In short
- Flowgrid Ltd is the controller of the personal data described in this policy.
- We collect what we need to answer enquiries, verify businesses and the people behind them, provide the Platform and meet our legal obligations.
- We share data with the licensed partners that provide accounts, payments and crypto services, and with the service providers that help us run Payhit. We do not sell personal data.
- You have rights over your data, and you can complain to the Information Commissioner's Office.
Who we are
Payhit is a trading name of Flowgrid Ltd, a private limited company registered in England and Wales under company number 17474059, with its registered office at Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE ("Flowgrid", "we", "us" or "our").
We are the controller of the personal data described in this policy, under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, and, where it applies, under the EU General Data Protection Regulation ("EU GDPR").
For any question about this policy or your personal data, contact us at [email protected] or by post at our registered office.
Who this policy covers
This policy applies to personal data about:
- visitors to our website at payhit.io (the "Website");
- people who contact us, for example through the contact form;
- representatives, directors, beneficial owners, shareholders and authorised signatories of businesses that apply for, or use, the Payhit platform (the "Platform"); and
- users of the Platform.
When a business uses the Platform to process data about its own customers or counterparties, we act as a processor for that business, and the business's own privacy notice applies. When a licensed partner provides a regulated service to you, that partner is also a controller of your data and will give you its own privacy notice.
Personal data we collect
| Context | Personal data |
|---|---|
| Visiting the Website | IP address, browser and device type, pages requested, referring page, date and time of the request, and the cookies described in our Cookie Policy. |
| Contacting us | Name, work email address, company name, industry, expected monthly volume, services you are interested in, and anything else you tell us in your message or in later correspondence. |
| Applying for an account | Information about the business, such as legal name, registration and VAT numbers, addresses, website, business activity, countries of operation, expected volumes, source of funds and purpose of the account. For each director, beneficial owner, representative and signatory: full name, date of birth, nationality, residential address, contact details, role, ownership percentage, whether they are a politically exposed person, and corporate documents in which they appear. |
| Identity verification | Images and data from identity documents, a selfie or short video for liveness checks, and the resulting verification outcome. Facial images used to confirm that you match your identity document are biometric data, which is a special category of personal data. |
| Screening | Results of sanctions, politically exposed persons and adverse media checks, which may include information about alleged or actual criminal offences. |
| Using the Platform | Login details, two-factor authentication settings, user roles, IP address and device information, actions taken in the Platform (audit log), API usage, and support communications. |
| Transactions | Where you use a regulated service through the Platform: names, account numbers and IBANs of payers and payees, amounts, currencies, dates, references and crypto-asset wallet addresses. |
Our onboarding form saves your progress in your browser's local storage so that you can leave and come back. That draft stays on your device and is not sent to us until you submit your application.
Where we get personal data from
We collect most personal data directly from you. We also receive it from:
- the business you work for or own, for example when a colleague lists you as a director or beneficial owner;
- public registers, such as Companies House and other national company registers and VAT registers;
- identity verification, sanctions and politically exposed persons screening, adverse media and fraud prevention providers; and
- our licensed partners, for example the outcome of their own checks or information about your use of their services.
How we use personal data, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry and discussing whether Payhit is right for your business. | Our legitimate interests in responding to business enquiries and developing our business. Where you are a sole trader, taking steps at your request before entering into a contract. |
| Verifying businesses and the individuals connected to them, assessing risk, and screening against sanctions, politically exposed persons and adverse media lists. | Compliance with legal obligations, including anti-money laundering, counter-terrorist financing and sanctions laws that apply to us or to our partners. Our legitimate interests in preventing financial crime and in only working with businesses that meet our partners' requirements. For biometric data and data about criminal offences, the conditions in Schedule 1 to the Data Protection Act 2018 for preventing or detecting unlawful acts, preventing fraud and meeting regulatory requirements, or your explicit consent where we ask for it. |
| Opening and running your account, providing the Platform and the API, and passing instructions to our partners. | Performance of our contract with the business you represent. For individuals acting on behalf of that business, our legitimate interests in providing the service the business has asked for. |
| Keeping the Website and Platform secure, detecting and preventing fraud and misuse, and keeping audit logs. | Our legitimate interests in protecting our systems, our customers and our partners. Compliance with legal obligations where they apply. |
| Sending service messages, such as security alerts, changes to our terms and information about your account. | Performance of our contract with the business you represent, and our legitimate interests in keeping users informed. |
| Sending news about Payhit to business contacts. | Our legitimate interests in promoting our services to businesses. You can opt out at any time using the link in our messages or by contacting us. |
| Improving the Website and Platform, and producing aggregated statistics that do not identify individuals. | Our legitimate interests in developing our products. |
| Keeping records, dealing with complaints and legal claims, and responding to requests from regulators, courts and law enforcement. | Compliance with legal obligations, and our legitimate interests in establishing, exercising and defending legal claims. |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that assessment.
If you do not provide information that we or our partners need to meet legal obligations, we will not be able to open an account or provide services to the business you represent.
Automated checks and decisions
We use automated tools to verify identity documents, carry out liveness checks, screen against sanctions and politically exposed persons lists, and calculate a risk score for each application. These tools flag results for review. Decisions to approve or refuse an application, or to request further information, are made by members of our compliance team, not solely by automated means.
International transfers
Our partners and some of our service providers are located, or process data, outside the United Kingdom, including in the European Economic Area and in other countries. Transfers to the European Economic Area are covered by the UK's adequacy regulations.
Where we transfer personal data to a country that is not recognised as providing an adequate level of protection, we use appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a recipient's certification under the UK Extension to the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.
How long we keep personal data
- Enquiries that do not lead to an account: up to 24 months after our last contact with you.
- Verification and due diligence records, including identity documents and screening results: 5 years after the end of the business relationship, or longer where the law or a regulator requires it. If an application is not approved, 5 years after the decision.
- Transaction records: 5 years after the transaction, or longer where the law requires it.
- Contracts, invoices and accounting records: 6 years after the end of the financial year to which they relate.
- Security and server logs: up to 12 months, unless needed to investigate an incident.
When personal data is no longer needed, we delete it or anonymise it so that it can no longer identify you.
How we protect personal data
We use technical and organisational measures appropriate to the risk, such as encryption in transit, restricted and role-based access, access logging, and confidentiality obligations for our staff and service providers. No system is completely secure, but we work to protect your data and will notify you and the regulator of a personal data breach where the law requires.
Your rights
Depending on the circumstances, you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased;
- restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a structured, machine-readable format and have it sent to another organisation; and
- withdraw your consent at any time where we rely on consent, without affecting processing before the withdrawal.
To exercise your rights, contact us at [email protected]. We may need to verify your identity first. We will reply within one month, which may be extended by two further months for complex requests.
Some rights are limited by law. For example, we cannot delete due diligence records that anti-money laundering laws require us to keep, and in some cases the law prevents us from telling you that a report has been made to the authorities.
You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. If you are in the European Economic Area, you can also complain to the data protection authority in your country. We would appreciate the chance to deal with your concerns first, so please contact us before approaching the regulator.
Children
The Website and Platform are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make significant changes, we will tell users of the Platform by email or in the Platform before the changes take effect.
Contact us
Flowgrid Ltd (trading as Payhit)Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
Company number 17474059, registered in England and Wales
[email protected]