Privacy notice

Who we are, and our role

In this notice, “we” is Pleezpay and “you” is the person whose information it is. We decide how your information is handled when it reaches us through this website, a sales call, a broker or partnership enquiry, or the day-to-day running of our company. Questions about it go to [email protected].

Payment and shopper data is different. There, the business we work for normally sets the purpose and the method, which makes it the controller (in some US laws, the “business”). We handle that data on its instructions as its processor (the “service provider”), under our customer agreement and the data processing terms attached to it.

Where the information comes from

We hold five kinds of information, grouped here by source.

• What you tell us about yourself. Your name and job title, your company and its website, your work email, and the countries you sell in.
• What you share about the company. Volumes, the providers you work with now, the features you are after, ideas for a partnership, and the messages we exchange.
• What your browser sends. IP address, browser and device type, which pages were requested and when, security log entries, and the cookie choice you made.
• What customer accounts generate. For customers and the users they authorise: metadata about credentials, settings, payment events, webhook deliveries, support tickets and the audit trail.
• What others pass to us. Details from public company registers, payment providers, partners or our own vendors, when they are allowed to share them.

Our enquiry forms are not the place for card numbers, bank logins, passport or tax numbers, or other sensitive personal data. Leave those out.

What we use it for

• Replying to you, showing you the product, weighing up a partnership and preparing a contract.
• Running the platform and its documentation: keeping it secure, supporting it, fixing it and making it better.
• Signing users in, stopping abuse, keeping an audit trail and protecting our systems and our customers.
• Managing our relationships with customers and partners, invoicing, compliance enquiries and our own legal duties.
• Counting how this website is used, through analytics, but only once you agree. Until then, no analytics code runs.
• Bringing, pursuing or answering legal claims, and enforcing our contracts.

The legal ground depends on the use and on which law governs it. It is one of: your consent; steps you asked us to take before a contract; carrying out a contract; meeting a legal obligation; or a legitimate interest, such as operating a secure service for other businesses.

Cookies and analytics

One necessary entry, kept in local storage on your device, records whether you accepted analytics. Analytics itself is optional and stays switched off unless you say yes; “Cookie choices” in the footer lets you change your mind whenever you like. The full list is in the Cookie notice.

Who receives it

• Companies that handle it on our behalf, such as infrastructure and hosting, email and messaging, analytics and security vendors, our professional advisers and other business-service suppliers.
• A connected payment provider, when a flow a customer has authorised can’t run without it.
• Public authorities or anyone else the law obliges us to disclose it to.
• A buyer, investor or merger partner, if we are part of a merger, financing, acquisition or asset sale, with proper safeguards in place.

Two things we never do: sell personal information for money, or share it for cross-context behavioural advertising. On our marketing pages, Google Tag Manager may load the analytics you consented to. The hosted payment page never loads it.

How long it stays

Each record is kept for as long as its original purpose reasonably needs, and no longer. What counts includes how long an enquiry or contract runs, what security and audit require, how long disputes can be raised and claims brought, our tax and accounting duties, and how often backups cycle. The period therefore varies with the kind of record and with the customer’s agreement. After that we delete the information or strip what identifies you, except where a law or a legal hold makes us keep it.

Where it is processed

Pleezpay is a US company, and some of the vendors we use work with data outside the United States. When a law restricts sending information abroad, we rely on a transfer mechanism that law recognises, or on another basis it allows for that particular relationship.

How we protect it

Our technical and organisational safeguards are chosen to fit the information and the service. They reduce risk; they can’t remove it, because no system is fully secure. Our Security page sets out what is in place today and where it stops.

What you can ask us to do

The rights you have depend on where you live. They can include asking us to:

• show you the information, or give you a copy of it;
• fix it, erase it or limit what we do with it;
• stop a use you object to;
• stop relying on a consent you gave earlier.

You can also complain to a data protection regulator. If you live in California, the law there may let you ask what we collect, use and disclose, and have it corrected or deleted, as far as that law applies. Exercising any of these rights won’t change how we treat you.

Email [email protected] to make a request. We may first check who you are and that you are entitled to ask. If the data is held on behalf of a business we work for, that business may be the one we pass your request to.

Children, and new versions

Pleezpay serves businesses. Nothing here is aimed at children, and we don’t knowingly gather children’s personal information through this site. When our services or the law move on, this notice may be revised; the “Last updated” date shows which version you are reading.