Privacy Policy | Resources

This Privacy Policy provides important details about how we collect, use, and share your personal data. Please read it carefully.

We provide financial and technology infrastructure. Businesses of all sizes use our software and services to process payments, manage invoicing, send and receive funds, integrate with third-party platforms, and streamline business operations.

This Privacy Policy ("Policy") describes the categories of Personal Data we collect, how we process and disclose that data, and how you can contact us with questions or concerns about your privacy. It also explains your rights and choices as a data subject, including, where applicable, the right to object to certain processing.

Depending on the activity, Nexio may act as a "data controller", "data processor", or "service provider" under applicable data protection laws. More detail about our privacy practices, including our role in specific contexts and the legal bases we rely on when processing Personal Data, is provided in this Policy.

Defined Terms

In this Policy, "Nexio," "we," "our," or "us" refers to Complete Merchant Solutions, LLC d/b/a Nexio, which is responsible for the collection, use, and handling of Personal Data as described in this document. Depending on your jurisdiction and the Services you use, Nexio may act together with its acquiring banks or other Financial Partners in determining how your Personal Data is processed.

"Personal Data" refers to any information associated with an identified or identifiable individual, which may include information you provide to us directly, and information we collect about you during your interaction with our Services (such as device information, IP address, or account activity).

"Services" refers to the products, services, and applications that Nexio provides, including:

Merchant acquiring and payment processing services offered under the Nexio Merchant Agreement ("Merchant Services");
Nexio's online and AI-enabled tools, including merchant diagnostic tools such as the Alan Statement Agent and any successor, related, or replacement online tools (collectively, the "Online Services");
Nexio's merchant portals and online reporting tools; and
Nexio websites and related online services.

We provide Merchant Services and Online Services to businesses, nonprofit organizations, and individual users (collectively, "Merchants" where applicable). We may also process data about individuals who interact with our Merchants, receive Nexio-generated communications, or use Nexio's online portals and tools.

"Financial Partners" are financial institutions, acquiring banks, card networks, ACH operators, and other partners that Nexio works with to provide Merchant Services and Online Services.

Depending on the context, "you" may be a Merchant, Customer, Representative, or Visitor:

End Users (Merchants and Authorized Users). When you use Nexio Services directly (for example, by logging into a Nexio portal, using an Online Service such as the Alan Statement Agent, or otherwise transacting with Nexio in your own name), we refer to you as an "End User."
End Customers. When you are not directly contracting with Nexio, but your Personal Data is processed by Nexio in connection with a Merchant's use of our Services (for example, when you pay a Merchant's invoice processed through Nexio), we refer to you as a "Customer."
Representatives. When you are acting on behalf of a Merchant—such as a business owner, account administrator, or authorized signatory—we refer to you as a "Representative."
Visitors. When you interact with Nexio by visiting our website without being logged in, or by otherwise engaging with us outside of being an End User, Customer, or Representative (for example, when you send Nexio a message requesting more information), we refer to you as a "Visitor."

In this Policy, "Transaction Data" refers to the data collected and used by Nexio to facilitate the processing of payments and related Services you request. Some Transaction Data is Personal Data and may include: your name, email address, contact number, billing or business address, payment method details (such as credit or debit card number, bank account information, or ACH details), merchant and location identifiers, amount and date of payment, and in some instances, details about the goods or services purchased.

1. Personal Data We Collect and How We Use and Share It

Our collection and use of Personal Data differs based on whether you are an End User, Customer, Representative, or Visitor, and the specific Service that you are using. For example, if you are a sole proprietor who wants to use our Merchant Services, we may collect your Personal Data to onboard your business; at the same time, you might also be a Customer if you purchase goods from another Merchant that uses Nexio for payment processing. You could also be an End User if you log into our Merchant portal or use an Online Service to manage your account or obtain a diagnostic report.

