The service needs an email, order contents, status history and limited technical security logs. OxaPay processes crypto payment data under its own service terms; secret credentials are never sent to the browser. Do not place wallet seed phrases or private keys in support messages.
Retention should be limited to fulfillment, receipts, fraud prevention, disputes and legal duties. Requests to access, correct or delete data go to [PRIVACY_CONTACT_TO_VERIFY]; identity checks may be required. Controller identity, transfers, retention periods and regional rights must be finalized before publication.
Order processing requires the checkout email, USV reference, cart details, selected payment session, transaction status and delivery history. Technical logs may include timestamps, device or browser data, IP-related security signals and consent records. These data are used to create and secure the order, verify payment, provide support, prevent abuse, keep accounting records and meet applicable legal duties—not to sell gift codes or wallet secrets.
Access is limited by operational need and service providers receive only data necessary for payment, hosting, email or support. Retention periods, processor list, transfer safeguards, controller identity and privacy contact must be completed at [LEGAL_ENTITY_NAME_TO_VERIFY], [REGISTERED_ADDRESS_TO_VERIFY] and [PRIVACY_CONTACT_TO_VERIFY]. Applicable rights may include access, correction, deletion, restriction, objection or complaint; legal retention and fraud evidence can limit deletion.