Introduction
Nylo LLC (hereinafter "NYLO", "we", "us", or "our"), a company incorporated under the laws of Georgia (Law of Georgia “On Entrepreneurs”) with registration number 412790154 and registered address at 88 Avtomshenebeli St, Kutaisi Free Zone, Land Plot 01/298, Kutaisi, Georgia, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website (nylo.pro) and services (“Services”). We adhere to the applicable data protection laws, including the Law of Georgia on Personal Data Protection (2023) and the principles of the EU General Data Protection Regulation (GDPR), which closely align with each other. By using our Services, you acknowledge that you have read and understood this Privacy Policy.
Data Controller and Contact Information
NYLO is the data controller and processor responsible for processing your personal data. If you have any questions about this Privacy Policy or wish to exercise your rights regarding your personal data, please contact us at support@nylo.pro. This is the general contact for all privacy-related matters. We will be happy to assist you and address any concerns.
Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this policy. The types of data we may collect and process include:
- Identity and Contact Information: When you use our Services or register an account, we may collect your first name, last name, email address, and phone number. This information helps us verify your identity, communicate with you, and provide support. In some cases, we can request additional information (e.g. your ID document, proof of address or documents confirming the source of funds of your transaction) if we have a motivated suspicion that your transaction(s) can be related to Money Laundering, Terrorist Financing or other criminal offences in accordance with our KYC/AML Policy.
- Technical Information: We collect certain technical details by automated means when you interact with our site. This includes your IP address (which may indicate your general location or country of residence), browser type and version, operating system, device type, and other device identifiers or device fingerprint data. We also use cookies and similar tracking technologies to recognise your browser or device. These technologies gather information about your usage, preferences, and settings to ensure the site functions properly and to enhance security (see Cookies and Tracking Technologies below for details).
- Payment Information: If you make a payment or transaction through our Services, you will provide payment details such as your credit or debit card information (cardholder name, card number, expiration date, etc.). We use this information only to process the transaction you have requested. Importantly, we do not permanently store your full card details on our systems. Card data is transmitted securely over encrypted connections (HTTPS) to our payment processors and is handled using encryption and tokenisation techniques for interim processing. In practice, this means your sensitive card information is converted into a secure token, and the actual card number is not retained in our main databases. We do not use your payment details for any purpose other than completing the payment, and we will never share your full card number with unauthorised parties.
- Cookies and Usage Data: As mentioned, we use cookies to collect data about your interactions with our Services. This may include dates/times of visits, pages viewed, referring URLs, and other usage statistics. Some cookies are essential for site functionality (e.g. to keep you logged in or remember your preferences), while others help us analyse site traffic and performance. We may also receive similar technical data if you access our Services via a mobile device or integrate our payment widget on a third-party site.
We do not collect any sensitive personal data ( such as financial account passwords or biometric data) under this Privacy Policy, except for the payment card details you provide for transactions as described above. If we ever need to collect additional personal data, we will obtain your consent or ensure another legal basis applies, and we will update this Policy accordingly.
How We Use Your Personal Data
We process personal data for the following purposes, in each case relying on an appropriate legal basis (see Legal Bases section below):
- To Provide and Maintain Our Services: We use your personal data to create and manage your user record, facilitate the payments or transactions you initiate, perform fraud screening, and deliver the features of our payment gateway. For example, we use your name and card information to process a payment, and use your email to send you transaction confirmations or notices about your account.
- To Communicate with You: We may use your email address and/or phone number to send you important service-related communications. This includes confirmations of transactions, receipts, notices about changes to our terms or policies, security and fraud alerts, and customer support responses. These communications are necessary for us to fulfill our contract with you and keep you informed about your use of the Services.
- For Security and Fraud Prevention: We process certain data (such as IP addresses, device fingerprints, and cookies) to detect, prevent, and mitigate fraudulent or unauthorised activities on our platform. This includes using automated tools to identify potentially suspicious behaviour and using device and browser information to verify that logins and payments are legitimate. These measures protect both you and us from fraud, and help us comply with legal obligations related to secure payment processing. For example, device fingerprinting allows us to recognise if a device has been associated with fraudulent activity and take appropriate action to prevent fraud in real time.
