This clause describes OPTINITI’s respective obligations when handling and storing information connected with the stc pay Services. 

The following terms used in this section relate to data provided to OPTINITI by the Merchant or the Account Holders, or received or accessed by the Merchant through the Merchant’s use of the stc pay Services:

“Data Subject” the individual, the entity or the Account Holder who is the owner of the Data. 

“Personal Data” means information that identifies a specific living person (not a company, legal entity, or machine) and is transmitted to or accessible through the stc pay Service including, but not limited to, name, postal address, email address, telephone number, date of birth, Passport and ID number (or its equivalent), driver’s license number, account information (including, but not limited to, financial and payment card account information), PIN, Internet Protocol (IP) address, or any other unique identifier or one or more factors specific to the individual’s physical, physiological, mental, economic or social identity, whether such data is in individual or aggregate form and regardless of the media in which it is contained.

“User Data” means information that describes the Merchant’s business and its operations, products or services, and orders placed by an Account Holder. 

“Payment Data” means payment account details, information communicated to or by Financial Services Providers, financial information specifically regulated by Laws, and any other information used with the stc pay Services to complete a Payment Transaction.

“OPTINITI Data” means details of the API transactions over OPTINITI infrastructure, information used in fraud detection and analysis, aggregated or anonymized information generated from Data, and any other information created by or originating from OPTINITI or the stc pay Services. 

The term “Data” used without a modifier means all Personal Data, User Data, Payment Data, and OPTINITI Data.

“Process” or “Processing” means any operation or set of operations performed upon Data, whether or not by automatic means, such as analyzing, reviewing, manipulating, creating, collecting, procuring, obtaining, accessing, recording, organizing, storing, transferring, adapting, altering, retrieving, consulting, using, disclosing or destroying the Data.

OPTINITI Processes, analyses, and manages Data to: (a) provide stc pay Services to the Merchant, other OPTINITI users, and Account Holders; (b) mitigate fraud, financial loss, or other harm to users, Account Holders and OPTINITI; and (c) analyse, develop and improve OPTINITI’s products, systems, and Equipment. OPTINITI provides Data to third-party service providers, including Financial Services Providers and their affiliates, as well as stc and global affiliates, to allow us to provide the stc pay Services to the Merchant and other Account Holders. 

OPTINITI may provide any Personal Data to stc to market stc pay and their products to the Merchant and/or the Account Holders. Merchant understands and consents to OPTINITI’s use of Data for the purposes and in a manner consistent with this clause 19.

19.2 Notwithstanding clause 15 above, OPTINITI will only use User Data as permitted by this Agreement, by other agreements between the Merchant and OPTINITI, or as otherwise directed by the Merchant. The Merchant will protect all Data the Merchant receives through the stc pay Services, and the Merchant may not disclose or distribute any such Data, and Merchant will only use such Data in conjunction with the stc pay Services and as permitted by this Agreement or by other agreements between the Merchant and OPTINITI.

The Merchant may not use any Personal Data to market to Customers unless it has received the express consent from a specific Customer to do so. The Merchant may not disclose Payment Data to others except in connection with processing Transactions requested by Customers and consistent with applicable Laws and network rules.

Last Updated on: 15 January, 2023