AIRPOS PRIVACY POLICY

information on the processing and protection of personal data

Version: 1.0
Effective date: 30 October 2026

1. GENERAL PROVISIONS

1.1. This Privacy Policy (the “Policy”) explains which personal data are processed when the AirPOS website, mobile application, Merchant Dashboard, payment pages, SoftPOS, PayLink, Virtual POS, Gateway, API and other AirPOS components are used; the purposes and legal grounds of processing; the recipients of data; and the rights available to individuals.

1.2. The operator of AirPOS is TRANZA LLC, a company incorporated under the laws of Saint Vincent and the Grenadines under registration number 4527 LLC 2026, with its registered office at Euro House, Richmond Hill Road, Kingstown, St. Vincent and the Grenadines (“TRANZA”, the “Operator”, “we” or “us”).

1.3. The Policy applies to data relating to:

visitors to the AirPOS website;
applicants for onboarding and Merchants;
directors, ultimate beneficial owners, representatives, employees, cashiers and other Authorised Users of Merchants;
Payers using payment pages or supported payment interfaces;
developers, representatives of partners and suppliers and other persons interacting with AirPOS.

Each such individual is referred to as a “Data Subject”.

1.4. The Policy applies together with the AirPOS Public Offer, Terms of Use, AML/CFT Policy, the contractual terms applicable to a particular Merchant and notices displayed when specific functions are used.

1.5. TRANZA processes Personal Data fairly, for specified purposes and only to the extent necessary for those purposes, and takes measures to maintain their accuracy, security and limited retention.

2. DEFINITIONS

Personal Data means any information relating to an identified or identifiable individual.

Processing means any operation involving Personal Data, including collection, recording, organisation, storage, use, disclosure, restriction, deletion and anonymisation.

Controller means a person that determines the purposes and essential means of Processing Personal Data.

Processor means a person that processes Personal Data on the documented instructions of a Controller.

Merchant means a business or organisation connected to AirPOS to accept payments for its own goods, works or services.

Payer means a person initiating a payment in favour of a Merchant.

Authorised User means an employee, cashier, representative, developer or other person to whom a Merchant has granted access to AirPOS.

Payment Partner means a bank, acquirer, processing organisation, payment system or another payment-infrastructure participant.

Transaction means an operation initiated through AirPOS using a supported payment instrument.

3. ROLES OF TRANZA MERCHANTS AND PAYMENT PARTNERS

3.1. TRANZA acts as an independent Controller when it determines the purposes and essential means of Processing, including when:

reviewing an application and onboarding a Merchant;
conducting KYB/KYC, AML/CFT, sanctions and risk checks;
providing and protecting accounts and AirPOS components;
arranging, monitoring and documenting Transactions;
preventing fraud, breaches and misuse;
handling requests, Refunds, Chargebacks, claims and disputes;
complying with its own legal, regulatory, accounting and reporting obligations.

3.2. A Merchant is an independent Controller of data it collects and uses for sales, orders, delivery, loyalty programmes, fiscal or cash-register receipts, customer support and its own other purposes. The Merchant is responsible for the lawfulness of such Processing.

3.3. Where TRANZA processes particular data solely on a Merchant’s documented instructions, TRANZA acts as a Processor. The scope, subject matter and conditions are set out in the agreement with the Merchant or a separate data-processing agreement.

3.4. Payment Partners, KYC/KYB providers and other infrastructure participants may act as independent controllers or processors depending on their role and applicable law. Their privacy notices apply to Processing whose purposes and means they determine independently.

3.5. Questions concerning an order, customer questionnaire, delivery, loyalty programme or other use of data by a Merchant should be addressed to that Merchant. Questions concerning Processing determined by TRANZA should be sent using the contact details in section 24.

4. SOURCES OF DATA

4.1. TRANZA may obtain Personal Data:

directly from the Data Subject during registration, form completion, verification, payment or contact with support;
from the Merchant, its representatives and Authorised Users;
from Payment Partners, banks, acquirers, processors and payment systems;
from providers of KYB/KYC, AML/CFT, sanctions screening, anti-fraud and information-security services;
from public registers, official lists, public sources and commercial databases whose use is lawful;
automatically from the device, application, browser, servers and security systems during interaction with AirPOS.

4.2. If a Merchant provides another person’s Personal Data to TRANZA, the Merchant must have a lawful basis for the transfer and provide that person with the required Processing information where the Merchant is obliged to do so.

5. DATA OF APPLICANTS MERCHANTS AND RELATED PERSONS

5.1. For application review, onboarding and ongoing service, TRANZA may process:

name, surname, date and place of birth, nationality and residential address;
contact details and preferred communication method;
details and images of identity documents;
position, authority, specimen signature and representation information;
information on directors, members, ultimate beneficial owners and ownership structure;
registration, tax, licensing and other corporate information where it relates to an individual;
business activity, professional experience, source of funds and source of business wealth where required for checks;
bank and settlement details relating to an individual;
results of sanctions, PEP, adverse-media and other applicable screening;
correspondence, questionnaire responses, documents and review results.

