1. About HansePay

HansePay is a trading name of Atrya Technologies SIA, a company registered in the Republic of Latvia (Commercial Register no. [reg. no.]), with its registered office at Marijas iela 2A, Rīga, LV-1050, Latvia, and operating from Stadtdeich 2–4, 20097 Hamburg, Germany.

Atrya Technologies SIA is supervised by Latvijas Banka (Bank of Latvia). HansePay enables cross-border payments and currency exchange for individuals and businesses. Certain regulated payment and e-money services are provided in partnership with licensed payment institutions (see clause 8). Our full authorisation details are set out in our Legal Notice.

2. Services

HansePay provides the following payment services to eligible individuals and businesses within the European Economic Area (EEA):

• Opening and operating payment accounts (individual and business)
• Executing domestic and cross-border payment transactions (SEPA Credit Transfers, SWIFT)
• Currency exchange (FX) services
• Receiving and holding funds in payment accounts
• Onward remittance and business treasury services

We do not offer deposit-taking, lending, or investment services. Depending on the payment corridor, settlement may be performed using payment rails operated by our regulated partners. Funds held in connection with these services are safeguarded — not protected by a deposit guarantee scheme — as described in clause 8.

3. Eligibility

Individual accounts: You must be at least 18 years of age and a resident of the European Economic Area. By accepting these Terms, you confirm that you are not subject to any sanctions or legal restrictions that would prevent you from using our services.

Business accounts: The authorised representative accepting these Terms on behalf of a legal entity confirms that they have authority to bind the entity, that the entity is duly incorporated and in good standing in its jurisdiction, and that the entity is not subject to sanctions or legal restrictions.

4. Account Opening and Identity Verification

We are required by law to verify your identity and, for business accounts, the identity of directors and beneficial owners (UBOs) before activating your account. This process (Know Your Customer — KYC) involves providing:

• Personal identification documents (passport or national ID)
• Proof of address
• For businesses: company registration documents, ownership structure, and information about persons with significant control
• Information about the purpose of your account and the source of your funds

We may request additional documentation at any time to comply with our regulatory obligations. Failure to provide requested information may result in account restriction or closure.

HansePay reserves the right to decline any application without providing reasons, subject to applicable law.

5. Using Your Account

5.1 Account Security

You are responsible for maintaining the confidentiality of your account credentials. You must notify us immediately at hello@hansepay.com if you become aware of any unauthorised access to your account. We will not be liable for losses resulting from your failure to maintain the security of your credentials.

5.2 Payment Instructions

You authorise HansePay to execute payment instructions submitted through your account. You are responsible for ensuring the accuracy of all payment details including IBAN, account numbers, and beneficiary information. We cannot recover funds sent to incorrect account details.

5.3 Processing Times

SEPA Credit Transfers within the EEA are typically processed by the next business day (D+1). International (SWIFT) transfers may take 1–5 business days depending on the destination country and correspondent banking arrangements. We are not responsible for delays caused by third-party financial institutions.

6. Fees

HansePay's current fee schedule is available at hansepay.com/pricing. Fees may change on 30 days' notice. Continued use of our services after the effective date of a fee change constitutes acceptance of the new fees.

7. Prohibited Activities

You agree not to use HansePay's services for:

• Any activity that is illegal under applicable law, including but not limited to money laundering, tax evasion, fraud, or financing of terrorism
• Transactions involving parties or jurisdictions subject to international sanctions administered by the EU, UN, US (OFAC), or UK
• Processing payments on behalf of third parties (money service business activity) without disclosure and our prior written consent
• Gambling, adult entertainment, arms dealing, or other activities that we determine at our sole discretion to present unacceptable risk
• Any activity that violates any third party's intellectual property rights or privacy

Breach of this section may result in immediate account suspension, reporting to law enforcement, and civil or criminal liability.

8. Safeguarding of Funds and Payment Partners

Where regulated payment or e-money services are provided through a licensed partner (for example, BlindPay), customer funds are held and safeguarded by that partner under its own authorisation, in accounts segregated from operating funds. Where Atrya Technologies SIA itself holds customer funds, those funds are safeguarded in line with applicable EU requirements in segregated accounts held with regulated credit institutions.

Funds held in a payment or e-money account are not covered by a deposit guarantee scheme. Safeguarding protects your funds in the event of insolvency by keeping them segregated and ahead of unsecured creditors. To use payment services, you may be required to accept the terms of our payment partner in addition to these Terms.

