Last updated: 6 September 2026Content version: 2026-09-06.1

EuniPay Privacy Policy

This Privacy Policy explains how EuniTech AB ("EuniTech", "we", "our", or "us") processes personal data through EuniPay.

Scope

This Policy applies to EuniPay merchant accounts, public product and documentation pages, dashboard sessions, server APIs, connected payment-platform configuration, managed Checkout, payment-event verification, signed callback delivery, tax-evidence processing, Transactions, and Receipts. It does not govern a Merchant's storefront, payment-platform account, products, fulfilment, support, refunds, or independent use of buyer data. Merchants must provide their own notices for those activities.

Controller and Processor Roles

EuniTech generally acts as controller for merchant account administration, service security, access logs, abuse prevention, operational communications, billing, and its own legal obligations. For buyer identity, address, VAT evidence, payment context, Checkout, payment-platform reference, Transaction, Receipt, and merchant callback data processed for a Merchant's sales, the Merchant determines the purposes and EuniTech generally processes that data on the Merchant's instructions to provide EuniPay.

The precise role depends on the activity and applicable law. The Merchant is responsible for deciding which buyer data it submits, establishing a lawful basis, providing required notices, minimising data, and responding to buyers for its own processing.

Information We Process

EuniPay processes the following categories when provided or generated for the Service:

  • Merchant and seller information: business contacts, usernames, password hashes, account and environment identifiers, seller legal and VAT details, addresses, currency settings, and commercial-rate configuration.
  • Buyer information: merchant buyer references, names or business identity, billing address and country, VAT number, business or consumer status, and submitted Buyer Profile fields.
  • Tax and location evidence: VIES request and result evidence, timestamps, buyer-country evidence, IP addresses or IP-derived country evidence, GeoIP reference metadata, VAT rates, and reverse-charge decisions.
  • Payment-platform and Checkout information: payment-platform configuration and account identifiers, encrypted credentials and signing secrets, Webhook URLs and configuration, enabled payment methods, Checkout and external-order identifiers, origin restrictions, provider session, payment and event references, event verification metadata, payment status, and merchant callback URLs, signing-secret metadata, delivery state, and retry records.
  • Transactions and Receipts: Tax Preview and Tax Quote values, monetary amounts, currencies, conversion snapshots, verified or merchant-declared payment references and timestamps, Transaction snapshots, Receipt numbers and content, and generated Receipt files.
  • Authentication and operations: session identifiers, session timing and revocation state, API-key identifiers and hashes, request and security logs, IP addresses, user agents, idempotency records, errors, and audit metadata.

Purposes

We process data to provide and administer EuniPay; authenticate users and API clients; connect supported payment platforms; create and operate Checkout; verify payment-platform events; deliver signed callbacks; calculate supported VAT and currency context; obtain and preserve evidence; generate Transactions and Receipts; secure, troubleshoot, audit, and maintain the Service; prevent misuse and fraud; provide support and operational communications; comply with law; and establish or defend legal claims.

Legal Bases

Where the GDPR applies and EuniTech acts as controller, processing is based as appropriate on performance of a contract, legitimate interests in operating and securing EuniPay, compliance with legal obligations, or consent where specifically requested. When EuniTech acts as processor, the relevant Merchant determines the applicable legal basis for submitted buyer and Transaction data.

Sources and Sharing

We receive data from Merchants and their authorised users, Merchant backend API calls, service use, connected payment-platform APIs and Webhook events requested by a Merchant, and sources used for documented functions such as VIES and GeoIP country data. EuniPay also generates calculated, operational, callback-delivery, and audit data from those inputs.

We share data only as reasonably necessary with the Merchant that owns the relevant environment, authorised personnel, infrastructure and professional-service providers, third-party services used for requested functions, authorities where legally required, and parties necessary to protect rights, security, and the Service. We do not sell personal data in the ordinary commercial sense.

Locations and International Transfers

EuniPay's primary PostgreSQL database, Redis services, and S3-compatible object storage are currently hosted on Alibaba Cloud infrastructure in Frankfurt, Germany. Providers and authorised support resources may process data in other countries. Where required, we rely on applicable adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards and supplementary measures under data-protection law. EuniPay does not claim that every third party processes data only in the EEA.

Retention

We retain personal data for as long as reasonably needed for service delivery, account administration, security, contractual obligations, billing, dispute resolution, legal compliance, and backup integrity. Account data, sessions, logs, idempotency records, tax evidence, Transactions, Receipts, and generated objects may have different purposes and retention periods. Data is deleted or anonymised when no longer needed, subject to legitimate technical and legal constraints.

Security

We use reasonable technical and organisational measures designed to protect EuniPay data, including access controls, credential hashing or encryption as applicable, environment separation, private object storage, signed callback delivery, logging, and infrastructure safeguards appropriate to the Service. No system is completely secure, and Merchants remain responsible for their own systems, payment-platform account access, credentials, Webhook configuration, and backend access.

Merchant and Buyer Rights

Depending on applicable law and the processing role, individuals may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent where consent is used. We may verify identity and authority before acting. Buyers should normally contact the Merchant that collected and submitted their data; we assist Merchants with valid requests as required for our role.

Individuals may complain to their local supervisory authority, including Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection.

Cookies and Browser Storage

The dashboard uses a necessary authentication cookie and limited browser storage for authentication, language, and environment preferences. EuniPay does not currently use non-essential Analytics or advertising technology. See the Cookie Notice for details.

Changes

We may update this Policy when EuniPay functions, processing, providers, or legal requirements change. The current content version and date are published with the legal bundle.

Contact

Questions, privacy requests, or concerns may be sent to: