How we handle your information.

01Who we are

RimonPay is the trading name under which we provide merchant account introductions. [The legal entity behind RimonPay — its jurisdiction, company number and registered office — will be inserted here before launch.]

RimonPay is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are responsible for looking after it.

You can reach us about anything in this policy at sales@rimonpay.com or by post at [postal address]. [State whether you have appointed a Data Protection Officer or a privacy contact, and give their details — or confirm that you have not and are not required to. Consider a dedicated privacy@rimonpay.com address for data protection matters.]

[Confirm your ICO registration number and that the applicable data protection fee is paid. Most UK controllers that process personal data electronically must register with the ICO and pay an annual fee.]

02What this policy covers

This policy covers how we handle personal data when you:

• visit rimonpay.com;
• make an enquiry through our enquiry form;
• register a RimonPay account;
• complete a merchant application, including information about your directors and beneficial owners;
• upload documents to us; or
• contact us by email, telephone or any other means.

What this policy does not cover. RimonPay is an introducer, not an acquirer. Once we introduce your file to an acquirer, that acquirer processes your information as its own separate controller. It will give you its own privacy notice, and you should read it before you sign any merchant agreement. We do not control what an acquirer does with your data after it receives your file.

03The personal data we collect

We collect the following categories of personal data:

We do not ask for special category data (such as health, racial or ethnic origin, religious beliefs, political opinions or trade union membership) and you should not send it to us. If a document you upload happens to contain it, we will only process it as necessary for the purposes in section 5.

04Where we get it from

• From you, when you complete a form, upload a document or speak to us.
• From your business and its representatives, where a colleague or adviser provides information about you.
• From verification and screening providers, including company registries, identity verification services, and sanctions, politically exposed person (PEP) and adverse media screening providers.
• From acquirers, in the course of an introduction.
• Automatically from your device, when you use our website.

Where you give us information about another person — for example a co-director or a beneficial owner — you must make sure they have seen this policy and understand how their information will be used.

05Why we use it, and our lawful basis

We must have a lawful basis under the UK GDPR for everything we do with your personal data. These are ours:

Where we rely on legitimate interests, we have carried out a balancing assessment to make sure our interests do not override your rights. You can object to that processing at any time — see section 10. Where we rely on your consent, you can withdraw it at any time, and withdrawal does not affect anything we lawfully did before you withdrew.

06Who we share it with

We do not sell your personal data. We share it only with:

• Acquirers you have agreed we may approach. This is the point of the service — your file cannot be underwritten otherwise. You choose which acquirers we contact.
• Verification and screening providers — company registry checks, identity verification, sanctions, PEP and adverse media screening, and fraud prevention.
• Technology and storage providers — hosting, document storage and email, acting as our processors under written contracts that require them to protect your data and act only on our instructions.
• Professional advisers — our lawyers, accountants, auditors and insurers, where necessary.
• Regulators, law enforcement, courts and public authorities, where we are required by law to disclose, or where it is necessary to prevent or detect crime.
• A buyer or successor, if our business or assets are sold, restructured or merged. The recipient would be bound by this policy until it adopts its own.

[List your actual named processors and their roles, or state that a current list is available on request. Also confirm any intra-group sharing, including whether information is shared with any parent, subsidiary or affiliate.]

07Sending personal data outside the UK

Some of our service providers may store or process personal data outside the UK. Where we transfer personal data to a country that does not benefit from UK adequacy regulations, we put a lawful safeguard in place before the transfer. Depending on the provider and the country, we rely on:

• UK adequacy regulations (sometimes called “data bridges”), where the country is recognised as providing adequate protection;
• the UK International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses;
• another mechanism permitted by the UK GDPR, such as an applicable derogation.

Where required, we carry out a transfer risk assessment before the transfer. The UK’s test, as amended by the Data (Use and Access) Act 2025, is whether the protection offered in the destination is not materially lower than the protection offered in the UK. You can ask us for a copy of the safeguards we rely on by contacting us at sales@rimonpay.com.

