Bankify logo

Privacy policy

Last updated: 17 August 2026

Controller

EARTHPLEXO SERVICES LTD
Company number: HE 346681
Registered office: 7 Amathountos, 3105, Limassol, Cyprus
(“Earthplexo”, “the Company”, “we”, “us” or “our”)

For the avoidance of doubt, Earthplexo acts as the data controller for personal data processed in connection with the Website, enquiries and any centralised activities for which it determines the purposes and means of processing.

Where you proceed to onboarding or receive Services, the relevant Group Company may act as the data controller for personal data processed in connection with onboarding, KYC/KYB and AML/CTF checks, service provision and its own legal or regulatory obligations. The relevant controller will be identified during onboarding.

DPO contact: privacy@payperless.com

This Privacy Policy explains how we process personal data when you visit our website, submit an enquiry, or (if you become a client) use our services. We are committed to protecting your personal data and process it in accordance with applicable data protection laws, as described below.

1. Applicable law and jurisdictional framework

The Company is incorporated in the Republic of Cyprus. The laws of the Republic of Cyprus govern our general operations. However, the specific data protection law applicable to your personal data depends on your jurisdiction of residence and the circumstances of our processing:

(a) For users in the European Economic Area (EEA) and the United Kingdom:

We process your personal data in accordance with the GDPR (EU) 2016/679 and the UK GDPR, which apply extraterritorially to our processing of personal data of data subjects located in those jurisdictions. Where both apply, the stricter standard shall prevail. In Cyprus, the GDPR is implemented by Law 125(I)/2018.

(b) For users in jurisdictions with extraterritorial data protection laws:

Where you are resident in a jurisdiction whose data protection laws apply extraterritorially to our processing of your personal data, we will comply with those laws to the extent required. Such jurisdictions may include, but are not limited to:

  • Australia: Privacy Act 1988;
  • Singapore: Personal Data Protection Act 2012 (PDPA);
  • Japan: Act on the Protection of Personal Information (APPI);
  • South Korea: Personal Information Protection Act (PIPA);
  • Thailand: Personal Data Protection Act 2562 (BE 2562) (PDPA);
  • Hong Kong: Personal Data (Privacy) Ordinance (PDPO);
  • Malaysia: Personal Data Protection Act 2010 (PDPA);
  • United States: applicable state laws, including but not limited to the California Consumer Privacy Act (CCPA/CPRA), where such laws apply to our processing activities.

In each such case, we will honour the rights granted to you under your applicable local law to the extent required by that law.

(c) For users in all other jurisdictions:

If your jurisdiction of residence does not have a data protection law that applies extraterritorially to our processing of your personal data, your personal data will be processed in accordance with the laws of the Republic of Cyprus, which is our jurisdiction of incorporation; however, we voluntarily adhere to internationally recognised data protection principles as a matter of best practice.

2. What personal data we collect and why

Data categoryExamplesPurposeLegal basis (GDPR)Retention
Enquiry form dataName, company, email, phone, contact link, messageRespond to request, provide service information and pricing, begin onboardingArticle 6(1)(b) – steps at request of data subject before contract12 months after last contact (or longer if you enter into Business Terms of Service)
TechnicalIP address, browser, device, referring URL, pages visited, system logsSecurity, website improvementArticle 6(1)(f) – legitimate interest2 years (aggregated)
Client data (if onboarded)Name, contact details, business information, service preferences, billing info, ID, proof of address, UBO, transaction dataKYC/AML, provide services, invoicing, communicationLegal obligation (Article 6(1)(c) – AML laws, tax) + performance of contract (Article 6(1)(b))7 years after project completion/account closure

Special categories: We do not process biometric or health data except for liveness checks (which are not stored). Criminal offence data (sanctions, PEP) processed under Art. 6(1)(c) and Art. 10 GDPR.

3. Data sharing and international transfers

We share data with:

(a) Service providers (processors):

  • Email and communication platforms (e.g., Gmail)
  • Project management and CRM tools (e.g., Jira)
  • Hosting and cloud infrastructure providers (e.g., AWS)
  • Professional advisors (e.g., lawyers, accountants) where necessary

(b) Competent authorities: where required by law, including but not limited to Cypriot authorities (e.g., Tax Department, Police, Court), and authorities in jurisdictions where we operate or where you are located (e.g., court orders, regulatory requests).

(c) Group Companies and Affiliates (as defined in the Terms and Conditions): we may share data with our Group of Companies and/or Affiliates for internal administrative, operational, compliance purposes and for provision of services. A Group of Company or Affiliate are bound by confidentiality obligations and are required to process data in accordance with this Privacy Policy and applicable law.

All processors (where the transfer to third parties is not required by law) are bound by Data Processing Agreements that comply with the requirements of the GDPR or, where applicable, with other agreements required by applicable data protection laws. Each processor is contractually obligated to:

  • process personal data only on documented instructions from the Company;
  • implement appropriate technical and organisational security measures to protect the data;
  • ensure confidentiality of all personnel authorised to process data;
  • assist the Company in responding to data subject requests;
  • notify the Company without undue delay of any personal data breach;
  • engage sub-processors only with the Company's prior written consent;
  • delete or return all personal data upon termination of the engagement, unless required by law to retain it.

International transfers:

From EEA/UK: we rely on SCCs and the UK International Data Transfer Agreement (where applicable), together with supplementary measures (encryption, pseudonymisation).

From other jurisdictions: we will ensure that any cross-border data transfer complies with the applicable local law requirements (e.g., adequacy decisions, standard clauses, or consent).

Where required by applicable law, we will obtain your explicit consent for cross-border data transfers.