5.2. Where requested information is necessary for a mandatory check or for conclusion or performance of a contract, refusal to provide it may make it impossible to review the application, activate or continue the service.

6. ACCOUNT AND AUTHORISED USER DATA

6.1. When an account is created or used, TRANZA may process:

name, business contact details, position and relationship with the Merchant;
account identifier, assigned roles and access rights;
authentication and contact-verification information;
login history, settings changes and administrative actions;
device, active-session and security-event data;
messages, requests and support communications.

6.2. Passwords are stored in protected form. One-time codes, tokens, API keys and other access credentials are processed only to the extent necessary for authentication, authorisation and protection of AirPOS.

7. PAYER AND TRANSACTION DATA

7.1. In connection with a Transaction, TRANZA may receive and process a limited set of information, including:

amount, currency, date and time;
identifiers of the Transaction, Merchant, point of sale, device or payment request;
payment method and channel used to initiate payment;
information on the result in the terminology available in the infrastructure actually used;
masked card number, payment-instrument type or brand and other limited card attributes supplied by a Payment Partner;
information on authorisation, Refund, cancellation, Chargeback, dispute or suspicious activity;
contact details provided for a payment notification, response to a request or another requested function;
technical and security signals related to the operation.

7.2. A complete card number, PIN, card security code and other sensitive authentication data must not be entered or sent through AirPOS fields, messages or channels not intended for them. Where a secure payment interface is provided by a Payment Partner, the relevant details may be supplied directly to that partner and TRANZA receives only the limited data provided by the integration.

7.3. TRANZA does not obtain more information from a contactless payment instrument than is provided for by the payment technology, payment-system rules and Payment Partner configuration used.

7.4. AirPOS does not determine the content of a Merchant’s order beyond the information the Merchant includes in the payment request. The Merchant must not include special categories of data or other excessive information in the payment purpose.

8. TECHNICAL AND SECURITY DATA

8.1. When the website, application and platform are used, TRANZA may process:

IP address, date, time and approximate network-connection information;
browser type and version, operating system, language and interface settings;
device model, application version and technical application or device identifiers;
availability of NFC and device-compatibility information;
session identifiers and logs of logins, requests, errors and administrative actions;
crash, performance, diagnostic and function-usage data;
signals required to detect automated requests, attacks, fraud and unauthorised access.

8.2. Technical identifiers are used to operate and protect AirPOS and are not intended to obtain unrelated information from the device.

8.3. Mobile-application permissions are requested only for functions that require them. Availability may depend on permission being granted. The User can manage permissions in device settings, but disabling them may restrict the relevant function.

9. WEBSITE DATA COOKIES AND SIMILAR TECHNOLOGIES

9.1. The AirPOS website and web interfaces may use cookies, local storage and similar technologies that are strictly necessary to:

establish and protect a user session;
save language and other settings;
prevent fraud and misuse;
maintain technical operation;
diagnose errors and assess AirPOS performance.

9.2. Optional technologies are used on the basis of consent or another permissible ground where required by applicable law. Available settings and categories actually used are displayed in the cookie-management interface or relevant notice.

9.3. Restricting necessary cookies may prevent login or operation of protected functions. Browser settings do not always allow separate control of every form of local storage.

10. PURPOSES OF PROCESSING

10.1. TRANZA processes Personal Data for the following purposes:

reviewing applications and identifying and verifying applicants;
concluding, performing, amending and terminating Merchant agreements;
creating accounts, managing access and authentication;
providing and technically supporting AirPOS components;
arranging, routing, confirming, recording and reconciling Transactions;
settlement, Refunds, Chargebacks and resolution of discrepancies;
KYB/KYC, AML/CFT, sanctions and other mandatory checks;
preventing, detecting and investigating fraud, misuse and breaches;
protecting Users, devices, data, infrastructure and the payment ecosystem;
responding to requests, support, complaints, claims and disputes;
accounting, tax, audit, regulatory and other mandatory recordkeeping;
establishing, exercising and defending legal claims;
stability, diagnostics, testing and improvement of AirPOS;
sending service, contractual and security notices;
sending marketing communications where required consent or another legal basis exists.

10.2. TRANZA does not use data for an incompatible new purpose without an additional legal basis and, where required, prior notice to the Data Subject.