- To Comply with Legal Obligations: We may process and retain your information as required by applicable laws and regulations. This includes complying with financial, tax, and accounting rules, Know-Your-Customer (KYC) and anti-money laundering regulations (if applicable), and responding to lawful requests by public authorities. For instance, Georgian and international regulations may require that we retain certain transaction records and verify customer identities for a specified period. We will only disclose the data strictly necessary when responding to official legal requests or audits.
- To improve and personalise the Service: We may analyse aggregated usage data (e.g. overall visitor trends, transaction volumes, error logs) to understand how our Services are used and how we can improve them. This helps us optimise the user experience, add new features, and enhance performance and security. In some cases, we might use cookies to remember your preferences (such as language or region) to personalise your experience. Any analysis is done in compliance with data protection principles, and whenever feasible, we use anonymised or pseudonymized data for these purposes.
- Marketing and Promotional Communications (with Consent): With your permission, we may use your name and contact details to send you newsletters, offers, or updates about new features and services of NYLO that might interest you. We will only send you marketing emails or messages if you have actively opted in to receive them. You have the right to withdraw your consent at any time (see Your Rights below), and each marketing email will include an easy way to unsubscribe or opt out. If you do opt out of marketing messages, we will stop using your data for that purpose. (Note: Transactional and service-related communications, as described above, will still be sent as needed.)
We do not use your personal data for any purposes incompatible with the above. If we intend to process your data for a new purpose, we will update this Policy and, if required, obtain your consent or provide you with a new notice.
Legal Bases for Processing
We process your personal information only when we have a valid legal basis to do so under Georgian law and/or GDPR. Depending on the context, one or more of the following legal bases may apply:
- Consent: In certain cases, we rely on your consent to process personal data. For example, we will ask for your consent before sending marketing emails or when using non-essential cookies or similar technologies. Where we rely on consent, you have the right to withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing already carried out.
- Contractual Necessity: We process some data because it is necessary to enter into or perform our contract with you. For instance, when you provide your email and payment information to make a transaction, or your phone number for two-factor authentication, we process that data to fulfill your request and provide the Service you expect. Without this data, we would not be able to execute the payment or provide the service.
- Legal Obligation: Certain processing is required for us to comply with our legal obligations. This can include verifying your identity to meet anti-fraud or anti-money laundering laws, retaining transaction records for accounting/tax purposes, or disclosing information to authorities when mandated by law. We only process the data necessary for compliance with such obligations.
- Legitimate Interests: We may process your data as needed for our legitimate business interests (or those of a third party), except where overridden by your interests or fundamental rights and freedoms. Our legitimate interests include maintaining the security of our systems, preventing fraud, improving our Services, and providing customer service. For example, using device and usage data for fraud prevention and security monitoring is based on our legitimate interest in protecting our business and customers. We always consider your rights and will not process personal data on this basis if our interests are outweighed by the impact on your privacy.
In all cases, we ensure that we apply principles of fairness, transparency, and purpose limitation. This means we only collect and use personal data for explained and lawful purposes, and we strive to minimise data usage to what is relevant and necessary for those purposes. If you have questions about the specific legal basis for any particular processing of your personal data, please contact us (see the Contact Us section).
Cookies and Tracking Technologies
Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies to make our Services function correctly, secure your interactions, and provide a convenient user experience. For example, cookies allow us to remember your session so you don’t have to log in repeatedly, and they store your preferences (like language or region). We also use cookies to collect information about how users navigate our site, which helps us improve the design and content.
We employ both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period or until you delete them). Some cookies may be set by third-party services that we use (for instance, analytics providers) to help us understand site traffic or to assist with advertising/marketing. We will ask for your consent for any cookies that are not strictly necessary for the Service to work, in accordance with applicable law. You can manage or disable cookies at any time through your browser settings; however, please note that if you block certain cookies, some features of our site may not function properly.
