, signed by You, stating that the third party is given permission to make such request on your behalf.

In case of questions or claiming right with regard to the Personal Data Protection you can contact us as follows:

Email: support@criopay.com

Phone: +359887661202

Every effort will be made to respond to all of your requests relating to privacy in a timely manner and within the statutory terms. If a privacy issue remains unresolved, you may contact your local data protection authority, for which you may find contact details below in section SUPERVISORY BODY.

8. DISCLOSURE OF INFORMATION TO THIRD PARTIES

Please be advised that in certain cases, SelfiPay may disclose your information, such as if we have reasonable grounds to believe that the law requires us to do so, where it is necessary to prevent and resolve fraud, unauthorized use of our services, violations of our Terms and Conditions, or other harmful illegal activities, and to protect our users.

Accordingly, your Personal Data may be shared with third party recipients in the following circumstances:

• In order to comply with a legal requirement, legal process, court order or legal process in respect of the Controller or its branches, subsidiaries, associates;
• for the purpose of investigating a possible crime such as identity theft;
• with public authorities in fulfilment of their legal obligation to carry out their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, etc;
• in connection with a reorganisation (merger, amalgamation, separation and division), sale, purchase, business transformation, dissolution, liquidation, bankruptcy of the Administrator;
• where we believe it is necessary to protect the rights, property, or safety of the Administrator or others associated with the Administrator; or
• where otherwise required or permitted by law, including any contractual obligations of the Administrator.

9. PRIVACY POLICY

We reserve the right to make changes to this Privacy Policy from time to time. Such changes shall be effective immediately upon publication. We encourage you to review this page regularly, to ensure that you are always aware of what information we collect, how and for what purposes SelfiPay uses it, and under what circumstances (if any) we will disclose it to other parties.

Where a change materially affects the way we process your Personal Data, we will provide you with appropriate notice before the change becomes effective. Where the change requires a new or additional consent under applicable data protection law, the relevant processing will not commence until such consent has been obtained.

10. SUPERVISORY BODY

The local Supervisory body on the territory of the Republic of Bulgaria in matters, regarding Personal Data, is:Commission for Personal Data Protection, Address: Sofia, 1592, No 2, Tsvetan Lazarov Blvd., Phone: +359 2 915 3580, Fax: +359 2 9153525,
e-mail: kzld@cpdp.bg, website: http://www.cpdp.bg/.