9. Liability and Limitation

We will not be liable for:

• Indirect, consequential, or special losses arising from your use of our services
• Losses arising from system outages, third-party payment network failures, or force majeure events
• Losses arising from your provision of incorrect payment details
• Regulatory or compliance actions taken against your account that are required by law

Our aggregate liability to you in any 12-month period shall not exceed the total fees paid by you to HansePay in that period, or €500, whichever is greater.

Nothing in these Terms limits liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.

10. Intellectual Property

All content on the HansePay platform, including software, design, text, and logos, is the property of Atrya Technologies SIA or its licensors and is protected by copyright, trademark, and other intellectual property laws. You may not reproduce, distribute, or create derivative works without our prior written consent.

11. Suspension and Termination

We may suspend or close your account with notice where:

• You breach these Terms or our Acceptable Use Policy
• We are required to do so by law or regulatory authority
• We reasonably suspect fraudulent, unlawful, or harmful activity
• You fail to provide required identity verification documents

You may close your account at any time by contacting hello@hansepay.com. Following account closure, we will return any outstanding balances to you within a reasonable period, less any amounts owed to us, provided we are not legally restricted from doing so.

12. Amendments

We may update these Terms at any time. We will provide at least 60 days' advance notice for material changes by email and/or a prominent notice on our platform. If you do not agree to the updated Terms, you may close your account before the effective date of the change. Continued use after the effective date constitutes acceptance.

13. Governing Law and Dispute Resolution

These Terms and any dispute arising in connection with them are governed by the laws of the Republic of Latvia, without regard to conflict-of-law principles. For consumer disputes, mandatory consumer protection laws of your country of residence apply to the extent they provide greater protection.

In the first instance, please contact us at legal@hansepay.com. See our Complaints Policy for details of our formal complaints process and escalation routes.

14. Contact

Atrya Technologies SIA, trading as HansePay
c/o Factory Works GmbH, Stadtdeich 2–4, 20097 Hamburg, Germany
legal@hansepay.com

1. Data Controller

The data controller is Atrya Technologies SIA, Marijas iela 2A, Rīga, LV-1050, Latvia, operating under the brand HansePay from Stadtdeich 2–4, 20097 Hamburg, Germany.

2. Data We Collect

2.1 Account and identity data

• Full name, date of birth, nationality
• Government-issued identification documents (passport or national ID)
• Residential address and proof of address
• Email address and phone number
• Profile photograph (from ID documents)

2.2 Business account data (additional)

• Company name, registration number, registered address, legal form
• NACE industry codes and business description
• Details of directors, authorised signatories, and beneficial owners (UBOs)
• Corporate structure and ownership information
• Company financial information (source of funds, account purpose)

2.3 Transaction data

• Payment amounts, currencies, dates, and reference information
• Sender and recipient account details (IBANs, SWIFT codes, names)
• Transaction purpose and payment references

2.4 Usage and technical data

• IP address, browser type and version, operating system
• Device identifiers
• Pages visited, time spent, click-through paths
• Login timestamps and session data

2.5 Compliance data

• Politically Exposed Person (PEP) status and sanctions screening results
• Source of wealth and source of funds declarations
• Risk assessment scores and customer due diligence records
• Correspondence with us relating to your account

3. How We Collect Data

• Directly from you — when you apply for an account, fill in forms, upload documents, or communicate with us
• From identity verification providers — our KYC partner (Signicat) processes your biometric and document data to verify your identity
• From sanctions and PEP databases — we screen your details against EU, UN, OFAC, and UK consolidated sanctions lists
• Automatically — when you use our website or platform, via cookies and server logs (see our Cookie Policy)
• From third-party payment networks — when receiving payments, counterparty data arrives via SEPA and SWIFT messaging

4. Why We Process Your Data (Legal Basis)

Purpose	Legal basis
Opening and operating your payment account	Contract (Art. 6(1)(b) GDPR)
Processing payment transactions	Contract (Art. 6(1)(b) GDPR)
Identity verification (KYC)	Legal obligation (Art. 6(1)(c) GDPR) — EU AML Directive
Sanctions and PEP screening	Legal obligation (Art. 6(1)(c) GDPR)
Transaction monitoring for AML	Legal obligation (Art. 6(1)(c) GDPR)
Regulatory reporting	Legal obligation (Art. 6(1)(c) GDPR)
Fraud prevention and security	Legitimate interests (Art. 6(1)(f) GDPR)
Service improvement and analytics	Legitimate interests (Art. 6(1)(f) GDPR)
Marketing communications	Consent (Art. 6(1)(a) GDPR) — you can opt out at any time

