Privacy Policy

Version: 1.0

Effective date: 12th May 2026

Document

Version

1.0

Status

Approved by DPO

Prepared for

FM Finance (Malta) Ltd

Reviewer

Dr J. J. Galea, Data Protection Officer (GTG Legal) — jjgalea@gtg.com.mt

Regulatory framework

GDPR (Regulation (EU) 2016/679); Data Protection Act (Cap. 586); ePrivacy regulations (S.L. 586.01); MFSA, FIAU and IDPC guidance

Effective date

12th May 2026

1. Introduction

FM Finance (Malta) Ltd ("FM Finance", "we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy (the "Policy") explains how we collect, use, disclose and otherwise process personal data when you visit our website, apply for or use our payment services, communicate with us, apply for a role with us, or otherwise interact with us.

This Policy is issued in accordance with:

Regulation (EU) 2016/679 ("GDPR");

the Data Protection Act (Chapter 586 of the Laws of Malta) ("DPA") and any subsidiary legislation issued thereunder;

the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) implementing the ePrivacy Directive in Malta; and

any binding guidelines issued by the European Data Protection Board ("EDPB") and the Information and Data Protection Commissioner ("IDPC").

For the purposes of the GDPR, FM Finance (Malta) Ltd is the data controller in respect of the personal data described in this Policy, save where this Policy or a separate notice expressly states that we act as a data processor on behalf of a merchant (see Section 12).

2. About us

Legal entity: FM Finance (Malta) Ltd
Registered office: Office 09, Level 2, Northlink Business Centre, Burmarrad Road, Naxxar, NXR 6345, Malta
MFSA Authorisation ID: FFML-24932
General email: info@fmpay.eu

FM Finance (Malta) Ltd is licensed and regulated by the Malta Financial Services Authority ("MFSA") as a financial institution authorised to provide payment services, including merchant acquiring of card-based payment transactions.

3. Data Protection Officer

We have appointed an external Data Protection Officer ("DPO") in accordance with Article 37 of the GDPR.

DPO Dr J. J. Galea
Firm GTG Legal
Email dpo@fmpay.eu

For all matters relating to this Policy, the exercise of your data subject rights, or any other privacy-related queries, you may contact our DPO directly at our dedicated privacy mailbox dpo@fmpay.eu.

4. Who this Policy applies to

This Policy applies to the following categories of data subjects:

Merchants and prospective merchants — businesses that apply for or use our acquiring and payment services, including their directors, ultimate beneficial owners ("UBOs"), shareholders, persons with significant control, authorised signatories, employees and other connected natural persons whose personal data we process for due diligence and onboarding purposes.
Website visitors — individuals who visit, browse or interact with our website (including via cookies, contact forms, demo requests and chat tools).
Job applicants and suppliers — individuals who apply for a role with FM Finance, and natural persons acting on behalf of our suppliers, vendors, partners and professional advisers.

A separate notice is issued to employees under our internal HR documentation, and is not covered by this Policy.

A note on cardholders: in the course of providing acquiring services to merchants, we process limited cardholder personal data (including primary account numbers) on the merchant’s behalf. In that context we generally act as a data processor, and we do so under the merchant’s privacy notice and our merchant agreement. See Section 12.

5. Personal data we process

We collect and process the categories of personal data set out below. We will only collect data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (Article 5(1)(c) GDPR — data minimisation).

5.1 Merchants and connected individuals

Identification data: full name, date and place of birth, nationality, gender, identity card or passport number, photograph from identity documents, signature, tax identification number.

Contact data: residential address, business address, email, telephone number.

Verification & due diligence data: proof of address, proof of identity, source-of-funds and source-of-wealth declarations, sanctions and PEP screening results, adverse media checks, ownership and control structure information, certified corporate documents.

Financial and account data: bank account details (IBAN, BIC), billing information, tax residency, FATCA/CRS classification (where relevant), expected and actual transaction volumes and values, settlement history.

Transaction and acquiring data: information about transactions you process through our services (including merchant category, transaction amount, currency, date and time, authorisation result, chargebacks and disputes).

