1. Controller and contact
The data controller is offerpsp.com (Individual Entrepreneur, Georgia), trading as OfferPSP.
Privacy requests may be sent to bizdev@offerpsp.com with the subject “Privacy request”.
Legal
Privacy Notice
Effective date: 16 August 2026
This notice explains how offerpsp.com, an individual entrepreneur registered in Georgia and trading under the OfferPSP brand, handles personal data in its B2B matching, introduction and client-workspace service.
2. Scope
OfferPSP provides business-to-business research, matching and introduction support between merchants and independent payment service providers. This notice applies to offerpsp.com, the OfferPSP client workspace, business communications, matching workflows and related operational systems.
It does not govern a payment provider’s separate due-diligence process or services. Each provider is responsible for its own privacy notice and compliance.
3. Information we collect
Information you or your organisation provide
- Business contact data: name, role, work email, telephone number and Telegram username.
- Company and merchant-profile data: company and trading names, websites, registration and operating details, business model, vertical, target markets, currencies, traffic profile, expected volumes, payment methods, current setup and requested routes.
- Licensing and verification data: licence status, jurisdiction, licence number, supporting evidence and business documents uploaded for review.
- Request and relationship data: matching requests, shortlists, selections, introduction status, notes, tasks and decisions made within the workspace.
- Communications: messages, emails, Telegram correspondence where used, attachments, participants, delivery status and related timestamps.
Information collected when you use the service
- Authentication and security data: account identifiers, secure sign-in records, authorisation data, access events and abuse-prevention signals.
- Technical and operational data: browser and device information made available through standard web requests, IP-derived country, timestamps, requested pages, system events and error logs.
- Current-visit attribution: landing page, referring website and campaign parameters included in the page URL. The public website does not use this information for cross-site behavioural advertising.
Information from other sources
For relevant B2B research and outreach, we may receive business contact information from referrals, existing professional relationships, company websites, professional profiles, public registers or the organisation a person represents. Where personal data was not collected directly from you, this notice is provided at the first communication or within the period required by applicable law.
Fields marked as required are needed to identify the requesting business, contact its representative and assess the request. Providing them is not a statutory requirement, but without them we cannot accept or evaluate the request. Optional profile information can be added later in the client workspace.
Please do not submit payment-card data, bank credentials, passwords, special-category personal data or personal documents that are not reasonably required for a business review.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Receive a request, create an account, maintain the client workspace, assess fit, prepare matching results and arrange requested introductions. | Steps requested before entering a service relationship and performance of that relationship; where the user acts for an organisation, our legitimate interest in providing the requested B2B service. |
| Verify company and licensing information, prevent fraud or misuse, maintain security, troubleshoot the service and keep an audit trail. | Our legitimate interests in operating a secure, reliable and accountable B2B service; compliance with legal obligations where applicable. |
| Manage messages, follow-ups, support and the business relationship. | Performance of the requested service and our legitimate interest in responding to and managing business communications. |
| Send relevant one-to-one B2B outreach to a professional contact. | Our legitimate interest in developing relevant business relationships, only where permitted by applicable direct-marketing and electronic-communications law. You may object at any time. |
| Send optional newsletters or other consent-based marketing. | Your consent, where consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing. |
| Establish, exercise or defend legal claims and meet accounting, regulatory or lawful authority requirements. | Legal obligation and our legitimate interests in protecting our rights. |
Where we rely on legitimate interests, we consider the professional context, relevance, reasonable expectations, sensitivity of the data and impact on the individual. We do not use legitimate interests where those interests are overridden by the individual’s rights and freedoms.
5. Matching and AI assistance
OfferPSP may use rules and AI-assisted tools to organise merchant information, compare it with provider criteria, draft internal summaries or communications and highlight possible matches. These tools support human review. They do not make a solely automated decision that produces legal or similarly significant effects for a merchant or contact.
Provider onboarding, pricing, risk acceptance and contractual decisions are made independently by the relevant provider.
6. Who receives information
- Authorised OfferPSP personnel and contractors who need access for matching, support, security or administration and are subject to confidentiality obligations.
- Selected payment providers where a potential introduction is relevant. We do not publish merchant profiles or distribute them as an open lead list. A provider acts under its own responsibilities when it receives information for independent due diligence.
- Infrastructure and service providers supporting database, authentication, storage, hosting, automation, email delivery, communications, monitoring and AI-assisted workflows. Current core infrastructure includes Supabase-hosted data services in the European Union and Vercel-hosted web services. Other providers are used only as needed for the selected communication or workflow.
- Professional advisers, courts or authorities where disclosure is reasonably necessary to comply with law, protect rights or respond to a valid legal request.
We do not sell personal data or merchant profiles.
7. International transfers
Some service providers or recipients may process data outside the European Economic Area, the United Kingdom or your country. Where applicable law requires a transfer safeguard, we use an adequacy decision, approved standard contractual clauses or another lawful mechanism and apply appropriate technical and organisational measures. You may request information about the relevant safeguard by contacting us.
8. Retention
We keep personal data only for as long as needed for the purpose for which it was collected. Retention is determined by the status and duration of the request or account, the need to manage introductions and follow-ups, security and duplicate-prevention requirements, applicable limitation periods and legal or accounting obligations.
- Active account, request, matching and communication records are retained while the relationship is active and for a reasonable follow-up period.
- Uploaded business documents are removed when they are no longer reasonably required for review, introduction, a legal obligation or a dispute.
- Security and operational logs are kept according to limited operational cycles unless an incident requires longer preservation.
- After an objection to B2B outreach, we may retain a minimal suppression record so that the objection continues to be honoured.
Data may be deleted, anonymised or restricted earlier when it is no longer necessary or when a valid deletion request applies.
9. Security
We use access controls, authenticated client workspaces, row-level database permissions, private document storage, encrypted connections, restricted administrative access and operational logging. No online service can guarantee absolute security. If you believe information has been exposed or an account has been misused, contact us promptly.
10. Cookies and local storage
The public website does not use third-party advertising cookies or cross-site behavioural tracking. It may read campaign parameters and the referring page during the current visit. The client workspace uses strictly necessary authentication and session storage so that secure sign-in and account access work. Browser or device controls can remove this storage, but doing so may sign you out.
11. Your rights
Depending on the law that applies to you, you may request access, correction, deletion, restriction, portability or a copy of your personal data. You may object to processing based on legitimate interests and may withdraw consent where processing is based on consent.
You have an unconditional right to object at any time to the use of your personal data for direct marketing. We will stop that use and retain only the minimum information needed to honour the objection.
We may need to verify your identity before acting on a request. We normally respond within the period required by applicable law. You may also complain to the data-protection authority in your habitual residence, place of work or the place of the alleged infringement. The European Data Protection Board lists EEA supervisory authorities.
12. B2B outreach
When OfferPSP contacts a professional representative first, the message must identify OfferPSP, explain the business reason for the contact and provide a simple way to decline further messages. We do not conceal the sender or continue personal-data-based outreach after an objection. Country-specific rules may require consent for particular electronic communications; we apply those rules where they govern the contact.
13. Children and sensitive data
OfferPSP is a B2B service and is not intended for children. We do not knowingly collect children’s personal data or special-category personal data through the public intake form.
14. Changes to this notice
We may update this notice when the service, providers or legal requirements change. Material changes will be shown on this page and, where appropriate, communicated through the client workspace or email. The effective date at the top identifies the current version.
15. Contact
Email bizdev@offerpsp.com and include “Privacy request” in the subject line. Please do not send identity documents unless we specifically request them through a secure channel.