Tap to Pay app privacy policy
1. Who we are and what this policy covers
This policy describes how NEXTEP SOLUTIONS SRL (registered office: Avenue Charles-Quint 584, 1082 Berchem-Sainte-Agathe, Belgium, CBE 0807.560.929), which markets its payment-acceptance solution under the Nextepay brand, processes personal data in its Android application Nextepay Tap to Pay (shown as "Nextepay" on the phone, package name be.nextepay.softpos).
The app lets a merchant accept contactless card payments with an NFC phone, send payment links and receipts, and follow its payments. It completes our general privacy policy, which applies to everything this page does not cover.
Contact for any question relating to data: privacy@nextepay.com.
2. Who uses the app
The app is used by merchants and by the people of their team whom they invite to take payments, as sellers or managers. The merchant's customers, who pay, do not install it; what the app processes about them is described in section 5.
3. What the app processes, and why
Your account
Your name, your e-mail address, your role and the business you take payments for. Your password is sent only when you sign in and is stored on our servers as a hash, never on the phone. If your business shares a phone, the 4-digit code you use to take it over is also stored as a hash. The phone keeps your session until you sign out, your password changes or your access is removed.
Purpose: signing you in, applying your role (a seller cannot refund or cancel a payment) and knowing who took each payment. Legal basis: the performance of the contract between Nextepay and the merchant.
Payments
For each payment: the amount, the tip, the reference you enter, the date and time, the way of paying (card, link or QR code), the result, the card brand, the last four digits of the card, the authorisation code and the person who took it.
Purpose: the payment history, receipts, refunds, reconciliation with payouts and support. Legal basis: the performance of the contract, and our accounting and payment-services obligations.
The full card number and the card's security data are read by the payment component built into the app and encrypted at once. Neither Nextepay nor the merchant ever sees them.
Location
The app accesses the phone's approximate and precise location. The payment component reads it while the app is in use to take payments: the security rules of the card networks require checking the country where the phone takes payments. The location is used to prevent fraudulent transactions and to handle disputes about a transaction reported as fraudulent.
It is not used to track you, nor for advertising, and it is never sold. The app explains this before Android asks for the permission. Without it, the app cannot take card payments. Legal basis: our legal obligations and the legitimate interest of preventing payment fraud.
The phone and its security
The phone's model, device identifiers, the result of integrity checks (that the phone is genuine, unmodified and up to date, including through Google Play Integrity) and the technical and crash logs of the payment component, which it sends to Datadog, its monitoring service.
Purpose: the security of payments, required by the card networks, and troubleshooting. Legal basis: our legal obligations and the legitimate interest of securing payments.
Contact details you enter for a customer
When you send a receipt or a payment link, the e-mail address or the phone number of the customer that you type. Receipts by e-mail are sent by Nextepay. Text messages and WhatsApp messages leave from your own phone's apps: Nextepay only records that the receipt or the link was sent, how and to whom.
Purpose: sending the receipt or the link the customer asked for. Legal basis: the performance of the contract.
4. The permissions the app asks for
- NFC: reading contactless cards and phones held against the phone;
- Location: see section 3;
- Camera: the payment component checks that no app is using the camera during a payment, so that nobody can film the card or the code being entered. To scan a barcode into the reference, the app opens Google's scanner, which runs in Google Play services: the app only receives the code read;
- Network access: talking to Nextepay and to the payment platform;
- Do Not Disturb: if you agree, the payment component turns on Do Not Disturb while a payment is being made, so that no call or notification interrupts it or shows on the screen;
- Hiding other apps' windows: during a payment, the payment component hides the windows other apps draw over it, so that none can cover or spy on the code entry;
- Notifications: the payment platform sends technical messages to the payment component through Google Firebase Cloud Messaging, with Pushy as a backup service;
- Starting with the phone, alarms, keeping the phone awake, background work: keeping the payment component ready after the phone restarts, and finishing sending a payment when the phone goes into power saving;
- Phone state: the payment component reads device identifiers to detect fraud, to protect the app while it runs (against tampering with or spying on the app) and to bind the phone to its registration during the integrity checks. On recent Android versions, this is the device's Android ID. The app reads neither your calls nor your phone number;
- Vibration and Wi-Fi state: signals on the payment screens, and checking the connection.
The app does not use the advertising ID.
5. The merchant's customers
A customer who pays by card holds the card against the phone. Their card data is read and encrypted by the payment component, as described in section 3. Nextepay processes the transaction data on behalf of the merchant, as its processor, under the conditions of our general privacy policy. Their e-mail address or phone number is processed only if the merchant sends them a receipt or a payment link.
6. Who receives the data
- Nextepay, on servers hosted within the European Union;
- The authorised payment institution that processes the payments, and the provider of the payment component it uses: they receive the card data, the location and the phone's security data, and process them under their own responsibility for the security of payments and their regulatory obligations. Their identity is communicated to the merchant when the account is opened;
- Google, for the integrity checks of the phone, the distribution of the app and the technical messages of the payment component (Firebase Cloud Messaging); and Pushy, the backup service for those messages. They receive a technical identifier of the installation, not your payments;
- Datadog, the monitoring service of the payment component, for its technical and crash logs, hosted in the European Union (Datadog's EU site);
- our e-mail delivery provider, for receipts and links sent by e-mail.
No data is sold, and none is used for advertising.
7. Retention periods
- Your account: as long as you have access to the app. When your access is removed, your password and your sessions are erased at once; your name and your e-mail address stay attached to the payments you took, for as long as those payments are kept;
- Your sessions: until you sign out, your password changes or your access is removed;
- Payments: the periods required by payment-services regulations and accounting obligations;
- Customer contact details entered for a receipt or a link: kept with the payment they relate to, for as long as that payment is kept;
- Location and phone security data, at the payment institution and its provider: under their own responsibility (section 6), for payment security and fraud prevention; the payment component's technical logs are kept for 6 months at most, only to solve incidents. Nextepay does not receive the phone's location.
8. Security
Exchanges are encrypted (TLS). Passwords, codes and session tokens are stored on our servers as hashes only. The app never receives the full card number. Access within Nextepay is restricted to a need-to-know basis and logged.
9. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, within the limits provided for by regulation: some data (payments, identification) must be kept despite an erasure request, owing to our legal obligations. To exercise your rights: privacy@nextepay.com (response within one month). If you take payments for a merchant, you may also contact that merchant.
You may also lodge a complaint with the Belgian Data Protection Authority (rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be) or with the authority of your country of residence.
10. Changes
This policy may be adapted to reflect changes in the app or in regulation. The current, dated version is published on this page.