caibo
Our Solution Features Pricing
Documentation
Auth API
Start integrating Caibo products
Web Integrations
Embed payments in any web app
REST Integrations
Full REST API for any stack
Mobile Integration
iOS & Android native SDKs
Full API Reference
Complete technical documentation →
FAQs
Log in Get Started
Our Solution Features Pricing FAQs
Log in Get Started
Home Privacy & Terms
Legal

Privacy & Terms

Caibo Digital OOD Last updated: May 2025 Registered in Bulgaria

This Privacy Policy describes how Caibo Digital OOD collects, uses, and protects your personal data when you use our website and payment services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Bulgarian data protection law.

Privacy — Contents
  1. Who we are
  2. Data we collect
  3. How we use your data
  4. Legal basis for processing
  5. Who we share data with
  6. International transfers
  7. Data retention
  8. Your rights
  9. Security
  10. Contact & DPO
01

Who we are

Caibo Digital OOD is the data controller for personal data collected through caibo.digital and our payment gateway services. We are registered in Bulgaria and operate as an internet payment gateway (IPG) platform serving merchants globally.

Contact: office@caibo.digital

02

Data we collect

Information you provide

  • Account data — name, email address, phone number, company name, VAT number when registering as a merchant.
  • KYC/AML documents — identity documents, proof of address, business registration certificates required for account verification.
  • Communications — messages sent to our support team or via contact forms.

Information collected automatically

  • Usage data — pages visited, time on site, referral source, browser type, operating system.
  • Device data — IP address, device identifiers, screen resolution.
  • Transaction data — payment amounts, currency, transaction status, timestamps (we do not store full card numbers — these are handled by our PCI DSS Level 1 certified infrastructure).
  • Cookies & tracking — see our Cookie Policy for full details.
03

How we use your data

  • Providing and improving our payment gateway services
  • Merchant onboarding, KYC/AML compliance verification
  • Processing and settling payment transactions
  • Fraud detection, prevention and security monitoring
  • Regulatory reporting and legal compliance
  • Sending transactional communications (receipts, alerts, account updates)
  • Customer support and dispute resolution
  • Analytics to improve site performance and user experience
  • Marketing communications (where you have given consent)
04

Legal basis for processing

  • Contract performance — processing necessary to provide our payment services to merchants.
  • Legal obligation — KYC/AML compliance, tax reporting, regulatory requirements.
  • Legitimate interests — fraud prevention, security monitoring, service improvement.
  • Consent — marketing emails, analytics and marketing cookies (which you can withdraw at any time).
05

Who we share data with

We do not sell your personal data. We may share data with:

  • Payment networks — Visa, Mastercard, Amex and other card schemes for transaction processing.
  • Acquiring banks — our banking partners who settle funds on our behalf.
  • Fraud prevention providers — third-party risk and fraud scoring services.
  • Cloud infrastructure providers — hosting and data storage (subject to appropriate data processing agreements).
  • Analytics providers — Google Analytics (pseudonymised data only).
  • Regulatory authorities — financial regulators, tax authorities, or law enforcement when legally required.
  • Professional advisors — lawyers, auditors and accountants under confidentiality obligations.
06

International transfers

Some of our service providers are located outside the European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

  • EU Standard Contractual Clauses (SCCs)
  • Adequacy decisions by the European Commission
  • Binding Corporate Rules where applicable
07

Data retention

We retain personal data only as long as necessary for the purposes outlined above or as required by law:

  • Account data — for the duration of the merchant relationship plus 5 years.
  • Transaction records — 7 years (financial regulatory requirement).
  • KYC documents — 5 years after the end of the business relationship (AML Directive).
  • Marketing consent records — until you withdraw consent.
  • Website analytics — up to 26 months (anonymised after 14 months).
08

Your rights

Under GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion of your data where there is no legitimate reason for us to continue processing it.
  • Restriction — ask us to suspend processing while a dispute is resolved.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at office@caibo.digital. We will respond within 30 days. You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) in Bulgaria (cpdp.bg) or with the supervisory authority in your country of residence.

09

Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

  • TLS encryption for all data in transit
  • AES-256 encryption for data at rest
  • PCI DSS Level 1 certification for payment data
  • Access controls and principle of least privilege
  • Regular penetration testing and security audits
  • Staff training on data protection obligations

In the event of a personal data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33.

10

Contact & DPO

For any privacy-related questions or to exercise your rights, please contact our Data Protection Officer:

office@caibo.digital
Caibo Digital OOD — Registered in Bulgaria

These Terms of Service govern your access to and use of the Caibo payment gateway platform and related services provided by Caibo Digital OOD. By accessing our services, you agree to be bound by these terms.

