Payer data processing

1How this differs from the personal data policy

In the personal data policy the subject is a business representative: they submitted the onboarding request themselves, gave consent themselves and can withdraw it at any time.

Here the subject is a person sending a transfer. They did not choose MONTRA — they chose the partner’s service. The ground for processing is therefore mostly not consent but carrying out the transaction and complying with the law: refusing consent would mean being unable to send the transfer, and such “consent” would not be freely given.

Personal data policy

2Who is involved and in what role

• The partner — a participant of the payment system that has connected the P2P infrastructure and a party to the relationship with the user. It is an independent holder of its users’ data.
• MONTRA LLC — receives, processes and transmits financial information about the transaction.
• The issuer — the organisation that issued the payment instrument and authorises the transaction.
• Participant banks — perform the movement of funds.

MONTRA processes information about the transaction. Data about product quality, delivery and return terms is processed by the partner — such questions should be addressed to them.

3Purposes of processing

• receiving and carrying out the payment and settling with the partner;
• confirming the transaction and providing payment information;
• preventing fraud and securing transactions;
• handling refunds, disputed transactions and payer enquiries;
• complying with anti-money-laundering requirements;
• accounting, reporting and responding to requests from authorised bodies.

Payer data is not used for advertising purposes without separate consent.

4Categories of data processed

The data processed depends on the payment method and on the contract with the partner. The general principle is that only the minimum needed to carry out the payment is processed.

Payment instrument credentials are not stored on MONTRA’s side: they are processed and tokenised within the certified perimeter of a partner bank. Payment pages are hosted on a separate subdomain, apart from the marketing website.

• transaction parameters: amount, currency, date and time, identifier, status;
• details of the partner whose service created the transaction and the purpose of the transfer;
• contact details the payer provides themselves to receive confirmation;
• technical data needed to prevent fraud.

to be confirmedThe exact list of payment form fields will be published once contracts with partner banks are signed and the list of payment methods is approved.

5Legal grounds

Processing is carried out under Chapter 11 of the Digital Code of the Kyrgyz Republic No. 178 (Articles 77–90).

• performance of the contract between the payer and the partner and execution of the payment;
• compliance with statutory duties: customer due diligence, reporting, requests from authorised bodies;
• fraud prevention and transaction security;
• consent — only for optional purposes, such as additional notifications.

6Who the data is shared with

The full list of recipients is published by name: organisation, country and purpose of transfer. The list is filled in as contracts with contractors and partner banks are actually signed.

Cross-border transfer is permissible only with explicit informed consent that names the transfer, and under a data processing agreement with the contractor.

• the partner — to confirm the transaction and perform its obligations to the payer;
• participant banks and the issuer — for authorisation and movement of funds;
• authorised state bodies — in the cases and to the extent provided by law.

to be confirmedThe list of recipients and of countries of cross-border transfer will be published as contracts are concluded.

7Retention periods

Transaction records are kept for the periods prescribed by anti-money-laundering, accounting and reporting legislation. These periods cannot be shortened at the payer’s request.

Data not covered by statutory retention periods is destroyed or anonymised once the purpose is achieved.

to be confirmedSpecific retention periods per data category will be set by the approved revision of this document.

8Rights of the payer

• obtain information about the processing of your data;
• have inaccurate data corrected;
• require blocking or destruction of data in case of unlawful processing;
• withdraw consent given for optional purposes;
• appeal the holder’s actions to the authorised body and to court.

Transaction records cannot be destroyed before the statutory retention periods expire: such records form part of financial reporting and are subject to inspection.

Withdrawing consent

9Where to get in touch

For questions about the processing of payment data and to exercise your rights, contact MONTRA. Questions about the goods or service should go to the partner.

Email

info@montra.kg

to be confirmedContact details for enquiries are published once confirmed by the holder.

Enquiries, claims and disputes