Privacy Policy

This Privacy Policy explains how Peko Payment Services LLC (referred to below as "Peko", "we" or "us") collects, uses, shares and protects personal data in connection with the PekoFlow platform. It applies to merchants using PekoFlow, authorised users of merchant accounts, end-customers whose payment data is handled by our licensed Acquiring Partners via PekoFlow, and visitors to our website.

Who we are and our role

Peko is a technology provider. PekoFlow is an orchestration layer between merchants and licensed third-party payment service providers, acquirers or payment gateways (each Acquiring Partner) that are separately licensed and regulated in the jurisdictions in which they operate.

For merchant account data and merchant user data, Peko acts as the controller (or equivalent concept) under applicable data protection laws, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

For end-customer information you (the Merchant) present through your checkout page, payment link, integration or other payment interface provided through the Platform (including name, email, phone number, billing address and order details), the Merchant acts as the controller (or equivalent concept under applicable law). Peko processes such personal data as the Merchant's processor (or equivalent concept) on the Merchant's documented instructions solely to provide the Platform, including routing transactions and transmitting transaction-related information. Peko does not process personal data for its own independent purposes except where required by law or necessary for Platform security, fraud prevention or compliance.

Personal data we Collect

• From merchants and merchant users:
• Identification and contact data: name, email, phone, role and address.
• Account security data: password (hashed), MFA settings, trusted devices and session logs.
• Business profile: legal and trade name, business type, jurisdiction, industry, website, merchant category code, monthly volume estimate, average ticket size, incorporation and tax registration numbers.
• KYB / KYC documents: trade licence, memorandum or articles of association, share certificate, VAT registration, identification of owners and controllers (passport, Emirates ID, visa), bank verification document, UBO declarations and powers of attorney where required.
• Banking data: bank name, account holder name, account number (encrypted at rest where stored), IBAN, SWIFT and settlement currency.
• Signed Service Terms and electronic signature evidence.
• From end-customers via the merchant's checkout:
• Identifiers you pass to us: name, email, phone, address and any optional identifier you provide.
• Order details: amount, currency, item description and order reference.
• Technical data used to route the transaction: IP address, device and browser identifiers, and timestamps.

Full card numbers, CVV/CVC and full track data are entered by the customer directly on the Acquiring Partner's PCI-DSS-compliant hosted page and are not collected or stored by PekoFlow. Peko may receive a truncated or tokenised card reference from the Acquiring Partner solely for reconciliation and reporting.

• From admin, support and audit interactions:
• Records of dispute submissions and evidence you upload (subject to a 2 MB file size limit).
• Support tickets, correspondence, chat logs, and phone calls where recorded on notice.
• Admin activity logs for compliance, incident response and audit purposes.

From cookies and similar technologies: see the Cookie Policy.

Why we use personal data

We process personal data for the following purposes:

Providing the platform: creating and maintaining merchant accounts, running the dashboard, generating API keys and webhook secrets, delivering hosted checkout pages, routing transactions, relaying settlement, refund and dispute events, and providing reports.

Onboarding and KYB support: platform-side collection and organisation of KYB documents on behalf of merchants, and onward sharing with the relevant Acquiring Partner(s) made available through the Platform .

Security and fraud prevention: authenticating users, applying MFA and step-up verification, detecting and preventing fraud, abuse and unauthorised access.

Compliance: meeting our legal and regulatory obligations, responding to regulator, law enforcement, court and card scheme requests, and cooperating with Acquiring Partners in their regulated processes.

Analytics, support and improvement: understanding usage, diagnosing errors, improving the platform and providing support.

Communications: sending service, security and legal notices, and, with consent where required, marketing and product updates. You may opt out of marketing communications at any time by using the unsubscribe link or contacting us.

Where applicable, we rely on one or more of the following legal bases under the UAE Personal Data Protection Law: (i) performance of a contract with you, (ii) compliance with a legal obligation applicable to us, (iii) our legitimate interests in operating and securing the platform, and (iv) your consent where the law requires it.

