Privacy Policy
Last updated: June 2026
This policy explains how NOCOMP FZCO ("we", "us") collects, uses and protects personal data in connection with the COCO PAY CRM platform.
1. Who we are
COCO PAY CRM is owned and operated by NOCOMP FZCO, a UAE company located at IFZA Business Park, DDP, Premises Number 43483-001, Dubai Silicon Oasis, Dubai, United Arab Emirates. References to “COCO PAY CRM”, “we”, “our” or “us” mean NOCOMP FZCO.
2. Information we collect
- Account & contact data — name, business name, email, and credentials of dashboard users.
- Merchant configuration — processor/gateway settings and routing rules you provide.
- Transaction data — order identifiers, amounts, status, masked card details (first six and last four digits only) and gateway responses processed through the platform.
- Usage & technical data — IP address, device/browser information, and logs needed to operate, secure and audit the service.
We do not store full primary account numbers (PANs) or card verification values (CVV/CVC) for display. Card data is handled in line with PCI-DSS principles and minimised wherever possible.
3. How we use information
- To provide, operate and improve the platform, including payment routing, recovery, CRM and reporting.
- To authenticate users, secure accounts, and maintain audit logs.
- To prevent fraud, abuse and chargebacks, and to meet legal and compliance obligations.
- To communicate with you about your account, support requests and service updates.
4. Legal bases
We process personal data to perform our contract with you, to comply with legal obligations, and for our legitimate interests in operating a secure and reliable payments platform.
5. Sharing
We share data only as needed to deliver the service: with payment processors, gateways and acquiring banks you connect; with infrastructure and security sub-processors acting on our instructions; and where required by law or to protect our rights. We do not sell personal data.
6. International transfers
We operate from the United Arab Emirates and may process data in other jurisdictions through our sub-processors. Where data is transferred internationally, we apply appropriate safeguards.
7. Security
We apply technical and organisational measures including encryption of credentials at rest, transport encryption, access controls, rate limiting, audit logging and continuous monitoring.
8. Retention
We retain personal and transaction data for as long as needed to provide the service and to meet legal, accounting and compliance requirements, after which it is deleted or anonymised.
9. Your rights
Subject to applicable law, you may request access to, correction or deletion of your personal data, or object to certain processing. Contact us using the details below to exercise these rights.
10. Cookies
Our website uses limited cookies as described in our Cookie Policy.
11. Changes
We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.