Payment Security Policy

1. Roles and responsibilities (WTTM vs payment partners)

WTTM operates a digital marketplace and related services. Payment acceptance is performed by regulated payment partners (including Stripe) and/or approved banking partners (including Ipak Yuli Bank for certain bank-based flows). WTTM is not a bank and does not issue payment credentials.

Card scheme rules (Visa, Mastercard, and other networks as applicable) impose security obligations on participants in the payment chain. Your card issuer may apply additional authentication controls beyond WTTM’s environment.

2. Stripe: tokenisation, encryption, and hosted fields

Where Stripe is used, sensitive card data is typically collected through Stripe-hosted components or tokenisation flows designed to reduce PCI DSS scope for merchants. WTTM aims to avoid receiving, logging, or storing full Primary Account Numbers (PAN), CVV/CVC, or full magnetic-stripe equivalent data.

Stripe’s security posture, certifications, subprocessors, and regional terms are described in Stripe’s documentation and legal notices. WTTM may receive limited non-sensitive references (such as payment intent IDs, last4 brand fingerprint where permitted, and status metadata) to reconcile orders.

3. Visa and Mastercard: network authentication and issuer controls

Visa and Mastercard operate global payment networks with rules for secure acceptance, dispute handling, and fraud monitoring. Authentication experiences (including 3-D Secure / SCA workflows) may be presented by issuers or delegated authentication providers.

WTTM cannot guarantee issuer approval of a transaction. A declined authorisation does not necessarily indicate a WTTM system error; it may reflect issuer risk policy, spending limits, cross-border restrictions, or regulatory controls.

4. Ipak Yuli Bank and bank-transfer security

Where payments are completed via bank transfer instructions involving Ipak Yuli Bank (JSC, Uzbekistan) or other partner banks, customers must follow exact beneficiary details provided through official WTTM channels. WTTM will never ask you to send funds to unrelated personal accounts via unsolicited messages.

Bank transfers may be subject to sanctions screening, AML monitoring, correspondent banking delays, and intermediary fees. Always retain proof of transfer and share it only through verified support channels when requested.

5. PCI DSS scope and assessments

WTTM seeks to maintain PCI DSS compliance aligned to its actual cardholder data environment (CDE) scope. Controls may include segmentation, access control, vulnerability management, secure SDLC practices, logging and monitoring, and vendor due diligence.

Because architectures evolve, specific PCI reports (for example AOC/ROC) may be available to enterprise customers under NDA where applicable.

6. Fraud prevention, velocity checks, and manual review

We may use automated and manual fraud controls including device fingerprinting (where lawful), IP reputation, velocity limits, behavioural signals, and payment anomaly detection. Transactions may be delayed, cancelled, or referred for enhanced due diligence where risk indicators are present.

7. Customer security hygiene

You should protect account credentials, enable multi-factor authentication where offered, avoid public Wi‑Fi for payments, verify domain names and TLS certificates, and report suspicious messages (phishing/smishing) to [email protected].

WTTM will not request your full card number by email.

8. Incident response (high-level)

If WTTM becomes aware of a material security incident affecting personal data, we will follow applicable breach notification laws and contractual obligations, including notifying regulators and/or affected individuals where required.

This section is a high-level summary and does not create third-party beneficiary rights.

Uzbekistan Legal Entity (LLC UTTM)

Registered Address: 22-24 Small Ring Road, Yunusabad District, Tashkent, Uzbekistan

Bank: Ipak Yuli Bank, Mirzo Ulugbek Branch

MFO (Bank Code): 00421

OKED / Company Code: 07437461

TIN (INN): 312924418

Settlement Accounts:

UZS: 20208000307437461001

USD: 20208840607437461001

EUR: 20208978007437461001

Director: Ernest Akhmadulin (Akhmadulin Ernest Timurovich)