Contents
- Who we are
- Information we collect
- How we obtain information
- How we use information
- Our lawful bases
- Information required for an application
- KYC and identity verification
- Bank statements and financial information
- Credit Reference Agencies
- Fraud prevention and financial crime
- Debt recovery
- Who we share information with
- International transfers
- How long we keep information
- Data security
- Your data-protection rights
- Automated decision-making and profiling
- Telephone calls and communications
- Marketing
- Cookies
- Third-party websites and services
- Children
- Corporate transactions
- Changes to this notice
- Complaints
- Contact us
1. Who we are
ZozuPay is the trading name of ZOZU PAY LIMITED T/a ZozuPay ("ZozuPay", "we", "us" or "our").
Our registered office address and company registration number will be added to this Privacy Notice once the company has been formally registered and those details are available.
For data-protection purposes, ZozuPay will generally act as the data controller for the personal information described in this Privacy Notice, unless we state otherwise.
Email: privacy@zozupay.co.uk
2. Information we collect
Depending on how you interact with ZozuPay and the stage of your application, we may collect the following information.
Information you provide directly
- first name and last name;
- telephone number and email address;
- business name;
- monthly card sales or other business revenue information;
- funding requirement and requested funding period;
- application, request and verification references;
- documents and information you provide;
- communications, correspondence, feedback and complaints;
- information relating to your business, directors, partners, owners and beneficial owners where relevant; and
- information required to administer any funding facility you receive.
Identity and compliance information
Where necessary for an application or compliance process, we may collect identity details, date of birth, residential or business address, identification-document information, ownership and control information, verification results and other information required to complete relevant checks.
Financial information
Depending on the application or funding facility, we may collect bank statements, transaction information, card-sales information, turnover, financial performance information, existing financial commitments, repayment information and other financial information relevant to assessing or administering funding.
Technical information
When you use our website or online services, we may process technical information such as IP address, browser type, device information, pages viewed, security information and information about how our website is used, subject to applicable cookie and privacy requirements.
3. How we obtain information
We may obtain personal information:
- directly from you;
- from your business or authorised representatives;
- from identity and KYC service providers;
- from bank-statement, Open Banking or financial-information service providers;
- from credit-reference agencies;
- from fraud-prevention agencies;
- from business-information providers;
- from professional advisers, introducers or business partners where lawful;
- from publicly available sources; and
- from other third parties where lawful and necessary for our services.
Where we obtain personal information from a source other than you, we will provide the privacy information required by applicable law within the relevant timeframe.
4. How we use your information
We may use personal information to:
- receive and administer funding enquiries and applications;
- verify your email address and contact details;
- verify identity and carry out KYC checks;
- assess funding requirements and eligibility;
- assess financial information and business performance;
- carry out credit, risk and affordability assessments where applicable;
- detect, prevent and investigate fraud and financial crime;
- communicate with you and request documents or information;
- provide, administer and manage funding facilities;
- process or administer payments and repayments where applicable;
- maintain business and transaction records;
- protect the security of our systems and services;
- handle complaints, disputes and legal claims;
- comply with legal and regulatory requirements;
- recover amounts properly due to us where applicable; and
- improve and develop our services.
5. Our lawful bases for processing
We will identify an appropriate lawful basis for each processing activity. The lawful basis may differ depending on the purpose and circumstances.
Steps at your request before entering into a contract
Where you ask us to assess a funding application or take steps towards providing funding, we may process information where necessary to take steps at your request before entering into a contract.
Contract
Where you enter into an agreement with us, we may process personal information where necessary to enter into or perform that agreement.
Legal obligation
We may process personal information where necessary to comply with a legal or regulatory obligation applicable to us.
Legitimate interests
Where appropriate, we may rely on legitimate interests, including operating and administering our business, managing business and financial risk, preventing fraud, maintaining information and system security, improving services, managing customer relationships, establishing or defending legal claims and enforcing agreements.
Where we rely on legitimate interests, we will consider whether the processing is necessary and balance our interests against your rights and freedoms.
Consent
Where consent is the appropriate lawful basis, we will request it clearly and separately for the relevant purpose. Consent will not be used as a blanket basis for processing information that can appropriately rely on another lawful basis.
6. Information required for an application
Some information is necessary for us to assess and administer your funding application. If you do not provide information that is necessary for a particular purpose, we may be unable to assess your application, complete required verification checks or provide the requested funding service.
Where information is required by law or under a contractual obligation, we will explain this where appropriate.
7. KYC and identity verification
As part of an application or compliance process, we may use specialist third-party service providers for identity, KYC, verification, fraud-prevention or related checks.
A provider may process information necessary to perform the relevant service, including identity details, identification documents, verification results and technical information.
Biometric verification
If an identity-verification provider uses biometric technology, such as facial comparison or another biometric recognition method, the provider may process biometric information for identity verification or fraud prevention.
Where such processing constitutes special-category biometric data under applicable data-protection law, ZozuPay and/or the relevant provider will identify and rely on an appropriate lawful basis and special-category condition before processing takes place.
We will provide additional information where required regarding biometric processing, including applicable rights and choices.
We may select or change service providers from time to time. We will only use such providers where their involvement is necessary and lawful for the relevant application, service, security, fraud-prevention or compliance purpose and where appropriate contractual and data-protection safeguards are in place.
8. Bank statements and financial information
We may ask you to provide bank statements or use a specialist third-party financial-information, bank-statement or Open Banking service provider to obtain information that you have authorised us to access.
Such information may be used to:
- verify information supplied in an application;
- understand business cash flow and financial performance;
- assess funding suitability;
- assess affordability or repayment capability where relevant;
- identify potentially fraudulent or unusual activity; and
- administer an existing funding arrangement.
