public function getData()
    {
        // The application has the option of passing the query parameter
        // in, perhaps using its own middleware, or allowing Omnipay to
        // provide it.

        $crypt = $this->getCrypt() ?: $this->httpRequest->query->get('crypt');

        // Make sure we have a crypt parameter before trying to decrypt it.

        if (empty($crypt) || !is_string($crypt) || substr($crypt, 0, 1) !== '@') {
            throw new InvalidResponseException('Missing or invalid "crypt" parameter');
        }

        // Remove the leading '@' and decrypt the remainder into a query string.
        // An InvalidResponseException is thrown if the crypt parameter data is not
        // a hexadecimal string.

        $hexString = substr($crypt, 1);

        if (! preg_match('/^[0-9a-f]+$/i', $hexString)) {
            throw new InvalidResponseException('Invalid "crypt" parameter; not hexadecimal');
        }

        $queryString = openssl_decrypt(
            hex2bin($hexString),
            'aes-128-cbc',
            $this->getEncryptionKey(),
            OPENSSL_RAW_DATA,
            $this->getEncryptionKey()
        );

        parse_str($queryString, $data);

        // The result will be ASCII data only, being a very restricted set of
        // IDs and flags, so can be treated as UTF-8 without any conversion.

        return($data);
    }