4. Your rights under GDPR (for EEA and UK users)

Under GDPR, you have the right to:

  • (a) Access (Art. 15): confirmation of processing, copy of data.
  • (b) Rectification (Art. 16): correct inaccurate data.
  • (c) Erasure (Art. 17): “right to be forgotten”, unless we have a legal obligation (e.g., tax) to retain.
  • (d) Restriction (Art. 18): pause processing while a complaint is resolved.
  • (e) Data portability (Art. 20): receive a machine-readable copy.
  • (f) Object (Art. 21): to processing based on legitimate interests.
  • (g) Withdraw consent (Art. 7(3)): at any time without detriment.
  • (h) Lodge a complaint (Art. 77): with your local supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection).

To exercise your rights, email privacy@payperless.com. We will respond within one month (extendable by two months for complex requests). No fee, unless manifestly unfounded or excessive.

5. Your rights under other data protection laws

For users in jurisdictions other than the EEA and UK, the rights available to you depend on your local law. We will honour those rights to the extent required by applicable law. These rights may include (depending on your jurisdiction):

  • Access, rectification, erasure, restriction, portability, and objection;
  • Withdrawal of consent (where processing is based on consent);
  • Lodging a complaint with your local data protection authority.

To exercise your rights, or if you have any questions about which law applies to you, please contact us at privacy@payperless.com. We will respond within the timeframe required by your applicable local law (or within 30 days if no specific timeframe is prescribed).

6. Data retention and deletion

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law. Our retention periods are:

  • Enquiry data: deleted after 12 months if no further interaction (e.g., no Business Terms of Service entered, no ongoing communication).
  • Client data: retained for 7 years after project completion or account closure (to comply with tax and legal obligations in Cyprus).
  • Technical data (including IP addresses, browser/device info, referring URL, pages visited, and system logs): retained for 2 years (aggregated or anonymised where possible).

Destruction methods: secure electronic deletion (overwriting, degaussing), physical shredding of paper records.

Data that is no longer needed is anonymised where possible, or securely destroyed.

7. Security measures

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

  • Access controls: only authorised personnel have access to personal data, and only on a need-to-know basis.
  • Encryption: data in transit and at rest is encrypted using industry-standard protocols.
  • Secure hosting: servers are protected by firewalls, intrusion detection systems, and regular security patching.
  • Employee training: all staff receive data protection and security awareness training.
  • Incident response: we have procedures in place to detect, respond to, and report personal data breaches.

While we strive to protect your data, no method of transmission over the internet or electronic storage is absolutely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

8. Automated decision-making and profiling

We do not make solely automated decisions that have legal or significant effects on you based solely on website activity. For clients, we may use automated scoring for fraud prevention or risk assessment, but you will be informed in the relevant Business Terms of Service and have the right to human review.

9. Contact

Data Controller:
EARTHPLEXO SERVICES LTD
Company number HE 346681
7 Amathountos, 3105, Limassol, Cyprus

Data Protection Officer (DPO): privacy@payperless.com

For general privacy enquiries: privacy@payperless.com

Postal address for privacy correspondence:
EARTHPLEXO SERVICES LTD
Attn: Data Protection Officer
7 Amathountos, 3105, Limassol, Cyprus

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in technology, legal requirements, or our practices. The “Last updated” date at the top of this policy will be updated accordingly. We will notify you of any material changes via a notice on the Website or by email (if you have provided one). We encourage you to review this policy periodically.

Payment and treasury tools

See how Bankify can support your international business.

Bankify is a trading name used by Next Markets Ltd and Oyster Pay Limited. Bankify is not a separate legal entity or a bank.

Next Markets Ltd, trading as Bankify, is a company registered in England and Wales under company number 14020031, with its registered office at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF. Next Markets Ltd is registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Foreign Money Services Business, registration number N300000324.

Oyster Pay Limited, trading as Bankify, is a company incorporated in the Province of British Columbia, Canada, under incorporation number BC1461638. Oyster Pay Limited is registered with FINTRAC as a Money Services Business, registration number M24940836, and with the Bank of Canada as a payment service provider under the Retail Payment Activities Act (Canada).

FINTRAC and Bank of Canada registrations do not constitute a banking licence, deposit insurance or an endorsement by either authority.

Disclaimer — Services made available through the Bankify platform may be provided by Next Markets Ltd, Oyster Pay Limited and/or appropriately authorised third-party banks, electronic money institutions and payment service providers.

The services made available through Bankify are intended exclusively for eligible corporate, institutional and professional clients. Our services are not available to retail clients residing in, or corporate clients registered or established in, the United Kingdom, the United States, the European Union, or any other restricted jurisdiction. Service availability remains subject to applicable law, the customer's jurisdiction, requested services, successful due diligence, provider approval and the applicable customer agreement.

The information provided on this website is for general informational purposes only. It does not constitute a public offer, solicitation, financial promotion, investment advice or a recommendation to enter into any transaction. Nothing on this website should be construed as an offer to provide services in a jurisdiction where such an offer would be unlawful or require an authorisation that the relevant service provider does not hold. The applicable contracting entity and service provider will be identified before onboarding is completed.

Neither Bankify nor the entities operating under the Bankify trading name provide investment advice. Prospective customers should obtain independent legal, financial, tax and regulatory advice before using any service or entering into any transaction. To the extent permitted by applicable law, Next Markets Ltd and Oyster Pay Limited accept no responsibility for decisions made solely in reliance on the general information presented on this website.

General enquiries: info@bankify.com  |  Complaints: complaints@bankify.com  |  Privacy enquiries: privacy@bankify.com

This website is operated by EARTHPLEXO SERVICES LTD, a company incorporated in the Republic of Cyprus with company number HE 346681, registered office 7 Amathountos, 3105, Limassol, Cyprus. © 2026 EARTHPLEXO SERVICES LTD. All rights reserved.