Merchant data processing notice

Who this notice is for

This notice applies if you are applying to eCom Pay for payment services, or if you already hold an account with us. It explains how we handle personal data about the people behind a business rather than about visitors to our website. Website visitors are covered by our privacy notice instead.

When this notice refers to you, it means the individuals who give us personal data so that we can assess and provide these services. For a sole trader or a partnership, that is the people who own the business. For a limited company, that is the directors, shareholders, ultimate beneficial owners and anyone else responsible for running the business whose details we collect. In every case it also includes any joint applicant, any guarantor, and any authorised contact you nominate on the account.

If you give us personal data about another person, such as a fellow director or a guarantor, you must show them this notice and make sure they understand that you have shared their details with us.

Who we are and how to contact us

eCom Pay is a trading name of E Commerce Professionals Limited, a company registered in England and Wales under company number 12563051, with its registered office at 13 Whites Row, London, E1 7NF. We are registered with the Information Commissioner’s Office under registration number ZB872102.

We are a data controller of the personal data described in this notice, because we decide why and how it is processed when we take your application, prepare it, place it and support your account afterwards.

It matters who does what, so we set it out plainly. eCom Pay is not the acquirer. We are a specialist provider that collects your information, checks it, builds your case and presents it to the acquirer that will hold your merchant account. The acquirer is a separately regulated business. It carries out the regulated onboarding checks, it makes the decision on whether your account is opened, it sets the terms of your merchant agreement and it is responsible for processing and settling your transactions. The acquirer and the card schemes are data controllers of the personal data they hold for their own purposes, and each of them will tell you how it uses that data under its own terms. This notice covers what we do, not what they do.

For anything about this notice, or to exercise any of the rights described in it, email privacy@ecompay.co.uk, call 0345 548 0072 at any time, or write to us at our registered office.

Where we get your personal data

Most of it comes from you, on the application form, in the documents you send us and in the conversations we have with you while your account is being set up and while it is running. We also receive personal data from the following sources.

Public registers, including Companies House, the register of people with significant control, the electoral register and the insolvency register.
Identity verification, sanctions screening and politically exposed person screening providers.
Credit reference agencies and fraud prevention agencies.
The acquirer and the card schemes, including the scheme operated databases of terminated merchants.
Any introducer, broker, comparison site or partner who referred you to us.
Publicly available sources, including your own website, your terms of sale and information you have published about your business.

What personal data we process

The categories of personal data we hold about you are as follows.

Identity data, meaning your name, date of birth, nationality, your role in the business and your shareholding.
Contact data, meaning your business and home address, email address and telephone numbers.
Verification data, meaning copies of the documents you send us to prove identity and address, such as a passport, a driving licence, a bank statement or a utility bill.
Financial data, meaning bank account details, business turnover, projected and actual processing volumes, average transaction values, and the financial information contained in accounts and statements you provide.
Credit and financial standing data obtained from credit reference agencies about you as an individual where you are a sole trader, a partner or a guarantor, and about the business.
Business data, meaning your business model, the products or services you sell, your licences and regulatory registrations where your sector requires them, your delivery and refund terms, and your website.
Account and transaction data, meaning processing volumes, settlement records, refund and chargeback records, and the account activity generated once you are live.
Correspondence data, meaning the record of your enquiries, emails, support tickets and the notes our team makes about conversations with you.
Risk and compliance data, meaning the results of sanctions, politically exposed person and adverse media screening, and the results of any checks against fraud prevention or card scheme databases.
Marketing preferences, meaning the choices you have made about how we contact you.

We do not record telephone calls.

We do not seek special category data. If you tell us about a health condition, a disability or any other circumstance that affects how you need us to communicate with you, we will record only what is needed to give you the adjustment you have asked for, and we will do so on the basis of your consent or because it is necessary for reasons of substantial public interest in providing an equal service.

