Privacy Policy

This Policy applies to the following categories of persons:

• Customers: individuals who make payments, receive refunds, or otherwise interact with our business clients using payment interfaces or checkout pages powered by Noda.
• Business representatives: employees, officers, administrators, authorised users, contacts, or other authorised representatives, acting on behalf of an existing or prospective business client.
• Business contacts and suppliers: individuals acting on behalf of service providers, licensed payment partners, or suppliers who engage with Noda.
• Website visitors: individuals who visit or interact with our website.

The personal data we collect and how it is used depends on your relationship with us and how you interact with the Services.

In most cases, we collect personal data directly from you. We may also obtain personal data from third parties where permitted by applicable law, such as public registers and databases, verification service providers, partners, or business clients. In addition, certain information may be collected automatically through your use of the Services.

The personal data we process depends on the nature of our relationship with you, the capacity in which you are acting, and how you use or interact with the Services.

Customers

If you are a Customer and a transaction is processed through our platform, we may process the following categories of personal data:

• Transaction Data. This may include your name, payment method information (such as internal reference number and IBAN), merchant and purchase details, billing address, currency, amount, date, payment status, payment account provider, or payment service providers initiating a transaction, and other information provided to us by you. We may also collect information entered into a checkout form even if the transaction is not completed.
• Personal Identification Information. Where necessary to complete a transaction, we may process certain identification data. This information may be provided directly by you, received from payment service providers, or obtained from trusted identity verification services, and may include identification documents or photographs.
• Data Collected Automatically. When you interact with our Services, including the platform and its payment-related interfaces (such as checkout forms), we automatically collect certain technical and usage information about your device and how the relevant forms are used. This may include IP address, device type, browser settings, language preference, pages or screens viewed, and interaction events (such as button clicks). This information may be collected through server logs and similar technologies.
• Contact Details and Communications. This may include your address, phone, email, and other information you provide to us, as well as communications and correspondence with Noda, or where relevant, with our business clients (e.g. in case of user disputes) or payment service providers involved in the transaction.

Business representatives

When you act on behalf of an existing or prospective business client, we may process the following categories of personal data:

• Identity and Verification Information. We may conduct pre-screening for contractual and platform-risk purposes when entering into a contract with a business client and this may involve processing of full name, date and place of birth, nationality, identification documents, beneficial owner information, photographs, proof of address (such as utility bills), company affiliation, job title, and information obtained from compliance or verification tools, as provided by you or by authorised third parties.
• Data Collected Automatically. When you interact with our Services, including the platform, dashboards, or API, we automatically collect certain technical and usage information. This may include login details, IP address, device and browser information, access logs, and records of system interactions, to support security, access control, and system operation.
• Contact Details and Communication. This may include your business address, phone, email, and other information that you provide to us, as well as records of communications with us, including enquiries, correspondence, and feedback you provide in connection with the Services.
• Marketing Information. Where permitted by applicable law, this may include your contact details and preferences relating to the receipt of marketing or informational communications from us. You may opt out of such communications at any time.

Business contacts and suppliers

If you are an employee, officer, representative, contractor, sub-contractor, or adviser of a supplier, service provider, or partner of Noda, we may collect and process your full name, role or position, business address, contact details (such as email and phone number), as well as records of communications with us, including enquiries and correspondence.

Website visitors

When you visit our website, we may automatically collect certain technical information, such as your IP address and browser or device information, where this is necessary for the operation and security of the website.

We do not currently use cookies or similar technologies on our website for analytics, advertising or targeting purposes.

We may use strictly necessary technical measures where required to operate, secure and protect the website and our Services.

Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review the privacy information provided by those third parties.