1.1 End Users

We provide End User Services when you interact directly with Nexio—for example, by creating or using a Nexio account, using an Online Service such as the Alan Statement Agent, or accessing our online merchant portals.

a. Personal Data we collect about End Users

Using Online Services or Merchant Portals. When you create an account or log into a Nexio portal or Online Service, we collect any login credentials, role assignments, account settings, and activity within the Service. For Online Services that do not require an account (such as the Alan Statement Agent), we collect the information you submit through web forms (such as name and email address) and the files you upload (such as merchant statement PDFs). We may also collect information you provide when connecting a Nexio service to third-party software systems (such as accounting, BMS, or CRM tools), including credentials, tokens, and synchronized data (e.g., invoices, ledgers, or customer records).
Merchant Applications. When you apply for a Nexio Merchant Account, we collect business and financial information, including legal name, DBA, business addresses, ownership and control details, tax identification numbers, and linked bank accounts, as required for underwriting and compliance.
Transaction Data. When you use a Nexio portal or Online Service to send invoices, process payments, obtain a diagnostic report, or review reporting, we collect details of those transactions, including payment method, settlement data, chargebacks, and refunds.
Support Interactions. When you contact Nexio support, we may collect information about your account and, with your permission, access transaction or workflow data as necessary to troubleshoot and resolve issues.

b. How we use and share Personal Data of End Users

Services. We use and share your Personal Data to provide Nexio Services to you, which includes onboarding, transaction processing, reporting, workflow automation, support, and communications about our Services (such as policy updates or feature notices).
Merchants and Financial Partners. We may share your Personal Data—including name, contact details, business information, and transaction data—with our acquiring banks, card networks, ACH operators, and other Financial Partners as necessary to underwrite, process, and settle transactions.
Fraud Detection and Loss Prevention. We use your Personal Data collected across our Services to detect fraud and prevent financial losses for you, us, and our Merchants and Financial Partners. This may include sharing relevant data with Merchants and Financial Partners so they can assess the risk of a transaction or account activity.
Product Development. We may use de-identified or aggregated data to improve our Online Services and other features, enhance our fraud and risk models, and develop new services.
Advertising. Where permitted by applicable law, we may use your Personal Data, including Transaction Data, to offer you additional Nexio Services or features. Subject to applicable law and any consent requirements, we may also share limited data with service providers such as analytics or marketing partners who assist us in communicating about Nexio Services. We do not sell your Personal Data to third parties.

1.2 End Customers

Nexio provides various Merchant Services to our Merchants, which include processing in-person or online payments, payouts, and related workflows. When acting as a service provider—also referred to as a Data Processor—for a Merchant, we process End Customer Personal Data in accordance with our agreement with that Merchant and the Merchant's lawful instructions. This happens, for example, when we process a payment because you purchased a product from a Merchant using Nexio, or when a Merchant directs us to send you funds.

Merchants are responsible for ensuring that the privacy rights of their End Customers are respected, including obtaining appropriate consents and making disclosures about their own data collection and use associated with their products and services. If you are an End Customer, please refer to the privacy policy of the Merchant you are doing business with for its privacy practices, choices, and controls.

a. Personal Data we collect about End Customers

Transaction Data. If you are making payments to, receiving refunds or payments from, initiating a purchase or donation with, or otherwise transacting with a Merchant that uses Nexio, we receive your Transaction Data. This may include your name, contact details, payment method, billing information, and transaction details (such as amount, date, and merchant). We may also receive your transaction history with that Merchant. Additionally, we may collect information entered into a payment or checkout form—even if you do not complete the transaction—if it was transmitted to Nexio by the Merchant.
Identity/Verification Information. Nexio provides verification and fraud-prevention tools that Merchants may use to confirm your authorization to use a particular payment method. During these processes, you may be asked to provide certain Personal Data (for example, name, billing information, or payment method details). To protect against fraud and impersonation, we may cross-verify this data with information we have received from Merchants, our Financial Partners, and identity verification services or other service providers.

