Privacy Policy

DaoPay GmbH (“DaoPay” or “Controller”), with registered office at Hackhofergasse 5/14, 1190 Vienna, Austria, is a Licensed Austrian Payment Service Provider and Acquirer, supervised by the Austrian Financial Market Authority (FMA).

Controller

DaoPay GmbH, Hackhofergasse 5/14, 1190 Vienna, Austria

Data protection contact

privacy@daopay.com

Data subject requests

privacy@daopay.com

DaoPay’s Data Protection Officer

DaoPay has appointed a Data Protection Officer in line with Article 37 GDPR. The Data Protection Officer is responsible for the company’s data protection matters in accordance with legal and regulatory requirements and reports directly to the Managing Directors. You can reach our Data Protection Officer at privacy@daopay.com or by post at DaoPay GmbH, attn. Data Protection Officer, Hackhofergasse 5/14, 1190 Vienna, Austria. The Data Protection Officer’s main functions are:

• Monitoring compliance with data protection regulations and ensuring rule-compliant processes and guidelines within DaoPay.
• Acting as contact person for data subject rights requests.
• Acting as contact person and informant on data protection matters for DaoPay employees.
• Providing comprehensive advice and support across all areas of DaoPay in the field of data protection.
• Cooperating with the data protection authority.
• Advising on data protection impact assessments and monitoring their performance.

Personal data

Personal data means any data that may be linked to a specific, identifiable natural person.

How we use your information lawfully

Your personal data is only processed for specific, explicit and legitimate purposes, and always within the bounds of lawfulness, as described below.

Purposes of processing and legal grounds

Personal data shall be processed without consent, for the following purposes:

• Complying with specific pre-contractual or contractual obligations undertaken by us to our customers.
• Complying with national or EU laws and regulations, or executing orders or instructions given to DaoPay by judicial authorities, oversight authorities or professional bodies.
• Exercising the rights of DaoPay, specifically defending itself in court proceedings.

On the basis of DaoPay’s legitimate interest in maintaining professional relationships with current and prospective customers:

• Carrying out customer relationship management, including with the contacts of current and prospective customers and other persons or entities with whom our professionals have developed business relationships.
• Complying with policies and procedures adopted by DaoPay to manage shared verification processes preliminary to accepting and correctly performing assignments, and quality control processes.

How we process personal data more broadly

We process the information you provide to us for the following purposes, on the basis of performing a contract with you (Article 6(1)(b) GDPR), complying with legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in good customer service (Article 6(1)(f) GDPR):

• To conclude and execute agreements with you and provide services to you.
• To send you administrative information, for example about our website and changes to our Terms & Conditions.
• To process transactions on your behalf.
• To fulfil your order, arrange delivery, and communicate with you about the service and related customer service.
• To respond to your inquiries and fulfil your requests, including questions and comments.
• To contact you when we have an obligation to do so.
• To offer and facilitate services at your request.
• To improve our service and develop new services.
• To resolve conflicts, manage litigation, resolve issues, and provide customer service, including troubleshooting.
• For our business purposes, such as analysing and managing our business, mergers and acquisitions, market research, audits, developing new products, enhancing our website, identifying usage trends, and evaluating promotional campaigns and customer satisfaction, as we believe necessary or appropriate under applicable law, to comply with legal process, or to respond to requests from public and government authorities.

Website visitor data

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics loads only after you accept optional analytics in our cookie banner; without that consent, no analytics script runs and no analytics cookies are set. The legal basis is your consent under Article 6(1)(a) GDPR and § 165 Abs. 3 TKG 2021, which you can withdraw at any time with effect for the future via “Cookie Settings” at the bottom of every page.

When enabled, Google Analytics uses cookies to distinguish visitors and measures how this website is used — for example which pages are visited, how long visits last, the type of device and browser, and the approximate region derived from your IP address. Google Analytics 4 does not log or store IP addresses. We have not activated Google Signals and we use no advertising or remarketing features; the data is used solely to understand and improve how this website performs.

Google may transfer the collected data to servers of Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; in addition, transfers are covered by the European Commission’s Standard Contractual Clauses under Article 46 GDPR. Analytics data is retained for a maximum of 14 months and then deleted automatically.

Beyond this, we process the technical request data your browser sends, such as IP address and user agent, to deliver this website and protect it against attacks (legitimate interest, Article 6(1)(f) GDPR), together with the strictly necessary cookies needed to operate the site and the consent mechanism itself. Server logs are deleted after 180 days. When you use one of our forms, the bot check described below also runs. For the specific cookies Google Analytics sets, their durations, and how to give, refuse or withdraw consent, see our Cookie Policy & Consent (GDPR).

Bot protection on our forms

Our contact, support, PreCheck and Review Pack forms are protected by captcha.eu, a service of Captcha GmbH, Muthgasse 2, 1190 Vienna, Austria. The check runs only when you start using one of these forms. Captcha GmbH receives your IP address, which it shortens before storing, your device and browser type, the referring page, pointer movements and the timing between keystrokes. It does not receive what you type. Captcha GmbH keeps this data for no more than 6 months. We use the service to protect our forms against bots and spam. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.

Merchant and business partner data

When you engage with us as a business partner, we process the information needed to assess and onboard your business, including contact details, business model, expected payment volume, and Identity & Verification data. This includes identifying directors and beneficial owners and performing required regulatory checks.

