What we hold, and why
Last updated: August 2026
This page is the detail behind our privacy policy. Every category of data we hold about you appears below with its purpose, its legal basis, how long we keep it and who else sees it. Where a retention period is set by regulation rather than by us, the table says so.
Data categories
Retention periods marked as a regulatory requirement cannot be shortened at request. Everything else can be, and the section below explains how.
| Category | What it includes | Why we hold it | Legal basis | How long | Who else sees it |
|---|---|---|---|---|---|
| Account data | Name, email, phone number, business name, commercial registration number | Creating and running your account | Performance of contract | Life of the account, then 7 years for tax records | SeferPay staff only |
| Transaction data | Amounts, timestamps, payment method, last four digits of the card, customer reference | Processing payments and producing your financial reports | Performance of contract and legal obligation | 10 years — financial regulatory requirement | Card networks and your acquiring bank, as the transaction requires |
| Identity and compliance data | Identity documents, trade registry extract, beneficial ownership details | Meeting anti-money-laundering and know-your-customer obligations | Legal obligation | 8 years after the account closes — regulatory requirement | Identity verification providers and regulators on lawful request |
| Usage data | Sign-in times, features used, dashboard activity | Improving the product, detecting fraud, and supporting you | Legitimate interest | 24 months | SeferPay staff only |
| Communication data | Support conversations, email preferences | Answering you, and sending product updates you asked for | Consent for marketing, legitimate interest for support | 3 years, or until you withdraw consent | SeferPay staff only |
What you can ask us to do
These rights apply under GDPR, KVKK and PDPL. We answer every request within 30 days, and we do not charge for it.
Get a copy
Ask for everything we hold about you, in a machine-readable format you can take elsewhere.
Correct something
If a detail is wrong, tell us and we will fix it. Most account fields you can edit yourself without asking.
Delete your data
We will delete what we are not legally required to keep, and tell you plainly what we must retain and until when — rather than deleting quietly and leaving you to assume it is all gone.
Withdraw consent
Marketing consent can be withdrawn at any time and takes effect immediately. It does not affect your account or your ability to use the product.
Object to processing
Where we rely on legitimate interest, you can object. We will either stop, or explain why the interest overrides the objection — and you can escalate that answer to your regulator.
Complain
You can complain to your data protection authority without going through us first. We would rather you told us, but it is not a condition.
Making a request
Write to us with the request and the account it concerns. A person handles it, and you will get a reply that names what we did rather than confirming receipt.
Contact us