We process personal data for the following purposes:

• to operate, maintain, and support the website, technical platform and related Services;
• to enable payment transactions between merchants (our business clients) and their customers through integrated payment interfaces;
• to manage relationships with business clients, suppliers, partners, and their representatives;
• to provide customer and operational support and respond to enquiries;
• to ensure website or platform security, prevent misuse, fraud, and unauthorised access;
• to comply with applicable legal and regulatory obligations;
• to communicate with you regarding the Services, including service-related notices;
• to send marketing communications where permitted by law and in accordance with your preferences.

Where we intend to use personal data for a new purpose not described in this Policy, we will provide appropriate notice and, where required, obtain your consent.

We process personal information only where we have a lawful basis under applicable data protection laws. Depending on the context, processing may be based on one or more of the following grounds:

• Contractual necessity: where processing is necessary to enter or perform a contract with you in connection with our Services.
• Legal obligations: where processing is necessary to comply with applicable legal or regulatory requirements, including obligations relating to accounting, record-keeping, and other applicable rules.
• Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. This may include operating and maintaining our systems, preventing misuse of the Services and fraud, ensuring security, and managing internal operations and service development.
• Consent: where you have given your consent to specific processing activities and where such consent is required by law.

Where personal data is required for us to enter into or perform a contract with you, or to comply with a legal obligation, failure to provide that information may mean that we are unable to provide the relevant service or enter into the relevant relationship with you.

Automated decision-making and profiling

We do not rely on decisions based solely on automated processing of your personal data, including profiling. Any decisions related to the delivery of our Services and data processing are made by authorised staff.

We may share personal data with trusted third parties where this is necessary to operate our Services, meet legal or regulatory requirements, or otherwise for the purposes described in this Policy. Any sharing of personal data is carried out in accordance with applicable data protection laws and subject to appropriate safeguards.

Personal data may be shared with the following recipients:

• Licensed payment partners: authorised payment service providers involved in the processing of payment transactions through our platform, who act in their own regulated capacity (a list of partners is available here).
• Payment service providers and financial institutions: banks, electronic money institutions, payment institutions, payment processors, and other financial institutions involved in the processing, authorisation, and settlement of transactions.
• Technology and infrastructure providers: providers of IT, cloud hosting, security, data storage, communications, and related technical services that support the operation of our systems, products and services.
• Identity verification and fraud prevention providers: third parties assisting us with identity verification, and, where relevant, sanctions screening, fraud detection, and compliance checks.
• Professional advisers: legal, accounting, audit, and other professional advisers who provide services to us and are subject to professional duties of confidentiality.
• Group entities and operational support providers: companies providing shared administrative, technical or operational support where necessary for the purposes described in this Policy.
• Business partners and service providers: third parties that support specific aspects of our services, such as analytics, billing, customer communications, or marketing activities, where permitted by law and subject to any required consent.
• Potential business partners or successors: where necessary in connection with a proposed corporate transaction, such as a merger, acquisition or restructuring.
• Regulatory and public authorities: supervisory authorities, tax authorities, courts, or law enforcement bodies, where disclosure is required or permitted by applicable law.

We may transfer personal data to countries outside of the EU or EEA as necessary for the purposes described above, including to countries that may not provide the same level of data protection as your home country. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws.

These safeguards may include: (a) transfers to countries recognised by the European Commission as providing an adequate level of protection; (b) the use of standard contractual clauses approved by the European Commission; and (c) other safeguards provided by Article 46 of the GDPR (or, where applicable, a derogation under Article 49 GDPR).

Where required by applicable law, you may request further information about the safeguards we use for international data transfers, including a copy of the relevant mechanisms, by contacting us using the details set out below.

We protect personal data by implementing appropriate technical and organisational measures designed to safeguard it against accidental loss, destruction, alteration, unauthorised access, or disclosure. The level of security we apply is based on an assessment of the risks involved in the processing activity.

Examples of measures we use include:

• restricting access to personal data to staff and service providers on a need-to-know basis;
• pseudonymisation and encryption of personal data, where appropriate;
• security controls designed to ensure the ongoing confidentiality, integrity, availability, and resilience of our systems and services;
• backup and recovery measures to restore access to personal data in a timely manner in the event of a physical or technical incident; and
• regular testing and review of our technical and organisational measures, and staff training where appropriate, to help ensure those measures remain effective.

