PridePay Privacy Notice

1. About this notice

PridePay is a trading name of Cardaq Limited ("Cardaq", "we", "us" or "our"). This notice explains how we collect, use, share and protect your personal data when you use the PridePay services, visit our website at https://pridepay.com (the "Website"), or otherwise interact with us.

Cardaq Limited is the controller of your personal data. We are a private limited company incorporated in England and Wales with company number 07805564, whose registered office is at One Bartholomew Close, London, EC1A 7BL. Cardaq Limited is authorised and regulated by the Financial Conduct Authority as an electronic money institution (firm reference number 900088). You can check this on the Financial Services Register at https://register.fca.org.uk.

You can contact us about this notice or your personal data at info@pridepay.com or by writing to us at the registered office address above.

This notice does not apply to third-party websites, products or services, even if they link to the Website or our services. Please read the privacy notices of those third parties before you provide them with your personal data.

2. Information you provide to us

2.1. You may give us personal data when you apply to open an account, subscribe to our services, complete forms on the Website, contact us by phone, email or in-app messaging, or report a problem. This may include:

• identity data, such as your name and date of birth;
• identity verification data, including images of your passport or other identity documents, and a photograph of your physical appearance;
• contact data, such as your address, email address and telephone number;
• financial data, such as payment card and bank account information;
• profile and background data, such as a personal description; and
• any other information you choose to provide to us.

3. Information we collect automatically

3.1. Each time you visit the Website or use our services we may collect:

• technical data, including your Internet Protocol (IP) address, login data, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and
• usage data, including the full Uniform Resource Locator (URL) clickstream to, through and from our Website (with date and time), the services you viewed or searched for, page response times, download errors, length of visits to pages, page interaction information and the methods used to browse away from a page.

3.2. We collect some of this data using cookies and similar technologies. Please see our Cookies Policy at cookies policy link for details.

4. Special category and criminal offence data

4.1. Where we use images of you or your identity documents to verify your identity by electronic means, this may involve processing biometric data, which is a special category of personal data under Article 9 of the UK GDPR.

4.2. When we carry out sanctions, fraud and financial crime screening, we may process data relating to actual or alleged criminal offences within the meaning of Article 10 of the UK GDPR.

4.3. We only process this data where a condition in the UK GDPR and the Data Protection Act 2018 applies, which is typically that the processing is necessary for reasons of substantial public interest (including the prevention and detection of unlawful acts and compliance with regulatory requirements) or for the establishment, exercise or defence of legal claims.

5. Purposes and lawful bases

5.1. We use your personal data only where the law allows us to. The lawful bases we rely on are:

• performance of a contract with you, or to take steps at your request before entering into a contract;
• compliance with a legal or regulatory obligation to which we are subject;
• our legitimate interests (or those of a third party), where these are not overridden by your interests and rights; and
• your consent, where we ask for it.

5.2. We use your personal data for the following purposes:

• to assess and process your application for our services, which is necessary to take steps before entering into a contract with you;
• to provide our services and perform our contract with you, which is necessary for the performance of our contract;
• to carry out customer due diligence, identity verification, sanctions screening, fraud prevention, risk management, transaction monitoring and anti-money laundering checks, which is necessary to comply with our legal and regulatory obligations and in our legitimate interests in preventing financial crime;
• to respond to enquiries, send service notices and provide customer support, which is necessary for the performance of our contract and in our legitimate interests in supporting our customers;
• to administer and secure the Website and our services, including troubleshooting, data analysis, testing, research and statistical purposes, which is in our legitimate interests in running our business securely;
• to notify you of changes to our services, which is necessary for the performance of our contract and to comply with our legal obligations;
• to send you marketing communications about products and services similar to those you have obtained from us, which is in our legitimate interests, subject to your right to opt out at any time; and
• to send you other marketing communications, and to serve and measure advertising, where you have consented.

6. Change of purpose

6.1. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis for doing so.

7. If you do not provide personal data

7.1. Where we need to collect personal data by law, or under the terms of a contract with you, and you do not provide that data when requested, we may not be able to open your account or provide our services to you. We will tell you if this is the case at the time.

8. Automated processing

8.1. As part of onboarding, fraud prevention and transaction monitoring, we may use automated means to make decisions about you, including whether to accept your application or to flag or block a transaction.

8.2. Where a decision that produces legal effects concerning you, or similarly significantly affects you, is based solely on automated processing, you have the right to obtain meaningful information about the logic involved, to make representations, to obtain human intervention and to contest the decision, in accordance with Articles 22A to 22D of the UK GDPR.