Terms — Contents
  1. Definitions
  2. Eligibility & registration
  3. Our services
  4. Merchant obligations
  5. Fees & settlement
  6. Intellectual property
  7. Limitation of liability
  8. Termination
  9. Governing law
  10. Contact
01

Definitions

  • "Caibo" — Caibo Digital OOD, a company registered in Bulgaria.
  • "Services" — the Caibo internet payment gateway, merchant dashboard, APIs, and related tools.
  • "Merchant" — a business or individual who registers for and uses the Services to accept payments.
  • "End Customer" — a person who makes a payment to a Merchant through the Services.
  • "Transaction" — a payment instruction initiated through the Services.
02

Eligibility & registration

To use our Services, you must be a legally registered business entity or sole trader aged 18 or over. By registering, you represent that all information provided is accurate and that you have the authority to bind your organisation to these terms.

Account approval is subject to our KYC/AML verification process. We reserve the right to decline or suspend applications at our sole discretion, including based on the nature of your business, transaction volumes, or risk profile.

03

Our services

Caibo provides an internet payment gateway enabling Merchants to accept card payments, alternative payment methods, and process transactions globally. Specific capabilities are described in the Our Solution page and applicable service schedules.

We do not guarantee uninterrupted availability of the Services but will endeavour to maintain uptime consistent with industry standards. Planned maintenance will be communicated in advance where practicable.

04

Merchant obligations

As a Merchant, you agree to:

  • Use the Services only for lawful business purposes and in accordance with applicable card scheme rules (Visa, Mastercard, etc.).
  • Not process prohibited transaction types as listed in our Acceptable Use Policy.
  • Maintain accurate and up-to-date account information.
  • Implement reasonable security measures to protect your API credentials and merchant dashboard access.
  • Comply with all applicable laws including consumer protection, data protection, and anti-money laundering regulations.
  • Promptly notify Caibo of any suspected unauthorised access or security breach.
  • Maintain sufficient funds or reserves to cover potential chargebacks and refunds.
05

Fees & settlement

Fees for the Services are as set out in your Merchant Agreement or on our Pricing page. We reserve the right to amend fees with 30 days' written notice.

Settlement of funds to your designated bank account will occur in accordance with the settlement schedule agreed during onboarding. Caibo reserves the right to withhold settlement where there is a reasonable suspicion of fraud, chargeback risk, or breach of these terms.

You are responsible for all applicable taxes on fees charged by Caibo in your jurisdiction.

06

Intellectual property

All intellectual property rights in the Services, including software, APIs, documentation, branding, and content, remain the exclusive property of Caibo Digital OOD. We grant you a limited, non-exclusive, non-transferable licence to use the Services solely for your own business purposes during the term of your Merchant Agreement.

You may not copy, modify, reverse-engineer, or create derivative works of any part of the Services without our prior written consent.

07

Limitation of liability

To the maximum extent permitted by applicable law, Caibo shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, data, or goodwill, arising out of or in connection with the Services.

Our total aggregate liability to you for any claim shall not exceed the total fees paid by you to Caibo in the three months preceding the event giving rise to the claim.

Nothing in these terms limits liability for fraud, death or personal injury caused by negligence, or any other liability that cannot be excluded under applicable law.

08

Termination

Either party may terminate the Merchant Agreement with 30 days' written notice. Caibo may suspend or terminate your account immediately without notice if:

  • You breach these Terms or the Merchant Agreement in a material way.
  • We reasonably suspect fraudulent or illegal activity.
  • Required by a regulator, card scheme, or court order.
  • You become insolvent or enter administration.

Upon termination, your access to the Services will cease and any outstanding settlements will be processed subject to applicable withholding periods.

09

Governing law

These Terms are governed by and construed in accordance with the laws of Bulgaria. Any disputes arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the Bulgarian courts, without prejudice to your right as a consumer to bring proceedings in the courts of your country of residence.

10

Contact

For any questions regarding these Terms, please contact us at office@caibo.digital.

We may update these Terms from time to time. Continued use of the Services after any such change constitutes your acceptance of the new Terms.

caibo

The A to Z payment platform built for business growth.

Product
Our Solution Features Pricing
Developers
Auth API Web Integrations REST Integrations Full API Reference
Company
FAQs Contact Us Privacy & Terms Cookie Policy Gateway Services Agreement
© 2025 Caibo Digital OOD. All rights reserved. office@caibo.digital