Privacy Policy

PayNext is developed and operated by D-WAY LTD, a company registered in Cyprus under registration number HE 409481, based in Limassol, Cyprus. References to "we", "us", and "PayNext" in this Policy mean D-WAY LTD.

How we handle personal data depends on whose data it is. This mirrors Section 5 of our Terms of Service.

PayNext as controller. We are the data controller for the personal data of your relationship with us: your account registration details (name, business name, email, country), company profile (VAT/registration numbers, address, bank details you choose to store, logo), subscription and billing records, security and audit logs, and your communications with us.

PayNext as processor. For all personal data you enter into the platform about others — your clients, invoice recipients, and employees on payslips — you are the controller and we are your processor. We store and process that data only to provide the Service to you, on your instructions, and for no other purpose. We do not access, analyze, sell, or disclose it except as needed to operate the Service or as required by law. If a data-subject request from one of your clients or employees reaches us, we redirect it to you.

Account data (email address, password hash, two-factor data); company data (business name, VAT/registration numbers, address, bank details, logo); subscription and billing records; operational logs (email send logs, admin and access logs, error diagnostics). We collect no more than the Service needs.

To provide and secure the Service, verify accounts, bill subscriptions, prevent abuse, and comply with our legal obligations. Legal bases: performance of our contract with you, our legitimate interests in securing and improving the Service, and compliance with legal obligations. We do not sell personal data, and we do not use your data or Your Content for advertising or profiling.

We rely on vetted infrastructure providers for application hosting, managed database, authentication, object storage, and outbound email delivery. Where you configure your own SMTP provider, it delivers your outbound email. Card and subscription payments are processed by licensed payment providers, who receive only what payment processing requires — we never store your full card details. No other third parties receive personal data unless required by law. A current sub-processor list is available on request, and we notify customers of material changes.

Data we control: retained while your account is active, then as described in Section 11 of the Terms — lapsed paid accounts are retained for 30 days from freezing (export available throughout), never-paid inactive accounts for 14 days after approval, after which deletion is permanent. Billing records and audit logs we are legally required to keep are retained for the statutory periods and no longer. Data we process on your behalf follows the same lifecycle, since it lives inside your account.

As our customer, you can request access to, rectification of, deletion of, or portability of the personal data we control about you, and object to certain processing — contact D-WAY LTD at info@d-way.com, or use the self-service export and deletion tools available on every plan. If you are a client or employee of one of our customers, the business you dealt with is the controller of your data — please direct your request to them; we will forward any request we receive to the relevant customer.

You also have the right to complain to a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection; in the UK, the ICO.

Data is processed in the EU/EEA and in other jurisdictions where our infrastructure providers operate, in each case under appropriate safeguards (such as adequacy decisions or standard contractual clauses).

Per-tenant isolation enforced at the database layer (row-level security), encryption in transit, two-factor authentication on sensitive access, and append-only audit logging. See the Trust page for details.

We will update the version date above when this policy changes materially and may ask you to re-accept before continuing to use the Service.