Why we process it and our lawful bases

Data protection law requires us to explain the legal ground for each purpose. More than one ground can apply to the same activity.

To take steps at your request before entering a contract, and to perform that contract

This covers assessing your application, verifying who you are, building and presenting your case for underwriting, opening and configuring your account, providing the gateway, terminals and other products you have taken, settling your funds, handling refunds and chargebacks, and giving you day to day support and account management.

To comply with our legal obligations

This covers our anti money laundering and counter terrorist financing duties, sanctions screening, record keeping and reporting duties, responding to lawful requests from the police, courts, tax authorities and regulators, and responding to requests you make under data protection law.

For our legitimate interests, or those of the acquirer and the card schemes

This covers assessing risk and creditworthiness before and during the relationship, monitoring accounts for fraud, preventing losses to us and to our partners, recovering debts, keeping proper business records, defending and pursuing legal claims, improving our services and training our team, and letting business customers know about products related to the ones they already use. We have considered your interests and rights in each case and we do not process data this way where your interests override ours.

With your consent

This covers marketing by email or text where the law requires consent, and any special category data you ask us to record so that we can adjust how we deal with you. You can withdraw consent at any time by emailing privacy@ecompay.co.uk or by using the unsubscribe link in any marketing message. Withdrawing consent does not affect anything we did before you withdrew it, and it does not stop us sending you the operational and account messages you need in order to use the service.

The checks we carry out

Card schemes and payment industry rules require every merchant to be checked before an account is opened and monitored afterwards. Those checks are carried out by the acquirer and by the specialist providers it uses. Our part is to collect the information and documents needed for them, to verify that what you have given us is complete and consistent, and to pass it on with your application. We do not run the regulated searches ourselves and we do not make the decision on your account. The checks cover the following.

Identity and address verification on the business owners, directors and any guarantor.
Verification of the business itself, its ownership structure and its ultimate beneficial owners.
Sanctions, politically exposed person and adverse media screening.
Checks on credit history and financial standing, covering both the business and, where you are a sole trader, a partner or a guarantor, you as an individual.
Checks against the card scheme databases of merchants whose accounts have been terminated.
Review of your website, your terms of sale and your licences, and in some cases a visit to your premises or an equivalent verification.
Ongoing monitoring of processing activity, refund and chargeback levels and any change to your business model, for as long as the account is open.

Credit reference agencies

To assess an application, the acquirer and its providers search records held by credit reference agencies about the business and, where relevant, about the owners, partners or guarantors personally. Your details are supplied to the agency and the agency returns information, which can include public record information such as the electoral register, insolvency and judgment records, together with shared credit account information.

That information is used to assess financial standing and the level of risk in the account, to confirm that the details given are accurate, and to help prevent fraud and money laundering. Information may continue to be exchanged with credit reference agencies for as long as you hold the account.

A search of a personal credit file leaves a record of that search on the file, which other organisations carrying out later searches can see. Credit reference agencies are data controllers in their own right and process your data under their own arrangements, and you can obtain a copy of what they hold by contacting them directly. If you want to know which agency was used in relation to a particular application, email privacy@ecompay.co.uk and we will find out for you.

Fraud prevention and card scheme databases

If false or inaccurate information is given, or if fraud is identified or suspected, that is recorded and the details may be passed to fraud prevention agencies and to the card schemes, by us or by the acquirer.

Where an account is terminated for particular reasons, including fraud, excessive chargebacks, breach of the merchant agreement or insolvency, the card schemes require the acquirer to enter the business and its principals on a scheme operated database of terminated merchants. Being listed on that database can make it harder or impossible to obtain card processing from any provider for a period of years. We will always tell you if this applies to your account.

Fraud prevention agencies and card schemes keep this information for different periods depending on why it was recorded, and law enforcement may access it to detect, investigate and prevent crime.

Who we share your personal data with

We share personal data only where there is a reason to, with the following categories of recipient.