[Confirm the countries in which your processors and acquirers store or access data, and the specific safeguard used for each. If all processing stays in the UK, say so plainly here instead.]

08How long we keep it

We keep personal data only as long as we need it for the purposes in section 5, plus any period we are required to keep it by law. Retention periods are set by reference to our legal and regulatory obligations — including anti-money-laundering record-keeping — and to the limitation periods for legal claims.

When a retention period ends, we securely delete or anonymise the data. Where data has been passed to an acquirer, that acquirer keeps it under its own retention policy — we cannot delete it from their systems.

09How we keep it secure

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include:

• encryption in transit using TLS, and encryption at rest for stored documents;
• access limited to the people who need it to do their job, on a least-privilege basis;
• written contracts with every processor, requiring confidentiality and appropriate security;
• procedures to detect, investigate and report a personal data breach, including notifying the ICO within 72 hours where a breach is reportable and telling you where it is likely to result in a high risk to your rights.

[Confirm these controls reflect what you actually operate, and add any certifications, penetration testing cadence or accreditations you hold.]

10Your rights

Under the UK GDPR you have the following rights:

• The right to be informed — about how we use your data, which is what this policy does.
• The right of access — to receive a copy of the personal data we hold about you and certain other information.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure — to have your data deleted where there is no good reason for us to keep it.
• The right to restrict processing — to limit how we use your data while a concern is resolved.
• The right to data portability — to receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
• The right to object — to processing based on legitimate interests, and to direct marketing at any time.
• The right to withdraw consent — at any time, where we rely on consent.
• Rights relating to automated decision-making — see section 13.

These rights are not absolute. For example, we may not be able to delete information we must keep to comply with the law, or to establish, exercise or defend legal claims. If we cannot do what you have asked, we will explain why.

To exercise any of these rights, contact us at sales@rimonpay.com. We will respond within one month. If your request is complex we may extend that by up to two further months and will tell you if we do. We may ask you to confirm your identity, and where we reasonably need more information to find what you have asked for, we may ask you for it and pause the response clock until you reply.

11How to make a complaint

If you are unhappy with how we have handled your personal data, please tell us first — we would like the chance to put it right.

• Email sales@rimonpay.com, or write to us at [postal address].
• Or use our data protection complaints form at [link to complaints form]. We are required by the Data (Use and Access) Act 2025 to make it easy for you to complain, including by offering an electronic form.

We will acknowledge your complaint within 30 days of receiving it, and respond to it without undue delay. We will tell you the outcome and explain what we have done.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office:

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You can complain to the ICO at any time, and you do not have to come to us first.

12Cookies and similar technologies

Our website uses storage and access technologies, such as cookies, for these purposes:

• Strictly necessary — to make the site work, keep a form session secure and remember your choices. These do not require consent.
• Statistics and functionality — to understand how the site is used and improve it. Where we rely on these without asking for consent, we do so under the exemption introduced by the Data (Use and Access) Act 2025 and we give you a clear way to opt out.
• We do not use advertising or cross-site tracking cookies, and we do not sell data collected through cookies.

[Add your cookie table here — cookie name, provider, purpose, type and duration — and link to your cookie settings control. This must match the technologies your live site actually sets.]

13Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects about you. Verification and screening tools may flag a possible match, but a human reviews any flag before it affects your application, and you can ask us to explain any such decision, make representations about it, and obtain human intervention.

[Confirm this remains true once your screening providers are live. If any provider makes an automated decision, this section and the safeguards you offer must be updated.]

14Changes to this policy

We may update this policy from time to time, for example if we change our providers or the law changes. We will change the version number and the “last updated” date at the top, and where a change is material we will tell you directly before it takes effect.

15Contact us

For anything to do with this policy or your personal data:

• Email: sales@rimonpay.com
• Post: [postal address]
• Company: RimonPay

This policy was last updated on 2 October 2026. It applies to rimonpay.com and to all RimonPay services.