Our services in the UK including the issuance of electronic money and the provision of payment services are suspended with immediate effect until further notice.

Click here >

General Terms and Conditions

Paywiser Limited is a private company incorporated in England and Wales under the Companies Act 2006 (Company No.: 10677553) with a registered office at Timsons Business Centre, Bath Road, Kettering, Northamptonshire, NN16 8NQ, United Kingdom. Paywiser Limited is regulated and authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011 (FRN: 901086) as an electronic money institution (“EMI”).

Please read these Terms and Conditions carefully before using the www.paywiser.uk website (the “Website”) or accessing any of the services offered by Paywiser Limited (“we”, “us”, or “our”). By accessing or using the Website or our services, you agree to be bound by these Terms. If you do not agree with any part of these Terms, you should not use our Website or services.

Governing Law

These Terms shall be governed by and construed in accordance with the laws of England and Wales, without regard to conflict of law principles.

Failure by Paywiser Limited to enforce any provision of these Terms shall not constitute a waiver of those rights. If any provision of these Terms is found to be invalid or unenforceable by a competent court, the remaining provisions shall continue in full effect. These Terms constitute the entire agreement between you and Paywiser regarding the Website and services and supersede any prior agreements.

Copyrights

All content on this Website, including downloadable files, is protected by copyright. You may not reproduce, distribute, modify, or publicly display any content from this Website without prior written permission from Paywiser Limited.

Changes to Terms

We reserve the right to amend, modify, or replace these Terms at any time at our sole discretion. Changes will be posted on the Website. It is your responsibility to review the Terms periodically. By continuing to use the Website or our services after such changes, you accept and agree to the updated Terms. If you do not agree with any changes, you should cease using the Website or services immediately.

No Warranty

The Website and our services are provided on an “as is” basis without any representations or warranties, whether express or implied.

While we aim to maintain a high standard of service, Paywiser Limited does not guarantee that the Website will be uninterrupted, secure, or free from errors. We do not warrant that information on the Website is complete, accurate, or up to date.

To the maximum extent permitted by law, Paywiser Limited shall not be liable for any damages arising from your use of, or reliance on, the Website or services. Nothing on this Website constitutes financial, legal, or professional advice.

Indemnity

You agree to indemnify and hold harmless Paywiser Limited and any Paywiser group companies from any losses, liabilities, costs, or expenses (including legal fees) arising from:

  1. Your breach of these Terms
  2. Your use of the Website or services in a manner inconsistent with these Terms
  3. Any claim by a third party relating to your actions or omissions in connection with the Website or services

Links to Third-Party Websites

The Website may contain links to third-party websites or services not owned or controlled by Paywiser Limited. We do not endorse or assume responsibility for the content, privacy policies, or practices of these third-party sites.

You acknowledge and agree that Paywiser Limited shall not be liable for any loss or damage caused or alleged to be caused by your use of or reliance on third-party websites or services. We recommend that you review the terms and privacy policies of any third-party sites you visit.

Last updated: Sept 2025

arrow_drop_up back to top of the page

PAYWISER LIMITED

UK Data Protection Policy

1. Introduction

Paywiser Limited is a company incorporated in England and Wales, company number 10677553 (the “Company”). The Company is fully committed to data protection, privacy, and the safeguarding of individuals’ personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We respect and protect the rights of all individuals, particularly their right to privacy and to the protection of personal data in the context of its collection, processing, storage, and use.

This Data Protection Policy (“Policy”) has been approved by the Board of Directors of the Company. The Company’s Data Protection Officer (DPO) is responsible for ensuring compliance with this Policy and all applicable data protection laws, and for overseeing its enforcement across the organisation.

This Policy establishes the standards and procedures for processing personal data in a manner compliant with the UK GDPR and other applicable UK data protection legislation. It defines the requirements for all business processes that involve the collection, processing, or storage of personal data, and assigns clear responsibilities to ensure compliance.

The Company has a duty, as an employer and as a regulated UK electronic money institution (EMI), to manage the processing of employees’, customers’, suppliers’, partners’, and other stakeholders’ personal data responsibly and lawfully. All employees of the Company, when handling personal data in the course of their duties, are required to comply strictly with this Policy and with all instructions issued to ensure data protection compliance.

The principles set out in this Policy are based on UK data protection and privacy laws, reflecting the requirements of the UK GDPR, and are intended to apply to all staff members, contractors, and temporary personnel of the Company, and and cover all forms of processing of personal data, including but not limited to collection, storage, transfer, and use. Paywiser reserves the right, acting reasonably and in compliance with applicable data protection laws, to determine the appropriate lawful basis, safeguards, and internal procedures for the processing of personal data.

2. Definitions

  • Anonymous data & Anonymized data
    Anonymous and anonymized data is information that does not relate to an identifiable individual. Even if additional data or information were added, identification of the individual is not (or is no longer) possible. This Policy does not apply to such data.
  • Biometric data
    Personal data derived from specific technical processing relating to the physical, physiological, or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual (e.g., fingerprints or facial recognition data).
  • Consent
    Any freely given, specific, informed, and unambiguous indication of the individual’s wishes by which they signify agreement to the processing of personal data relating to them.
  • Controller
    Any natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. For the personal data of its employees, customers, suppliers, partners, or other individuals, Paywiser Limited is regarded as the controller.
  • Data concerning health
    Personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about that person’s health status.
  • Erasure
    The permanent destruction, deletion, or anonymisation of stored personal data such that re-identification of the individual is no longer possible.
  • Genetic data
    Personal data relating to the inherited or acquired genetic characteristics of an individual which provide unique information about their physiology or health, derived in particular from an analysis of a biological sample from the individual.
  • Personal Data
    Any information relating to an identified or identifiable individual (“data subject”). An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity. Personal data covered by this Policy includes data of employees, applicants, customers, suppliers, and users of the Company’s websites and services. Such data may be stored in the Company’s own systems, systems operated on behalf of the Company by third parties, or in customer-operated systems to which the Company has access for the purposes of support, consultancy, or service provision.
  • Processor
    A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. This may include external service providers or other Paywiser entities which act as processors rather than controllers.
  • Processing
    Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. Anonymisation of data is also considered processing for the purposes of this Policy.
  • Pseudonymization
    Processing of personal data such that the data can no longer be attributed to a specific individual without the use of additional information, which is kept separately and protected by technical and organisational measures to prevent re-identification. Pseudonymized data remains personal data under UK GDPR, and this Policy applies accordingly.
  • Special categories of personal data
    Personal data deemed particularly sensitive due to its nature, where processing is likely to result in significant risks to the rights and freedoms of individuals. This includes, but is not limited to, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, genetic data, biometric data used for unique identification, sex life or sexual orientation, criminal convictions and offences, and data subject to professional confidentiality obligations. Depending on context, this may also include financial data such as credit card, bank account, or national insurance numbers that could be misused for identity theft.
  • Third party
    Any natural or legal person, public authority, agency, or body other than:
    • the data subject;
    • the controller;
    • the processor; or
    • persons authorised to process personal data under the direct authority of the controller or processor.
  • Recipient
    Any natural or legal person, public authority, agency, or body to which personal data is disclosed, whether a third party or not. Public authorities receiving personal data under statutory or regulatory obligations shall not be considered recipients if the disclosure is required by law.

3. Principles for Protecting Personal Data

Personal data shall only be processed lawfully and in accordance with the principles set out below.

Lawfulness, Fairness, and Transparency

Personal data may only be processed lawfully, fairly, and in a transparent manner in relation to the data subject. This applies when processing is legally permitted in the specific case. Under UK GDPR, lawful processing includes, among others, cases where processing is:

  • necessary for the performance of a contract to which the data subject is a party (e.g., storing and using personal data required for employment or service contracts);
  • necessary to take steps at the request of the data subject prior to entering a contract (e.g., a customer requests information about a financial product and then enters into an agreement);
  • necessary to comply with a legal obligation, including obligations under UK financial, tax, or social security laws;
  • necessary to protect the vital interests of the data subject or another natural person;
  • necessary for the legitimate interests pursued by the controller or a third party, provided these interests are not overridden by the rights and freedoms of the data subject (e.g., for direct marketing where permitted);
  • necessary for decisions based on automated processing in an individual case that produces legal effects concerning the data subject, where permitted under UK law, required for contractual performance, or based on explicit consent; or
  • based on the explicit consent of the data subject (e.g., subscribing to newsletters or registering on a website).

