GDPR — Data Protection

Last updated: June 2025

1. Our Commitment

Paynorama is committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). We process personal data lawfully, fairly, and transparently.

2. Data Controller

The data controller is:

Entity: Paynorama
Representative: Marouen Bachoual
Email: contact@paynorama.io

3. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access (Art. 15): Request a copy of the personal data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate data
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
Right to restriction (Art. 18): Request restriction of processing in certain circumstances
Right to portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interests
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

4. How to Exercise Your Rights

To exercise any of the above rights, send a request to contact@paynorama.io. We will respond within 30 days. We may ask you to verify your identity before processing your request.

5. Data Processing Activities

Authentication: Email and password — legal basis: contract performance
Billing: Name, email, billing address — legal basis: contract performance
Analytics: Aggregated usage data — legal basis: legitimate interest
Support communications: Email — legal basis: legitimate interest / contract

6. Data Transfers

Your data is stored and processed within the European Union. Any transfer outside the EU is performed under adequate safeguards as required by GDPR Chapter V.

7. Sub-processors

We use the following sub-processors, each bound by a Data Processing Agreement:

Resend — transactional emails
Umami — cookieless analytics, self-hosted on our EU infrastructure
Stripe / payment processor — billing

8. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by Art. 33-34 GDPR.

9. Supervisory Authority

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the French supervisory authority: CNIL — www.cnil.fr.

10. Contact

For any GDPR-related enquiries: contact@paynorama.io