Risk, fraud and compliance data: information generated by our risk-monitoring, fraud-prevention and AML/CFT systems, including alerts, risk scores, suspicious transaction reports, watchlist matches, and the outcome of investigations.

Communications data: emails, chat messages, secure-portal correspondence, recorded telephone calls (where recording is in operation and you have been notified), and other communications between you and FM Finance.

5.2 Website visitors

Technical data: IP address, browser type and version, time-zone setting, operating system and platform, device identifiers, referring URL.

Usage data: pages viewed, time spent on pages, links clicked, search terms entered, scroll depth, session and journey data.

Cookie and tracker data: data collected through cookies, marketing pixels, tags and similar technologies, as further described in Section 11.

Form data: any information you voluntarily submit through our contact, demo, callback or newsletter forms (typically name, business email, company name, country, and message content).

5.3 Job applicants

Application data: name, contact details, CV/résumé, cover letter, educational and professional background, employment history, references, right-to-work documentation, salary expectations and any information you choose to share during interviews.

Background-check data: (where lawful and necessary for the role) conformity checks, regulatory references (under MFSA fit-and-proper requirements where applicable), criminal-record certificates, sanctions screening.

5.4 Suppliers, partners and professional contacts

Business contact data: name, role, employer, business email, business phone.

Onboarding and AML data: where the supplier or partner is itself subject to due diligence, the categories listed in Section 5.1.

Contractual and financial data: contract details, invoices, payment information.

5.5 Special categories of personal data

We do not seek to process special categories of personal data (Article 9 GDPR). Where such data appears incidentally — for example, in identity documents, or unsolicited content in correspondence — we will only retain and process it to the extent strictly necessary, on an appropriate legal basis (typically Article 9(2)(f) — establishment, exercise or defence of legal claims).

5.6 Criminal offence, sanctions and regulatory-risk data

Where we process personal data relating to criminal convictions, alleged offences, sanctions, regulatory findings, watchlist matches, adverse media, suspicious activity indicators or related security measures, we do so only where authorised by applicable Union or Maltese law, including AML/CFT, sanctions and financial-services laws, or where otherwise necessary for the establishment, exercise or defence of legal claims.

6. Sources of personal data

We collect personal data:

Directly from you — when you complete an application form, submit a contact or demo request, communicate with us, or provide documents during onboarding or the ongoing relationship.
From your use of our services and website — automatically generated data (transactional, technical, usage and cookie data).
From third-party sources — including identity verification, KYC/AML and electronic-identity providers; credit reference agencies and credit bureaux; sanctions, PEP and adverse-media screening providers; publicly available registers (the Malta Business Registry, comparable foreign company registries, professional registers); card schemes and other payment-system participants; law enforcement, regulatory and tax authorities; your bank, payment service providers and other counterparties to transactions you process with us; referral partners, agents and introducers; and publicly available sources (including company websites and professional networking platforms).

7. Purposes and legal bases of processing

The table below sets out the principal purposes for which we process personal data and the corresponding lawful bases under Article 6 GDPR (and, where relevant, Article 9 GDPR).

Purpose

Categories of data

Legal basis

7.1

Onboarding merchants and prospective merchants, including identification, due diligence and assessment of the application.

Identification, contact, verification & due diligence, financial.

Article 6(1)(b) — pre-contractual steps. Article 6(1)(c) — legal obligations under AML/CFT and financial-services laws (Section 8).

7.2

Ongoing customer due diligence, transaction monitoring, sanctions and PEP screening, fraud prevention, risk scoring and reporting of suspicious activities.

All categories in Section 5.1, including risk and compliance data.

Article 6(1)(c) — legal obligations (Cap. 373; S.L. 373.01 Prevention of Money Laundering and Funding of Terrorism Regulations ("PMLFTR")). Article 6(1)(f) — legitimate interest in protecting our business and the integrity of the payments system. Article 9(2)(g) where applicable.

7.3

Managing the merchant relationship — support, account administration, billing and dispute resolution.

Identification, contact, financial, transaction, communications.

Article 6(1)(b) — performance of a contract. Article 6(1)(f) — operating the relationship efficiently.

