Privacy Policy

    Privacy Policy

    Last updated: April 30, 2026

    Vallwork Tech FZCO (PayOrc) and/or its affiliates and entities (collectively "PayOrc", "we" or "us") values your security and privacy. PayOrc is incorporated in BUILDING A1, IFZA BUSINESS PARK, DUBAI DIGITAL PARK, DUBAI SILICON OASIS, DUBAI, UAE. We being Technology Service Partner (TSP) to PSPs and Banks we are VAPT, PCI DSS compliant.

    It is our policy to respect the privacy of our website services, portal and app users. In accordance with our Terms of Use PayOrc collects information about you when you use or access our websites and other web-based products, information or services (collectively, the "Website Services") as well as through other interactions and communications you have with us, such as through the PayOrc App (the "App") or PayOrc Portal (the "Portal") or PayOrc Checkout Page (the "Page"). This data protection policy (the "Policy") sets out the basis on which any information, including any personal data, we collect from you, or you provide to us, will be processed by PayOrc. Each time you access or use the Website Services, the App, the Portal, the Page or provide us with information, by doing so you are accepting and, where possible, consenting to the practices described in this Policy. It is important that you read this Privacy Policy so that you are fully aware of how and why we use your personal information.

    1. Third Party Websites and Children Data

    1.1 Third Party Websites

    If you are using Website Services, some links on it may lead to non-PayOrc websites with their own privacy notices, which may be different to this Privacy Policy. You should read those privacy notices carefully.

    1.2 Children Data

    The Website Services, App, Portal or Page are not targeted, intended or expected to be of use to children. Apart from providing information for specific services or purposes, as per our policy, App, Website, Portal or Page do not knowingly collect, maintain, or process personal information from children under the age of 18. If we discover that we have inadvertently received personal information from a child under the age of 18, we will promptly delete it from our records. If you are a parent or guardian and are aware that your child has provided us with personal data, please contact us at [email protected].

    2. Information We Collect

    We collect and process the following categories of personal data:

    2.1 Information You Provide

    • Account Information: Name, email address, phone number, business name, and job title when you register for an account.
    • Business Information: Business registration details, tax identification numbers, bank account details, and KYC documents required for payment processing.
    • Transaction Data: Payment card details (tokenized), transaction amounts, merchant identifiers, and payment method information processed through our platform.
    • Communications: Information you provide when contacting our support team or providing feedback.

    2.2 Information Collected Automatically

    • Device Information: IP address, browser type, operating system, device identifiers, and log data.
    • Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns.
    • Cookies and Tracking: We use cookies and similar technologies to maintain sessions, remember preferences, and analyze usage (see our Cookie Policy).

    3. How We Use Your Information

    • Service Delivery: To provide, operate, and maintain the payment orchestration platform.
    • Payment Processing: To route, process, and reconcile transactions across payment service providers (PSPs).
    • Security: To detect fraud, prevent unauthorized access, and ensure PCI DSS compliance.
    • Analytics: To analyze platform usage, optimize performance, and improve our services.
    • Communication: To send transaction confirmations, security alerts, service updates, and (with your consent) marketing communications.
    • Legal Compliance: To comply with applicable laws, regulations, and regulatory requirements in the UAE and other jurisdictions we operate in.

    4. How We Share Your Information

    • Payment Service Providers: We share transaction data with connected PSPs solely for the purpose of processing payments.
    • Regulatory Authorities: When required by law, regulation, or legal process.
    • Service Providers: Trusted third-party vendors who assist in operating our platform (hosting, analytics, support), bound by strict data protection obligations.
    • Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to affected users.

    We do not sell your personal information to third parties.

    5. International Data Transfers

    Your data may be transferred to, stored, and processed in countries other than the UAE. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and adequacy determinations where applicable. Where data is transferred outside the UAE, we ensure that the receiving jurisdiction provides adequate data protection as per UAE data protection regulations.

    6. Data Security

    • PCI DSS Level 1 certified — the highest standard in payment security.
    • AES-256 encryption for data at rest and TLS 1.2+ for data in transit.
    • Role-based access controls (RBAC) and multi-factor authentication.
    • Continuous monitoring, penetration testing, and vulnerability assessments.
    • Tokenization of card data — we never store raw card numbers.

    7. Data Retention

    We retain your information for as long as your account is active or as needed to provide the Service. Transaction records are retained for a minimum of 7 years as required by financial regulations. You may request deletion of your account data, subject to legal retention requirements.

    8. Your Rights

    • Access: Request a copy of the personal data we hold about you.
    • Correction: Request correction of inaccurate or incomplete data.
    • Deletion: Request deletion of your personal data, subject to legal obligations.
    • Portability: Request your data in a structured, machine-readable format.
    • Objection: Object to processing of your data for certain purposes.
    • Withdraw Consent: Withdraw consent for marketing communications at any time.

    9. Children's Privacy

    The Service is not intended for individuals under 18. We do not knowingly collect personal information from children.

    10. Account Deactivation and Deletion

    If you wish to Deactivate and Delete your PayOrc Merchant account along with all associated data, then please login to your PayOrc account and use Account Deactivation Request option under the Profile section of account settings. We will process your request within 30 working days. Please note that some data may be retained as required by financial regulations and applicable law.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on our platform. Continued use of the Service after changes constitutes acceptance of the updated policy.

    12. Contact Us

    For questions about this Privacy Policy or to exercise your rights, contact us at:

    Questions? Contact Us →

    Other Policies

    Cookie PolicyTerms of ServiceRefund Policy