Date of last update: November 10, 2026
1. General provisions
1.1. This Privacy Policy (hereinafter the “Policy”) governs the collection, use, storage, transfer and protection of individuals’ personal data when using the website averipay.com, when applying for and using the payment services of Averipay (including accepting payments and paying out funds), when concluding and performing contracts, and when interacting with Averipay.
1.2. The controller of personal data is Avrepey OOD, EIK 208357967, registered in the Republic of Bulgaria, with its registered address at 41 Hristofor Kolumb St., floor 2, office 226, Iskar district, 1592 Sofia, Bulgaria, operating under the Averipay brand (the “Company”, “we”, “us”).
1.3. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Bulgarian Personal Data Protection Act and other applicable legislation.
1.4. This Policy applies to website visitors, persons seeking information, merchant applicants and merchants who are individuals, the legal representatives, beneficial owners and authorised persons of merchants, persons making payments to merchants through the Company’s services, and other individuals whose personal data is processed by the Company in connection with its activities.
1.5. The Company aims to ensure that personal data is processed lawfully, fairly and transparently, to limit its collection to what is necessary for the stated purposes and to take appropriate measures to keep it secure.
1.6. Using the website does not in itself mean consent to every type of processing of personal data. For operations that require consent, the Company asks for it separately in the manner provided by law.
2. What personal data we process
2.1. Depending on the nature of the interaction with the Company and the services used (including opening and maintaining a merchant account and accepting payments), the following categories of personal data may be processed. They relate to individuals: merchants who are individuals, legal representatives, beneficial owners and authorised persons of merchants, and persons making payments.
2.1.1. Identification data
First name, surname, date of birth, nationality, personal identification number or other identification number, and identity document data, where obtaining it is necessary and permitted by law, including for the identification of the merchant, its representatives and beneficial owners.
2.1.2. Contact data
Telephone number, email address, residential address, correspondence address and other contact details provided by the user.
2.1.3. Business and bank data
Name and type of the merchant, line of business, the website or application through which payments are accepted, expected and actual turnover, ownership and management data, and the bank account (IBAN) for payouts.
2.1.4. Payment transaction data
Amount, currency, date and time, payment status, merchant identifier, payment instrument data to the extent necessary to process the payment, and data on refunds, disputes and chargebacks.
2.1.5. Compliance check data (KYC/AML)
Results of sanctions list screening, information on whether a person is a politically exposed person, information on the source of funds, risk assessment and other data collected in performing the requirements of ЗМИП, where required by law.
2.1.6. Data on interaction with the Company
The content of enquiries, applications, complaints and email correspondence, as well as information on interaction with the Company’s employees.
2.1.7. Technical data
IP address, device type, operating system, browser, technical logs, data on the pages visited and on the use of the website and merchant account features, including data used to detect fraud and unauthorised access.
2.2. The Company collects only the personal data that is necessary for specific and lawful purposes of processing. The Company does not provide credit, does not process data on the creditworthiness of individuals and does not carry out credit scoring.
2.3. Personal data may be received directly from the user, from the merchant in relation to its representatives, beneficial owners and payers, may arise in the course of performing contracts and processing payments, or may be provided by third parties and organisations (partner banks, verification service providers, public registers and lists) where there is an appropriate legal basis.
2.4. If providing certain data is mandatory by law (for example for identification and checks under ЗМИП) or is necessary for concluding a contract, the Company informs the applicant accordingly. Failure to provide such data may make it impossible to open a merchant account or provide the relevant service.
3. Purposes of processing personal data
3.1. The Company processes personal data for the following purposes:
3.1.1. Merchant onboarding and identification (onboarding and KYC)
Assessing the merchant’s application, identifying and verifying the merchant, its representatives and beneficial owners, and concluding a payment services agreement.
3.1.2. Provision of payment services
Accepting and processing payments, settlement and payouts, charging fees in accordance with the rates, recording payment transactions and managing contractual obligations.
3.1.3. Compliance with legal obligations
Complying with the requirements of ЗПУПС and Directive (EU) 2015/2366 (PSD2), of anti-money laundering and counter-terrorist financing legislation (ЗМИП), including sanctions screening and reporting to the competent authorities, and of financial, accounting and tax legislation.