7.4

Responding to enquiries submitted via our website, contact forms, email, telephone or chat.

Form data, communications, technical data.

Article 6(1)(f) — legitimate interest in responding to enquiries and pursuing potential business relationships. Article 6(1)(b) where the enquiry is a step prior to a contract.

7.5

Direct marketing of our products and services to existing customers and prospective business contacts (B2B).

Business contact data, communications, profile data.

Article 6(1)(f) — legitimate interest in promoting our services. Article 6(1)(a) — your consent, where required (e.g. non-essential marketing cookies, prospects with no prior relationship).

7.6

Operating, securing and improving our website, applications and IT systems (administration, troubleshooting, support, maintenance, performance, network and information security).

Technical, usage, cookie and communications data.

Article 6(1)(f) — legitimate interest in network and information security (recital 49 GDPR) and improving our services.

7.7

Recruitment and assessment of job applications.

Application and background-check data.

Article 6(1)(b) — pre-contractual steps. Article 6(1)(c) — legal/regulatory obligations (incl. MFSA fit-and-proper test). Article 6(1)(f) — legitimate interest in selecting suitable candidates.

7.8

Managing supplier and partner relationships.

Business contact, onboarding, contractual data.

Article 6(1)(b) — performance of a contract. Article 6(1)(f) — operating our supply chain.

7.9

Establishing, exercising or defending legal claims, complying with court orders and lawful requests, and protecting our rights and property.

Any of the above as relevant.

Article 6(1)(c) — legal obligation. Article 6(1)(f) — legitimate interest. Article 9(2)(f) where special category data is involved.

7.10

Corporate transactions (mergers, acquisitions, reorganisations, sale of assets).

Any of the above as relevant.

Article 6(1)(f) — legitimate interest in carrying out the transaction, with appropriate confidentiality safeguards.

Where we rely on legitimate interests (Article 6(1)(f)), we do so only after having carried out a Legitimate Interests Assessment ("LIA") which assesses our interests against your rights and freedoms. You may request further information about any specific LIA by contacting our DPO.

Where we rely on consent (Article 6(1)(a)), you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

8. Legal and regulatory obligations

As an MFSA-licensed financial institution, we are subject to a number of laws that require us to collect, retain, monitor and in certain cases disclose personal data, including in particular:

the Financial Institutions Act (Chapter 376 of the Laws of Malta) and rules issued by the MFSA thereunder;

the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta) and the PMLFTR, together with the Implementing Procedures issued by the Financial Intelligence Analysis Unit ("FIAU");

EU sanctions regimes and the National Interest (Enabling Powers) Act (Chapter 365 of the Laws of Malta);

Directive (EU) 2015/2366 ("PSD2") as transposed in Malta, including strong customer authentication requirements;

Regulation (EU) 2015/847 on information accompanying transfers of funds (the "Funds Transfer Regulation");

card-scheme rules issued by Visa, Mastercard and other payment networks of which we are a member;

the Income Tax Acts, FATCA and the Common Reporting Standard, as applicable.

Failure to provide personal data that we are required to obtain may result in our being unable to enter into or continue our business relationship with you.

9. Automated decision-making and profiling

We use automated tools, including risk-scoring and fraud-detection engines, to monitor transactions, detect unusual patterns and protect our business and customers from fraud, money laundering and other financial crime. These tools may produce risk scores or alerts that influence whether a transaction is approved, held for review, or declined, or whether further information is requested from a merchant.

Human review. In all cases where an automated outcome would have a legal or similarly significant effect on you (for example, declining a merchant application or terminating an account), the final decision is taken by a member of our staff after meaningful review. To that extent, we do not engage in solely-automated decision-making within the meaning of Article 22(1) GDPR.

Your safeguards. Where our processing involves profiling that significantly affects you, you have the right to:

obtain meaningful information about the logic involved (in general terms);

express your point of view;

contest the decision; and

request human intervention.

To exercise these rights, please contact our DPO.