In addition to cookies, we use device fingerprinting and other tracking technologies to enhance security. Device fingerprinting involves collecting a combination of device and browser attributes (such as screen size, OS version, browser plugins, and other technical data) to create a unique identifier for a device. This helps us recognise trusted devices and detect suspicious activity (for example, if an attacker attempts to use stolen credentials on an unrecognised device). Device fingerprinting operates in the background when you access our Services; it does not install anything on your device, but it allows us to link a series of requests to the same device. We treat the data from these techniques as personal data, and we protect it in the same way as other personal information.
Your Choices: When you first visit our site, you will be informed about our use of cookies and given the opportunity to consent to non-essential cookies. Even after you consent, you can always adjust your cookie preferences by changing your browser settings to refuse or delete cookies. You can also use browser extensions or settings to block device fingerprinting scripts, though this may affect the ability to use our Services seamlessly. We do not respond to “Do Not Track” signals at this time, because there is no common industry standard for them, but we remain committed to honouring your privacy choices as described here.
For more details about our use of cookies (such as a full list of cookies and their purposes/expiration), please see our Cookie Policy (if available) or contact us for information.
How We Share Your Personal Data
We do not sell your personal information to third parties. However, in order to provide our Services and comply with laws, we may share your data with third parties in the following circumstances:
- Payment Processors and Financial Partners: We share necessary payment information with banks, credit card networks, payment processors, or other financial institutions to facilitate your transactions. For example, when you make a card payment, the card number, expiration date, CVV (and sometimes your name and billing information) must be securely transmitted to our payment processing partner and the relevant banking networks to authorise and complete the transaction. These third parties are authorised to use your information only as needed to provide these payment services or comply with applicable law (e.g., for fraud detection or regulatory compliance). We transfer card data through secure methods as described earlier, and we ensure our partners are bound to protect your data.
- Service Providers (Processors): We employ trusted third-party companies and individuals to perform functions on our behalf and help us operate the Service. This includes IT infrastructure providers (such as cloud hosting or data centre services), email and SMS providers (to send verification codes or notifications), analytics services (to help us understand usage of our site), customer support tools, and security services (such as fraud prevention tools, identity verification services, etc.). These service providers may have access to personal data strictly as needed to perform their tasks for us, and they are contractually obligated to keep your information confidential and to use it only for the purpose of providing their services to us. We carefully vet our vendors and require them to implement adequate data protection measures.
- Merchants: When you purchase goods or services from a Merchant using our NYLO payment facilitation services, we share necessary payment information with the merchant to facilitate your transaction. For example, when you make a payment, details such as your name and billing information may be securely transmitted to the merchant to authorise and complete the transaction. Merchants are authorised to use your information only as necessary to provide the requested goods or services or to comply with applicable law (e.g., for fraud detection or regulatory compliance).
- Business Transfers: If we undergo a business transaction such as a merger, acquisition by another company, restructuring, or sale of all or part of our assets, your personal data may be transferred to the successor or new owner as part of that transaction. In such cases, we will ensure that the new owner is bound by terms that provide at least the same level of protection for your data as this Privacy Policy. We will notify you (for example, via email or a notice on our website) of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal data as a result of the transfer.
- Legal and Regulatory Disclosure: We may disclose your personal information to courts, law enforcement agencies, government authorities, or other authorised third parties if and to the extent required or allowed by law. Examples include responding to a valid subpoena or court order, cooperating with regulators during audits or investigations, or disclosing information to enforce our terms of service or protect the rights, property, or safety of NYLO, our customers, or others. We will only share the information that is reasonably requested or required in each case, and whenever feasible, we will inform you of such disclosures (unless we are legally prohibited from doing so).
- With Your Consent: In situations where you explicitly consent to or request data sharing, we will share your information accordingly. For instance, if you ask us to integrate with a third-party service or to share your details with a partner, we will do so with your direction. Outside of the scenarios listed above, you will have a chance to consent or opt in before we share your personal data with third parties for any new or additional purpose.
We require all third parties with whom we share personal data to respect the security of your information and to treat it in accordance with applicable data protection law. Where those third parties act as "data processors" on our behalf, they must process personal data in line with our instructions and implement appropriate security measures. Some third parties (like banks or payment networks) may be independent controllers of your data; in those cases, their own privacy policies will apply in addition to ours.
