Who we are
ZyroPay Ltd ("ZyroPay", "we") is the controller of personal data described in this policy. We are registered with the [Information Commissioner's Office] under number [ZA000000]. Our data protection officer can be reached at privacy@zyropay.net.
This policy covers three groups of people: merchants (businesses using ZyroPay and their staff), payers (people paying a merchant through ZyroPay) and visitors to this website.
What we collect
| Who | Data |
|---|---|
| Merchants | Names, job titles, contact details, identity documents of directors and beneficial owners, company and bank details, dashboard activity. |
| Payers | Payment amount and reference, the bank chosen, the payment outcome, and IP data used for rate limiting and fraud prevention. In some countries, the payer's name and account number. We never receive bank login credentials and never return account numbers in API responses. |
| Visitors | Details you submit through our forms, and with consent, analytics data about how you use the site. See our cookie policy. |
How we use it
| Purpose | Lawful basis |
|---|---|
| Process payments | Performance of a contract; legal obligation under payment services regulation. |
| Verify merchants | Legal obligation under anti-money laundering law. |
| Prevent fraud | Legitimate interests and legal obligation. |
| Reply to enquiries | Legitimate interests; consent where you give it. |
| Product updates | Consent, which you can withdraw at any time. |
| Site analytics | Consent, given through the cookie banner. |
Who we share it with
- Banks and payment schemes, to carry out payments.
- Yapily, our open banking provider, to initiate payments with the payer's bank.
- Identity verification and fraud prevention providers, such as [provider names].
- Formspree, Inc., which receives the contact and application forms on this website and forwards them to us by email.
- Cloud hosting and IT service providers acting on our instructions.
- Regulators, law enforcement and courts where the law requires it.
We never sell personal data.
International transfers
We store data in the UK and the European Economic Area. Some providers process data elsewhere, including Formspree in the United States. In those cases we rely on an adequacy decision or standard contractual clauses with appropriate safeguards.
How long we keep it
We keep transaction and verification records for at least five years after the end of our relationship, as anti-money laundering law requires. Enquiry form data is kept for [24 months] if it doesn't lead to an agreement. Analytics data is kept for [14 months]. The payer receipts list on our checkout is stored only in the payer's own browser.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy in a portable format. Where we rely on consent, you can withdraw it at any time. Some rights are limited where we must keep data by law. Email privacy@zyropay.net and we'll respond within one month.
Security
Data is encrypted in transit and at rest, access is limited to staff who need it and is logged, and our systems are tested regularly by independent security specialists.
Contact and complaints
Questions about this policy go to privacy@zyropay.net. If you're unhappy with how we've handled your data, you can complain to the [Information Commissioner's Office (ico.org.uk)] or your local data protection authority.