Privacy notice
1. Who is responsible
OrsunPay is operated by Orsun Tech OÜ, registry code 17418287, registered at Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia. This notice describes personal data used for our website, business enquiries, account administration and service support.
You can address a privacy enquiry to Orsun Tech OÜ by post or use Contact, identifying the request as a privacy matter. Do not include passwords, payment credentials or identity documents in an initial request.
We act as controller where we decide why and how information is used for these purposes. When a business customer instructs us to process its customers’ personal data through the platform, the parties’ data processing agreement defines that processing. A payment provider may have separate responsibilities under its own notice.
2. Information we receive
| Context | Information and source |
|---|---|
| Business enquiries | The name, business email, company, message, monthly-volume range and any website or country supplied in the contact form; the chosen language, submission time, source and privacy-notice version. |
| Website delivery and protection | Connection information such as IP address, requested page and browser headers received by infrastructure. The lead service stores a salted hash of the IP address to apply submission limits; the hash remains potentially personal data. |
| Merchant accounts and support | Business contact details, user identifiers, roles, authentication and account activity, and information you provide when requesting help. |
| Use of the platform | Transaction references, statuses, amounts, currencies, provider responses, delivery records and customer information included in the integration you or your provider use. The purpose and roles depend on the service and agreement. |
| Optional website analytics | Page visits and counts of contact, documentation and sign-up clicks and successful enquiry submissions, when Plausible is enabled. Form contents are not attached to these events. |
Some fields are required to answer an enquiry or provide an account. Without the necessary information, we may be unable to complete that request. Please avoid including sensitive information or details about other people unless necessary and lawful.
3. Purposes and legal bases
We use business contact information to answer enquiries, discuss an integration and administer the customer relationship. Where you personally request steps toward a contract or are a contracting party, the basis is those steps or performance of the contract. For employees and other representatives of a business customer, our basis is our legitimate interest in communicating with that business and providing its service.
Our legitimate interests also include protecting the website and accounts, preventing abusive submissions, investigating technical problems and maintaining proportionate security records. We assess these interests against individuals’ rights. Information needed for applicable accounting, tax or other legal duties is processed to meet those obligations.
Optional processing that requires consent must have an appropriate consent mechanism. A contact-form acknowledgement is not blanket permission for unrelated advertising. We use an enquiry to respond to the request and do not treat it as a newsletter subscription. Website analytics may be enabled only with an appropriate legal basis and any consent required in the relevant jurisdiction.
4. Analytics and browser storage
The website supports Plausible analytics without analytics cookies or local storage. The application sends the canonical page address and limited event names; it strips query strings, fragments and referrer information from the analytics payload. Plausible describes its handling of network information and daily visitor identifiers in its data policy. We do not describe this as an absence of all data processing.
The public website and the signed-in merchant cabinet have different storage needs. Account sessions, authentication steps and cabinet preferences use the storage described in our cookies notice.
5. Recipients and international processing
Authorised personnel and suppliers receive information necessary for their functions. The supplier register distinguishes hosting, email delivery, website analytics and documentation services, including arrangements still requiring confirmation. Enquiry notifications may contain the contact details and message you submit and are delivered to the designated business inbox.
Where Resend is used, its published policy states that message content and related records are stored in the United States, even if an EU sending region is selected. A supplier’s available region is not a guarantee about our deployed configuration. Before a restricted international transfer, the parties must establish the applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards, and any necessary supplementary measures. Information about the relevant safeguards can be requested through our contact route.
We may disclose information where required by law, to establish or defend legal claims, or in connection with a business reorganisation subject to applicable safeguards. A provider connected by your business may process transaction information under its own agreement and privacy notice.
6. Retention
Retention must follow the purpose of the processing: enquiries for the period necessary to respond and manage the resulting business discussion; account records for administration and security; contractual and accounting records for applicable legal requirements; and dispute records where needed to establish or defend a claim.
The applicable period depends on the type of record, the status of the enquiry or account, statutory obligations and any outstanding claim. You can contact us to ask which retention criteria apply to your records or request deletion, subject to applicable legal requirements. Data processed for a merchant follows the agreed DPA and its retention instructions, subject to applicable law.
7. Your rights
Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or a portable copy of your information. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. Withdrawal does not invalidate earlier lawful processing. Direct-marketing objections will be respected.
Contact us with enough information to locate the relevant record. We may seek proportionate identity verification and will respond within the applicable legal time limit. If your request concerns a purchase from a merchant, contact that merchant first; we assist it as required by the DPA. You can also complain to the Estonian Data Protection Inspectorate or another competent data protection authority.
8. Security, audience and changes
The implementation uses safeguards including encrypted transport, access permissions, protected authentication tokens and controls against abusive submissions. The agreed security schedule defines the commitments for merchant processing. No certification is claimed by this notice.
OrsunPay’s business website is intended for professional users. Contact us if you believe a child has provided information that should be removed. We will update this notice when the relevant practices change and communicate material changes where required. The revision date appears above.