b. How we use and share Personal Data of End Customers

Payment processing and accounting. We use your Transaction Data to deliver payment-related Services to Merchants—including processing payments, handling refunds and disputes, and enabling reporting and accounting functions. Your Personal Data may also be used to improve the performance of our Services.
Sharing for transactions. During a payment transaction, your Personal Data is shared with entities involved in completing the transaction. For example, when you select a payment method, we may share Transaction Data with your bank, card network, or other payment method provider to authenticate and process the transaction, prevent fraud, and handle disputes. The Merchant you transact with also receives your Transaction Data and may share it with others as described in its own privacy policy.
Fraud detection and loss prevention. We use your Personal Data collected across our Services to detect and prevent fraud and losses for you, us, our Merchants, and Financial Partners. We may provide Merchants and Financial Partners with information about your attempted or completed transactions so they can assess risk and prevent unauthorized activity.
Identity/Verification services. We use Personal Data to perform verification services for Merchants, to prevent fraud, and to enhance security. For these purposes, we may use Personal Data you provide directly, or Personal Data obtained from third-party service providers (for example, for phone or payment method verification).
Merchants (and their authorized third parties). We share End Customers' Personal Data with the Merchant you are transacting with and with parties the Merchant authorizes us to share data with. Examples include:
- Providing a Merchant with your transaction details to process payments, refunds, or payouts.
- Sharing information you provided through Online Services or other Nexio systems with the Merchant that requested it (such as invoice or payment details).
- Allowing a Merchant to use verification services powered by Nexio to validate information you provided.
Merchants you transact with may further share your Personal Data with additional service providers, in accordance with their own privacy policies.
Advertising by Merchants. If you begin a purchasing process with a Merchant, the Merchant may receive your Personal Data from us even if you do not complete the transaction. Merchants may use this information for their own marketing and advertising, subject to their privacy policies.

1.3 Representatives

We collect, use, and share Personal Data from Representatives of Merchants (for example, business owners, officers, and authorized signers) to provide our Merchant Services and Online Services.

a. Personal Data we collect about Representatives

Registration and Contact Information. When you register for a Nexio Merchant Account or use an Online Service on behalf of a business, we collect your name, role, and any login credentials. If you register for or attend an event organized by Nexio or sign up to receive Nexio communications, we collect your registration and profile data. As a Representative, we may also collect your Personal Data from third-party data providers in order to advertise, market, and communicate with you.
Identification Information. As a current or potential Merchant Representative, owner, shareholder, officer, or director, we need your contact details (such as name, postal address, telephone number, and email address) to fulfill our obligations to Financial Partners and regulators, verify your identity, and prevent fraud. We may also collect government-issued identity documents, date of birth, ownership interests, associated identifiers, and in some cases, history of fraud or misuse. This information may be collected directly from you, from public sources, or from third parties such as credit bureaus and identity verification services. You may also choose to provide us with bank account information for settlement or ownership verification.

b. How we use and share Personal Data of Representatives

Merchant Services. We use and share Representatives' Personal Data with Merchants to provide Nexio's Services, including account onboarding, underwriting, transaction processing, and ongoing account management.
Financial Partners and Regulatory Requirements. We share Representatives' Personal Data with acquiring banks, card networks, and other Financial Partners during onboarding and periodically thereafter to meet due diligence, anti-money laundering (AML), and sanctions screening requirements. We may also be required to submit such information to government entities in connection with regulatory obligations.
Third-Party Services Authorized by Merchants. We share Representatives' Personal Data with third-party apps or services that a Merchant chooses to integrate with Nexio Services. Examples include payment method providers (such as Visa, Mastercard, or ACH operators) that require Representative information during onboarding or dispute handling. The use of such data by third parties authorized by a Merchant is governed by those third parties' privacy policies.
Fraud Detection and Loss Prevention. We use Representatives' Personal Data to identify and manage risks, including fraud, money laundering, or misuse of our Services. This includes using information from public sources, credit bureaus, or our own Services to identify risk patterns and monitor for terms of service violations. Nexio may share Representatives' Personal Data with our Merchants, Financial Partners, and service providers (including verification providers) to confirm accuracy and evaluate risk indicators.
Advertising. Where permitted by law, and where required with your consent, we use and share Representatives' Personal Data with third parties (such as analytics providers or social networks) to advertise and market our Services. Subject to applicable law, including any consent requirements, we may advertise through interest-based advertising and track the effectiveness of such ads. We may also use your Personal Data, including account activity, to evaluate your eligibility for and offer you additional Nexio Services or features. We do not transfer your Personal Data to third parties in exchange for payment.

