REPAY Privacy Policy
Last modified: July 3, 2024
REPAY Holdings, LLC, through its subsidiaries (collectively, “REPAY,” “we,” “us” or “our”), provides integrated payment processing solutions to businesses with specific transaction processing needs. We collect and process information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”) as described in this REPAY Privacy Policy (this “Policy”).
We take the privacy of your Personal Information very seriously and are committed to the responsible use and protection of it. This Policy contains details about how we collect, use, and share with third parties Personal Information that we obtain from and about you, including when you or our business customers use our payment services (the “Services”) through our mobile application, our website or websites that we host or power (collectively, the “Websites”) or other payment channels (collectively, our “Channels”) or where a link to this Policy is posted. Please read this Policy carefully.
You may have certain privacy rights under applicable US state laws, including the California Consumer Privacy Act, as amended (including, without limitation, by the California Privacy Rights Act) (together, the “CCPA”), the Colorado Privacy Act, the Nebraska Data Privacy Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, Chapter 603A of the Nevada Revised Statutes, and all laws implementing, supplementing or amending the foregoing, including regulations promulgated thereunder (collectively, “U.S. Privacy Laws”).
If you are a resident of California, Colorado, Nebraska, Texas, Utah or Virginia, please see “Your State Law Privacy Rights” below for more information about your privacy rights under U.S. Privacy Laws.
This Policy does not apply to Personal Information relating to our job applicants, current employees, former employees, or independent contractors (collectively, “Personnel”).
TABLE OF CONTENTS
2. Personal Information We Collect
3. How We Collect Personal Information
4. How We Use Personal Information
5. To Whom We Disclose Personal Information
6. Cookies and Other Tracking Technologies
12. Your State Law Privacy Rights
13. Additional Notice for California Residents
14. Additional Notice For Nevada Residents
- OVERVIEW
We obtain Personal Information about you from various sources in order to provide the Services, manage the Websites and Channels, and for other purposes described below. You may be a visitor to our Websites, a user of our Channels, a customer or a vendor of a business that has contracted with us to provide the Services to you (a “REPAY Client”), or a business contact from a REPAY Client or one of our partners or service providers. If you are a customer of a REPAY Client, then please note that we are a service provider or processor to such REPAY Client and we collect and process Personal Information at the REPAY Client’s direction. If you have any questions about how the REPAY Client has directed us to process your Personal Information or you would like to exercise your rights under U.S. Privacy Laws with respect to Personal Information that we process as a service provider or processor, please contact the REPAY Client.
- PERSONAL INFORMATION WE COLLECT AND PROCESS
The categories of Personal Information we have collected and processed about you in the previous 12 months and the purposes for which we used such Personal Information are described in the following table. The letters listed under the column “Purposes” correspond to the purposes described in Section 4 below.
| Category of Information | Description | Purposes for Collection |
| Identifiers | Your name, alias, postal address, country of residence, unique personal identifier, online identifier, internet protocol address, email address, account name, phone number, social media identifiers, social security number, driver’s license number, passport number, or other similar identifiers. | a, b, c, d |
| Financial Information | Information such as debit card numbers, credit card numbers, social security numbers, bank account information, and any background information provided by you or collected by us as part of our business analysis, client onboarding, regulatory compliance checks and other related processes. | a, b, c |
| Protected Characteristics | Information relating to protected classes, such as age, gender, sex, citizenship and date of birth. | a, b, c |
| Commercial Information | Records of personal property, creditworthiness, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | a, b, c, d |
| Internet Usage Information | Your browsing history, IP addresses, cookie IDs, search history, information from your web browser header, and other information regarding your interactions with and use of the Websites or Channels. For more information, see “Cookies and Other Tracking Technology,” below. | a, b, c, d |
| Geolocation information | Information such as longitude and latitude from your IP address or mobile device when using our Websites or Channels that may provide approximate location of the device you are using. | b, c |
| Sensory Data (Audio, electronic, visual, or similar information) | Information such as CCTV video recordings of our premises, audio recordings when you speak with our Customer Service Department, and video conferences with REPAY Clients. | c |
| Professional or Employment Information | Information such as job title, business address, employment history, or other professional information. | c |
| Sensitive Personal Information | We also collect the following categories of sensitive information, referred to herein collectively as “Sensitive Personal Information”: | |
| Social security, driver’s license, state identification card, or passport numbers. | a, b | |
| Account log-in, financial account, debit card, or credit card numbers in combination with any required security or access code, password, or credentials allowing access to an account. | a, b | |
| Information collected and analyzed concerning a consumer’s health. | a, c |
Our Retention of Your Personal Data
The length of time for which we retain each category of Personal Information described above depends on the purposes for which we collected and use it and as required to comply with applicable laws. We keep your Personal Information for no longer than reasonably necessary to achieve the purposes for which it was collected or processed. The criteria used to determine the period of time such Personal Information is retained includes the nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of the Personal Information, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation).
