How we protect data internally.

01Scope and definitions

This policy applies to all personal data processed by RimonPay, in any format — electronic or paper — and to all personnel. “Personal data” means any information relating to an identified or identifiable individual. “Processing” means anything we do with it, including collecting, storing, sharing, deleting and reviewing it.

Where this policy refers to the UK GDPR, it means the UK GDPR as amended by the Data (Use and Access) Act 2025, whose main data protection provisions came into force on 5 February 2026.

02Policy statement

RimonPay is committed to protecting the personal data it holds, and to processing it lawfully, fairly and transparently. We collect only what we need, we are open about why we need it, we keep it only as long as necessary, and we protect it with appropriate security. Compliance with this policy is a condition of working for or with RimonPay.

03Roles and responsibilities

04The data protection principles

We process personal data in accordance with the principles in the UK GDPR. Personal data must be:

1. Processed lawfully, fairly and transparently — we have a lawful basis for everything we do, we tell people what we are doing, and we do not use data in ways they would not expect.
2. Collected for specified, explicit and legitimate purposes — and not used for anything incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary — we do not collect data “just in case”.
4. Accurate and kept up to date — we correct inaccurate data promptly, and the individual completing an application is responsible for telling us of changes.
5. Kept for no longer than necessary — retention periods are defined, documented and applied.
6. Processed securely — using appropriate technical and organisational measures against unauthorised access, loss, destruction or damage.
7. Accountable — we can demonstrate how we comply, which is what the records, assessments and reviews in this policy are for.

05Lawful basis

No personal data may be processed unless a lawful basis applies. Our bases are documented in the Data Privacy Policy and recorded against each processing activity in our record of processing. Where we rely on consent, it must be freely given, specific, informed and unambiguous, and we must be able to demonstrate it. Where we rely on legitimate interests, a balancing assessment must be recorded. Where we rely on a recognised legitimate interest introduced by the Data (Use and Access) Act 2025, we must still assess that the processing is necessary for the purpose pursued.

06Data protection by design and by default

Data protection is built into new projects, systems and processes from the start, not added afterwards. Before we introduce a new processing activity, a new provider or a material change to an existing one, we consider: what data is involved, what the lawful basis is, what the risks are, and what measures reduce them. Privacy settings default to the most protective option.

07Records of processing

We maintain a record of our processing activities covering: the purposes of processing, the categories of individuals and data, the recipients, any international transfers and their safeguards, the retention periods, and the security measures in place. The record is reviewed at least annually and whenever a processing activity changes.

08Data protection impact assessments

We carry out a Data Protection Impact Assessment before any processing that is likely to result in a high risk to individuals. This includes large-scale processing of sensitive data, systematic profiling, and the use of new technology. Where a DPIA identifies a high residual risk we cannot mitigate, we consult the ICO before proceeding.

09Sharing data and using processors

Personal data is shared only where there is a lawful basis and a documented need, and only with the categories of recipient described in our Data Privacy Policy. Where an application is submitted, the company applying and the individual completing it authorise us to share the application information with anyone we deem relevant to the application, as set out in our Terms of Use.

Every processor must be engaged under a written contract containing the terms required by Article 28 UK GDPR, including confidentiality, security, sub-processor controls, breach notification, assistance with rights requests, and deletion on termination. We do not transfer personal data internationally without an appropriate safeguard.

10International transfers

We may transfer personal data outside the UK only where a lawful transfer mechanism is in place: UK adequacy regulations, the UK International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or a permitted derogation. Where required, a transfer risk assessment is completed before the transfer, applying the test introduced by the Data (Use and Access) Act 2025 — whether protection in the destination is not materially lower than in the UK.

11Individual rights and requests

We uphold the rights set out in our Data Privacy Policy: access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making. Requests may be made to sales@rimonpay.com.

• We respond within one month of receipt, extendable by up to two further months for complex requests, with the individual told if we extend.
• We may ask for identification where we have reasonable doubts, and for further information where it is reasonably required to find what has been asked for — in which case the response clock is paused until the individual replies.
• Searches must be reasonable and proportionate. We record what we searched and why.
• We do not charge a fee unless a request is manifestly unfounded or excessive.

12Personal data breaches

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Anyone who becomes aware of a suspected breach must report it immediately to the data protection lead.

• We assess the breach, contain it, and record it in our breach log regardless of whether it is reportable.
• Where a breach is reportable, we notify the ICO within 72 hours of becoming aware of it.
• Where a breach is likely to result in a high risk to individuals, we tell those affected without undue delay, in clear language.
• Where a processor causes a breach, it must notify us without undue delay.

13Handling complaints

The Data (Use and Access) Act 2025 requires us to make it easy for people to complain about how we use their data, including by offering an electronic complaints form. We acknowledge complaints within 30 days of receipt and respond without undue delay, telling the individual the outcome. We keep a record of complaints and their outcomes. Individuals may also complain to the ICO at any time.

14Retention and disposal

Personal data is kept only for as long as necessary for the purposes it was collected for, plus any period required by law — including anti-money laundering and tax record-keeping obligations — and the limitation period for legal claims. Retention periods are set out in the Data Privacy Policy and applied automatically where systems allow. When a period ends, data is securely deleted or anonymised. Deletion of paper records is by secure destruction.

15Training and awareness

All personnel receive data protection training on joining and at least annually thereafter. Training covers the principles, lawful basis, handling rights requests, recognising and reporting a breach, and secure handling of documents. Completion is recorded.

16Monitoring, review and non-compliance

Compliance with this policy is monitored by the data protection lead, who reports to senior management at least annually on compliance, breaches, complaints, requests and risks. This policy is reviewed at least annually and whenever the law or our processing changes.

Failure to comply with this policy is a serious matter and may result in disciplinary action, termination of a contract, or, where the law has been broken, referral to the ICO or the police.

17Related documents

• Data Privacy Policy — our public notice
• Cookies Policy
• Anti-Money Laundering Policy
• Terms of Use

18Approval and contact

This policy is approved by senior management of RimonPay. Questions about it should go to the data protection lead at sales@rimonpay.com.