We may use different service providers depending on the service required. Providers will only be used where their involvement is necessary for the relevant application, service, security, fraud-prevention or compliance purpose and appropriate safeguards are in place.
Where you connect a financial account through a third-party provider, you should also review that provider's privacy information before authorising access.
9. Credit Reference Agencies
Where relevant to the assessment or administration of a funding application or facility, we may obtain information from credit reference agencies ("CRAs").
We may provide information about you, your business and your application to CRAs and may use information obtained from them to assess identity, creditworthiness, affordability, fraud risk and other relevant risks associated with an application or funding facility.
CRAs may record searches made against your credit file. Information supplied to CRAs may be used by them and other organisations to assess applications for credit, manage accounts, prevent fraud and recover debts, subject to applicable law.
Where applicable, information about a funding facility and how it is managed may be reported to CRAs.
If an account is in default and we are legally entitled and required to report the relevant information, we may report information about the default to CRAs.
Further information about how a particular CRA uses personal information may be available from that CRA's own privacy notice.
10. Fraud prevention and financial crime
We may share information with fraud-prevention agencies and other organisations where necessary to prevent, detect and investigate fraud, money laundering, identity theft and other financial crime.
Where we receive information from fraud-prevention agencies or similar organisations, we may use that information when assessing applications, managing funding facilities, protecting our business and customers, preventing fraud and complying with legal or regulatory obligations.
If we identify information suggesting that inaccurate, misleading or fraudulent information has been provided, we may take appropriate action and may share relevant information with appropriate organisations where permitted or required by law.
11. Debt recovery
Where amounts become due under a funding agreement, we may use third-party service providers, including debt collection, tracing or legal service providers, where necessary to recover amounts properly due.
We may provide those organisations with information necessary to perform their services, subject to applicable data-protection law.
13. International transfers
Some of our technology or service providers may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will use an appropriate lawful transfer mechanism and safeguards required by applicable UK data-protection law. Depending on the circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful mechanism.
Where required, further information about relevant international transfers and safeguards will be made available through the relevant privacy information or on request.
14. How long we keep your information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting, reporting, fraud-prevention, dispute-resolution and record-keeping requirements.
Retention periods may differ depending on the type of information, the purpose for which it is used and whether you become a customer.
We will maintain and periodically review appropriate retention periods and will securely delete or otherwise dispose of personal information when it is no longer required, subject to applicable legal obligations.
15. Data security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, destruction, alteration, disclosure and other unlawful or unauthorised processing.
Access to personal information is restricted to people and organisations that need access for legitimate business, service, legal or regulatory purposes.
No method of transmitting or storing information electronically can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of information transmitted to or stored by us.
16. Your data-protection rights
Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have the right to:
- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request erasure of personal information;
- request restriction of processing;
- object to certain processing;
- request portability of certain personal information;
- withdraw consent where processing is based on consent; and
- object to direct marketing.
Not all rights apply in every circumstance. Information may sometimes need to be retained or processed because of a legal obligation or another applicable exemption.
17. Automated decision-making and profiling
We may use automated tools, rules, analytical systems or profiling to assist with application processing, fraud prevention, identity verification, risk assessment or analysis of financial information.
We will not state that a funding decision is solely automated unless that is how the relevant decision-making process actually operates.
If we make a decision solely by automated means that produces a legal or similarly significant effect on you, we will comply with the additional requirements that apply to such processing, including providing appropriate information and safeguards and, where required, giving you a means to request human intervention, express your view and challenge the decision.
18. Telephone calls and communications
We may retain records of communications with you, including emails, telephone communications, messages, documents and other correspondence, where necessary for customer service, application administration, quality assurance, security, dispute resolution, legal claims, regulatory compliance or record-keeping.
Where permitted by law and where applicable to our operations, telephone calls may be recorded or monitored for purposes including quality assurance, staff training, security, fraud prevention, dispute resolution, maintaining accurate records and compliance.
Where calls are recorded, we will retain recordings only for as long as necessary for the relevant purpose and in accordance with our applicable retention schedule.
19. Marketing
We may contact you about ZozuPay products or services where permitted by applicable law.
Where consent is required for electronic marketing, it will be obtained separately from the funding application and submission of an application will not be conditional on agreeing to receive marketing communications.
You can opt out of marketing communications at any time using the unsubscribe instructions in the relevant communication or by contacting us.
21. Third-party websites and services
Our website and communications may contain links to websites or services operated by third parties.
Third-party websites and services may have their own privacy notices and terms. We are not responsible for the privacy practices of third parties operating independently from us.
You should review the relevant third-party privacy information before providing information or authorising access to a third-party service.
22. Children
Our services are intended for businesses and individuals who are legally able to enter into the relevant arrangements.
We do not knowingly collect personal information from children for the purpose of providing business funding.
23. Corporate transactions
If ZozuPay sells, transfers or restructures all or part of its business or assets, personal information may be disclosed to prospective or actual purchasers, investors, professional advisers and other parties involved in the transaction where necessary and lawful.
Where appropriate, information will continue to be protected under applicable data-protection requirements following the transaction.
24. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, technology, data-processing activities, service providers, legal requirements or regulatory guidance.
The latest version will be published on our website and will show the relevant "Last updated" date.
Where required, we will provide additional information or notice before introducing a new use of personal information that requires it.
25. Complaints
If you have concerns about how we use your personal information, we encourage you to contact us first so that we can investigate and try to resolve your concern.
Email: privacy@zozupay.co.uk
You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO).
26. Contact us
If you have a question about this Privacy Notice, want to exercise a data-protection right, or have a concern about how we process your personal information, please contact:
Registered office: [To be added after company registration]
Company number: [To be added after company registration]
Privacy email: privacy@zozupay.co.uk
We may need to verify your identity before responding to certain requests involving personal information.