- HOW WE COLLECT PERSONAL INFORMATION
We collect Personal Information about you in the following ways and from the following sources:
- In connection with the Services. If you are a customer or a vendor of a REPAY Client, when you make payments, accept payments or otherwise conduct transactions through a REPAY Client’s website, our Websites, or our Channels, we will receive your transaction information. Depending on how the REPAY Client implements our Services, we may receive this information directly from you, the REPAY Client or third parties. The Personal Information that we collect may include payment method information (e.g., credit or debit card number, or bank account information), transaction amounts, and date of transaction. Different payment methods may require the collection of different categories of Personal Information. The REPAY Client will determine the payment methods that it enables you to use, and the payment method information that we collect will depend upon the payment method that you choose. When you make a transaction, we may also receive your name, email, billing or mailing address and, in some cases, your transaction history to authenticate you.
- Directly from you. We also collect Personal Information directly from you when you submit requests for information on the marketing page of our Website or call our Investor Relations group.
- Through cookies and other tracking technologies. We may collect information about how you use the Websites or otherwise interact with us online automatically, such as IP address, information about your device, internet usage, browsing preferences, browser type, website activity, and other technical information when you interact with us online. We may also collect information about how you use the Channels. For more information, see “Cookies and Other Tracking Technologies,” below.
- From third parties. We may collect Personal Information from third parties, such as service and content providers, companies that provide or sell lists of potential customers, or from others interacting with us.
- From public sources. We may collect information about you from public sources such as government entities that maintain public records or information you submit in public forums.
We may combine information that we receive from the various sources described in this Policy, including third party sources and public sources.
- HOW WE USE PERSONAL INFORMATION
We may use Personal Information for the following purposes:
- To provide the Services, such as to register and administer accounts on the Channels or the Websites; provide customer support; diagnose, repair and track service and product quality issues; communicate with you about the Services; authenticate your identity; verify eligibility for certain programs; to respond to requests, complaints, and inquiries; and otherwise facilitate your relationship with us.
- To prevent fraud, such as using Personal Information about you obtained through our Services and from our identity verification service providers to confirm your identity and detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity. Our fraud monitoring, detection and prevention services may collect Personal Information about you and use technology to help us assess the risk associated with an attempted transaction by you with a REPAY Client.
- For our own internal business purposes, such as to evaluate or audit the usage, performance and safety of the Services; evaluate and improve the quality of the Services and design new products and services; operate our Websites and Channels; internal research and analytics purposes; display or evaluate the effectiveness of our advertising or marketing efforts; evaluate and improve the quality of your interactions with us; catalog your responses to surveys or questionnaires; or maintain internal business records.
- For marketing, such as for contextual ad customization or to market the Services or the services of our affiliates or other third parties. We may use Personal Information we collect to send you newsletters, surveys, questionnaires, promotions, or information about events. You can unsubscribe to our email marketing via the link in the email or by contacting us using one of the methods described in “Contact Information,” below.
