Privacy Policy
Last updated · August 8, 2026
This Privacy Policy explains how Axa Zara LLC collects, uses, retains, shares, and protects personal data through Orqex. Orqex is a business-to-business payment orchestration platform available through websites, APIs, dashboards, hosted checkout pages, software development kits, webhooks, and related services.
1. Company identity and scope
Orqex is provided by Axa Zara LLC, a Delaware company registered under number 7814835, located at 16192 Coastal Highway, Lewes, Delaware 19958, United States. Website: www.orqex.com. General and privacy contact: support@axazara.com. Security reports: security@axazara.com. This Policy applies to representatives of customers and prospects, website users, authorised users, payers, beneficiaries, and other individuals whose data is submitted to Orqex by a customer.
2. Our data protection roles
For personal data submitted by a customer about its payers, customers, or beneficiaries, the customer generally determines the purposes and essential means of processing. The customer acts as controller and Orqex acts as processor or service provider, following documented instructions and the applicable data processing agreement. Orqex acts as controller for account administration, contracts, billing, prospect management, support, platform security, abuse prevention, legal compliance, and anonymised or aggregated service analytics.
3. Customer and prospect data
We may process names, business contact details, profile information, language, time zone, company, organisation, project, role, permissions, invitations, verification status, account settings, login activity, contractual and billing information, and the contents of demo, waitlist, support, survey, or other business communications.
4. Payer, beneficiary, and transaction data
Depending on the customer's integration, Orqex may process a payer's or beneficiary's name, email, telephone number, country, postal address, city, region, postal code, customer reference, bank account details, mobile money identifier, or cryptoasset wallet address. Transaction data may include amount, currency, description, timestamps, payment method, country, provider, routing result, status, provider references, exchange rate, settlement amount, fees, refund or dispute details, webhook and return URLs, failure reasons, retry decisions, and metadata supplied by the customer.
5. Card data and restricted data
Orqex is not designed to receive or store full payment card numbers, card security codes, PINs, or magnetic-stripe data. Card details must be entered through the secure interfaces or components of the relevant payment provider. Customers must never place raw card data, authentication secrets, health data, government secrets, or special-category data in metadata, logs, free-text fields, or support requests.
6. Technical, security, and risk data
We may process IP addresses, approximate country, browser, operating system, device type, user agent, language, session and key activity, request logs, webhook events, response codes, errors, administrative activity, and security alerts. To detect abuse and fraud, we may process irreversible instrument fingerprints, transaction history, velocity signals, risk scores, flags, anomaly results, and review outcomes. Provider credentials, webhook secrets, and other integration secrets are also processed to operate customer connections.
7. Sources of data
We receive data directly from customer representatives and website users; from customers using the API, dashboard, hosted checkout, SDKs, or webhooks; from payers and beneficiaries interacting with an Orqex checkout; from payment providers, banks, acquirers, card networks, and mobile money operators; from devices and browsers; and, where lawful, from public or professional sources used to verify a business or prevent fraud.
8. Purposes and legal grounds
We process data to create and administer accounts, provide payment orchestration, route transactions, manage failover, refunds and payouts, secure integrations, detect fraud, provide support, invoice customers, comply with law, defend legal rights, improve reliability, and send permitted business communications. Where a legal ground is required, we rely as applicable on performance of a contract, documented customer instructions, legal obligations, legitimate interests in providing and securing a reliable B2B service, or consent. Customers remain responsible for the legal ground and notices applicable when Orqex acts as their processor.
9. Routing, fraud prevention, and automation
Orqex may use technical and transaction signals to rank available methods, select a provider under customer rules, identify anomalous behaviour, block an instrument, trigger a review, or recommend a retry. These operations may involve automated processing. Where applicable law grants rights concerning a solely automated decision with legal or similarly significant effects, the individual may request information, contest the decision, or seek human intervention from the relevant customer or Orqex according to each party's role.
10. Data recipients
We disclose only the data reasonably necessary to: the relevant Orqex customer; payment providers, banks, acquirers, card networks, mobile money operators, and issuers; hosting, storage, database, monitoring, security, communication, support, analytics, and IP-geolocation providers; professional advisers and auditors; authorities where legally required; and an entity involved in a merger, financing, reorganisation, or sale subject to appropriate safeguards. Connected providers may include Stripe, PawaPay, Flutterwave, FedaPay, PayDunya, PayStack, Wave, Djamo, HUB2, PayTech, Cryptomus, and other providers selected by the customer. Each third party may process data under its own terms. Orqex does not sell personal data or share it for cross-context behavioural advertising.
11. International transfers
Axa Zara LLC is established in the United States and uses providers in multiple countries. Data may therefore be processed outside the individual's country. Where required, we use recognised safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the applicable UK Addendum, transfer assessments, and supplementary technical or contractual measures. Customers may request an applicable data processing agreement.
12. Retention
Our reference retention periods are: prospects and waitlist data, 24 months after the last meaningful interaction; account, organisation, project, and customer-controlled transaction data, for the contract plus up to 90 days for export and deletion; Orqex invoices and accounting records, 7 years; disputes, confirmed fraud, and legal claims, for the proceeding plus up to 7 years; risk fingerprints and security blocks, 24 months after relevant activity unless confirmed fraud requires longer retention; webhook logs, 30 days; generated export files, 7 days; general technical and security logs, up to 12 months; support requests, 3 years; residual backups, a proposed rolling maximum of 90 days. A different period may apply where required by law, contract, a valid customer instruction, security needs, or the establishment or defence of legal claims. Data may be retained in irreversibly anonymised form.
13. Security
We use technical and organisational measures proportionate to risk, including tenant and environment separation, role-based access, API authentication, key rotation, webhook signature controls, rate limiting, security logging, and application-level protection of sensitive secrets. Orqex reduces exposure to card data by relying on provider-hosted pages, tokens, and components. No system can guarantee absolute security. See the Security page for further information.
14. Cookies and marketing
Orqex may use cookies that are necessary for operation and security and, where consent is required and obtained, preferences and audience measurement. Details are set out in the Cookie Policy. Customer and prospect representatives may receive permitted product or business communications. Marketing emails include an unsubscribe method. Opting out does not prevent operational, security, billing, or contractual communications.
15. Your rights
Depending on applicable law and our role, you may have rights to information, access, correction, deletion, restriction, objection, withdrawal of consent, portability, human review of certain automated decisions, and a complaint to a competent authority. California residents may also have rights to know, correct, delete, limit certain uses of sensitive information, opt out of sale or sharing, and receive non-discriminatory treatment. Orqex does not sell personal data or share it for cross-context behavioural advertising. When Orqex processes data for a customer, contact that customer first. To make a request directly to us, email support@axazara.com with the subject “Orqex privacy request”. We may verify identity and authority before responding.
16. B2B service, changes, and contact
Orqex is intended for businesses and professionals and is not directed to children. Third-party payment pages and websites are governed by their own policies. We may update this Policy to reflect service, practice, or legal changes. We will provide reasonable notice of a material change where required. Questions or complaints may be sent to Axa Zara LLC, Orqex Service, 16192 Coastal Highway, Lewes, Delaware 19958, United States, or support@axazara.com.
