1. Introduction

Ebury Mass Payments Limited (“We”, “Us” or “Our”) are committed to protecting and respecting your privacy.

As part of Our normal business operation We collect certain personal information from Our clients.  This policy sets out the basis on which We process any such personal information that We collect or that you provide to Us.  Please read this policy carefully to understand Our practices regarding your personal information.

By visiting www.ebury.com, online.ebury.com, masspayments.ebury.us or bos.eburypartners.com (“Our sites”) you are accepting and consenting to the practices described in this notice.

2. Our contact information

For the purpose of the Data Protection, the Data Protection Act 2018, EU General Data Protection Regulation and the UK General Data Protection Regulation, (the “Regulation”):

You may contact Our Data Protection Officer directly with any enquiries relating to Data Protection.

You can submit a data subject request using this link.

3. How to complain

You have the right to lodge a complaint with your Supervisory Authority. For the purpose of Our processing the lead Supervisory Authority is:

4. The type of information we collect

We may collect and process the following data about you:

Information you give Us through the use of Our sites or Our services.

You may give Us information about you by filling in forms on Our sites or by corresponding with Us by phone, e-mail or otherwise. This includes information you provide when you register to use Our sites, subscribe to Our services, place an order or transact on Our sites or report a problem with Our sites. The information you give Us may include your name, address, e-mail address and phone number, financial and credit information.

• Contact information, such as your name, address, email address and phone number
• Identification information, such as certified identity documents, proof of address or business documentation including your personal details
• Financial and credit information

You may give Us information relating to beneficiaries, shareholders, trustees and directors to enable us to deliver Our services. This may be through filling in forms on Our sites or by corresponding with Us by phone, email or otherwise. You must obtain appropriate consent before disclosing such information to Us. The information you give Us may include their name, address, email address and phone number, financial and credit information.

Information We collect about you when you use Our sites.

With each visit to Our sites We may automatically collect the following information:

• technical information, including the internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from Our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call Our customer service number.
  

Information We receive from other sources when delivering Our services.

• We may receive information about you if you use any other websites We operate or other services We provide. This data may be shared internally and combined with data collected on this site. 
• We also work closely with third parties (including, for example, introducers, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them. 

Where we receive information We will ensure this will be in full compliance of the Regulation.

5. Cookies

We follow the “Express Consent” basis for processing cookies. The first time you visit Our sites We will inform you of the cookies We use and provide opt-in options which states your consent for Us to use cookies.

A cookie is a very small text file placed on your computer, that allows Us to distinguish you from other users of Our sites. These cookies help Us to provide you with a good experience when you browse Our sites. We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of Our sites. They include, for example, cookies that enable you to log into secure areas of Our sites.
• Analytical/performance cookies. They allow Us to recognise and count the number of visitors and to see how visitors move around Our sites when they are using them. This helps Us to improve the way Our sites work, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies.These are used to recognise you when you return to Our sites. This enables Us to personalise Our content for you, by remembering your preferences (for example, your choice of language or region).

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which We have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

You may block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of Our sites.

6. How We use your information

Information you give to Us. We will use this information:

• to carry out Our obligations arising from any contracts entered into between you and Us and to provide you with information, products and services that you request from Us;
• to carry out Our obligations arising from any contracts entered into between Us and third parties relating to the services provided to You; 
• Your information will only be used in these circumstances in the performance of a contract with You; or 
• where there is a defined legitimate interest, for the purpose of monitoring the contractual relation between Us and the third parties involved in the relationship with You.
• to provide you with information about other products and services We offer;
• where you are an existing private customer, We will only contact you with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you. 
• where you are a new private customer,  We will contact you only if you have consented to this. If you do not want Us to use your data in this way, please tick the relevant box situated on the form on which We collect your data. 
• where you are a corporate/business customers, We will contact you where We have identified a legitimate interest in relation to the services We offer and your business.
• You may withdraw this consent at any time by using the links provided at the bottom of marketing emails from Us, or by contacting Our DPO.
• to notify you about changes to Our service;
• to respond to any enquiry you have made through Our sites, or via phone, e-mail or otherwise.
• to comply with legal obligations We are subject to as a data controller and regulated business.This includes:
• using personal information needed to comply with legal and regulatory duties related to anti-money laundering and counter-terrorist financing;
• detecting, preventing and prosecuting fraud or theft, as well as preventing illegitimate or prohibited use of our services or other illegal or wrongful activity. 
• monitoring and reporting compliance issues. 
• This may further include using your personal information to validate and authenticate your identity, and utilising third parties to help us do so. See Information We disclose about you.
• where required to protect your vital interests or that of another natural person
• where performing tasks carried out in the public interest or in the exercise of official authority invested in Us

Information We collect about you. We will use this information:

• to administer Our sites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to improve Our sites to ensure that content is presented in the most effective manner for you and for your computer;
• to allow you to participate in interactive features of Our services, when you choose to do so;
• as part of Our efforts to keep Our sites safe and secure;
• to measure or understand the effectiveness of advertising We serve to you and others, and to deliver relevant advertising to you.