Who we share personal data with

We share personal data only as needed to run the platform, and only with the following categories of recipient:

Acquiring Partners: the regulated and licensed PSP, acquirer or payment gateway . We share your KYB information and transaction data with the Acquiring Partner so it can perform its own regulated onboarding, monitoring, settlement, refund and chargeback functions. Once shared, the Acquiring Partner processes that data as controller under its own privacy notice.

Peko group: Peko affiliates where they support platform delivery, security, group compliance and administration.

Service providers: cloud hosting, monitoring, security, analytics, email delivery, electronic signature, customer support and professional advisers, in each case under confidentiality and data protection obligations.

Regulators and authorities: where required by law or by a valid order (data protection authorities, tax authorities, courts, law enforcement and sanctions authorities).

Card schemes: Visa, Mastercard, American Express and any other scheme relevant to the payment methods used, where required by scheme rules.

Corporate transactions: in a merger, acquisition, financing or restructuring, with prospective parties and advisers under confidentiality.

Where a Merchant requests onboarding with more than one Acquiring Partner, or elects to use multiple Acquiring Partners through PekoFlow, Peko may share the Merchant's onboarding information, KYB documentation and related information with relevant Acquiring Partner enabled for your account for the purposes of onboarding, compliance, transaction routing and the provision of services requested by the Merchant.

We do not sell personal data.

International transfers

Personal data may be processed in jurisdictions other than the UAE, including in the ADGM and in countries where our Acquiring Partners, affiliates or service providers operate. Where a transfer is subject to the UAE Personal Data Protection Law, we use the transfer mechanisms permitted under that Law (including adequacy assessments, standard contractual clauses, binding corporate rules or explicit consent, as applicable).

How long we keep personal data

We keep personal data only for as long as we need for the purposes described above and to meet legal, tax, accounting, audit, regulator and card-scheme retention requirements. In broad terms:

• Merchant account and KYB data: for the duration of the account and a further period required by AML, tax and audit law (typically five to eight years in the UAE).
• Transaction and settlement data: for the retention period required by tax, audit and card scheme rules.
• Support and complaint records: for the period needed to demonstrate handling and to comply with limitation periods.
• Marketing consent and preference records: until you withdraw consent, plus a reasonable period to evidence the withdrawal.

Your data protection rights

Subject to applicable law and to legitimate exceptions (including where retention is required by another law or by Acquiring Partner's own regulatory obligation), you may request to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase data where the legal basis has ended and no exception applies.
• Restrict or object to processing based on legitimate interests.
• Receive a copy of the data you provided in a structured, machine-readable format where the law provides for portability.
• Withdraw consent where processing is based on consent (without affecting prior processing).
• Lodge a complaint with the UAE Data Office.

Requests should be sent to privacy@peko.one. Where the data relates to your transactions with Acquiring Partner, you may also need to contact the Acquiring Partner directly. We will assist with routing your request.

Where Peko acts as a processor on behalf of a Merchant, Peko may refer the request to the relevant Merchant and assist the Merchant in responding to that request.

Security

We maintain administrative, technical and physical safeguards designed to protect personal data, including encryption in transit and at rest for sensitive fields, multi-factor authentication, role-based access control, least-privilege access, monitoring, secure development practices, periodic vulnerability and penetration testing, PCI DSS-aligned controls on the components of the platform in scope, and incident response processes. No system is perfectly secure; you must also do your part to protect your credentials.

If we determine that a personal data breach has occurred that is likely to result in risk to you, we will notify you and the relevant supervisory authority in accordance with the UAE Personal Data Protection Law and within the timeframes required.

Children

PekoFlow is a business-to-business platform and is not directed at children. We do not knowingly collect data from anyone under the age of 18 in a personal capacity. If you believe a child has provided data to us, please contact privacy@peko.one.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or dashboard notice.

Contact us

Data protection queries and rights requests: privacy@peko.one

Postal address: Peko Payment Services LLC, UG 05-07, A7 Building, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE.

For matters relating to a specific transaction or settlement, please also contact the Acquiring Partner that processed the transaction as identified in your dashboard or receipt.