Privacy Policy

1. Who we are (data controller)

The controller responsible for processing your personal data is:

• NEXTGEN PAYMENT SRL, a Belgian société à responsabilité limitée (private limited company)
• Registered office: Rond-point Robert Schuman 2-4, box 6, 1040 Brussels, Belgium
• Enterprise number (CBE/KBO): 0782.389.429
• VAT number: BE 0782.389.429
• Email: [email protected]
• Phone / WhatsApp: +32 497 59 22 76
• Website: www.nextgenpayment.eu

NextGen Payment acts as an Independent Sales Organisation (ISO) and payments consultancy. We introduce merchants to third-party acquiring banks, payment service providers and IBAN account providers, and advise them on acquiring, payment gateway solutions, IBAN accounts, crypto pay-in and pay-out, fraud and chargeback prevention, Visa VAMP guidance, payments consultancy and events. We are not a bank, payment institution or acquirer, and we do not hold or move client funds. Contracts for the actual payment services are concluded directly between the merchant and the third-party provider, which applies its own terms and its own KYC and AML checks.

We have not appointed a Data Protection Officer. For any question about this policy or about your data, please contact [email protected].

2. What data we collect and from where

We collect the following categories of personal data:

• Contact and onboarding form (at /start-now): first name, last name, corporate email, phone, company name, website, country, monthly volume and business information, services of interest, and any free text message you send.
• Messages you send us: the content of emails and WhatsApp messages, together with the contact details they contain.
• Merchant and representative data shared during onboarding: identity and company details of merchants and their representatives that we pass to partner acquirers for their KYC checks. Where we receive data about a representative from the merchant rather than from the person directly, this policy (in particular sections 2 to 9) serves as the information required under Article 14 GDPR.
• Analytics and advertising data: collected through cookies and similar technologies only with your consent (Google Analytics 4, Google Ads conversion tracking and Meta Pixel, loaded through Google Tag Manager with Google Consent Mode v2).
• Strictly necessary technical data: a first-party item that stores your cookie choice (ngp_consent, 12 months) and Cloudflare security data (Turnstile anti-spam on the form, __cf_bm and cf_clearance).

We obtain this data directly from you when you use our form, write to us or go through onboarding, and in the case of representative data from the merchant you work for.

3. Purposes and legal basis

We process your personal data for the following purposes, each with its own legal basis under the GDPR:

• Responding to enquiries and carrying out onboarding: to answer your questions, prepare and introduce you to suitable providers and take the steps leading up to a possible agreement. Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• B2B follow-up and keeping our services secure: to follow up on business relationships with merchants and representatives, send relevant information to professional contacts, and protect our website and systems against fraud, spam and misuse. Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in developing our business and ensuring security.
• Accounting and anti-money-laundering obligations: to keep accounting records and comply with applicable legal duties. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
• Analytics and advertising cookies: to measure how our website is used and to run and measure advertising. Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

4. Is providing your data mandatory?

Providing your data is voluntary, but some data is necessary for specific purposes. The fields marked as required on the form are needed so that we can reply and assess your request; without them we cannot process your enquiry or carry out onboarding. The identity and company details required for KYC are needed by the partner provider to open and maintain the payment service; without them the provider cannot enter into or continue the relationship. Analytics and advertising cookies are entirely optional, and refusing them has no effect on your use of the website or on our services.

5. Recipients and processors

We share personal data only where necessary, with the following recipients and processors:

• HighLevel Inc. (CRM, USA)
• Pabbly (form automation, India)
• Google Ireland Ltd / Google LLC (Analytics, Ads and Tag Manager, USA)
• Meta Platforms Ireland Ltd (Pixel, with transfers to the USA)
• Cloudflare Inc. (CDN and security, USA)
• one.com (email hosting, Denmark, EU)
• Raiola Networks (web hosting, Spain, EU)
• Partner acquiring banks and payment service providers chosen together with the merchant (inside and outside the EU), which act as separate controllers for their own KYC, AML and service purposes
• Professional advisers and public authorities where we are legally required to disclose data

6. International transfers and safeguards

Some recipients are located outside the European Economic Area (EEA). Where this is the case, we rely on appropriate safeguards:

• United States: the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise the European Commission's Standard Contractual Clauses.
• India and other countries: the European Commission's Standard Contractual Clauses.

You may request a copy of the relevant safeguards by writing to [email protected].

7. How long we keep your data

• Enquiries and leads that do not become clients: 24 months after the last contact.
• Client and contract data: the duration of the relationship plus 10 years, to meet Belgian accounting and AML retention obligations.
• Analytics cookies: as set out in the cookie table (for example _ga 2 years, _ga_<ID> 2 years, _gcl_au 90 days, _fbp 90 days).
• Consent record: 12 months.

8. Your rights

Under the GDPR and the Belgian Act of 30 July 2018 you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data in the cases provided by law.
• Restrict processing in the cases provided by law.
• Data portability, where processing is based on consent or on a contract and is carried out by automated means.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time, after which we will stop processing your data for that purpose.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not be subject to a decision based solely on automated processing. We do not take such decisions.

To exercise any of these rights, email [email protected]. We will reply within one month of receiving your request. We may ask for information to confirm your identity before acting on a request.

9. Complaints to the supervisory authority

If you believe your data is not being processed in accordance with the law, you have the right to lodge a complaint with the Belgian Data Protection Authority:

• Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit)
• Rue de la Presse 35, 1000 Brussels, Belgium
• www.dataprotectionauthority.be
• [email protected]

10. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access and disclosure. These include the use of Cloudflare security services, anti-spam protection on our form (Turnstile) and restricted access to data within our organisation and processors. No method of transmission or storage is completely secure, but we work to keep our safeguards in line with the risk.

11. Cookies

Our website uses strictly necessary items to function and to remember your cookie choice, and, only with your consent, analytics and advertising cookies (Google Analytics 4, Google Ads and Meta Pixel) loaded through Google Tag Manager with Google Consent Mode v2. We rely on the Belgian Electronic Communications Act of 13 June 2005 (Article 10/2) for consent to non-essential cookies. You can change or withdraw your choice at any time through the "Cookie settings" link in the footer. For full details, see our Cookie Policy.

12. Minors

Our services and website are intended for businesses and their representatives. They are not aimed at, and must not be used by, anyone under the age of 18. We do not knowingly collect personal data relating to minors.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our activities or in the law. The current version is always available at /policies-terms/privacy-policy. Where changes are significant, we will take reasonable steps to inform you.

14. Effective date

This Privacy Policy is effective as of 13 October 2026. You may also wish to read our Terms and Conditions and our Legal Notice.