3.1.4. Fraud prevention and security
Preventing fraud and payment abuse, monitoring payment transactions for suspicious activity, detecting unauthorised actions, protecting information systems and ensuring the proper functioning of the website. Automated processing of transaction data may be used for these purposes.
3.1.5. Customer service
Handling enquiries, providing information under contracts, and processing requests, complaints and payment disputes.
3.1.6. Protection of legitimate interests
Establishing, exercising and defending the Company’s legal rights, including resolving disputes, chargebacks and claims under payment services agreements in accordance with the procedure provided by law.
3.1.7. Marketing communications
Providing information about the Company’s products and services where there is an appropriate legal basis and in compliance with the applicable requirements for electronic communications.
3.2. Personal data is not used for purposes incompatible with the original purposes of collection without an appropriate legal basis.
4. Legal bases for processing
4.1. The Company processes personal data on the basis of Article 6 of the GDPR.
4.2. Depending on the specific operation, the following legal bases may apply:
- Performance of a contract or taking steps prior to entering into it. For example, accepting and processing a merchant application, providing payment services, settlement and payouts.
- Compliance with a legal obligation. For example, checks and data retention under ЗМИП, the requirements of ЗПУПС and PSD2, and accounting, tax and financial legislation.
- Legitimate interests of the Company or of third parties. For example, preventing fraud, ensuring information security and protecting legal rights, including in payment disputes, provided that the rights and interests of data subjects are respected.
- Consent of the data subject. For example, for separate marketing communications and for the use of non-essential cookies, where consent is required by law.
4.3. Consent is requested where it is the necessary legal basis for processing. Consent is not requested for checks under ЗМИП and ЗПУПС, as that processing is carried out on the basis of a legal obligation.
4.4. Where processing is based on consent, the user may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
4.5. Withdrawal of consent does not stop the processing of data if another valid legal basis exists for it.
5. Recipients of personal data
5.1. The Company may disclose personal data to third parties only where there is a lawful basis and to the extent necessary for the relevant purpose.
5.2. Depending on how the business is actually organised, the recipients of data may include:
- hosting, technical support and information technology service providers;
- acquiring banks, partner banks and other payment service providers involved in the processing, clearing and settlement of payments;
- international card schemes and payment card issuers, to the extent necessary to process card payments;
- providers of identification, information verification (KYC), sanctions screening and fraud prevention services;
- professional advisers, auditors and legal representatives;
- competent state, supervisory and judicial authorities, including the Bulgarian National Bank, the Financial Intelligence Directorate of the State Agency for National Security, the National Revenue Agency and the Commission for Personal Data Protection;
- other recipients to whom the transfer of data is permitted or prescribed by law.
5.3. When engaging processors of personal data, the Company ensures that appropriate contractual and organisational safeguards for the protection of information are in place in accordance with the GDPR.
5.4. The Company does not sell users’ personal data to third parties for their independent use for marketing purposes.
5.5. The actual categories of recipients and the grounds for disclosure must correspond to the Company’s real personal data processing activities.
6. Transfers of data outside the European Economic Area
6.1. When transferring personal data outside the European Economic Area, the Company complies with the requirements of Chapter V of the GDPR.
6.2. Such transfers may be carried out on the basis of a decision of the European Commission on an adequate level of protection or by applying other mechanisms and safeguards provided for by the GDPR, including standard contractual clauses, where applicable.
6.3. The user has the right to obtain information on the relevant safeguards and on how to access them.
6.4. Information on actual international transfers: —.
7. Retention periods for personal data
7.1. The Company keeps personal data no longer than is necessary to achieve the purposes of its processing, unless longer retention is required by law.
7.2. Retention periods are determined taking into account the nature of the data, the purposes of processing, the requirements of anti-money laundering legislation (the Bulgarian Measures Against Money Laundering Act, ЗМИП), the Payment Services and Payment Systems Act (ЗПУПС), accounting and other applicable legislation, and the need to establish, exercise or defend legal rights.
7.3. Different retention periods may apply to different categories of data.
- Identification data and AML checks (ЗМИП):
- —
- Payment transaction data:
- —
- Accounting and financial documents:
- —
- Enquiries, complaints and payment disputes:
- —
- Technical logs and website data:
- —
- Marketing data:
- —
7.4. At the end of the applicable period, personal data is deleted, anonymised or kept only where another lawful basis exists.
7.5. The right to erasure of personal data is not absolute and may be limited in the cases provided for by law.
8. Protection of personal data
8.1. The Company applies technical and organisational measures appropriate to the nature of the processing and the existing risks to the rights and freedoms of individuals.
8.2. Such measures may include segregation of access rights, protection of information systems, control of access to data, backups and organisational security procedures.
8.3. Access to personal data is granted only to authorised persons who need it to perform their respective duties.
8.4. The Company takes measures to prevent unauthorised access, accidental loss, unlawful alteration, destruction or disclosure of personal data.
8.5. In the event of a personal data breach, the Company performs the obligations provided for by the GDPR to assess the incident and, where necessary, to notify the supervisory authority and the persons affected.
9. Rights of data subjects
9.1. In accordance with the GDPR and subject to the conditions provided by law, users have the following rights.
9.1.1. Right of access
To obtain confirmation that their personal data is being processed, information about that processing and a copy of the data being processed.
9.1.2. Right to rectification
To require the correction of inaccurate personal data and the completion of incomplete data.
9.1.3. Right to erasure
To request the erasure of personal data where the grounds provided by the GDPR apply.
9.1.4. Right to restriction of processing
To require the restriction of processing in the cases established by law.
9.1.5. Right to object
To object to the processing of personal data based on legitimate interests, in the cases provided by law.
Where data is processed for direct marketing purposes, the data subject has the right to object to such processing at any time.
9.1.6. Right to data portability
To receive personal data in a structured, commonly used and machine-readable format and to transmit it to another controller, subject to the conditions established by the GDPR.
9.1.7. Right to withdraw consent
To withdraw previously given consent where processing is based on it.
9.1.8. Rights in relation to automated decision-making
In the cases provided by law, not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, and to benefit from the safeguards established by the GDPR.
9.2. To exercise their rights, users may send a request to: payments@averipay.com.
9.3. The Company handles requests within the time limits established by the GDPR. As a rule, a reply is provided within one month of receiving the request. In cases provided for by law, the period may be extended, and the applicant will be informed accordingly.
9.4. To prevent unauthorised disclosure of personal data, the Company may request additional information needed to confirm the applicant’s identity.
9.5. The exercise of certain rights may be limited if the processing of personal data is necessary for compliance with legal obligations or for other purposes provided for by law.
10. Right to lodge a complaint
10.1. If the user believes that the processing of their personal data infringes legal requirements, they may contact the Company directly for clarification and for their request to be reviewed.
10.2. The user also has the right to lodge a complaint with the competent data protection supervisory authority.
Commission for Personal Data Protection of the Republic of Bulgaria (CPDP)
- Official website:
- www.cpdp.bg
10.3. The right to apply to the supervisory authority does not limit the possibility of using other legal remedies provided by law.
12. Contact information
12.1. For questions about the processing of personal data, the exercise of data subjects’ rights and further information, you can contact the Company using the following details:
- Company:
- Avrepey OOD
- Trading name:
- Averipay
- EIK:
- 208357967
- Registered address:
- 41 Hristofor Kolumb St., floor 2, office 226, Iskar district, 1592 Sofia, Bulgaria
- Email:
- payments@averipay.com
- Contact of the data protection officer, if appointed:
- —
12.2. When sending a request, you are advised to include information that makes it possible to identify its subject and to provide a reply.
12.3. The Company may request additional information to confirm the applicant’s identity if this is necessary to protect personal data.
13. Changes to the Privacy Policy
13.1. The Company may review and update this Policy from time to time in connection with changes in legislation, the services provided, the technologies used and personal data processing activities.
13.2. The current version of the Policy is published on the Company’s official website.
13.3. The date of the last update is indicated at the beginning of the document.
13.4. If the changes materially affect the processing of personal data or the rights of users, the Company provides additional information in the cases and in the manner provided by law.
Averipay
© 2026 Averipay. All rights reserved.