Overview
All payment applications handle a variety of customer data, or Personally Identifiable Information (PII) as this data is defined as by the privacy legislation of most jurisdictions.
This includes both Commercial information about each customer and their Payment Card data.
For stand-alone payment applications all data is entered directly into the payment application by the consumer.
For integrated applications additional customer data may be shared with the payment application by the merchant’s systems.
Transaction data, excluding the sensitive Payment Card data, is also returned to the payment application from the payment processor.
All information handled by payment applications is generally governed under your commercial terms for privacy, acceptable use and confidentiality.
However, this information is also protected in accordance with various legislative and regulatory requirements and the retention periods for certain data that are mandated under PCI regulations.
This document explains these retention policies.
Payment Card Information
Customers enter the following Payment Card data:
- Primary Account Number (PAN)
- Expiration Date
- Security Code (i.e., CVC or CVV)
This card information is required to perform a one-time payment and to store a card. Some applications may also collect the Cardholder name.
Payment Card data is never stored or retained by Datatel – this data is securely transmitted directly to your payment processor, payment gateway or token service provider.
Commercial Information
Customers may enter, or your information systems may transmit, the following customer data to the payment application:
- Identifiers (e.g., a customer account or invoice number the transaction applies to)
- Financial Information (e.g., Payment Amount, Past Due Amount, Authorization to Store card)
This customer information is securely stored and used to facilitate the transaction process, for application support, and for reporting to merchant.
Retention is generally governed by the commercial terms of the merchant’s application subscription.
Except for retention required to satisfy archival, statutory, regulatory or other legal requirements, this information is generally destroyed after 90 days in our normal course of operations, or upon termination of service by the merchant.
Regulated Retention
Under the PCI DSS (Payment Card Industry Data Security Standard) Requirement 10, all service providers are required to retain log files of the processed transaction data for a minimum period of 1 year to facilitate forensic analysis and compliance audits.
This excludes the Payment Card data, which is never retained or stored by Datatel systems.