10. Recipients of personal data

We share personal data only with recipients who need it for the purposes set out in Section 7, and subject to appropriate contractual, technical and organisational safeguards. Categories of recipients include:

Card schemes and payment networks, including Visa and Mastercard, and other participants in the payments ecosystem (issuing banks, acquiring banks, processors, gateways), to authorise, clear and settle transactions and to comply with scheme rules.
KYC / AML and identity-verification providers, who help us verify identities, screen against sanctions, PEP and adverse-media databases, and assess risk.
Cloud hosting and IT infrastructure providers (e.g. providers of hosting, storage, security, communications and SaaS services such as AWS, Google Cloud and Microsoft, and similar), who process personal data on our instructions as our processors.
Group companies and affiliates within the FMPay group, on a need-to-know basis, for shared back-office, compliance, risk, IT and reporting functions, under intra-group data sharing arrangements.
Professional advisers, including external lawyers, auditors, accountants, tax advisers, insurers and consultants, where reasonably necessary for them to provide their services.
Regulators, supervisory and law-enforcement authorities, including the MFSA; the FIAU; the IDPC; the Commissioner for Revenue and other tax authorities; the European Banking Authority (EBA), the European Central Bank (ECB) and other EU bodies, where applicable; the Financial Conduct Authority (FCA) and the National Crime Agency (NCA) in the United Kingdom, in connection with our group operations and lawful information-sharing; courts and tribunals, police and other law-enforcement bodies; and foreign equivalents of the above, where required by applicable law.
Acquirers, financial counterparties and correspondent banks, in the ordinary course of providing payment services.
Prospective or actual buyers in the context of a corporate transaction, subject to appropriate confidentiality undertakings and a lawful basis for the disclosure.

When a third party processes personal data on our behalf as a processor, we put in place a written agreement in accordance with Article 28 GDPR setting out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.

We do not sell personal data.

11. Cookies and similar technologies

Our website uses cookies and similar technologies (collectively, "cookies") to operate the site, secure it, understand how it is used, and (where you have consented) deliver marketing.

We use the following broad categories:

12. Our role as processor for merchants

When we provide acquiring services, we may process personal data relating to a merchant’s customers (cardholders) — for example, primary account numbers, transaction amounts, dates and merchant categories. In respect of that cardholder personal data, we generally act as a data processor on behalf of the merchant, who is the controller.

Each merchant is responsible for:

providing its customers with appropriate information about how their personal data is processed;

having a valid legal basis for that processing; and

ensuring that its instructions to us comply with applicable data protection law.

Our processing of cardholder data on a merchant’s behalf is governed by our merchant agreement (which includes a data processing addendum), the card-scheme rules, applicable law and security frameworks (including the Payment Card Industry Data Security Standard, "PCI DSS").

13. International transfers of personal data

We are based in Malta and the majority of our processing takes place within the European Economic Area ("EEA").

Where we transfer personal data outside the EEA — including to our group office in the United Kingdom for back-office, compliance, IT and management support — we ensure that an appropriate Article 46 GDPR safeguard is in place. In particular:

United Kingdom: transfers are made on the basis of the European Commission’s adequacy decision of 28 June 2021 in respect of the UK, which (subject to its periodic review) provides that the UK ensures an essentially equivalent level of protection to the GDPR. Where the UK adequacy decision ceases to apply, we will rely on the EU Standard Contractual Clauses ("SCCs") supplemented by appropriate technical and organisational measures.

Other third countries: where we use processors or sub-processors located outside the EEA (for example, certain cloud providers with global infrastructure), transfers are made on the basis of (i) an adequacy decision; (ii) the EU SCCs adopted by the European Commission Decision 2021/914; or (iii) another lawful Article 46 mechanism, in each case supplemented (where required following a Transfer Impact Assessment) by additional technical, contractual and organisational measures.

You may request a copy of the relevant safeguards (with confidential commercial information redacted) by contacting our DPO.

14. Retention of personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account legal and regulatory obligations, limitation periods, audit requirements and the existence of any actual or potential disputes.

Data category

Retention period

AML/CFT, KYC, identity verification, due diligence and transaction-monitoring records (including merchant onboarding files and ongoing monitoring outputs).