Personal data should generally be collected directly from the data subject. Where this is not possible, the data subject must be informed, including the types of personal data collected, how it will be processed and used, and the purposes of such processing.

Specific Purpose

Personal data may only be collected for specific, explicit purposes and must not be processed in ways incompatible with those purposes.

Purposes must be defined prior to data collection. Processing for purposes other than those initially defined is only allowed in exceptional cases, where permitted by law or based on the data subject’s explicit consent.

When assessing compatibility with the original purpose, the Company shall consider the data subject’s reasonable expectations, the type of data involved, potential impacts on the data subject, and any safeguards such as encryption or pseudonymization.

Data Minimisation

Personal data shall only be collected to the extent necessary to fulfil the defined purpose. Processing must be adequate, relevant, and limited to what is strictly necessary for the intended purpose.

Accuracy

Personal data must be accurate and kept up to date. All reasonable steps must be taken to correct or erase inaccurate data without delay. Systems and processes must provide options for rectification and updating of data by the data subject where applicable.

Storage Limitation (Obligation to Erase)

Personal data may only be stored as long as necessary for the purposes of processing or to comply with statutory retention obligations. Once storage is no longer required, personal data must be securely erased or anonymized. Systems must provide for timely deletion or blocking of data, in accordance with UK law.

Integrity, Availability, and Confidentiality

Personal data and processing operations must be appropriately protected through technical and organisational measures. This includes safeguarding against unauthorized or unlawful processing, accidental loss, destruction, damage, disclosure, or access.

Processing of Special Categories of Personal Data

Processing of special categories of personal data (e.g., health data, biometric or genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation) must always be transparent to the data subject.

Unless explicitly authorised by law, special categories of personal data shall only be processed with the prior, explicit consent of the data subject. The consent must specifically cover the categories of data and the purposes for processing. Enhanced protective measures, such as physical security, access restrictions, and encryption, must be implemented to safeguard such data.

4. Rights of Data Subjects

Right to be Informed

Data subjects have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under UK GDPR. The Company must provide data subjects with clear information including: the purposes for processing their personal data, retention periods for that personal data, who it will be shared with, and any other relevant information as required under UK law.

Right of Access and Data Portability

Data subjects have the right to obtain confirmation from the Company as to whether personal data concerning them is being processed. Where processing occurs, the Company shall provide access in accordance with UK GDPR. Information is typically provided in writing, unless the data subject submits the request electronically.

Information to be provided must include the purpose of processing, recipients of the data, categories of personal data, retention periods, and other legally required details under Article 15 UK GDPR. Data subjects must be provided with a copy of the personal data being processed. Upon request, data subjects are entitled to receive their personal data in a structured, commonly used, and machine-readable format to enable portability.

Right to Rectification, Restriction, and Erasure

When personal data is inaccurate, incomplete, or outdated, data subjects have the right to request rectification. For example, this may occur if a data subject changes their name due to marriage.

Data subjects also have the right to restrict processing where one of the following applies:

  • Accuracy of the personal data is contested, and verification is ongoing; restriction applies until verification is complete.
  • Processing is unlawful, and the data subject opposes erasure while requesting restriction instead.
  • The Company no longer needs the personal data for processing purposes, but the data is required by the data subject for legal claims; data subjects must be notified if erasure is pending.
  • The data subject has objected to processing while the Company evaluates whether its legitimate interests override the data subject’s rights.

During restriction, personal data must be marked to limit access and further processing.

Data subjects also have the right to erasure in the following situations:

  • The purpose of data processing no longer applies.
  • Consent is withdrawn for a specific processing purpose.
  • Address or contact data is used for direct marketing purposes and the data subject objects.
  • Data is processed unlawfully.
  • Erasure is necessary to comply with legal obligations.

Right to Object

Data subjects have the right to object to processing based on the Company’s legitimate interests, where their own rights or interests outweigh those interests.

Data subjects may also object to processing for direct marketing purposes, including profiling related to direct marketing, at any time and without providing reasons. If an objection is raised, the Company must cease processing for those purposes, unless compelling legitimate grounds exist (e.g., legal claims, regulatory obligations).

