Privacy Policy of the BeriPay Service (Operator: NextLab LLC)

Date of Last Update: September 30, 2026

1. General Provisions and Data Controller

1.1. This Personal Data Processing Policy (hereinafter, the “Policy”) sets out the rules for the processing, storage, and protection of personal data of Users of the BeriPay service (hereinafter, the “Service”).

1.2. The Personal Data Controller is NextLab LLC (ООО «НекстЛаб»), Registration No. 326188-3301-ООО, INN 00203202610365, address: Office 4a, 141 Toktogula St., Pervomaisky District, Bishkek, Kyrgyz Republic (hereinafter, the “Operator”).

1.3. The BeriPay Service includes the website https://beripay.net, the mobile application, and the Telegram bot https://t.me/BeriPay_bot.

1.4. The Operator processes personal data in accordance with Law No. 58 of the Kyrgyz Republic “On Personal Information”, Federal Law No. 152-FZ “On Personal Data” (for processing data of individuals from the Russian Federation), and universally recognized international data protection standards (including GDPR principles).

2.1. Personal data processing is carried out strictly for the following purposes:

  • Conclusion and execution of the Agreement on the Use of the Service (Public Offer);
  • Facilitating information technology interaction between the User and issuing partners for the issuance and maintenance of Virtual Cards;
  • Compliance with statutory AML/CFT (Anti-Money Laundering and Countering the Financing of Terrorism) requirements;
  • User identity verification (KYC), including sanctions list screening and biometric verification;
  • Sending service notifications, responding to Support queries, and preventing fraudulent activities.

3. Categories of Data Processed

3.1. The Operator may process the following categories of data:

  • Identification Data: Full name, date of birth, citizenship, identity document series and number, photo/scan copies of documents;
  • Biometric Data: Facial photo image obtained during biometric checks (Liveness check);
  • Contact Data: Email address, phone number, Telegram username/ID;
  • Technical and Network Data: IP address, cookies data, device type, operating system, system logs, and session IDs;
  • Transaction and Balance Data: Top-up request history, Virtual Card details, accounting balance records.

4. Data Transfer to Third Parties and Cross-Border Transfer

4.1. The User agrees that the Operator is entitled to transfer and entrust the processing of personal data to the following categories of third parties:

  • Specialized accredited identity verification and compliance analytics partners (KYC/AML providers) — for document verification, Liveness checks, PEP (Politically Exposed Persons) screening, and sanctions check;
  • Virtual Card issuing partners and card program operators — for the purposes of card issuance, transaction authorization, and card maintenance;
  • Payment gateway and IT infrastructure providers — to ensure technical operation of the Service.

4.2. Cross-Border Transfer: Data may be transferred to foreign jurisdictions where partner infrastructure is located, provided an adequate level of data protection is guaranteed.

4.3. Storage of databases of Users from the Russian Federation is conducted in compliance with statutory primary localization requirements.

5. Data Processing Retention and Deletion

5.1. Personal data is processed and stored for the duration of the User’s Account activity and Service usage.

5.2. Pursuant to international and national AML regulations, personal data collected during verification (KYC) and transaction accounting shall be retained by the Operator and its partners for at least 5 (five) years after the termination of the relationship with the User or Account closure.

5.3. Upon expiration of the statutory retention periods, personal data shall be securely destroyed or anonymized.

6. Data Security and Rights of the User

6.1. The Operator implements necessary organizational and technical measures to safeguard personal data against unauthorized access, destruction, modification, or disclosure.

6.2. The User has the right to:

  • Request information regarding the processing of their personal data;
  • Request the rectification or updating of incomplete or inaccurate data;
  • Withdraw consent to data processing (noting that withdrawal results in the inability to use the Service and account closure, subject to mandatory statutory AML retention duties).

7. Contacts and Data Requests

For queries regarding personal data processing and the exercise of rights, Users may contact: