Privacy and Cookie Policy

1. Who we are

1.1 The controller of personal data described in this Policy is XINTAPAY FOR ECOMMERCE W.L.L., CR No. 194877-1, registered office at Bldg. 1418, Rd. 1030, Block 1010, Al Hamalah, Kingdom of Bahrain (“XINTAPAY”, “we”). Contact for privacy matters: compliance@xintapay.io.

1.2 This Policy is drawn up in line with the Bahrain Personal Data Protection Law No. 30 of 2018 (the “PDPL”) and, for customers in the European Economic Area and the United Kingdom, the GDPR and the UK GDPR.

2. Scope

2.1 This Policy applies to visitors of our websites, to buyers and beneficiaries of the service packages we sell, and to representatives of partner institutions using the Supplier Account.

3. Data we collect

3.1 Identity and contact data: name, email address, phone number, country of residence.

3.2 Order data: the service and partner institution, applicant or student references, order amount and currency, order history and correspondence.

3.3 Beneficiary data provided by the buyer: name, date of birth where required for enrolment, applicant or student ID.

3.4 Payment confirmation data: payment status, method, masked card number (last four digits). Full card numbers are collected and processed by our payment partners, not by us.

3.5 Partner onboarding data: company details, licences and accreditations, details of officers and beneficial owners, verification documents.

3.6 Technical data: IP address, device and browser information, log records, and cookie data described in section 13.

4. Purposes and legal bases

4.1 Performing the contract of sale and delivering the service package: processing is necessary for the performance of a contract to which the data subject is party (PDPL Article 4; GDPR Article 6(1)(b)).

4.2 Compliance with legal obligations, including accounting, consumer protection and sanctions screening (PDPL Article 4; GDPR Article 6(1)(c)).

4.3 Our legitimate interests: preventing fraud and abuse, securing the websites, improving our services, establishing and defending legal claims (PDPL Article 4; GDPR Article 6(1)(f)).

4.4 Consent: marketing communications and non-essential cookies (PDPL Articles 4 and 24; GDPR Article 6(1)(a)). Consent can be withdrawn at any time with effect for the future.

5. Payment card data

5.1 Checkout payments are processed by licensed payment service providers on PCI DSS certified infrastructure. We receive confirmation of the payment and masked data only and do not store full card numbers.

6. Who we share data with

6.1 The partner institution named in your order, to deliver the underlying service; it processes this data as an independent controller under its own privacy terms.

6.2 Payment service providers and acquiring partners, to process your payment and prevent fraud.

6.3 Screening, verification and fraud-prevention providers; IT, hosting and support providers acting on our instructions; professional advisers; and public authorities where disclosure is required by law.

6.4 We do not sell personal data.

7. International transfers

7.1 We may transfer personal data to countries included in the adequacy list adopted under the PDPL (Ministerial Order No. 42 of 2022); such transfers do not require further authorisation.

7.2 Other transfers are made under the conditions of Articles 12 and 13 of the PDPL, including your consent, necessity for the performance of your contract, or safeguards approved by the Personal Data Protection Authority.

7.3 For data subject to the GDPR or the UK GDPR, transfers outside the EEA or the UK rely on adequacy decisions or on standard contractual clauses (and the UK addendum or IDTA, as applicable).

8. Retention

8.1 Order, invoicing and accounting records: [5/10] years as required by law. Partner onboarding records: the duration of the relationship plus [5] years. Technical logs: up to [12] months. Marketing data: until consent is withdrawn.

9. Your rights under the PDPL

9.1 You may request access to your personal data, correction of inaccurate data, blocking or erasure of data processed in breach of the PDPL, and you may object to processing for direct marketing and withdraw consent.

9.2 To exercise your rights, write to compliance@xintapay.io. We respond within the periods required by the PDPL. You may also lodge a complaint with the Personal Data Protection Authority of the Kingdom of Bahrain.

10. Additional rights for EEA and UK data subjects

10.1 If the GDPR or the UK GDPR applies to you, you also have the rights of rectification, erasure, restriction of processing, data portability and objection, and the right to complain to your local supervisory authority. [If required under Article 27 GDPR, details of our EU representative will be published here.]

11. Security

11.1 We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised access, including encryption in transit, access controls, logging and staff confidentiality undertakings.

12. Children

12.1 Purchases on our websites may be made only by persons of at least 18 years. Data of beneficiaries under 18 is provided by their parents, guardians or authorised representatives and is processed only as needed to deliver the service package.

13. Cookies

13.1 We use: (a) essential cookies, required for the operation and security of the websites (no consent needed); (b) analytics cookies, used with your consent to understand how the websites are used; and (c) preference cookies, used with your consent to remember your settings.

13.2 You can manage non-essential cookies through the cookie banner and your browser settings. Blocking essential cookies may affect the operation of the checkout.

13.3 The current list of cookies, providers and storage periods is available at [link to cookie table].

14. Changes

14.1 We may update this Policy by publishing a new version with a new effective date on the websites.

15. Contact

15.1 XINTAPAY FOR ECOMMERCE W.L.L., CR No. 194877-1, Bldg. 1418, Rd. 1030, Block 1010, Al Hamalah, Kingdom of Bahrain. Privacy contact: compliance@xintapay.io.