Privacy Policy

Effective date: 2026-04-17 · Last updated: 2026-11-13. Operator: M.A.X SİSTEMLƏRİ PLYUS LLC (trade name Max Systems), a payment institution licensed by the Central Bank of the Republic of Azerbaijan. Data protection contact: compliance@pay2net.co.

1. What we collect

• From Merchants: company details, information about owners and beneficial owners, bank details, contact details of the Merchant’s staff, and data on how the Merchant uses the API.
• From End Customers, on the Merchant’s behalf: the email address and phone number when provided, the IP address and payment details. Of the card number we keep only the first 6 and last 4 digits and the card brand; see section 7.
• From visitors of this site: what you enter in the forms (name, email, company, message) and technical data recorded in server logs, such as the IP address, the requested page and the browser type. This site has no analytics or advertising trackers.

2. Why we collect it

To provide the payment service; to meet anti-money-laundering and customer identification requirements under the laws of the Republic of Azerbaijan and the rules of our partner banks; to prevent fraud; to calculate settlements; to answer support requests; and to improve the service using aggregated data.

3. Data retention

• Transaction records and merchant verification records — for the periods required by law, including anti-money-laundering legislation.
• API request logs — 395 days, in both test and live mode.
• Audit trail of actions in our systems — 5 years.

4. Sub-processors

We use sub-processors for hosting (AzInTelecom data centres in Azerbaijan), for sending email and for screening against sanctions lists. The current list, showing what data each sub-processor receives and where it processes it, is available on request from compliance@pay2net.co.

5. Your rights

End Customers and Merchants can request access to their personal data, its correction or its deletion by writing to compliance@pay2net.co or through our contact form. We answer within the time limits set by law. Some data — for example, transaction records that we must keep by law — cannot be deleted before the required period ends; in such cases we restrict its processing.

6. Where data is stored

Data of the MAXFI platform is stored in AzInTelecom data centres in the Republic of Azerbaijan, as required by the Central Bank of the Republic of Azerbaijan. Backups are also kept in Azerbaijan. Some services we use — for example, screening against international sanctions lists and email delivery — may process personal data outside Azerbaijan.

7. Card data

Card details are entered on the MAXFI payment page or in the MAXFI Widget, never on the Merchant’s servers. MAXFI sends them to the acquiring bank over TLS. To complete 3-D Secure, the full card number is kept encrypted for at most 30 minutes and is not stored after that. The CVC is never stored. We keep only the first 6 and last 4 digits of the card number.

MAXFI is being assessed against PCI DSS 4.0.1 as a service provider; the assessment is in progress. Details: PCI DSS.

8. Cookies and browser storage on this site

This site sets one cookie, maxfi_lang, to remember the language you chose. Display settings (theme, text size, contrast, font) are kept in your browser’s local storage and are not sent to us. There are no tracking, advertising or third-party analytics cookies.

9. Contact

Data protection requests: compliance@pay2net.co, or the contact form with the topic “Security & compliance”.