5. Automated Decision-Making

In line with our AML and KYC obligations, we use automated processing — including sanctions-list screening and risk scoring — to assess the risk profile of applicants and transactions. Some of these decisions may be made solely by automated means within the meaning of Article 22 GDPR, where this is necessary for entering into or performing our contract with you, or to comply with a legal obligation to which we are subject. Where this is the case, you have the right to obtain human intervention, to express your point of view, and to contest the decision by contacting privacy@hansepay.com.

6. Sharing Your Data

We share your personal data only where necessary:

• Signicat (Norway, within the EEA) — identity verification and KYC processing under a Data Processing Agreement
• Correspondent banks and payment networks — required to execute your payment instructions (SEPA, SWIFT)
• Sanctions screening providers — to comply with AML obligations
• Latvijas Banka and other regulatory authorities — when required by law
• Law enforcement agencies — when legally required or to prevent serious crime
• Professional advisers (lawyers, auditors) — under strict confidentiality
• Successors in business — in the event of a merger, acquisition, or sale of assets

We do not sell your personal data. We do not share your data for third-party marketing purposes.

7. International Data Transfers

Most of our processing takes place within the European Economic Area (EEA). Service providers located in the EEA — including our identity-verification partner Signicat (Norway) — are not subject to third-country transfer restrictions. Where we do transfer personal data to a country outside the EEA, we rely on one of the following safeguards:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules where applicable

You may request a copy of the relevant transfer safeguards by contacting privacy@hansepay.com.

8. Data Retention

We retain your personal data for as long as necessary to provide our services and to comply with our legal obligations. Key retention periods include:

• Account and KYC data: 5 years from account closure (EU AML Directive requirement)
• Transaction records: 5 years from the date of the transaction
• Compliance and risk records: Up to 10 years where required by regulatory or legal proceedings
• Marketing preferences: Until you withdraw consent
• Technical logs: 12 months

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your data where we no longer have a legal basis to retain it
• Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

Note that some rights are subject to limitations — for example, we may be unable to delete data we are required to retain for AML or regulatory purposes.

To exercise any of these rights, contact privacy@hansepay.com. We will respond within 30 days.

10. Supervisory Authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the relevant supervisory authority:

Datu valsts inspekcija (Latvian Data State Inspectorate)
Elijas iela 17, Rīga, LV-1050, Latvia
www.dvi.gov.lv

You may also contact the supervisory authority in your country of residence.

11. Cookies

We use cookies and similar tracking technologies on our website. Please see our Cookie Policy for full details.

12. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our platform before the changes take effect. The current version is always available at this page.

1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to remember your preferences and actions over time, or to collect data about how you use the site. Similar technologies include web beacons, pixels, local storage, and session storage.

2. Categories of Cookies We Use

2.1 Strictly Necessary Cookies

These cookies are essential to make our website and platform function. Without them, services such as logging in or completing your account application cannot be provided. They do not require your consent.

Cookie	Purpose	Duration
hp_session	Maintains your logged-in session and security token	Session
hp_csrf	Prevents cross-site request forgery attacks	Session
hp_onb	Saves your progress through the account opening flow	30 days
hp_pref	Stores your language and interface preferences	1 year
cookieconsent	Records your cookie consent choices	1 year

2.2 Analytics Cookies

These cookies help us understand how visitors use our website — which pages are most visited, where users drop off in the onboarding flow, and how to improve our product. We only place these cookies with your consent.

Cookie	Provider	Purpose	Duration
_ga, _ga_*	Google Analytics	Page views, session analytics, user journey data	2 years
_gid	Google Analytics	Distinguishes individual users	24 hours
ph_*	PostHog (self-hosted)	Product analytics and funnel analysis	1 year

2.3 Marketing and Targeting Cookies

These cookies may be placed by our advertising partners to build a profile of your interests and show you relevant advertisements on other sites. We only place these cookies with your explicit consent.

