PactPay (“PactPay“, “we“, “us“, or “our“) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website at https://www.pactpay.tech (the “Website“) or use our digital asset swap services (the “Services“).
This Privacy Policy is prepared in accordance with Law No. 81 of March 26, 2019 on the Protection of Personal Data of the Republic of Panama (the “Data Protection Law“), as regulated by Executive Decree No. 285 of May 28, 2021, and any other applicable Panamanian legislation.
By using the Website or the Services, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy should be read together with our Terms and Conditions.
The party responsible for the processing of your personal data (the “Data Controller“) is the operator of the PactPay brand, an entity indirectly owned by Ramp Capital S.A., a company incorporated under the laws of the Republic of Panama.
This Privacy Policy applies to the personal data of Website visitors, individuals who register for or use the Services, individuals who submit inquiries or support requests to us, and other individuals who interact with us. It does not apply to the practices of third parties that we do not own or control, including third-party websites, blockchain networks, wallet providers, or decentralized protocols.
We collect and process the following categories of personal data:
a) Identity and contact data. Your name, e-mail address, telephone number, date of birth, nationality, and country of residence, where you provide these to us on registration, in support communications, or as part of any verification we carry out.
b) Identity verification data. Where verification is required or requested, government-issued identification documents and images, selfie or liveness-check images, and the results of checks carried out by third-party verification and screening providers. Where this includes biometric identifiers derived from facial images, we process such data only where you have given your explicit consent or where processing is required to comply with a legal obligation, and only for the purpose of verifying your identity and preventing fraud.
c) Transaction data. Details of your Swap transactions, including source and destination digital asset types, amounts, quoted and executed rates, fees, timestamps, transaction status, blockchain transaction hashes, and the wallet addresses you submit or from which you send assets.
d) Payment data. Where you use a fiat-denominated payment method, limited payment-instrument details (for example, masked card details, bank account or IBAN details, and the name of the account holder), typically collected and held by our regulated payment-processing partners rather than by us.
e) Communications data. The content of your e-mails, support tickets, chat messages, and other correspondence with us, including any attachments, and records of our responses.
f) Technical and usage data. Your IP address, approximate location derived from IP address, browser type and version, device identifiers and characteristics, operating system, language settings, referring pages, session identifiers, pages viewed, and interaction data, collected through cookies and similar technologies (see Section 11).
Except for the identity-verification data described in Section 4(b), we do not intentionally collect sensitive personal data (such as data revealing racial or ethnic origin, health, political opinions, or religious beliefs), and we ask that you do not submit such data to us.
We collect personal data:
Directly from you, when you register, complete a form, submit a transaction, upload a document, or contact us;
Automatically, when you access the Website or Services, through cookies, server logs, and similar technologies; and
From third parties, including identity-verification and sanctions-screening providers, payment processors, blockchain analytics providers, and publicly available sources such as public blockchain records and sanctions lists.
We process personal data for the following purposes and on the following bases recognized under the Data Protection Law:
To provide the Services, including registering you, quoting and executing Swaps, processing payments, and providing transaction records — based on the performance of a contract with you, or steps taken at your request prior to entering into a contract.
To verify your identity and prevent financial crime, including sanctions screening, fraud prevention, and transaction monitoring — based on compliance with a legal obligation and our legitimate interests in preventing fraud and unlawful use of the Services, and, in respect of any biometric processing, on your explicit consent.
To respond to inquiries and provide customer support — based on the performance of a contract and our legitimate interests in responding to your request.
To comply with legal and regulatory obligations, including anti-money-laundering, counter-terrorism-financing, sanctions, tax, accounting, and record-keeping requirements, and to respond to lawful requests from competent authorities — based on compliance with a legal obligation.
To operate, secure, maintain, and improve the Website and Services, including diagnosing technical faults, analyzing usage, and protecting against unauthorized access — based on our legitimate interests.
To establish, exercise, or defend legal claims and to manage complaints and disputes — based on our legitimate interests and compliance with a legal obligation.
To send you service and marketing communications about our products and features, where permitted — based on your consent, which you may withdraw at any time.
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Withdrawing consent for processing that is necessary to provide the Services may mean we can no longer provide them to you.