11. LEGAL BASES

11.1. Depending on the purpose and applicable law, TRANZA relies on one or more of the following bases:

necessity to enter into or perform a contract with the Data Subject or take pre-contractual steps at the Data Subject’s request;
compliance with a legal or regulatory obligation;
legitimate interests of TRANZA, a Merchant, Payment Partner or another person, subject to an appropriate assessment of the Data Subject’s rights and interests;
consent of the Data Subject;
establishment, exercise or defence of legal claims;
another basis provided by applicable law.

11.2. Legitimate interests may include security and resilience of AirPOS, fraud prevention, protection of business reputation and payment-infrastructure participants’ rights, service development, auditing, internal reporting and defence in disputes.

11.3. Where Processing is based on consent, consent may be withdrawn prospectively. Withdrawal does not affect the lawfulness of prior Processing or Processing supported by another legal basis.

11.4. For Data Subjects covered by the EU General Data Protection Regulation (GDPR) or similar law, the specific legal basis is determined for each Processing purpose.

12. KYC KYB AML CFT AND SANCTIONS SCREENING

12.1. TRANZA may process identification, corporate, financial and other information required to verify a Merchant and related persons, assess risk and comply with AML/CFT and sanctions obligations.

12.2. Checks may include comparison with documents, official registers, sanctions lists, politically exposed person information, adverse media and information from specialist providers.

12.3. TRANZA may request additional documents and information on source of funds, source of business wealth, ownership structure, nature of activities and specific Transactions where required for verification or by applicable requirements.

12.4. Rights of access, erasure, restriction and disclosure of review information may be limited where necessary to comply with retention duties, investigation confidentiality, prohibition on tipping-off, protection of monitoring methods or other mandatory rules.

13. FRAUD PREVENTION AND AUTOMATED PROCESSING

13.1. For risk assessment, TRANZA and its providers may use rules, models and automated tools taking into account Transaction parameters, activity history, technical signals, Merchant information, screening results and indications of unusual behaviour.

13.2. The result may lead to a request for further information, enhanced review, temporary restriction of a function, referral for manual review or another action permitted by contract and law.

13.3. Where a decision concerning a Data Subject is based solely on automated Processing and produces legal or similarly significant effects, TRANZA provides safeguards required by applicable law. These may include the right to request human intervention, express a view and contest the decision where those rights apply.

14. RECIPIENTS OF PERSONAL DATA

14.1. To the extent necessary for the relevant purpose, data may be disclosed to:

banks, acquirers, issuers, processors, payment systems and other Payment Partners;
the Merchant for whose benefit a Transaction is initiated and its authorised persons;
cloud, hosting, communications, analytics, support and development providers;
providers of KYC/KYB, AML/CFT, sanctions monitoring, anti-fraud and information-security services;
auditors, insurers, legal, tax and other professional advisers;
a prospective purchaser, investor or participant in a reorganisation, subject to confidentiality and applicable requirements;
courts, regulators, law-enforcement, tax and other competent authorities where disclosure is required by law or a lawful request;
other persons on the Data Subject’s instructions or with consent, or on another lawful basis.

14.2. Providers acting as Processors receive only data needed for the assigned function and are bound by contractual confidentiality, security and permitted-use requirements.

14.3. TRANZA does not sell Personal Data as a standalone commercial product or disclose it to third parties for their own advertising without the required legal basis.

15. INTERNATIONAL TRANSFERS

15.1. TRANZA is incorporated in Saint Vincent and the Grenadines and AirPOS may use providers and Payment Partners in multiple jurisdictions. Data may therefore be processed outside the Data Subject’s country.

15.2. For an international transfer, TRANZA applies the mechanism required by applicable law and assesses the data scope, purposes, recipient and transfer risks.

15.3. Where the GDPR applies, transfers outside the European Economic Area rely on an adequacy decision, standard contractual clauses, binding corporate rules, a statutory derogation or another permissible mechanism. Supplementary technical and organisational measures are applied where necessary.

15.4. Information on the applicable mechanism and available means of obtaining information on safeguards is provided on request to the extent permitted by law and confidentiality obligations.

16. RETENTION PERIODS

16.1. TRANZA retains data no longer than necessary for the relevant purpose unless longer retention is required by law, mandatory payment-infrastructure rules or defence of legal claims.

16.2. The retention period is determined with regard to:

the duration of the contractual relationship and account-closure period;
mandatory periods for KYC/KYB, AML/CFT, payment, accounting, tax and audit records;
Chargeback, claim and limitation periods;
the need to investigate an incident, fraud or breach;
sensitivity, volume, purposes and risk of continued retention;
documented periods applied by the relevant Payment Partner or provider.

16.3. As a general rule:

application, contract and account data are retained during the relationship and a subsequent period required for mandatory records and defence of claims;
KYC/KYB and AML/CFT documents are retained for at least the period prescribed by applicable mandatory requirements;
Transaction, settlement, Refund, Chargeback and dispute data are retained for mandatory financial and payment periods;
security and technical logs are retained for a period proportionate to security, diagnostics and investigation purposes;
requests and correspondence are retained until completion and longer where needed to evidence contractual actions or defend claims;
data processed by consent for marketing are retained until consent is withdrawn or an earlier ground for cessation arises.