5 years from the end of the business relationship or from the date of the occasional transaction, extendable to 10 years where required by the FIAU, the MFSA or other competent authority (Article 13 PMLFTR and FIAU Implementing Procedures).

Bank account, billing and accounting records.

10 years from the relevant accounting period (Companies Act, Income Tax Acts and VAT requirements).

Recruitment data — unsuccessful candidates.

12 months after the end of the recruitment process, unless you have consented to a longer period for talent-pool purposes.

Website, analytics and cookie data.

In line with the periods set out in our Cookie Policy. Server logs are retained for security and audit purposes for up to 12 months.

After the relevant retention period has expired, personal data is securely deleted, irreversibly anonymised or, where that is not immediately technically possible, the relevant data will be securely archived, access-restricted and isolated from further active processing until deletion or anonymisation becomes possible.

15. Security of personal data

We have implemented appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, in line with Article 32 GDPR, including:

access controls, role-based permissions and ‘least privilege’ principles;

encryption of personal data in transit and, where appropriate, at rest;

network segregation, firewalls, intrusion detection and vulnerability management;

secure software development and change-management practices;

PCI DSS compliance for cardholder data environments;

staff training and confidentiality undertakings;

vendor due diligence and contractual data-protection commitments;

business continuity, disaster recovery and incident response procedures;

regular review and testing of our controls.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the IDPC without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR) and, where the breach is likely to result in a high risk, we will inform the affected data subjects without undue delay (Article 34 GDPR).

16. Your rights as a data subject

Subject to the conditions and exceptions set out in the GDPR, you have the following rights in relation to your personal data:

Right of access (Article 15) — to obtain confirmation of whether we process your personal data and, if so, a copy of that data and the information set out in Article 15(1).
Right to rectification (Article 16) — to have inaccurate personal data corrected and incomplete data completed.
Right to erasure (Article 17, ‘right to be forgotten’) — to have your personal data erased where one of the grounds in Article 17 applies (for example, the data is no longer necessary, you withdraw consent and there is no other legal basis, or the data has been unlawfully processed).
Right to restriction of processing (Article 18) — to have processing restricted in the circumstances set out in Article 18.
Right to data portability (Article 20) — where processing is based on consent or a contract and is carried out by automated means, to receive the personal data you have provided in a structured, commonly used and machine-readable format, and to transmit it to another controller.
Right to object (Article 21) — to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f), and to object at any time and unconditionally to processing for direct-marketing purposes.
Right not to be subject to a decision based solely on automated processing (Article 22) — see Section 9.
Right to withdraw consent (Article 7(3)) — at any time, where processing is based on consent.
Right to lodge a complaint with a supervisory authority — see Section 17.

Limits. Many of these rights are not absolute. For example, we may be required by law (in particular by AML/CFT and financial-services rules) to retain and continue processing personal data even after you have asked us to erase it.

How to exercise your rights. Please send your request to our DPO at dpo@fmpay.eu. We may need to verify your identity before responding. We will respond without undue delay and in any event within one month of receipt of the request, although that period may be extended by a further two months where necessary, taking into account the complexity and number of requests (Article 12(3) GDPR). There is normally no charge, but we may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive.

17. Complaints

If you are not satisfied with how we have handled your personal data or any privacy-related request, please first contact our DPO so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta:

Address Information and Data Protection Commissioner, Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
Telephone +356 2328 7100
Email idpc.info@idpc.org.mt
Website https://idpc.org.mt

You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

18. Children

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete it without undue delay.

19. Third-party websites

Our website may contain links to third-party websites and services. This Policy does not apply to those third-party websites and services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party websites you visit.

20. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The current version is always available on our website, with the version number and effective date shown at the top. Where changes are material, we will provide additional notice (for example, by email, or by a prominent notice on our website) before the changes take effect.

21. Contact

If you have any questions about this Policy or the way we process your personal data, please contact us:

FM Finance (Malta) Ltd Office 09, Level 2, Northlink Business Centre, Burmarrad Road, Naxxar, NXR 6345, Malta
Telephone +356 2093 9970
General email info@fmpay.eu
Privacy mailbox dpo@fmpay.eu
Data Protection Officer Dr J. J. Galea