International Data Transfers
Given the global nature of electronic services, the personal data we collect may be transferred to and stored in countries other than your own. For example, if you are located in Georgia, some of our servers or service providers might be located in other countries (such as in the European Union or the United States). Conversely, if you are an EU resident using our Services, your data may be processed in Georgia or elsewhere.
Georgian Law: We comply with the requirements of the Georgian Data Protection Law when transferring data outside of Georgia. This law permits the transfer of personal data to another country or international organisation only if that destination ensures an adequate level of data protection or certain other conditions are met. The Personal Data Protection Service (PDPS) of Georgia may formally designate countries or international organisations with “adequate” safeguards. If we need to transfer data to a country that is not recognised as having adequate protection, we will implement appropriate additional measures such as a written agreement incorporating standard data protection clauses, obtaining your explicit consent for the transfer (after informing you of possible risks), or relying on another legal derogation as permitted by law.
GDPR (EU) Requirements: If we transfer personal data from the European Economic Area (EEA) or the United Kingdom to a country that is not deemed to provide adequate data protection under EU law, we will ensure compliance with GDPR transfer requirements. This typically means we will enter into European Commission-approved Standard Contractual Clauses (SCCs) or rely on another valid transfer mechanism for such data flows. We will also implement supplementary technical and organisational measures as necessary to protect the data in transit and at the destination. Our goal is to ensure that your personal information enjoys a high standard of protection wherever it is processed.
Regardless of where your data is processed, we will take steps to protect it in line with this Privacy Policy. We maintain strict data protection policies with our international partners and service providers and continuously monitor legal developments concerning cross-border data transfers. If you have questions about our transfer practices or want more information about international data transfers, please contact us.
Data Security
We take the security of your personal data very seriously and implement appropriate technical and organisational measures to safeguard it against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption in Transit and At Rest: All data transmitted between your browser and our servers is protected using industry-standard encryption protocols (such as SSL/TLS). This means that personal information (including payment details) is encrypted while it travels over the internet. We also encrypt or pseudonymize sensitive personal data at rest in our databases and storage systems whenever feasible. For example, passwords are stored using secure hashing algorithms, and other sensitive fields may be encrypted such that only authorised systems can decrypt them.
- Payment Card Security (Tokenisation): As noted, we do not store your raw credit card numbers on our main servers. Instead, we use a tokenisation system for payment processing. Tokenisation is a security technique that replaces sensitive data (like your card’s Primary Account Number) with a unique, non-sensitive token. The actual card data is handled only by our secure, isolated payment module or by our certified payment processor, and is encrypted and stored in a secure environment separate from our operational systems. The token can be used to reference the transaction or process refunds, but by itself, it cannot be decoded to reveal your card number by any unauthorised party. This greatly reduces the risk of your financial data being exposed, even in the unlikely event of a breach.
- Access Controls: We limit access to personal data to those employees, contractors, and service providers who need to know that information for their duties. All personnel with such access are subject to confidentiality obligations and undergo training on data protection. We employ role-based access controls, meaning each user of our internal systems can only view or manipulate the data that is necessary for their role. Administrative access to our databases and systems is logged and reviewed. Two-factor authentication and strong password policies are in place for our team to reduce the chance of unauthorised access.
- Security Testing and Monitoring: We regularly monitor our systems for possible vulnerabilities and attacks. Our infrastructure is protected by firewalls and intrusion detection systems. We conduct periodic security assessments, penetration tests, and code reviews to identify and address potential security weaknesses. In addition, we keep our software and infrastructure up to date with the latest security patches.
- Incident Response: In the event of any data breach or security incident, we have an incident response plan to take immediate action. This includes containing the incident, mitigating harm, investigating the circumstances, and notifying affected users and regulators as required by law. Under Georgian law, for example, we would notify the PDPS within 72 hours of becoming aware of a significant data breach, and we would inform individuals if the breach poses a high risk to their rights. We also continuously refine our response procedures to incorporate lessons learned and improve future readiness.