We do not sell your personal data. We may share personal data with:
Service providers and processors who perform services on our behalf — including cloud hosting and infrastructure, identity verification and KYC providers, sanctions and PEP screening providers, blockchain analytics providers, payment processors and acquiring banks, liquidity providers where necessary to settle your transaction, e-mail and messaging providers, customer-support platforms, and security and fraud-prevention providers — in each case under contractual obligations to protect the data and process it only on our instructions;
Affiliates within our group, including Ramp Capital S.A. and its subsidiaries, for compliance, risk management, internal administration, and shared operational functions;
Professional advisors, such as legal, accounting, audit, and tax advisors, where necessary;
Competent authorities, regulators, law enforcement, or courts, where required to comply with a legal obligation, respond to a lawful request, prevent or detect crime, or protect our rights or the rights of others; and
Successors in the event of a merger, acquisition, reorganization, financing, or sale of assets, subject to appropriate confidentiality safeguards.
Any third party with whom we share personal data is required to maintain confidentiality and to apply security measures consistent with the Data Protection Law.
Please note: blockchain transactions are recorded on public, immutable ledgers. Wallet addresses, amounts, and transaction hashes associated with your Swaps are publicly visible and are outside our control. We cannot alter or delete information recorded on a public blockchain.
Our infrastructure and service providers operate in multiple jurisdictions, including outside the Republic of Panama. Where personal data is transferred internationally, we take reasonable steps to ensure the transfer is carried out in accordance with the Data Protection Law and that an adequate level of protection is maintained, including through contractual safeguards with the recipient requiring confidentiality, purpose limitation, and appropriate security measures.
You may request further information about the safeguards applied to international transfers by contacting us at support@pactpay.tech.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements, and to establish, exercise, or defend legal claims.
In particular:
Transaction and verification records are retained for the period required by applicable anti-money-laundering and record-keeping legislation, which is generally not less than five (5) years from the date of the transaction or the end of the customer relationship, whichever is later.
Support and communications records are retained for the period necessary to address your request and for a reasonable period thereafter.
Technical and usage data is retained for shorter periods appropriate to security monitoring and analytics purposes.
Where personal data is no longer required and no legal obligation requires its retention, we will securely delete or irreversibly anonymize it.
In accordance with the Data Protection Law, you have the right to:
Access the personal data we hold about you and obtain information about how it is processed;
Rectify inaccurate, incomplete, or outdated personal data;
Delete (cancel) your personal data where it is no longer necessary for the purposes for which it was collected or where the processing does not comply with the law;
Object or oppose the processing of your personal data in the circumstances permitted by law;
Restrict processing, or request portability of your data, where applicable; and
Withdraw consent at any time where processing is based on consent.
These rights are not absolute. We may decline a request in whole or in part where we are required or entitled by law to retain the data — for example, where anti-money-laundering legislation requires us to keep transaction and verification records for a minimum period.
To exercise any of these rights, please contact us at support@pactpay.tech. We may need to verify your identity before acting on a request. We will respond within the timeframes established by the Data Protection Law and its regulations.
If you believe your rights have not been adequately addressed, you may lodge a complaint with the National Authority for Transparency and Access to Information (ANTAI) of the Republic of Panama, the supervisory authority for personal data protection.
The Website uses cookies and similar technologies to enable core functionality (such as maintaining your session and security state), remember your preferences, and analyze traffic and usage.
Cookies are small text files stored on your device. We use:
Strictly necessary cookies, required for the Website to function and for security purposes;
Preference cookies, which remember settings such as language and display options; and
Analytics cookies, which help us understand how the Website is used so that we can improve it.
You can control or disable cookies through your browser settings; however, disabling strictly necessary cookies will affect the functionality of the Website. Where required by law, we will request your consent before placing non-essential cookies.
Certain checks we apply — including sanctions screening, fraud scoring, and transaction monitoring — may involve automated processing that can result in a transaction being delayed, declined, or flagged for manual review, or in an account being suspended. Where such a decision significantly affects you, you may request human review by contacting us at support@pactpay.tech, subject to any legal restriction that prevents us from disclosing the reason for a decision.
We implement reasonable technical, organizational, and administrative measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls and least-privilege permissioning, network segmentation, logging and monitoring, and periodic review of our security practices.
No method of transmission or storage is completely secure, and while we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data-security breach affecting your personal data, we will act in accordance with the notification requirements of the Data Protection Law.
The Website and Services are not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us at support@pactpay.tech so that we may delete it.
The Website may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.
We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The revised version will be posted on the Website with an updated “Last updated” date and will take effect upon posting. Where a change is material, we will use reasonable efforts to notify you. We encourage you to review this Privacy Policy periodically.
For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact:
PactPay — Data Protection Contact E-mail: support@pactpay.tech
