PortalGet Started

Legal

Personal data policy

This policy covers the data of business representatives — people who submit an onboarding request, correspond with the company or file an enquiry. Data of an individual payer is covered by a separate document.

Data holder

The personal data holder is MONTRA Limited Liability Company. The holder determines the purposes and scope of processing and performs the duties imposed by law.

Full legal name
MONTRA Limited Liability Company
Registered address
Kyrgyz Republic, Bishkek, Leninsky district, Liniya 7-ya St., 9
Tax ID
02410202510157
Email
info@montra.kg
Call centre
+996 508 118 111
Payment organisation licence
№ 3071290126 · 29 January 2026
Payment system operator licence
№ 2069290126 · 29 January 2026
Issuing authority
National Bank of the Kyrgyz Republic

to be confirmedTax ID, email and call centre number are published once confirmed by the holder.

Who this policy covers

The policy covers MONTRA LLC’s processing of personal data of merchant representatives who submit an onboarding request, people corresponding with the company, people filing an enquiry or claim, and website visitors.

Processing of an individual payer’s data is not governed by this policy: it has different purposes, different legal grounds and different recipients. It is covered by a separate document.

Payer data processing

Purposes of processing

Consent is given separately for each purpose. Consent given for one purpose does not extend to another.

  • reviewing an onboarding request and responding to it;
  • concluding and performing the contract, including reconciliation;
  • customer due diligence under anti-money-laundering requirements;
  • handling enquiries, claims and disputes;
  • complying with statutory requirements and requests from authorised bodies;
  • ensuring security and preventing unlawful acts;
  • informing about services and materials — only where separate consent has been given.

Categories of data subjects

  • representatives and contact persons of merchants who submit an onboarding request;
  • authorised representatives of active merchants;
  • people who file an enquiry or claim;
  • website visitors.

Categories of data processed

  • identification data: full name;
  • contact data: phone number, messenger handle, email address;
  • business details: represented organisation, position, documents evidencing authority;
  • the content of the enquiry or request and the related correspondence;
  • technical data needed to protect the website against automated requests.

Special categories of data and biometric data are not collected. The public form on the website is deliberately limited to five fields: tax ID, documents and volumes are collected at the next step inside a protected perimeter — a public form must not become a store of sensitive data.

Retention periods

Personal data is kept no longer than the purpose of processing requires. Periods prescribed by law — for customer due diligence, accounting and reporting — continue to apply after consent is withdrawn.

Once the purpose is achieved, the data is destroyed or anonymised.

to be confirmedSpecific retention periods per purpose will be set by the approved revision of this document.

Recipients and cross-border transfers

The list of recipients is published by name: organisation, country and purpose of transfer. The list is filled in as contracts with contractors are actually signed — a provisional “indicative” list would be both inaccurate disclosure and a basis to treat the transfer as agreed.

As at publication, the website uses no external analytics, no external fonts and no third-party pixels.

Cross-border transfers are carried out under Article 89 of the Digital Code. The regulator has not published a list of countries with an adequate level of protection or standard contractual clauses, so transfer to a foreign service is permissible only with explicit informed consent that names the transfer, and under a data processing agreement with the contractor.

to be confirmedThe named list of recipients and of countries of cross-border transfer will be published as contracts with contractors are concluded.

Rights of the data subject and how to exercise them

To exercise a right, send a request to the holder. The request should state the requirement and include details allowing us to confirm that it comes from the data subject.

  • obtain information about the processing of your data and request a copy of it;
  • have inaccurate or incomplete data corrected;
  • require blocking or destruction of data in case of unlawful processing;
  • withdraw consent previously given;
  • appeal the holder’s actions to the authorised body and to court.

to be confirmedThe review period, identity verification methods and response format will be set by the approved revision of this document.

Responsible person and contacts

A person responsible for organising personal data processing has been appointed. Names and photographs of employees are not published on the website: this creates a target map for social engineering and would require their separate consent — a functional contact channel is published instead.

to be confirmedThe contact email of the responsible person is published once confirmed by the holder.

Contacts

Protection measures

Access to data is limited to employees who need it for their duties; transmission uses encrypted channels.

Internal information security policies are built on the principles of ISO/IEC 27001 and PCI DSS; certification is planned.

Security and compliance

Changes to this policy

A new revision of the policy is published with its effective date. Earlier revisions remain available, so it is always possible to check which text a consent was given against.