Cookie	Provider	Purpose	Duration
_fbp, fr	Meta (Facebook)	Ad targeting and conversion tracking	90 days
li_fat_id	LinkedIn	LinkedIn ad conversion and retargeting	30 days
_gcl_au	Google Ads	Conversion tracking for Google advertising	90 days

3. Managing Your Cookie Preferences

When you first visit our website, we present a cookie consent banner where you can accept all cookies, reject non-essential cookies, or customise your preferences. You can change your preferences at any time by clicking the "Cookie settings" link in the footer of any page.

You can also control cookies through your browser settings. Most browsers allow you to:

• View and delete cookies that have been set
• Block cookies from specific sites
• Block third-party cookies
• Clear cookies when you close your browser

Please note that blocking strictly necessary cookies will prevent you from using some features of our platform, including logging in.

For more information on managing cookies in popular browsers, visit:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

4. Contact

For questions about our use of cookies, contact privacy@hansepay.com.

1. Regulatory Framework

Atrya Technologies SIA (HansePay) is subject to the following key regulatory instruments:

• Directive (EU) 2015/849 (4th AMLD), as amended by Directive (EU) 2018/843 (5th AMLD) — customer due diligence and AML/CFT obligations
• Directive (EU) 2018/1673 (6th AMLD) — harmonisation of money-laundering criminal offences across the EU
• Regulation (EU) 2023/1113 — information accompanying transfers of funds and certain crypto-assets (recast "Transfer of Funds" Regulation)
• Latvian Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing
• Supervision by Latvijas Banka (Bank of Latvia)

The EU's new anti-money-laundering package — Regulation (EU) 2024/1624 (the single AML Rulebook, "AMLR"), Directive (EU) 2024/1640, and the new Anti-Money Laundering Authority (AMLA) — applies progressively from 2027. We are preparing for this transition.

2. Know Your Customer (KYC)

Before opening an account or activating payment services, we are required to verify the identity of all customers. This process exists to prevent our platform from being used for money laundering, terrorist financing, tax evasion, and sanctions violations.

2.1 Individual customers

We collect and verify:

• Full legal name, date of birth, and nationality
• Residential address
• Government-issued photo identification (passport or national ID)
• Source of income and employment status
• Account purpose and expected transaction volumes

2.2 Business customers

For legal entities we collect and verify:

• Company name, registration number, jurisdiction, and legal form
• Articles of incorporation and governance documents
• Register of shareholders / proof of ownership
• Identity of all directors and authorised signatories
• Identity and residential address of all Ultimate Beneficial Owners (UBOs) — persons owning or controlling 25% or more of the entity
• Business activity description, NACE industry classification
• Source of business funds and expected payment flows
• Account purpose and main counterparty countries

3. Enhanced Due Diligence (EDD)

We apply additional verification measures where we identify higher risk. This includes, but is not limited to:

• Customers who are Politically Exposed Persons (PEPs) or close associates of PEPs
• Customers or transactions with connections to higher-risk countries (as identified by FATF or EU-designated high-risk third countries)
• Customers operating in higher-risk sectors (crypto-assets, gambling, arms, cash-intensive businesses)
• Complex corporate structures or high transaction volumes relative to stated business activity
• Customers who are subject to adverse media or have previously been flagged by a financial institution

Enhanced due diligence may include requests for source of wealth documentation, additional corporate structure clarification, or senior management approval before account activation.

4. Politically Exposed Persons (PEPs)

A Politically Exposed Person (PEP) is an individual who holds, or has held, a prominent public function. This includes heads of state, government ministers, senior judges, senior military officers, executives of state-owned enterprises, and members of senior governing bodies of international organisations. In line with EU requirements, we continue to apply enhanced measures for at least 12 months after a person ceases to hold such a function, and for longer where the risk remains.

Close associates and immediate family members of PEPs are also subject to enhanced scrutiny. We ask all customers to self-declare PEP status during onboarding, and we additionally screen all customers and beneficial owners against PEP databases.

Being a PEP does not automatically prevent you from using HansePay, but additional review and documentation will be required.

5. Sanctions Screening

We screen all customers and beneficial owners against the following sanctions lists upon onboarding and on an ongoing basis:

• European Union Consolidated Sanctions List
• United Nations Security Council Sanctions List
• US Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) List
• UK Office of Financial Sanctions Implementation (OFSI) Consolidated List
• Latvian national sanctions registers

We are prohibited by law from processing transactions for or with any sanctioned party. If a customer is matched to a sanctions list, we are obligated to freeze their funds and report to the relevant authority. We cannot provide advance notice of such actions.