- TO WHOM WE DISCLOSE PERSONAL INFORMATION
We may disclose Personal Information to the categories of recipients described below. For more information specific to California, Colorado, Nebraska, Texas, Utah, and Virginia residents, see Section 12, “Your State Law Privacy Rights” below:
- Affiliates and subsidiaries. We may share Personal Information within our group of companies, which includes parents, subsidiaries, business units, and other companies that share common ownership for the purposes described above.
- Service providers. We may share information with service providers or subcontractors that help us perform our business functions, including completing a transaction you request or supporting our relationship with you, such as IT providers, accountants, logistics providers, analytics companies, and marketing providers.
- REPAY Clients. We share Personal Information with third party REPAY Clients for which we act as a service provider in connection with providing the Services.
- Third parties that facilitate payments. In connection with supporting, clearing or settling payment transactions, we share Personal Information with third parties that facilitate payments, such as payment networks (such as card brand associations), sponsoring financial institutions, clearing houses and payment processors.
- Law enforcement and other government agencies. We may share information with third parties like law enforcement or other government agencies to comply with law or legal requirements; to enforce or apply our Website Terms of Use and other agreements; and to protect ours, our users’, or third parties’ rights, property or safety.
- Parties to a corporate transaction. In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or any portion of our business, assets or stock, we may share Personal Information with third parties in connection with such transaction. Any other entity which buys us or part of our business will have the right to continue to use your Personal Information, but only in the manner set out in this Policy.
- COOKIES AND OTHER TRACKING TECHNOLOGIES
How We Use Tracking Technology. Tracking Technology helps us improve your experience of the Services. In particular, we use Tracking Technology for the following purposes:
- Storing your preferences and settings. We may store settings that enable our Websites to operate correctly or that maintain your preferences over time on your device. For example, we save preferences, such as language and browser settings, so those do not have to be reset each time you return to the Websites.
- Sign-in and authentication. When you sign into your account on our Websites, we store a unique ID number, and the time you signed in, in an encrypted cookie on your device. This cookie allows you to move from page to page within the Website without having to sign in again on each page. You can also save your sign-in information so you do not have to sign in each time you return to the Website.
- Security. We use cookies to detect fraud and abuse of our Websites and Services.
- Interest-based advertising. We use cookies to collect data about your online activity and identify your interests so that we can provide advertising that is most relevant to you.
- Analytics. To provide the Services and improve your user experience on our Websites, we use cookies and other identifiers to gather usage and performance data. For example, we use cookies to count the number of unique visitors to a web page or service and to develop other statistics about the operations of our Services. This includes cookies from us and from third-party analytics providers.
- Performance. We use cookies for load balancing to ensure that our Websites remain up and running.
Analytics and Advertising Tracking Technologies
We may also use Microsoft Advertising Services. To learn about the data Microsoft collects and how your data is used by it and to opt-out of certain Microsoft browser Interest-based Advertising, please visit here.
We may also use Google Ad Services. To learn more about the data Google collects and how your data is used by it and to opt out of certain Google browser Interest-Based Advertising, please visit here.
Tracking Technologies – Your Additional Choices.
Browser Settings: In addition, you can exercise control over browser-based cookies by adjusting the settings on your browser, and mobile devices may offer ad and data limitation choices. Please note that when you use cookie control tools, you will have to change your settings for each browser and device you use, and your limitation on cookies can limit the functionality of online services you use, including our services. In addition, third party tools may enable you to search for and opt-out of some of these trackers.
Mobile Device Settings: You can use mobile device settings to limit mobile tracking technologies and associated activities. You should determine whether your mobile devices vendor provides such settings to limit tracking and follow the procedures identified by the device vendor, if you wish to do so.
Ad Industry Tool: Some third parties that may collect Personal Information in association with your use of our online services for advertising, analytics and other purposes, and may sell that Personal Information downstream, provide you the opportunity to opt-out of their sales. Please visit here to opt-out of the sale of Personal Information by participating third parties. You must opt out on every device and browser you use in order to effectuate your “Do Not Sell” requests from these parties. However, opting out does not mean you will stop seeing ads and you may continue to still see interest-based ads. To learn more about interest-based advertising and additional opt-out choices related to it, please visit here.
