Privacy Policy

1. Who we are

QloudPay Limited is a company registered in England and Wales. Company number: 17144607. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: privacy@qloudpay.co.uk.

QloudPay provides QR-based payment services that allow businesses to accept Open Banking payments and card payments through regulated partners. For most activities described in this policy, QloudPay acts as the data controller.

QloudPay does not hold customer funds, operate a wallet, issue e-money, or provide regulated acquiring services. Regulated payment services are provided by our partners (Stripe for card payments and Plaid for Open Banking payments). QloudPay acts as a technical service provider and does not provide regulated payment services directly.

2. What this policy covers

This policy explains how we use personal data when you:

• visit our website or dashboard
• create or use a QloudPay merchant account
• make or receive payments using Open Banking or card rails
• scan a QloudPay QR code or use a payment link
• contact us for support
• receive communications or marketing
• interact with us as a supplier, partner or business contact

This policy should be read alongside our Terms of Service and Merchant Agreement.

3. Personal data we collect

The information we collect depends on how you use QloudPay.

Identity and contact details: name, email address, phone number, business name, job title, postal address and login details.

Merchant and business information: company number, trading name, business address, details of owners, directors or authorised users, bank account details for payouts, onboarding and verification information, and information submitted through forms or support requests.

Open Banking payments (Plaid): payment amount, payment reference, payer and payee details, bank account name, sort code and account number, transaction identifiers, refund information, and data provided by banks or Open Banking partners. QloudPay never asks for or stores online banking passwords.

Card payments (Stripe): card brand, masked card number, expiry month and year, authorisation results, settlement information, and chargeback or dispute information. QloudPay does not store full card numbers.

Technical and usage information: IP address, device type, browser type, operating system, pages viewed, links clicked, session logs, error logs and analytics data.

Communications and support: messages you send us, support tickets, emails and chat history, feedback or complaints.

Marketing and sales information: contact details, communication preferences, engagement with marketing messages, and information from events or referrals.

Information from third parties: merchants, banks, Plaid (Open Banking payments), Stripe (card payments), Sumsub (identity verification), Companies House (KYB/UBO data source), fraud prevention partners, analytics providers, advisers or regulators.

Special category data: QloudPay does not intentionally collect special category data (for example health, religion or biometrics). Please do not provide this information unless necessary. QloudPay is not intended for use by children under 16, and we do not knowingly collect personal data relating to children.

4. How we collect personal data

We collect data:

• directly from you
• from merchants using QloudPay
• from banks when you authorise Open Banking payments
• from Plaid when you use Open Banking
• from Stripe when you use card payments
• from Sumsub during identity verification
• automatically through website and app usage
• from public sources such as Companies House
• from partners, suppliers or advisers

5. How we use personal data

To provide QloudPay services: create and manage accounts, onboard merchants, initiate and process Open Banking and card payments, provide QR and payment link services, manage refunds, provide customer support and send service notifications. Legal bases: performance of a contract, legitimate interests, legal obligation, consent where required.

To verify and monitor merchants: verify identity and business details, assess eligibility, prevent fraud, comply with regulatory requirements and monitor account activity. Legal bases: legal obligation, legitimate interests, performance of a contract.

To process payments: initiate payments, confirm payment status, reconcile transactions, communicate with banks, Plaid and Stripe, and investigate failed or disputed payments. Legal bases: performance of a contract, legitimate interests, legal obligation.

To communicate with you: respond to enquiries, send service updates, notify you of changes and manage complaints. Legal bases: performance of a contract, legitimate interests.

To improve and secure QloudPay: monitor performance, fix issues, improve features, detect fraud and secure our systems. Legal bases: legitimate interests, legal obligation.

Marketing: we may send business-to-business marketing communications and you can opt out at any time. Legal bases: legitimate interests or consent where required.

Legal compliance: comply with law, respond to regulators, maintain records and enforce our terms. Legal bases: legal obligation, legitimate interests.

6. Who we share personal data with

We may share data with:

• banks and payment account providers
• Plaid (Open Banking payments)
• Stripe (card payments)
• Sumsub (identity verification)
• fraud prevention partners
• cloud hosting and infrastructure providers
• analytics and communication providers
• professional advisers
• regulators or public authorities
• merchants or customers where necessary
• suppliers or business partners
• potential investors or buyers (where appropriate)

We only share data where lawful and with appropriate safeguards.

7. International transfers

Some partners may process data outside the UK. Where this happens, we ensure appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses.

8. How long we keep personal data

We retain data only as long as necessary. Typical retention periods:

• merchant and account records: up to 7 years
• payment records: up to 7 years
• support records: up to 7 years
• marketing data: until you unsubscribe
• enquiry records: up to 12 months
• security logs: shorter periods unless required for investigation

When data is no longer needed, we delete or anonymise it.

9. Security

We use appropriate technical and organisational measures, including:

• encryption
• access controls
• multi-factor authentication
• monitoring and logging
• secure cloud infrastructure
• regular security reviews

No system is completely secure. You must keep your login details safe.

10. Your rights

You may have the following rights:

• access your data
• correct inaccurate data
• request deletion
• restrict processing
• object to processing
• object to marketing
• data portability
• withdraw consent
• complain to the ICO

To exercise your rights, contact privacy@qloudpay.co.uk.

11. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

12. Third-party links

QloudPay may contain links to third-party websites. We are not responsible for their privacy practices.

13. Complaints

If you have concerns, contact us at privacy@qloudpay.co.uk. You may also contact the Information Commissioner's Office (ICO).

14. Changes to this policy

We may update this policy from time to time. The latest version will be available on our website.

15. Contact us

For questions about this Privacy Policy, email legal@qloudpay.co.uk or write to 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.