Data Processing Agreement (Summary)

Roles

For the personal data your customers submit through PayKato checkouts and that you instruct us to handle (for example payer name, email, payment metadata), you act as the data controller and PayKato acts as the data processor. For PayKato's own purposes (account management, fraud prevention, AML/KYC obligations, product security), PayKato acts as an independent controller.

Subject matter & duration

Processing covers operating the Service for the merchant's account, for the duration of the merchant's use of PayKato, plus any retention required by law.

Categories of data & subjects

Contact details, transaction metadata, device/log data, and (where applicable) KYC documentation of merchants and beneficial owners. Data subjects include the merchant's payers, the merchant's representatives, and end-users of merchant integrations.

Sub-processors

PayKato uses categories of sub-processors including cloud infrastructure, payment processors, banking partners, KYC/identity providers, email and notification providers, analytics, and customer-support tools. A current list is available on request.

Security measures

• Encryption in transit (TLS) and at rest for stored data.
• Role-based access controls and least-privilege principles for internal access.
• Row-level isolation between merchant accounts.
• Audit logging of security-relevant events.
• Background-checked personnel and confidentiality obligations.

International transfers

Where personal data is transferred across borders, PayKato relies on appropriate safeguards (such as standard contractual clauses) where required.

Data-subject requests & breach notification

PayKato assists merchants in responding to data-subject requests and will notify affected merchants without undue delay after becoming aware of a personal-data breach involving their data.