The acquirer and the banking institutions involved in underwriting your account and settling your funds.
The card schemes, and other payment method providers whose methods you have chosen to accept.
Identity verification, sanctions screening, credit reference and fraud prevention providers.
Terminal, gateway and point of sale suppliers, and the logistics providers who deliver and collect hardware.
Our own technology suppliers, including hosting, email, telephony and customer record systems, all of which act on our instructions.
Any introducer, broker or partner who referred you to us, limited to what they need in order to know the outcome of the referral.
Our professional advisers, including lawyers, accountants and auditors.
Debt recovery agencies, where money is owed to us and other steps have failed.
Law enforcement, courts, tax authorities and regulators, where we are required or permitted to disclose.
A buyer or prospective buyer, and their advisers, if our business or part of it is sold or restructured.

We do not sell your personal data, and we do not share it with third parties so that they can market their own products to you.

Transfers outside the United Kingdom

Your personal data is normally held in the United Kingdom or the European Economic Area. Some of our suppliers, and some of the card scheme and screening infrastructure that payment services depend on, operate outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we do so only where the destination is covered by UK adequacy regulations, or under the International Data Transfer Agreement or the addendum to the standard contractual clauses, together with a transfer risk assessment. You can ask us for details of the safeguards used by emailing privacy@ecompay.co.uk.

How long we keep it

Where an application does not proceed, we keep the application file for two years so that we have a record of the decision and can deal with any query or complaint about it.

Where an account is opened, we keep identity and due diligence records for five years after the relationship ends, which is the period anti money laundering law requires. Transaction and settlement records are kept for six years after the end of the financial year they relate to, to meet tax and accounting requirements. Correspondence and account notes are kept for six years after the relationship ends, which matches the period in which a legal claim could still be brought.

Records relating to fraud, to a terminated account or to a regulatory matter may be kept for longer where there is a continuing reason to hold them. When personal data is no longer needed it is deleted or anonymised.

Automated decision making

Your application is not decided by automated means alone. Screening and scoring tools are used to gather information and to flag matters for attention, but the case is assessed by people at eCom Pay and the decision on the account is made by people at the acquirer. Fraud monitoring on a live account can result in a transaction being declined or an account being suspended automatically where the risk indicators require it, and where that happens you can ask us to review the decision and can put your side of it to us.

Your rights

Under UK data protection law you have the following rights, some of which apply only in particular circumstances.

To be told how we use your personal data, which is what this notice does.
To ask for a copy of the personal data we hold about you.
To have inaccurate personal data corrected and incomplete data completed.
To ask us to erase personal data where there is no longer a good reason for us to hold it.
To object to processing that we carry out on the ground of legitimate interests, and to object to direct marketing at any time.
To ask us to restrict processing while an accuracy or objection question is being resolved.
To receive personal data you gave us in a portable form, where the processing is based on consent or on a contract and is carried out by automated means.
To withdraw consent where we rely on it.

To exercise any of these, email privacy@ecompay.co.uk. We will respond within one month, and we will tell you if we need longer because the request is complex. There is no charge. We may need to confirm your identity before we act, which protects you as much as us.

Some of the organisations named in this notice, including credit reference agencies, fraud prevention agencies, the card schemes and the acquirer, are controllers of your data in their own right. If you want to exercise rights against them, you should approach them directly, and we will help you find the right contact if you ask.

Complaints

If you are unhappy with how we have handled your personal data, tell us first by emailing privacy@ecompay.co.uk so that we have the chance to put it right. Our complaints policy explains how we deal with complaints generally.

You also have the right to complain to the Information Commissioner’s Office at any time. The ICO can be reached at ico.org.uk or on 0303 123 1113. We would ask you to raise it with us first, but you do not have to.

Changes to this notice

We review this notice whenever our processing changes and at least once a year. The date at the top of the page shows when it was last updated, and the current version is always the one published here. Where a change materially affects how we use your personal data, we will tell account holders directly.