6. Transaction Monitoring

We monitor transactions on an ongoing basis for indicators of suspicious activity, including:

• Transactions inconsistent with a customer's stated business activity or expected volumes
• Unusual patterns such as rapid structuring to avoid reporting thresholds
• Payments to or from high-risk jurisdictions without a clear business rationale
• Transactions involving counterparties flagged in adverse media or sanctions databases

7. Suspicious Activity Reporting

We are legally required to report suspicious transactions to the relevant financial intelligence unit (FIU). In Latvia, this is the Financial Intelligence Unit (Finanšu izlūkošanas dienests — FID). We are prohibited by law ("tipping off" provisions) from informing customers that a report has been, or is being, made.

8. Your Obligations as a Customer

By using HansePay, you agree to:

• Provide accurate and complete information during onboarding and on any ongoing request
• Promptly notify us of any material changes to your circumstances, ownership structure, or business activity
• Not use our platform to process funds derived from criminal activity or to circumvent legal obligations
• Cooperate fully with any enhanced due diligence request we make
• Ensure that you are not subject to sanctions and that your transactions do not involve sanctioned parties or jurisdictions

Failure to comply with these obligations may result in account restriction, account closure, and reporting to relevant authorities.

9. Record Keeping

In accordance with EU AML legislation, we retain all customer due diligence records and transaction records for a minimum of five years from the date of the transaction or the end of the business relationship. Extended retention may apply in the case of ongoing legal or regulatory proceedings.

10. Contact

For compliance-related enquiries: compliance@hansepay.com

1. How to Submit a Complaint

You may submit a complaint using any of the following channels:

When submitting your complaint, please include:

• Your full name and account reference (if applicable)
• A clear description of the issue and what outcome you are seeking
• The date(s) of the relevant transaction(s) or events
• Any supporting documents (screenshots, payment confirmations, correspondence)

2. Our Complaints Process

Step 1 — Acknowledgement (within 3 business days)

We will acknowledge receipt of your complaint within 3 business days and provide you with a reference number and the name of the person handling your case.

Step 2 — Investigation (within 15 business days)

We will investigate your complaint thoroughly and provide a full written response within 15 business days of receipt. In complex cases, we may require up to 35 business days — we will notify you if this is necessary and explain the reason for the delay.

Step 3 — Final Response

Our final response will either uphold your complaint (and explain what remedial action we will take) or explain why we do not believe the complaint can be upheld, including your right to escalate.

3. Escalation — Financial Supervisor

If you remain dissatisfied after receiving our final response, or if we have not responded within 35 business days, you may escalate your complaint to our regulatory supervisor:

Latvijas Banka (Bank of Latvia) — Consumer Rights Protection
K. Valdemāra iela 2A, Rīga, LV-1050, Latvia
Phone: +371 67 022 300
www.bank.lv/en/consumers

4. EU Online Dispute Resolution

The European Commission's Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 and is no longer available. Consumers should instead use the national alternative dispute resolution (ADR) routes described in this policy.

5. Out-of-Court Dispute Resolution (Germany)

Customers in Germany may be able to refer a payment-services dispute to the statutory arbitration body at the Deutsche Bundesbank (Schlichtungsstelle bei der Deutschen Bundesbank):

Deutsche Bundesbank — Schlichtungsstelle
Postfach 11 12 32, 60047 Frankfurt am Main, Germany
www.bundesbank.de

The competent ADR body depends on our authorisation and any scheme membership. We will confirm the applicable body, and your right to refer the matter to it, in our final response to your complaint.

6. What We Cannot Help With

Some matters fall outside our complaints process:

• Complaints that are the subject of ongoing litigation
• Decisions we are required to make under AML, sanctions, or regulatory law (for example, account restriction or closure ordered by a regulatory authority)
• Complaints about the actions of third parties, such as correspondent banks, beneficiary banks, or card networks, over which we have no control

7. Contact

For any complaints or feedback: complaints@hansepay.com
Atrya Technologies SIA, trading as HansePay
c/o Factory Works GmbH, Stadtdeich 2–4, 20097 Hamburg, Germany