1.4 Visitors

We collect, use, and share the Personal Data of Visitors.

a. Personal Data we collect about Visitors

When you browse Nexio websites or online portals, we may receive your Personal Data either directly from you or automatically through cookies and similar technologies. (See our Cookie Policy for more information.)

If you choose to complete a form on a Nexio site—or on third-party websites where our advertisements are displayed (such as LinkedIn or Facebook)—we collect the information you provide in the form. This may include your contact information, company name, and other details related to your interest in Nexio Services. We may also associate a location with your visit.

b. How we use and share Personal Data of Visitors

Personalization. We use the data we collect about you through cookies and similar technologies to measure engagement with content on our sites, improve navigation, customize your experience (such as language preferences or region-specific content), and provide relevant information about Nexio and our Services. Because not all Services are available globally, we may tailor content based on your region.
Advertising. Where permitted by law—and with your consent where required—we may use and share Visitors' Personal Data with third parties (such as analytics or advertising partners) so we can advertise and market Nexio Services and partner integrations. Subject to applicable law, we may advertise through interest-based advertising and track the effectiveness of such ads. We do not transfer your Personal Data to third parties in exchange for payment, but we may provide your data to partners (including advertising platforms, analytics providers, and social networks) who assist us in promoting our Services.
Engagement. As you interact with our sites, we use the information we collect to create opportunities for further interaction—such as follow-up discussions about Nexio Services, product demos, or chatbot communications to address your questions.

2. More Ways We Collect, Use, and Share Personal Data

In addition to the ways described above, we also process your Personal Data as follows:

a. Collection of Personal Data

Online Activity. Depending on the Service used and how our Merchant Services are implemented by our Merchants, we may collect information related to:

The devices and browsers you use across Nexio Sites and third-party websites, apps, and other online services ("Third Party Sites").
Usage data associated with those devices and browsers and your engagement with our Services, including data elements like IP address, plug-ins, language preference, time spent on Sites and Third Party Sites, pages visited, links clicked, payment methods used, and the pages that led you to our Sites and Third Party Sites. We may also collect activity indicators, such as mouse activity indicators, to help us detect fraud. (See also our Cookie Policy.)

Communication and Engagement Information. We also collect information you choose to share with us through various channels, such as support tickets, emails, or social media. If you respond to emails or surveys from Nexio, we collect your email address, name, and any other data you include in your responses. If you engage with us over the phone, we collect your phone number and any other information you provide during the call. Calls with Nexio representatives may be recorded, where permitted by law. We also collect engagement data related to your registration for, attendance at, or participation in Nexio events and any other interactions with Nexio personnel.

Forums and Discussion Groups. If our Sites allow posting of content, we collect Personal Data that you provide in connection with such posts.

b. Use of Personal Data

In addition to the uses described above, we use Personal Data in the following ways:

Analyzing, Improving, and Developing our Services. We collect and process Personal Data across our Services—whether you are an End User, Customer, Representative, or Visitor—to improve our Services, develop new Services, and make them more efficient, relevant, and useful. We may use Personal Data to generate aggregate and statistical information to understand and explain how our Services are used. Examples include:

Using analytics on our Sites (as described in our Cookie Policy) to understand your use of our Services and diagnose technical issues.
Training and operating artificial intelligence models to power our Online Services (such as generating diagnostic reports from uploaded merchant statements) and to protect against fraud and other risks.
Analyzing and drawing inferences from Transaction Data to reduce costs, disputes, and fraud, and to improve authentication and authorization rates for Merchants and their Customers.

