Privacy policy

Version 1.0In force from Previous versions
Contents
  1. 1. Who processes the data
  2. 2. What data the service uses
  3. 3. What the data is needed for
  4. 4. Recipients of the data
  5. 5. Cookies and analytics
  6. 6. Retention and rights
  7. 7. Data protection

1.Who processes the data

Operator
EASTERN PACIFIC HOLDINGS LIMITED
Company address
Unit 1002, 10/F, Lippo Centre, 89 Queensway, Admiralty, Hong Kong
Registration number
201229313D
Website
https://niceway.pro
Enquiries
@niceway_support

2.What data the service uses

  • account identifiers and the contact email;
  • authentication data and security events;
  • information about orders, payments, refunds and the products issued;
  • information required by an identity verification provider when a particular operation requires KYC;
  • technical logs: IP address, user agent, request time, session identifiers and audit events;
  • optional analytics events, only when an analytics tag is configured and after the user has made a choice in the cookie banner.

2.1Card numbers (PAN), CVC codes, one-time codes, passwords and provider keys must not end up on public pages, in analytics events or in logs.

3.What the data is needed for

  • creating and protecting the account;
  • creating, carrying out and displaying orders;
  • checking payments, webhooks and repeated requests;
  • issuing virtual cards through providers;
  • preventing abuse, investigating errors and auditing;
  • meeting applicable contractual and legal requirements.

4.Recipients of the data

4.1Data is passed on only to the extent needed for a particular operation: to payment providers, virtual card providers, identity verification providers, and infrastructure and email delivery providers. The providers’ own terms apply where they act as separate operators.

5.Cookies and analytics

5.1Required cookies support the session, CSRF protection and the selected settings. Consent cookies are isolated in the Niceway namespace. The analytics script, preconnect, noscript and goals are not included in the page if there is no analytics identifier; if there is one, they are enabled only in accordance with the user’s choice.

6.Retention and rights

6.1Retention periods depend on the type of data, the status of the contract, the requirements of payment and financial rules, security and applicable law.

7.Data protection

7.1The service uses separate user and administrator authentication, parameterised SQL queries, webhook signature verification, idempotent financial operations, action auditing and isolated provider boundaries.