Certain features of the Services depend on cookies. Please be aware that if you choose to refuse or delete cookies, some of our Website functionality may be impaired. If you change computers, devices, or browsers, or use multiple computers, devices, or browsers, and delete your cookies, you may need to repeat this process for each computer, device, or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other Tracking Technologies.
- DATA SECURITY
The security of your Personal Information is very important to us. We maintain organizational, technical and administrative measures designed to protect Personal Information within our organization against unauthorized access, destruction, loss, alteration or misuse, consistent with applicable regulatory requirements and applicable published security standards. Your Personal Information is only accessible to a limited number of personnel who need access to the information to perform their duties.
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your Personal Information, we cannot guarantee absolute security. When you provide us with financial information, we encrypt the transmission of that information by using industry practices as outlined by the Payment Card Industry Data Security Standard (PCI DSS).
If you have reason to believe that your Personal Information is no longer secure (for example, if you feel that the security of your account has been compromised), please contact us immediately at (877) 607-5468 or [email protected].
- CHILDREN’S PRIVACY
We recognize the importance of children’s safety and privacy on the Internet. For this reason, we do not knowingly collect or sell any information, including Personal Information, from children under 16 years of age. The Services are intended for individuals 16 years of age and older. They are not directed at, marketed to, or intended for, children under 16 years of age. If you believe that we have inadvertently collected Personal Information from a child under the age of 16, please contact us using one of the methods identified in “Contact Information” below, and we will take immediate steps to delete the Personal Information.
- SMS TEXT MESSAGING
In certain cases, we may send you a SMS text message regarding text-to-pay Services, for payment confirmation and other messages to your mobile phone number. Once you provide us with your mobile phone number (message and data rates may apply), you will receive a text message from us to complete the setup process. By replying to the text message, you will be confirming in writing that you have agreed to receive text messages containing information such as payment confirmations, bill reminders and other relevant messages, including information to inform you of new or additional Services offered by us from which you may benefit. Message frequency depends upon your payment activity and other information such as your geographic location that we may use to send you messages relevant to our Services available in your area.
To opt-out at any time, respond to the text with an indication that you no longer want to receive text messages from us (for example, by including the word “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe). If you cancel, we will send you a text message to confirm we have processed your cancellation. When you opt-out of receiving text messages, it does not affect other Services that are provided. Text messaging is not available in all areas. Not all mobile phones have SMS text capability.
- EXTERNAL LINKS
Our Websites may contain links to external sites or other online services that we do not control, including those embedded in third party advertisements or sponsor information. We are not responsible for the privacy practices and data collection policies for such third-party services. You should consult the privacy policies of those third-party services for details.
- WEBSITE TERMS OF USE
The Website Terms of Use are incorporated by reference into this Policy and can be found here.
- YOUR STATE LAW PRIVACY RIGHTS
This section generally applies to residents of California, Colorado, Nebraska, Texas, Utah, and Virginia whose Personal Information is subject U.S. Privacy Laws, subject to certain exceptions. If you are not a resident of the above-mentioned states, the rights described in this section do not apply to you.
Our Status as a Service Provider/Processor
In the vast majority of cases, we collect and process Personal Information solely in our capacity as a service provider or processor to REPAY Clients. In that context, we receive Personal Information from REPAY Clients and collect information from you on behalf of REPAY Clients and solely for the business purpose of providing the Services. If you are a customer or other user associated with a REPAY Client on whose behalf we have collected or processed your Personal Information, and you have questions or wish to exercise your rights relating to such Personal Information, please contact that REPAY Client directly, as the disclosure and rights described below do not apply to such information.
Summary of Personal Information Collected and Disclosed
Below is a summary of the categories of Personal Information that we collected and disclosed in the previous 12 months and the categories of third parties to whom we disclosed it.