While we strive to protect your information with these robust measures, it’s important to note that no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security. However, we devote great care to updating our security practices and will promptly inform you and take appropriate steps if any compromise of data occurs despite our safeguards.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, and to comply with legal or business requirements. The exact duration we keep your data may vary depending on the type of information and the reasons for processing it:
- Account Information: If you create an account with us, we will keep your account data (such as your name, contact info, and login credentials) for as long as your account remains active. If you decide to close your account, we will delete or anonymise your personal data within a reasonable time after account closure, except for information that we are required or permitted to retain longer (for example, to comply with legal obligations or to resolve disputes).
- Transaction Data: We retain records of transactions (payments) you make through our Services to provide you with history and receipts, to handle refunds or disputes, and to comply with financial record-keeping regulations. Transaction data may include information like the date, amount, payment method (and possibly hashed or tokenised card details), and involved parties. Typically, financial regulations require us to keep such records for a minimum period (from 5 to 7 years, depending on the data). We securely store this data and restrict access to it. After the retention period passes, or once the data is no longer needed, we will ensure it is securely disposed of or anonymised.
- Communication Data: If you contact us (for example, via support email or chat), we may retain those communications and our responses for a certain period, both to assist in any follow-up and to improve our customer service. Support tickets and emails are generally kept for up to a few years, unless you request their deletion sooner and we have no lawful reason to keep them.
- Cookies: Cookies and similar tracking data are stored on your device. Session cookies are deleted when you close your browser, whereas persistent cookies remain until they expire or you clear them. We set cookies to expire at various intervals depending on their purpose (for instance, an analytics cookie might persist for a few months). You can delete cookies at any time via your browser, which will delete the data associated with them. On our side, any server logs or analytics data linked to cookies are typically retained for a short to medium period (e.g., several months) in an aggregated form.
- Legal Compliance and Protection: In some cases, we may need to retain certain personal data for longer periods if required by law or if necessary for legal claims. For example, if we are involved in a litigation or receive a legal hold notice, we will retain relevant data until the issue is resolved. Also, if we believe an account was used for fraud or violates our terms, we might retain certain information to assist in preventing future abuse or to support investigations.
In all cases, when our retention period ends, or if you ask us to delete your data and we have no legal basis to keep it, we will either securely erase or anonymise your personal information so that it can no longer be associated with you. Anonymised data (which can no longer identify you) may be retained for analytical purposes without further notice.
Your Rights
You have various rights regarding your personal data under GDPR and the Georgian Data Protection Law. We are committed to honouring these rights and have processes in place to enable you to exercise them. These rights include:
- Right to Be Informed: You have the right to clear and transparent information about how we process your personal data. This Privacy Policy is part of our effort to inform you. If you have any questions about our data practices not addressed here, you can contact us for more information.
- Right of Access: You have the right to request confirmation as to whether we are processing your personal data, and if so, to access that data and obtain a copy. This is sometimes called a "Data Subject Access Request." We will provide you with a summary of the data we have about you, along with an explanation of why we have it and how we use it, within the time frame required by law. The first copy will be provided free of charge (reasonable fees may apply for additional copies or excessive requests, as permitted by law).
- Right to Rectification: If any of your personal data that we hold is inaccurate or incomplete, you have the right to request that we correct or update it. Upon your request, we will rectify erroneous information promptly and inform you when it’s done. For instance, if you change your phone number or notice your name is misspelt in our records, you can ask us to update those details.
- Right to Erasure: You have the right to request deletion of your personal data in certain circumstances (also known as the "right to be forgotten"). You can ask us to erase your data if it is no longer necessary for the purposes for which it was collected, if you have withdrawn your consent (and no other legal basis for processing applies), or if you believe we are unlawfully processing your data. We will honour valid erasure requests and will also instruct any third parties processing your data on our behalf to do the same, unless retention is required by law or other legitimate grounds. Please note that this right is not absolute – for example, we might retain data despite an erasure request if we need it to comply with a legal obligation or to establish/exercise a legal claim.