Communications. We use the contact information we have about you to deliver our Services, which may involve sending codes or alerts for authentication and account security. If you are an End User, Representative, or Visitor, we may also communicate with you using your contact information to provide information about our Services, invite you to events or surveys, or otherwise communicate with you for marketing purposes, subject to applicable law and opt-out rights. Where permitted, we may record calls for quality assurance, training, and compliance purposes.

Social Media and Promotions. If you choose to submit Personal Data to engage in an offer, program, or promotion, we use the Personal Data you provide to manage that program. We may also use the Personal Data you provide, along with data you make available on social media platforms, for marketing purposes, where permitted.

Fraud Prevention and Security. We collect and use Personal Data to help identify and manage activities that could be fraudulent or harmful across our Services, enable fraud detection tools, and secure our Services and transactions against unauthorized access, use, or alteration. We may collect information from public sources, third parties (such as credit bureaus), and Financial Partners for this purpose. We may also receive data such as IP addresses or other identifiers about potential security threats from third parties. Such information helps us verify identities, conduct credit checks where lawful, and prevent fraud.

Compliance with Legal Obligations. We use Personal Data to meet our contractual and legal obligations, including those related to anti-money laundering (AML), Know-Your-Customer (KYC) laws, counter-terrorism, export controls, and sanctions compliance. For example, we may monitor transaction patterns to detect money laundering or other harmful activity that could affect Nexio, our Financial Partners, Merchants, Customers, and others.

Minors. Our Services are not directed to children under the age of 13, and we request that they do not provide Personal Data to seek Services directly from Nexio. In certain jurisdictions, we may impose higher age limits as required by applicable law.

c. Sharing of Personal Data

Nexio Affiliates. We may share Personal Data with Nexio-affiliated entities for the purposes described in this Policy.

Service Providers or Processors. We rely on service providers to help us provide, communicate, market, analyze, and secure our Services. These providers may offer services such as cloud hosting, analytics, identity verification, customer support, or audit functions. We authorize these service providers to use or disclose Personal Data only as necessary to perform services on our behalf and in compliance with contractual confidentiality and security obligations.

Financial Partners. We share Personal Data with acquiring banks, card networks, ACH operators, and other Financial Partners to provide Services to Merchants and to comply with network and regulatory requirements. This may include sharing data required during onboarding, settlement, dispute handling, or compliance checks.

Others with Consent. In some cases, we may refer you to other providers (for example, professional service firms or integration partners). In these instances, we will disclose the identity of the third party and the information to be shared, and seek your consent.

Corporate Transactions. If Nexio undergoes a business transaction such as a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or part of its business, assets, or equity, Personal Data may be shared with the parties involved. Any successor entity will be entitled to continue using your Personal Data, subject to this Policy.

Compliance and Harm Prevention. We share Personal Data when necessary to comply with law; to meet obligations imposed by Financial Partners; to enforce our contractual rights; to secure and protect Nexio Services, rights, privacy, safety, and property; and to respond to valid legal requests from courts, law enforcement, regulators, or other authorities, including those outside your country of residence.

