Privacy Policy

1. Important information and who we are

Purpose of this privacy policy

This privacy policy describes how Mypinpad Ltd (“Mypinpad”, “we”, “us”, “our”) collects and processes personal data when you use this website, contact us, or interact with our online services. This website is not intended for children, and we do not knowingly collect data relating to children.

Data controller

Mypinpad Ltd is the data controller responsible for personal data collected through this website.

Contact details

• Legal entity: Mypinpad Ltd
• Email: info@mypinpad.com
• Registered address: c/o Acuity Law Limited, 3 Callaghan Square, Cardiff, CF10 5BT
• Telephone: +44 (0)2920 674437

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk. We would, however, appreciate the opportunity to address your concerns before you approach the ICO.

Changes to this policy

We review this privacy policy regularly. The date at the top of this page indicates when it was last updated. Please keep us informed of any changes to your personal data.

Third-party links

This website may contain links to third-party websites. We do not control those sites and are not responsible for their privacy practices.

2. The data we collect about you

Personal data means any information that identifies an individual. We may collect, use, store, and transfer the following categories of personal data:

• Identity Data: first name, last name, username, title.
• Contact Data: email address and telephone numbers.
• Technical Data: IP address, login data, browser type and version, time zone, location, browser plug-ins, operating system, and platform.
• Profile Data: orders, preferences, feedback, and survey responses.
• Usage Data: information about how you use our website, products, and services.
• Marketing and Communications Data: your marketing and communication preferences.

We also collect aggregated data (statistical or demographic data) that does not directly identify any individual. If aggregated data is combined with personal data so that it can identify you, it is treated as personal data.

We do not collect any special categories of personal data (such as race, ethnicity, religious beliefs, sexual orientation, political opinions, trade union membership, health information, genetic, or biometric data) and we do not collect information about criminal convictions or offences.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract or services. We will notify you if this is the case.

3. How your personal data is collected

• Direct interactions: via forms, post, phone, email, or other correspondence — for example when you subscribe to our services, request marketing materials, or provide feedback.
• Automated technologies: through cookies, server logs, and similar technologies that track browsing patterns. See our cookies policy for details.
• Third parties or publicly available sources: Technical Data from analytics and search providers (such as Google) and Identity/Contact Data from professional networks (such as LinkedIn), which may be based outside the EU.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To perform the contract we are about to enter or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing, except in connection with sending third-party direct marketing by email or text, and for non-essential cookies and similar technologies on this website, as described in our cookies policy. You have the right to withdraw consent at any time: for marketing by contacting us, and for cookies through the Cookie settings link at the foot of every page.

The table below sets out each purpose and the lawful basis we rely on for it.

• Responding to an enquiry you send us

  Data

  Identity, Contact, the content of your message

  Lawful basis

  Legitimate interests (answering business enquiries), or steps at your request before a contract

• Developer SDK registration and sandbox access

  Data

  Identity, Contact, Technical

  Lawful basis

  Steps at your request before a contract, then performance of a contract

• Providing our services to your organisation

  Data

  Identity, Contact, Transaction

  Lawful basis

  Performance of a contract

• Business marketing about our products

  Data

  Identity, Contact, Marketing and Communications

  Lawful basis

  Legitimate interests, with an opt-out in every message; consent where PECR requires it

• Website analytics (Google Analytics)

  Data

  Technical, Usage

  Lawful basis

  Consent (statistics cookies)

• Marketing and CRM tracking (HubSpot, LinkedIn)

  Data

  Technical, Usage

  Lawful basis

  Consent (marketing cookies)

• Playing embedded videos (YouTube)

  Data

  Technical, Usage

  Lawful basis

  Consent, given when you choose to play a video

• Keeping the website secure and working

  Data

  Technical

  Lawful basis

  Legitimate interests (security and fraud prevention)

• Meeting legal and regulatory obligations

  Data

  Identity, Contact, Transaction

  Lawful basis

  Legal obligation

Marketing

We may use your Identity, Contact, Technical, Usage, and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. You will receive marketing communications from us if you have requested information from us or purchased services and have not opted out of receiving that marketing.

Opting out

You can ask us to stop sending you marketing messages at any time by following the opt-out links in any marketing message sent to you, or by contacting us. Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of a service purchase or other transaction.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, see our cookies policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

5. Disclosures of your personal data

We may share your personal data with selected external third parties (including service providers), and with parties involved in any business sale, transfer, merger, or acquisition. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Service providers are permitted to process your personal data only for specified purposes and in accordance with our instructions.

The service providers used on this website are:

• HubSpot (EU data centre): receives what you submit through our contact and developer registration forms, and, if you accept marketing cookies, records your visits to this website.
• Google Analytics 4 (Google): measures how this website is used. It runs according to your cookie choices and sets analytics cookies only if you accept statistics cookies.
• LinkedIn Insight Tag (LinkedIn): if you accept marketing cookies, measures the results of our LinkedIn campaigns.
• Cookiebot (Usercentrics): records your cookie choices.
• Google Cloud and Firebase (Google): host this website.

6. International transfers

Some of our external third parties operate outside the United Kingdom and the European Economic Area (EEA). Whenever we transfer your personal data outside the UK or EEA, we ensure a similar degree of protection by using one of the following safeguards:

• Transferring data to countries that have been deemed to provide an adequate level of protection.
• Using specific contracts approved for use in the UK or EU which give personal data the same protection it has in the UK or EEA.

Please contact us if you would like further information on the specific mechanism we use when transferring your personal data internationally.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation.

By law, we have to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers, for tax purposes.

In some circumstances you can ask us to delete your data — see your legal rights below. We may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information indefinitely without further notice.

9. Your legal rights

Under UK data protection law, you have rights including:

• Request access to your personal data (a “data subject access request”).
• Request correction of incomplete or inaccurate personal data.
• Request erasure where there is no good reason for us to continue processing your data, you have successfully exercised your right to object, processing was unlawful, or erasure is required to comply with local law. We may not always be able to comply with an erasure request for specific legal reasons.
• Object to processing where we are relying on a legitimate interest, where there is something about your situation that makes you want to object, or where we are processing your data for direct marketing.
• Request restriction of processing in certain circumstances.
• Request transfer of your personal data to you or a third party in a structured, machine-readable format.
• Withdraw consent at any time where we are relying on consent to process your personal data.

To exercise any of these rights, please contact us at info@mypinpad.com.

No fee usually required

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive, or excessive.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Glossary

Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests.

Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.