Privacy Policy

InvestPay EAD is a controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian legislation.

The company provides and maintains digital services, including the Amica platform and associated cashback and loyalty programmes.

• Identity and contact data — for example, name, email address, and phone number, where applicable
• Registration and profile usage data within the platform
• Transaction data and data received via Open Banking, where the user has provided the necessary consent through a licensed provider
• Correspondence, enquiries, complaints, and customer support data
• Technical data, logs, and security data generated when using the website and platform

• Registration and management of user profiles
• Provision of services, features, and customer support
• Identification of qualifying transactions and calculation/payment of cashback
• Prevention of fraud, protection of systems, and security management
• Fulfilment of legal and contractual obligations

• Performance of a contract, or taking steps at the request of the user prior to entering into a contract
• Explicit consent — where required, including for access to data via Open Banking
• Legal obligation
• Legitimate interests — for example, for security, fraud prevention, and protection of the company's rights

We may share personal data with:

• Service providers and processors who assist us under contract
• A licensed Open Banking service provider, where applicable
• Banks, payment institutions, or financial institutions involved in processing payments and requests
• Competent authorities, where required by law

We do not sell personal data to third parties.

We retain personal data only for as long as necessary for the relevant purpose, legal requirement, or the establishment, exercise, or defence of legal claims.

Specific retention periods may depend on the type of service, transaction, correspondence, or applicable legislation.

Under GDPR, you have the following rights regarding your personal data:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent, where processing is based on consent
• Right to lodge a complaint with the Commission for Personal Data Protection

You may submit a request by email to support@amica.bg. The company may provide a standard request form for convenience, though its use is not mandatory.

Requests will be responded to within the time limits set out in applicable legislation, unless an extension is required due to the complexity or number of requests.

You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), Sofia, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg.

We implement reasonable technical and organisational measures to protect personal data.

This policy may be updated to reflect changes in our services, applicable legislation, or the manner in which we process personal data. The date above reflects the most recently approved version.