3. Legal Bases for Processing Personal Data

For purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, we rely on a number of legal bases to process your Personal Data. For some jurisdictions, there may be additional legal bases.

a. Contractual and Pre-Contractual Business Relationships

We process Personal Data to enter into business relationships with prospective Merchants and End Users, and to fulfill our contractual obligations with them. These processing activities include:

Creation and management of Nexio Merchant Accounts, Online Service sessions, and associated login credentials, including the assessment of applications or submissions to initiate or expand the use of our Services;
Onboarding and underwriting of Merchants for acquiring and settlement purposes;
Accounting, auditing, reconciliation, and billing activities; and
Processing of payments and related activities, which include fraud detection, loss prevention, transaction optimization, communications about payments, and related customer service activities.

b. Legal Compliance

We process Personal Data to verify the identities of individuals and entities and to comply with obligations related to fraud monitoring, prevention, and detection; laws associated with identifying and reporting illicit or illegal activities (such as Anti-Money Laundering (AML) and Know-Your-Customer (KYC) regulations); PCI-DSS requirements; and financial reporting obligations.

For example, we may be required to record and verify a Merchant's identity to comply with regulations designed to prevent money laundering, fraud, and financial crimes. These legal obligations may also require us to report compliance to regulators, Financial Partners, or undergo verification audits.

c. Legitimate Interests

Where permitted under applicable law, we rely on our legitimate business interests to process your Personal Data. The following are examples of business purposes for which we have a legitimate interest in processing your data:

Detection, monitoring, and prevention of fraud and unauthorized payment transactions;
Mitigation of financial loss, claims, liabilities, or other harm to Customers, End Users, Merchants, Financial Partners, and Nexio;
Determination of eligibility for, and offering of, new Nexio Services;
Responding to inquiries, delivering Service notices, and providing customer support;
Promotion, analysis, modification, and improvement of our Services, systems, and tools, as well as the development of new products and features (including Online Service enhancements);
Management, operation, and improvement of the performance of our Sites and Services, including analytics to understand effectiveness and optimize our digital assets;
Marketing, analysis, and advertisement of our Services, including related improvements;
Aggregate analysis and development of business intelligence to operate, protect, and make informed decisions about our business;
Sharing of Personal Data with third-party service providers that perform services on our behalf and business partners that help us operate and improve our business;
Enabling network and information security throughout Nexio and our Services; and
Sharing of Personal Data among our affiliates.

d. Consent

In some cases, we may rely on your consent (or explicit consent) to collect and process Personal Data in connection with our interactions with you or the provision of certain Services (for example, marketing communications, surveys, or specific integrations that require authorization).

When we process your Personal Data based on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing based on consent before withdrawal.

e. Substantial Public Interest

We may process special categories of Personal Data, as defined by the GDPR, when such processing is necessary for reasons of substantial public interest and consistent with applicable law. For example, when we conduct politically exposed person checks or sanctions screening to comply with AML and KYC obligations. We may also process Personal Data related to criminal convictions and offenses when authorized by applicable law.

f. Other Valid Legal Bases

We may process Personal Data under other valid legal bases as recognized under applicable law in certain jurisdictions.

4. Your Rights and Choices

Depending on your location and subject to applicable law, you may have choices regarding our collection, use, and disclosure of your Personal Data:

a. Opting out of receiving electronic communications from us

If you wish to stop receiving marketing-related emails from us, you can opt out by clicking the "unsubscribe" link included in such emails or by following the instructions provided in those communications. We will process your request as quickly as reasonably practicable.

Please note, however, that even if you opt out of marketing communications, Nexio retains the right to communicate with you about the Services you receive (such as account support, policy or security updates, and other important notices). In addition, Merchants may still send you messages directly or instruct us to send messages on their behalf.

b. Your data protection rights

Depending on your location and subject to applicable law, you may have the following rights regarding the Personal Data Nexio processes about you when we act as a data controller:

The right to request confirmation of whether Nexio is processing Personal Data associated with you, the categories of personal data processed, and the third parties or categories of third parties with which your Personal Data is shared.
The right to request access to the Personal Data Nexio processes about you.
The right to request that Nexio rectify or update your Personal Data if it is inaccurate, incomplete, or outdated.
The right to request that Nexio erase your Personal Data in certain circumstances as provided by law.
The right to request that Nexio restrict the use of your Personal Data in certain circumstances, such as while Nexio is considering another request you've submitted (for example, a request to update your Personal Data).
The right to request that Nexio export the Personal Data we hold about you to another company, where technically feasible.
The right to withdraw your consent if your Personal Data is being processed based on your prior consent.
The right to object to the processing of your Personal Data if we are processing it based on our legitimate interests; unless we have compelling legitimate grounds or the processing is necessary for legal reasons, we will cease processing upon receiving your objection.
The right not to be discriminated against for exercising these rights.
The right to appeal any decision Nexio makes relating to your rights by contacting Nexio's Data Protection Officer ("DPO") at privacy@nex.io and/or relevant regulatory authorities.

You may have additional rights under applicable law (for example, under certain U.S. state privacy laws).

c. Process for exercising your data protection rights

To exercise your data protection rights related to Personal Data we process as a data controller, please contact us as outlined in the Contact Us section of this Policy.

For Personal Data we process as a data processor on behalf of a Merchant, you should direct your request to that Merchant (the data controller). If you contact us regarding Personal Data we process as a processor, we will, to the extent we can, identify and refer you to the relevant Merchant.

5. Security and Retention

We make reasonable efforts to provide a level of security appropriate to the risk associated with the processing of your Personal Data. Nexio maintains organizational, technical, and administrative measures designed to protect the Personal Data covered by this Policy from unauthorized access, destruction, loss, alteration, or misuse. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure.

We encourage you to assist us in protecting your Personal Data. If you hold a Nexio Merchant Account or other Nexio login, you can help protect your information by using a strong password, safeguarding your credentials against unauthorized use, and avoiding the use of identical login credentials across multiple services. If you suspect that your interaction with us is no longer secure (for instance, you believe that your Nexio account's security has been compromised), please contact us immediately.

We retain your Personal Data for as long as we continue to provide Services to you or to the Merchant with which you are transacting, or for a period in which we reasonably foresee continuing to provide Services. Even after we stop providing Services directly to you or to a Merchant you interact with, and even after you close your Nexio account or complete a transaction, we may continue to retain your Personal Data to:

Comply with our legal and regulatory obligations;
Enable fraud monitoring, detection, and prevention activities; and
Comply with our tax, accounting, contractual, and financial reporting obligations, including where required by our Financial Partners (and where retention is mandated by the payment methods you've used).

In cases where we keep your Personal Data, we do so in accordance with applicable limitation periods and record retention obligations under law and our agreements with Financial Partners.

6. Updates and Notifications

We may change this Policy from time to time to reflect new Services, changes in our privacy practices, or updates to relevant laws. The "Last updated" date at the top of this Policy indicates when this Policy was last materially revised. Any changes are effective as of the date we post the revised Policy on our website or otherwise provide notice of the update as required by law.

We may provide you with disclosures and alerts regarding this Policy or the Personal Data we collect by posting them on our website and, if you are an End User or Representative, by contacting you through your Nexio Merchant Portal or other Nexio account, by email, and/or by using the physical address listed in your account.

7. Contact Us

If you have any questions or complaints about this Policy, or about how Nexio collects, uses, or shares your Personal Data, please contact us at privacy@nex.io or by using the contact details provided in the Contact Us section of our website.

If you are an End Customer (i.e., an individual transacting with a Merchant that uses Nexio Services), please refer to the Merchant's privacy policy or notice for information about their privacy practices, choices, and controls, or contact the Merchant directly. As a data processor, Nexio processes End Customer data on behalf of Merchants in accordance with our agreements with them.

8. U.S. Consumer Privacy Notice

If you are a consumer located in the United States ("U.S."), we process your Personal Data in accordance with U.S. federal and state privacy laws, including the Gramm-Leach-Bliley Act (GLBA) where applicable. This notice explains our U.S. privacy practices in the federally required format.

FACTS: WHAT DOES NEXIO DO WITH YOUR PERSONAL INFORMATION?

Why?