Payer and cardholder data

Payer data we handle is limited to transaction metadata such as amount, currency, timestamp and scheme reference. Card data is handled by our card scheme and processing partners under their own frameworks. We use this data to process payments and to manage fraud, chargebacks and disputes.

Recipients and third parties

We share personal data only where necessary, with categories of recipients including card scheme partners, payment processing partners, hosting providers, Captcha GmbH for bot protection on our forms and, only with your consent, Google for web analytics. Where partners act as processors, they do so under contract and on our instructions. Supervisory authorities may access data where the law requires.

How we collect and protect your data generally

DaoPay processes information and personal data on its servers and protects it through physical, electronic and procedural measures, in accordance with applicable law. This helps prevent unauthorised access, maintains data accuracy and ensures the information is used correctly. Only employees who require access to perform their work are granted it.

We share personal data with third parties only where a legal basis allows it: to perform a contract with you or take steps at your request (Article 6(1)(b) GDPR), where the law requires it (Article 6(1)(c) GDPR), where we or a third party have a legitimate interest that your interests do not override, for example to prevent fraud (Article 6(1)(f) GDPR), or where you have consented (Article 6(1)(a) GDPR). The categories of recipients are listed under “Recipients and third parties”. For information about the data we hold about you, contact privacy@daopay.com.

The storage and processing of personal data transmitted or disclosed to us takes place only for the following purposes: processing, billing and controlling payment transactions, providing customer support, ensuring the best possible service, statistical evaluation (not profiling), and prevention of fraud and abuse.

Any personal data collected as part of a payment process to conduct business transactions is only transmitted to the extent necessary to the parties involved in the transaction (the merchant where the purchase was made, and the payment system operator used to make the payment). The legal basis for this processing is Article 6(1)(b) GDPR.

Downstream payment processing is performed by authorised payment system providers and our contracted business partners (typically banks, card scheme and telecommunication companies) that are authorised to carry out the relevant payment process and maintain appropriately secured systems. This is necessary to process distance-selling payments and to facilitate the use of DaoPay’s services.

We prefer to keep personal data within the European Economic Area. Where an international transfer is necessary, we rely on appropriate safeguards under Article 46 GDPR, such as the European Commission’s Standard Contractual Clauses, and assess each transfer before it takes place.

Where you have consented to analytics, usage data collected by Google Analytics may be processed by Google LLC in the United States on the basis of the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, as described under “Website visitor, merchant and payer data” above.

We keep the data collected during our business relationship for 7 years after the end of your contract with us. Beyond this general period, our records are kept for the specific legal retention periods that apply to particular obligations under Austrian law (for example, accounting and tax record-keeping requirements under UGB/BAO, and payment-services-specific requirements under ZaDiG 2018 and applicable anti-money-laundering law).

You have the right to access, rectify and erase your personal data, to restrict processing, to data portability, to object to processing, and to withdraw your consent at any time. To exercise these rights, contact DaoPay GmbH, Hackhofergasse 5/14, 1190 Vienna, Austria, email privacy@daopay.com. We may need to confirm your identity before acting on a request.

Your right to object (Article 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we use your data for direct marketing, you can object at any time without giving reasons, and we will stop using it for that purpose. To object, contact privacy@daopay.com.

If you believe the processing of your data breaches data protection law, or that your data protection rights have been violated in any other way, you have the right to lodge a complaint with the competent regulatory authority.

Authority

Datenschutzbehörde (Austrian Data Protection Authority)

Address

Barichgasse 40-42, 1030 Vienna, Austria

This right is without prejudice to any other administrative or judicial remedy available to you.

Our PreCheck uses a rule-based intake followed by a human-led review, so onboarding decisions are not based solely on automated processing. You can ask for human intervention and can contest a decision. If we introduce further automation in future, we will update this notice.

Where we do not collect personal data directly from you, we obtain it from other sources. Business partner data is provided by you directly; payer data reaches us through our card scheme and processing partners as part of the payment flow.

Right to correct inaccurate personal information

You have the right to request correction of inaccurate personal information processed by us.

Children’s privacy

This website is aimed at businesses and is not directed at children. We do not knowingly collect personal data from children under 14 through this website. Where a payment made by a minor reaches us as part of a payment flow, we process the related transaction data only as far as needed to execute the payment and meet our legal obligations.

Contact, support, PreCheck and Review Pack forms

When you use one of our forms (sales enquiry, support request, PreCheck or Review Pack request), we process the details you enter, such as your name, company, email address, phone number, your answers or message and any files you attach, to handle your request and any follow-up questions. Sales enquiries go to our sales team, support requests to our support team. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).

We keep these details for 6 months after your request has been dealt with, unless they become part of a business relationship or a legal retention obligation applies. We do not use them for newsletters or marketing emails.

If you use “Book a meeting”, Microsoft Bookings opens in a new tab. The details you enter there are processed by Microsoft on our behalf to schedule the meeting.

Responsibilities

Document Owner, creation and maintenance of this document

Head of Legal & Compliance

Legislative, statement of liability

Managing Directors

Implementation, execution

CISO

Administration, operations

CISO, IT

Inspection, audit of the company

Internal IT Revision

Risk analysis, evaluation of results

IT-Security Management Team

Last updated: 16 October 2026