Information about the categories of sources from which we collect Personal Information and the purposes for which we use Personal Information are described above in “How We Collect Personal Information” and “How We Use Personal Information,” respectively.
| Categories of Personal Information Collected | Categories of Third Parties to Whom We Disclosed Personal Information for a Business Purpose |
| Identifiers | - Service providers, such as IT providers, accountants, logistics providers, analytics companies, and marketing providers; - REPAY Clients and third parties that facilitate payments in connection with requested transactions; - Law enforcement or other authorities for legal compliance; and - Entities involved in a corporate reorganization, merger, or acquisition and their representatives. |
| Financial Information | - Service providers, such as IT providers, accountants, and analytics companies; - REPAY Clients and third parties that facilitate payments in connection with requested transactions; - Law enforcement or other authorities for legal compliance; and - Entities involved in a corporate reorganization, merger, or acquisition and their representatives. |
| Internet usage information | - Service providers, such as IT providers, accountants, logistics providers, analytics companies, and marketing providers; - third parties that facilitate payments in connection with requested transactions; - Law enforcement or other authorities for legal compliance; and - Entities involved in a corporate reorganization, merger, or acquisition and their representatives. |
| Geolocation information | - Service providers, such as IT providers, accountants, logistics providers, analytics companies, and marketing providers; - Business Partners in connection with requested transactions; - Law enforcement or other authorities for legal compliance; and - Entities involved in a corporate reorganization, merger, or acquisition and their representatives. |
| Commercial information | - Service providers, such as IT providers, accountants, logistics providers, analytics companies, and marketing providers; - third parties that facilitate payments in connection with requested transactions; - Law enforcement or other authorities for legal compliance; and - Entities involved in a corporate reorganization, merger, or acquisition and their representatives. |
Sale or Sharing of Personal Information
We have not sold or shared Personal Information in the previous 12 months.
Sensitive Personal Information
We do not use or disclose Sensitive Personal Information for purposes other than the following:
- To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
- To detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
- To resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions.
- To perform services on behalf of our business, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business.
- To verify or maintain the quality or safety of a service or device that we own, manufacture or control, and to improve, upgrade, or enhance a service or device we own, manufactured or control.
Your Privacy Rights
Subject to certain legal limitations and applicable exceptions, residents of California, Colorado, Nebraska, Texas, Utah, and Virginia may exercise the following rights:
Right to Know. You have the right to request that we disclose to you the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting the Personal Information, and the categories of third parties to whom we have disclosed your Personal Information. You may also request information about the specific Personal Information we have collected about you.
Right to Delete. You have the right to request that we delete your Personal Information that we have collected from or about you, as required by U.S. Privacy Laws.
Right to Correct. Residents of California, Colorado, Nebraska, Texas and Virginia have the right to request that we correct inaccurate Personal Information that we maintain about them.
Global Privacy Control
Certain U.S. Privacy Laws require businesses to process signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the sale and sharing of Personal Information, such as the Global Privacy Control (the “GPC”). To implement the GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable it. We have configured the settings of our consent management platform to receive and process the GPC on our Website.
How to Exercise Your Rights
Residents of California, Colorado, Nebraska, Texas, Utah and Virginia may exercise their state law privacy rights by either:
- emailing us at [email protected];
- calling us at (877) 607-5468; or
- visiting the “Your Privacy Choices” webpage HERE and following the instructions.
You may also designate an authorized agent to exercise these rights on your behalf by following the process described in “Authorized Agents,” below.
You may request access to your Personal Information twice in any 12-month period, measured from the date we receive your first request. If you submit a request to obtain your Personal Information more than twice in any 12-month period, we will either: (i) proceed with honoring your request; or (ii) deny your request in writing.
In accordance with applicable law, you have the right not to receive discriminatory treatment from us as a result of your exercising these rights.
Verification
In order for us to process your request, we will need to obtain certain information from you to verify your identity.
For a report of the specific Personal Information we have processed about you, you must provide us with three of the following pieces of information in order for us to verify your identity:
- full name;
- email address;
- mailing address;
- telephone number
- your account number with a REPAY Client;
- previous REPAY transaction ID;
- your REPAY Client ID; or
- The last four digits of your debit card number, credit card number or bank account number used to make a payment via REPAY.