Financial companies choose how they share your Personal Data. Federal law gives consumers the right to limit some—but not all—sharing. Federal law also requires us to tell you how we collect, share, and protect your Personal Data. Please read this notice carefully to understand what we do.

What?

The types of Personal Data we collect and share depend on the product or service you have with us. This information can include:

Social Security Number, EIN, or other government identifiers (for underwriting and compliance)
Contact details (such as name, email, phone, and address)
Account credentials and activity (Merchant Portal or Online Service logins, audit logs)
Payment and transaction information (account balances, transaction history, chargebacks, disputes)
Bank account and settlement details provided for payment processing

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers' Personal Data to run their everyday business. In the section below, we list the reasons financial companies can share Personal Data; the reasons Nexio chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information

Reason	Does Nexio Share?	Can you limit this sharing?
For our everyday business purposes – such as to process transactions, maintain accounts, comply with laws, respond to court orders and legal investigations, or report to credit bureaus	Yes	No
For our marketing purposes – to offer our products and Services to you	Yes	No
For joint marketing with other financial companies	Yes	No
For our affiliates' everyday business purposes – information about your transactions and experiences	Yes	No
For our affiliates' everyday business purposes – information about your creditworthiness	No	We don't share
For our affiliates to market to you	No	We don't share
For nonaffiliates to market to you	Yes	Yes

To limit our sharing

You may contact us at any time to limit our sharing. Please email privacy@nex.io.

Please note: If you are a new customer, we can begin sharing your information 30 days from the date we send this notice. When you are no longer a customer, we continue to share your information as described in this notice.

Questions?

Who we are

Who is providing this notice?

Complete Merchant Solutions, LLC d/b/a Nexio, and its affiliates that provide financial services in the U.S.

What we do

How does Nexio protect my Personal Data?

To protect your Personal Data from unauthorized access, destruction, loss, alteration, or misuse, we use security measures to comply with federal law. These include encryption, computer safeguards, access controls, secured files and buildings, and ongoing monitoring.

How does Nexio collect my Personal Data?

We collect your Personal Data, for example, when you:

Apply for or open a Nexio Merchant Account;
Provide bank account or tax information for underwriting or settlement;
Use our Online Services or Merchant Portals to send invoices, obtain a diagnostic report, process transactions, or review account activity;
Ask Nexio to process a payment on behalf of a Merchant.

We also collect your Personal Data from others, such as affiliates, Financial Partners, or service providers.

Why can't I limit all sharing?

Federal law gives you the right to limit only:

Sharing for affiliates' everyday business purposes—information about your creditworthiness;
Affiliates from using your information to market to you; and
Sharing for nonaffiliates to market to you.

State laws and individual companies may give you additional rights. See Other Important Information below.

What happens when I limit sharing for an account I hold jointly with someone else?

Your choices will apply to everyone on the account.

Definitions

Affiliates: Companies related by common ownership or control. They can be financial and nonfinancial companies. Nexio's affiliates include entities operating under the Nexio brand and related technology and services companies.
Nonaffiliates: Companies not related by common ownership or control. They can be financial and nonfinancial companies. Nonaffiliates with which we share include service providers, Merchants, and third-party partners we work with to provide Services, as well as advertising and analytics partners.
Joint Marketing: A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Our joint marketing partners include sponsor banks and acquiring institutions that partner with Nexio.

Other important information

Vermont: If your account is associated with a Vermont billing address, we will not disclose information about your creditworthiness to affiliates and will not disclose your Personal Data to nonaffiliated third parties for marketing, other than as permitted by Vermont law, unless you authorize us. For joint marketing, we will only disclose your name, contact information, and transaction information.
California: If your account is associated with a California billing address, we will not disclose your Personal Data except to the extent permitted under California law. For example, we may disclose Personal Data as necessary to process transactions or provide Services you request, at your instruction, or as required to safeguard against fraud, identity theft, and unauthorized transactions.