Information We receive from other sources. – We will use this information:

We may combine this information with information you give to Us and information We collect about you. We may use this information and the combined information for the purposes set out above (depending on the types of information We receive).

Information We disclose about you

We may share your personal information with any member of Our group, which means Our branches, Our representative offices, Our subsidiaries, Our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006. Any such sharing will be made in full compliance with the Regulation.

We will never sell your personal data without your consent. We may share your information with selected third parties. Where this is necessary, We are required to comply with all aspects of the Regulation. The following are the types of organisations We may share some of your personal information with:

• • Business partners, suppliers and sub-contractors for the performance of any contract We enter into with them or you.
  • Analytics and search engine providers that assist Us in the improvement and optimisation of Our sites.
  • Credit reference agencies for the purpose of assessing your credit score where this is a condition of Us entering into a contract with you.
    • The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at www.experian.co.uk/crain
    • Capita Identity Solutions: https://www.securitywatchdog.org.uk/privacy-policy
    • Trulioo: https://www.trulioo.com/privacy
  • To meet our Legal Obligations and to fulfil our contractual obligations, we may use Identity Verification services and other automated tools for the purpose of confirming your identity through online applications and to store your data. You have the right to ask us to manually review your application should you be refused our services based upon assisted decision making:
    • Jumio: https://www.jumio.com/legal-information/privacy-policy/ 
    • Comply Advantage: https://complyadvantage.com/privacy-notice/
    • LexisNexis: https://www.lexisnexis.com/en-us/terms/privacy-policy.page
    • Salesforce: https://www.salesforce.com/privacy/overview/
    • Orbis: https://www.bvdinfo.com/en-gb/privacy-policy

• Police and law enforcement agencies, where required to do so by law.

We may disclose your personal information to third parties:

• • • In the event that We sell or buy any business or assets, in which case We may disclose your personal information to the prospective seller or buyer of such business or assets.
    • If Ebury Partners UK Limited or substantially all of its assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets.
    • If We are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply Our Terms of Use or Terms and Conditions and other agreements; or to protect the rights, property, or safety of Us, Our group companies, customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

7. Where We store your personal information

The data that We collect from you may be transferred to, and stored at, a destination outside the United Kingdom (“UK”). t may also be processed by staff operating outside the UK who work for Us or for one of Our suppliers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. When these transfers are needed, they will be done in full compliance with the Regulation.  

Specifically, we may transfer your data to either the European Economic Area (“EEA”) or the USA.

Where data is transferred to the EEA this is done so under the adequacy decision terms between the UK and the EU, supported by the use of Standard Contractual Clauses for transfers internal to Ebury. In relation to transfers to the USA, We may transfer personal information through the use of Standard Contractual Clauses and additional measures as required to meet UK, EU, and US regulations. Data collected by Ebury in the USA will be stored in Ebury’s EU servers, and appropriate safeguards will be put in place to meet California Consumer Privacy Act (CCPA), Fair Credit Reporting Act (FCRA), Gramm-Leach-Bliley Act (GLBA), and other US laws where its application, unless it is preempted by, or in conflict with, federal law or the US or California Constitution.

All your personal information will be afforded a high level of protection wherever it is processed and no matter whether it is held by Us, or Our contractors or agents.

All information you provide to Us is stored under Our control. Any payment transactions will be encrypted. Where We have given you (or where you have chosen) a password which enables you to access certain parts of Our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal information, We cannot guarantee the security of your data transmitted to Our site; any transmission is at your own risk. Once We have received your information, We will use strict procedures and security features to try to prevent unauthorised access.

Should you have particular concerns about a method of data transmission, We will take reasonable steps to provide an alternative method.

8. Your rights

You may contact Our Data Protection Officer, [email protected], to exercise your rights. When exercising your rights We will always inform you of any lawful reason that may require Us to continue processing your data.

You have the right to request from Us information about whether we process your personal information, and ask questions about how We collect, store and process that information.

You have the right to access free information about the personal information We hold about you, whether this is transferred to a third country or international organisation and the associated safeguards.

You have the right to receive any personal data We hold about you in a commonly used and machine-readable format.

Where information We hold is not accurate or is incomplete, you have the right to request We correct such information and We will do so without undue delay.

You have the right to request that We delete any data We process about you, where the processing is no longer necessary.

Where you have previously provided consent for Our processing of your data, you have the right to remove that consent and for Us to stop processing your data specific to that consent. You also have the right to object to Our processing of your data.

9. External Sites

Our site may, from time to time, contain links to and from the websites of Our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that We do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

10. Retaining your Data

The period for which We will retain your data is dependent upon any statutory retention periods We are required to adhere to as a regulated organisation. After the expiration of that period, personal data shall be securely deleted, as long as it is no longer required for the fulfilment of any contract, initiation of a contract or in relation to other legal proceedings. 

Changes to Our privacy policy

This Notice was last updated on 5 May 2022. Any changes We may make to Our privacy notice in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to Our privacy Notice.