- Right to Restrict Processing: You have the right to request that we limit the processing of your personal data under certain conditions. This means we would mark the stored data to be excluded from further use while the restriction is in place. You can exercise this right if you contest the accuracy of your data (while we verify it), if you believe the processing is unlawful but you prefer restriction over deletion, if we no longer need the data but you need us to keep it for a legal claim, or if you have objected to processing (pending verification of overriding grounds). When processing is restricted, we will only store your data and not actively process it, except to establish or defend legal claims or to protect the rights of others.
- Right to Data Portability: For data that you have provided to us and that we process by automated means based on your consent or a contract, you have the right to obtain a copy in a structured, commonly used, machine-readable format. For example, we can export your account data in a CSV or JSON file upon request. You also have the right to request that we transmit such data directly to another controller (e.g., another service provider) where technically feasible. This right facilitates moving your data to other services of your choosing.
- Right to Object: You have the right to object to our processing of your personal data when such processing is based on legitimate interests or public interest, and you believe your rights and interests outweigh our justifications. If you object, we will review your request and cease the processing in question unless we have compelling legitimate grounds to continue (such as an overriding need or a legal obligation). Importantly, you have an unconditional right to object to your data being used for direct marketing purposes. If we are ever processing your data for direct marketing (either based on legitimate interest or with your consent), and you object or opt out, we will stop using your data for that marketing immediately and without question.
- Right to Withdraw Consent: If we are processing any of your personal data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing done before the withdrawal. If you withdraw consent for a specific purpose (for example, receiving newsletters), we will stop the data processing related to that purpose. There is no penalty or negative consequence for withdrawing consent; however, if the data is also used for other purposes under a different legal basis, we may continue processing for those purposes.
- Right to Lodge a Complaint: If you believe that we have infringed your data protection rights or processed your personal data unlawfully, you have the right to file a complaint with the relevant supervisory authority. In Georgia, the supervisory authority is the Personal Data Protection Service (PDPS). You can contact the PDPS to report concerns or seek a resolution. If you are an EU resident, you may also contact your country’s data protection authority or the lead authority in the EU member state where we might have an establishment. We would appreciate the chance to address your concerns directly before you approach a regulator, so we encourage you to contact us first, but you are fully entitled to seek help from authorities at any time.
To exercise any of your rights, please reach out to us at support@nylo.pro with your request. For security reasons, we may need to verify your identity (for example, by asking you to provide information that confirms you are the account holder) before acting on your request. We will respond to your inquiry without undue delay and at the latest within the timeframe required by applicable law (under Georgian law, generally within 10 working days for most requests; under GDPR, generally within one month). There is no fee for making a request, although a reasonable fee might be charged if requests are manifestly unfounded or excessive, or additional copies are requested, as permitted by law.
Please note that some rights may be limited if fulfilling them would adversely affect the rights and freedoms of others. For example, we cannot provide data that would reveal personal information about another person, nor can we delete data that we are required by law to keep. We will inform you if we must refuse any part of your request and provide the justification. Rest assured, we endeavour to uphold all privacy rights to the fullest extent possible.
Children’s Privacy
Our Services are not intended for children under the age of 18. We do not knowingly collect personal data from anyone under 18 years old. If you are under 18, please do not use the Services or provide any personal information to us. If we learn that we have inadvertently collected personal data from a minor under 18, we will take steps to delete such information promptly from our records. Parents or guardians who believe that we might have information about their child should contact us immediately so we can investigate and take appropriate action.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will revise the "Last updated" date at the top of this Policy. If the changes are significant, we will provide a more prominent notice, such as via email notification or a notice on our website, prior to the change becoming effective. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.
Your continued use of our website or Services after any updates to this Policy constitutes your acknowledgement of the changes. If we seek to use your personal data for a new purpose that is not covered by this Policy, we will obtain your consent (if required by law) or provide you with a relevant notice.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please do not hesitate to contact us:
Email: support@nylo.pro
We will respond to your inquiry as soon as possible, and in any event within any timeframes required by law. Your privacy is important to us, and we welcome your feedback.