16.4. After the applicable period, data are deleted, anonymised or isolated pending secure deletion unless a lawful basis for continued retention exists. Backups may remain within the backup cycle subject to restricted access.

17. DATA ACCURACY AND MINIMISATION

17.1. The Data Subject and Merchant must provide accurate and current information and notify changes relevant to service or mandatory checks.

17.2. TRANZA may request confirmation of updated data and restrict a function until verification is completed.

17.3. Documents, card details, health data, biometric data or other sensitive information must not be sent through free-text fields, support or payment descriptions unless TRANZA expressly requests them through a designated secure channel.

18. INFORMATION SECURITY

18.1. TRANZA applies technical and organisational measures appropriate to the nature of the data and assessed risk. Depending on the system, measures may include encryption in transit, access controls, multi-factor authentication, logging, monitoring, backups, segmentation, vulnerability management and incident-response procedures.

18.2. Employees and contractors receive access only to the extent necessary for their functions, subject to confidentiality and authority controls.

18.3. No method of transmission or storage eliminates risk entirely. Users must protect devices and credentials, use official application versions and immediately report suspicious activity.

18.4. In the event of a security breach, TRANZA takes measures to contain, assess and remediate the effects and notifies Data Subjects and competent authorities where required by applicable law.

19. DATA SUBJECT RIGHTS

19.1. Depending on applicable law, a Data Subject may have the right to:

receive information about Processing and access Personal Data;
request correction of inaccurate or incomplete data;
request erasure;
request restriction of Processing;
object to Processing based on legitimate interests or for direct marketing;
receive provided data in a portable format;
withdraw consent prospectively;
not be subject to a decision based solely on automated Processing where applicable law grants that right;
lodge a complaint with a competent supervisory authority;
exercise other rights provided by applicable law.

19.2. Rights are not absolute. A request may be limited wholly or partly where data are required for contract performance, mandatory retention, AML/CFT, fraud prevention, rights of others or establishment, exercise and defence of legal claims.

20. EXERCISING RIGHTS

20.1. Requests should be sent to info@airpos.co and describe the request and information allowing the relevant record to be located.

20.2. Before acting, TRANZA may reasonably verify the requester’s identity and authority. A copy of an identity document should not be sent unless requested through a secure channel.

20.3. TRANZA responds within the period prescribed by applicable law. For a complex or numerous request or where another Controller must participate, the period may be extended within lawful limits with notice to the requester.

20.4. Requests are normally handled free of charge. A reasonable fee or refusal may apply only where permitted by law, including manifestly unfounded or excessively repetitive requests.

20.5. Where TRANZA acts as Processor for a Merchant, the request may be forwarded to that Merchant or the Data Subject may be asked to contact the Merchant directly.

21. SERVICE AND MARKETING COMMUNICATIONS

21.1. TRANZA may send communications necessary for registration, security, contract performance, Transactions, account servicing, amendments to mandatory documents and handling requests. Opting out may be impossible while the relevant function is used.

21.2. Marketing communications are sent where the required legal basis exists. They may be declined using the provided link, settings or the contact address.

21.3. Opting out of marketing does not stop mandatory service and security notices.

22. MINORS DATA

22.1. Merchant and Authorised User accounts are intended for adults with the necessary legal capacity and authority.

22.2. AirPOS is not intended for independent collection of children’s data for marketing or account creation. A minor’s payment may be processed only within a permissible payment operation and subject to the rules of the Merchant, issuer and applicable law.

22.3. If TRANZA determines that a minor’s data were obtained without the required basis, reasonable measures will be taken to stop Processing or obtain the required confirmation.

23. AMENDMENTS TO THE POLICY

23.1. TRANZA may update the Policy following changes to AirPOS, providers, payment-infrastructure requirements, Processing practices or applicable law.

23.2. The current version is published on the official AirPOS website with its effective date.

23.3. Material changes are communicated through the website, application, account, email or another appropriate channel where required by law or the nature of the change.

23.4. An amendment does not retroactively alter the legal basis of Processing or cancel Data Subject rights.

24. CONTACT INFORMATION

For questions concerning privacy, Processing of Personal Data or exercise of rights, please contact TRANZA:

TRANZA LLC
Registration No.: 4527 LLC 2026
Euro House, Richmond Hill Road, Kingstown, St. Vincent and the Grenadines
Email: info@tranza.io

Please use the subject line “Privacy Request”. If the matter concerns a particular Merchant’s use of data, TRANZA may forward the request to the relevant Controller or provide the Controller’s available contact details.