Right to Complain

Data subjects may file a complaint regarding the processing of their personal data directly via e-mail to the Data Protection Officer: [email protected].

The Company must notify the data subject of all measures taken in response to their request or complaint within one month, in accordance with UK GDPR requirements.

5. Data Protection Governance Structure

Responsibility for compliance with data protection requirements rests with the Board of Directors of the Company, who oversee all processing of personal data for business purposes in accordance with UK GDPR.

The Board may delegate specific tasks and operational responsibilities for ensuring compliance to executive management and managers at various levels within the Company’s organisational framework. Delegation must be documented, with clear accountability, to ensure that each business process handling personal data adheres to the requirements of this Policy.

6. Responsibilities for Data Protection Compliance

Management of Paywiser

The Board of Directors of the Company is ultimately responsible for ensuring that all processes under their areas of oversight, in which personal data is processed (hereinafter referred to as “processes”), fully comply with the requirements of this Policy, UK GDPR, the Data Protection Act 2018.

Employees

All employees of Paywiser Limited are required to handle any personal data they access in the course of performing their duties with strict confidentiality. Employees must not collect, process, or use personal data without proper authorisation.

Employees are only permitted to process personal data to the extent necessary to fulfil their defined duties as set out in their employment contracts. If an employee is unsure whether a particular processing activity is authorised, they may assume the instructions of their manager are lawful, provided that no obvious prohibition exists.

7. Transfer/Commissioned Data Processing

If personal data is to be transferred to an associated company or a third-party service provider, a review must first be conducted to determine whether appropriate contractual agreements regarding data protection and privacy are required. Such a review is mandatory when the associated company or external service provider is processing personal data on behalf of the Company (hereinafter referred to as a “transfer for processing purposes”).

Where personal data is to be transferred to a country outside the United Kingdom, it must first be ensured that an adequate level of protection is guaranteed, in accordance with the UK GDPR and the Data Protection Act 2018. This includes:

  • Verification that the receiving entity applies equivalent technical and organisational measures to protect personal data;
  • Execution of standard contractual clauses or other approved mechanisms under UK law;
  • Documenting the rationale for transfer and measures taken to safeguard data.

Transfer for commissioned processing:

When the Company commissions an associated entity or an external service provider to process personal data on its behalf, the Company remains responsible for ensuring that the processing complies with all applicable UK data protection. This includes:

  • Monitoring the compliance of the processor with contractual obligations;
  • Conducting due diligence and risk assessments prior to engagement;
  • Ensuring that any subcontracting by the processor is subject to prior approval and equivalent contractual safeguards.

Transfer for the recipients’ own purposes:

The Company may transfer personal data to an associated company or external entity for their own purposes only if:

  • Such transfer is expressly permitted or required by law; or
  • The data subjects have provided explicit consent for the transfer and processing; or
  • The transfer is necessary for the performance of a contract to which the data subject is a party.

All transfers must be documented, with clear accountability maintained for ensuring compliance with UK GDPR principles.

8. Transfer of Customer Data

The Company processes personal data of customers both for its own purposes and on behalf of customers in the course of providing electronic money and payment services. Any use, sharing, or transfer of such customer data must comply with:

  • The UK GDPR and the Data Protection Act 2018;
  • The requirements under the Financial Conduct Authority (FCA) rules applicable to Electronic Money Institutions (EMIs); and
  • Any contractual obligations agreed with the customer regarding the handling, storage, and transfer of personal data.

Where customer data is to be transferred to an associated company or a third-party service provider, the Company must ensure:

  • The recipient has implemented adequate technical and organisational measures to protect the data;
  • Transfers outside the United Kingdom are subject to appropriate safeguards (e.g., standard contractual clauses or other UK-approved mechanisms);
  • Documentation of the transfer, including the purpose, legal basis, and measures taken to protect the data, is maintained.

Customer data may only be used or transferred for purposes explicitly agreed with the customer or otherwise permitted by law. In cases where the customer has provided consent, the Company must ensure that the consent is informed, explicit, and specific, and that the customer is able to withdraw it at any time.

Last updated: Sept 2025

arrow_drop_up back to top of the page
arrow_drop_up