1. Data Controller
manyfest one UG (limited liability)
Emdener Str. 45, 10551 Berlin, Germany
Email: hello@manyfest.one
Managing Director: Haroon Dilshad
2. Overview
Zahlo is a technical payment platform that enables merchants to accept account-to-account (A2A) payments via SEPA instant transfers. As a Technical Service Provider (TSP), we do not process payments, access bank accounts, or hold funds. This policy describes how we handle data when operating the platform.
3. Data we process
3.1 Merchant data (Merchant App)
- Business data
- Company name, IBAN and BIC — Art. 6(1)(b) GDPR (performance of a contract)
- Access data
- PIN passcode (hashed) — Art. 6(1)(b) GDPR
- Transaction data
- Amount, timestamp, status and payment reference — Art. 6(1)(b) GDPR
- Payment status
- Status set by the merchant and, for supported online integrations, order status sent by the shop — Art. 6(1)(b) GDPR
3.2 Customer data (end customers)
Zahlo does not process personal data of end customers during the payment process. The customer scans an EPC QR code with their own banking app and confirms the payment there. We have no access to:
- Customer bank accounts or account information
- Customer names, addresses or contact details
- Payment instruments or card details
3.3 Website visitors (zahlo.eu)
- Contact details
- Name, email address, website, optional company name and sales-channel details supplied during merchant registration — Art. 6(1)(a) GDPR (consent)
- Technical data
- IP address, browser type and access time in server logs — Art. 6(1)(f) GDPR (legitimate interest)
4. Purpose of processing
- Providing and operating the Zahlo platform
- Creating EPC QR payment requests
- Maintaining merchant payment history
- Technical troubleshooting and security
- Communicating with prospects and onboarding merchants
5. Processing in detail
5.1 Payment status on site
For in-store payments, the current version of Zahlo does not receive automatic confirmation from the merchant's bank account. The customer confirms the transfer in their own banking app and shows the confirmation to the merchant. The merchant then manually updates the payment status in Zahlo. Zahlo stores its own payment record, including the amount, timestamp, reference and status.
5.2 EPC QR codes
Generated QR codes contain the merchant's IBAN and BIC, the payment amount and a reference number. This data is displayed to the customer but is not transmitted by Zahlo to third parties. The QR code is generated locally on the merchant's device.
5.3 No access to bank accounts
In the described on-site process, Zahlo does not access bank accounts, hold customer funds or store bank login details. Each payment is authorised by the customer in their own banking app.
6. Recipients of data
- Hosting provider
- Server operation (application hosting and database) — EU
- Bank APIs
- Wise, Revolut and bunq payment notifications (webhooks) — EU / EEA
- Cloudflare
- DNS, CDN and DDoS protection — Global (Standard Contractual Clauses)
Personal data is not shared with third parties for advertising.
7. Storage duration
- Transaction data
- 10 years (legal retention under HGB/AO)
- Merchant account details
- Duration of the business relationship plus 10 years
- Raw webhook data
- Deleted immediately after processing; not stored permanently
- Server logs
- 30 days
- Waiting-list data
- Until consent is withdrawn
8. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure, where no legal retention duty applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent at any time (Art. 7(3) GDPR)
Please send requests to hello@manyfest.one.
9. Right to lodge a complaint
You may lodge a complaint with the competent data protection authority:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61, 10555 Berlin
www.datenschutz-berlin.de
11. SSL/TLS encryption
This website and all Zahlo services use SSL/TLS encryption for security. You can identify an encrypted connection by the lock icon in your browser's address bar and the “https://” prefix.
12. Changes
We may update this privacy policy to reflect changes in the law or our services. The current version is always available on this page.