While we endeavour to always protect our systems, operations, and information from unauthorised access, use, alteration, or disclosure, no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, we cannot guarantee the absolute security of personal data transmitted to or stored on our system.

We retain personal data only for as long as it is needed for the purposes for which it was collected. When determining the appropriate retention period, we consider the following criteria:

• retention requirements imposed by applicable law or regulation, including, for example, tax and accounting record-keeping obligations and related reporting or audit requirements;
• duration of the relevant contractual relationship and the amount, nature, and sensitivity of the personal data;
• potential risk of harm resulting from unauthorised use or disclosure of the personal data;
• whether the data remains necessary and whether the same outcome can reasonably be achieved using less data; and
• applicable limitation periods, where we reasonably consider that retention is necessary in connection with potential legal claims.

In some circumstances we may anonymise personal data so that it can no longer be associated with you. Where data has been anonymised, it may be used for statistical or research purposes without further notice to you.

Subject to applicable law, you may have certain rights in relation to your personal data. Details of such rights are set out below:

• Access. You have a right to know whether we process your personal data and, if so, to request a copy of that data. Please note that we cannot give you information that contains personal data about other people.
• Rectification. You may ask us to rectify your personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Erasure. You may ask us to delete your personal data in certain situations, including where: (a) it is no longer needed for the purposes for which it was collected; (b) you withdraw your consent; (c) you successfully object to the processing; or (d) the data has been processed unlawfully. We may retain personal data where required or permitted by applicable law.
• Restriction. You may ask us to restrict the processing of your personal data in certain situations, including where: (a) you contest its accuracy; (b) the processing is unlawful and you prefer restriction instead of deletion; (c) we no longer need the data but you ask us to keep it for legal claims; or (d) you have objected to processing and we are assessing whether our legitimate grounds override your interests. Where processing is restricted, we will store the data and only process it where permitted by law.
• Portability. You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that this data be transferred to another data controller, where the processing is based on your consent or a contract and is carried out by automated means.
• Objection. Where we process your personal data based on our legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. We will stop processing your data unless we can demonstrate an overriding reason why we need to use your personal data, or where the data is needed for legal claims. You may object at any time to the use of your personal data for direct marketing.
• Withdraw Consent. If you have consented to our processing of your personal data, you have the right to withdraw your consent at any time. Please note that withdrawal of consent does not affect the lawfulness of processing which may have taken place prior to withdrawal of consent.

You may exercise any of your rights by contacting us at [email protected]. We may need to verify your identity or confirm that you are authorised to make the request. Where a request involves correcting or updating personal data, we may also take reasonable steps to verify the accuracy of the information provided before making any changes.

If you are unhappy with how we process your personal data, you may submit a complaint by writing to [email protected].

If you are a customer of one of Noda’s business clients, this client may be responsible for responding to your request, and we recommend that you contact them directly.

You also have the right to lodge a complaint with a competent supervisory authority if you believe that we have not complied with applicable data protection laws. A list of EU supervisory authorities is available here .

For the purposes of applicable data protection laws, the data controller is:

Stone Rose Operations Limited

Tseriou,140,
Flat/Office 204, Strovolos
2044, Nicosia, Cyprus

If you have any questions, requests, or concerns regarding this Policy or how we process personal data, you may contact us at [email protected]. We will be happy to assist.

We may update this Policy from time to time to reflect our new or updated services or changes in business practices, applicable laws, or regulatory requirements. We will indicate the date of the latest update at the top of this Policy.

Where we make material changes to how we collect, use, or share your personal data, we will endeavor to post a notice on the main page of our website or notify you by other means (e.g. by email) before such changes take effect.

Previous versions of this Policy were published under the Rocka brand and are available below:

• Version dated August 1, 2026
• Earlier version