9. Who we share data with

9.1. We may share your personal data with:

• other members of our group, meaning our affiliated companies, subsidiaries and ultimate beneficial owners and their subsidiaries, within the meaning of section 1159 of the Companies Act 2006;
• business partners, suppliers and sub-contractors who help us provide our services;
• identity verification, fraud prevention, sanctions screening and financial crime providers;
• analytics providers who help us improve and optimise the Website;
• advertising networks, where you have consented;
• credit reference agencies, where a credit assessment is a condition of us providing services to you; and
• card schemes, banks and other financial institutions involved in processing your transactions.

9.2. We may also disclose your personal data to third parties:

• if we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer;
• if Cardaq Limited or substantially all of its assets are acquired by a third party, in which case personal data held about customers will be a transferred asset;
• where we are under a legal or regulatory duty to disclose or share your personal data, or to enforce our terms and conditions and other agreements, or to protect the rights, property or safety of Cardaq Limited, our customers or others; and
• to respond to requests from courts, law enforcement agencies, regulators and other public and government authorities, which may include authorities outside the United Kingdom.

9.3. We require everyone with whom we share your personal data to respect its security and to treat it in accordance with the law. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

10. Transfers outside the uk

10.1. We may transfer your personal data to, and store it in, countries outside the United Kingdom, where we or our service providers operate.

10.2. Where we transfer your personal data outside the United Kingdom, we ensure a similar degree of protection by relying on one of the following safeguards:

• a transfer to a country that the UK government has decided provides an adequate level of protection; or
• the International Data Transfer Agreement, or the international data transfer addendum to the European Commission's standard contractual clauses, approved for use in the United Kingdom; or
• another lawful transfer mechanism permitted under the UK GDPR, as assessed against the data protection test.

10.3. You may contact us for a copy of the safeguards we use to protect your personal data when it is transferred outside the United Kingdom.

11. Retention

11.1. We keep your personal data only for as long as we need it for the purposes set out in this notice.

11.2. If you are a PridePay customer, we retain your personal data for the duration of our relationship with you and for a period afterwards to the extent necessary to comply with our legal and regulatory obligations, including anti-money laundering record-keeping, tax, accounting and financial reporting requirements, and for the purpose of fraud monitoring, detection and prevention.

11.3. We retain identity and transaction records for a minimum of seven (7) years after our business relationship ends, in line with our anti-money laundering obligations, and for longer where required by law or to establish, exercise or defend legal claims.

12. Our security measures

12.1. We maintain technical, physical and administrative security measures designed to protect your personal data against loss, misuse, unauthorised access, disclosure and alteration. These include firewalls, data encryption, physical access controls to our data centres and access authorisation controls. Your personal data is accessible only to personnel who need access to perform their duties.

12.2. You are responsible for keeping your password and account registration information confidential. Please do not share your password with anyone. If you believe that the security of your account has been compromised, please contact us immediately.

12.3. No data transmission or storage system can be guaranteed to be completely secure. Although we take appropriate measures to protect your personal data, any transmission is at your own risk.

13. Your data protection rights

13.1. Subject to the conditions in the UK GDPR, you have the right to:

• request access to your personal data and a copy of it;
• request that we rectify inaccurate, incomplete or outdated personal data;
• request that we erase your personal data in certain circumstances;
• request that we restrict the processing of your personal data in certain circumstances;
• request that we transfer your personal data to you or another controller, where technically feasible;
• object to the processing of your personal data on grounds relating to your particular situation; and
• withdraw your consent at any time, where we rely on consent, without affecting the lawfulness of processing before withdrawal.

14. Your right to object to direct marketing

14.1. You have the right to object to the processing of your personal data for direct marketing purposes at any time. Where you object, we will stop processing your personal data for those purposes. You can exercise this right by using the unsubscribe link in any marketing email or by contacting us.

15. Exercising your rights

15.1. You can exercise your rights by contacting us using the details in clause 1. You will not usually have to pay a fee to access your personal data or to exercise any of your other rights. We may charge a reasonable fee, or refuse to comply, if your request is manifestly unfounded or excessive.

15.2. We may need to verify your identity before responding to your request. We will respond to all legitimate requests within one month, unless the request is complex or you have made a number of requests, in which case we may take up to a further two months and will notify you.

16. How to complain

16.1. If you have a concern about how we use your personal data, please contact us first so that we can try to resolve it. We operate a process for handling data protection complaints, and we will acknowledge and respond to your complaint in accordance with that process.

16.2. You also have the right to complain to the Information Commissioner's Office at any time. The ICO can be contacted at https://ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, appreciate the chance to deal with your concerns before you approach the ICO.

17. Updates

17.1. We may update this notice from time to time. Any changes will be posted on this page and, where appropriate, notified to you by email. Please check back regularly to see any updates. This notice was last updated on the date shown at the top.

18. Contact details

18.1. If you have any questions about this notice or how we handle your personal data, please contact us at info@pridepay.com , or write to us at Cardaq Limited (trading as PridePay), One Bartholomew Close, London, EC1A 7BL.