You also must tell us your state of residence and provide us with a signed declaration, under penalty of perjury, that you are who you say you are.
To request a report of the categories of Personal Information we have processed about you, to request that we delete or correct your Personal Information, you must provide us with two of the above-referenced pieces of information in order for us to verify your identity.
To the extent possible, we will use our existing account authentication practices to verify your identity. Where necessary, we may request additional information about you so that we can verify your identity. Where we did not already hold that information, we will use it only for the purpose of verifying your identity and to process your request. If you are submitting a request on behalf of a household, we will need to verify each member of the household in the manner set forth in this section.
Authorized Agents
You may use an authorized agent to exercise your rights on your behalf. Authorized agents may demonstrate that the agent has authority to exercise rights on the requesting consumer’s behalf by submitting supporting documentation to [email protected]. At a minimum, we will require evidence of the agent’s identity (via passport or driver’s license submission), and at least one of the following evidencing proof of your legal authority to act on the behalf of the individual who is the subject of this request:
- Written authorization signed by the consumer;
- Certified copy of a Power of Attorney; or
- Evidence of parental responsibility.
Whenever you interact with us on behalf of another individual or entity, such as by providing or accessing Personal Information about another individual, you represent that your interactions and exchanges comply with applicable U.S. Privacy Laws. You shall have sole responsibility for any violation of applicable laws as a result of a failure to obtain any necessary consent from such individual.
Timing
We will process Requests to Know, Correct, and Delete within 45 calendar days, unless we need more time, in which case we will notify you and may take up to an additional 45 calendar days (90 days total) to process your request.
Appeals
If you are a Colorado, Nebraska, Texas or Virginia resident and wish to appeal our response to your request to exercise your privacy rights, please contact us using any of the methods described in “Contact Information,” below. After receipt of an appeal, we will inform you of any action taken in response to the appeal, if any, along with a written explanation of the reasons for such action or inaction within the time periods required by applicable U.S. Privacy Laws.
- ADDITIONAL NOTICE FOR CALIFORNIA RESIDENTS
We disclose our tracking and “do not track” practices in Section 6. If you have any questions about this Policy or practices described in it, you should contact us in the following ways: Postal Mail: 3 West Paces Ferry Road, Suite 200, Atlanta, GA 30305, Attn: Legal/Marketing; By e-mail to [email protected].
- ADDITIONAL NOTICE FOR NEVADA RESIDENTS
Nevada “consumers” have the right to instruct us not to “sell” “covered information” as those terms are defined by Chapter 603A of the Nevada Revised Statutes. Although we do not currently “sell” “covered information” of Nevada “consumers” as those terms are defined under that law, you may contact us by one of the methods specified in “Contact Information” below and provide your name, Nevada resident address, and email address to be verified and exercise your opt-out rights in the event we do sell covered information under that law in the future. If you change your email address or other contact information, contact us in the same manner to update your contact information to help facilitate your opt-out. Changing your contact information elsewhere (e.g., informational requests, account information, etc.) will not update your Nevada opt-out information and we will only use the information provided to our opt-out program for managing opt-outs. It is your responsibility to keep your opt-out information current. If after opting-out you direct us to share you covered information with others, we will do so regardless of your prior opt-out.
- CONTACT INFORMATION
If you have questions regarding this Policy or our privacy practices generally, please contact us at:
Email: [email protected]
Phone: (877) 607-5468
Mail: REPAY, Attn: Legal Department, 3 West Paces Ferry Road, Suite 200, Atlanta GA 30305
We may update this Policy from time to time. The current Policy will be effective when posted. Please check this Policy periodically for updates. If any of the changes are unacceptable to you, you should cease interacting with us. When required under applicable law, we will notify you of any changes to this Policy by posting an update on the Websites.
If you are having trouble viewing or accessing this Policy or need it made available to you in an alternative format, please contact us at [email protected].
