1. Who we are and when this notice applies
Valtura Payments Group Limited (“Valtura”, “we”, “us”), company number 16319763, of 129 North Hill, Plymouth, Devon, England, PL4 8JY, is controller for personal data used for our website, account administration, billing, security, support, marketing and business operations.
When an ISO or other Platform subscriber uploads merchant, staff or business-contact personal data and tells us how to process it, that subscriber is normally controller and Valtura is processor. The Data Processing Addendum in the applicable Platform agreement governs that processing.
2. Personal data we collect
- Names, work contact details, job roles, company and account details.
- Login, device, browser, IP, security, audit and usage records.
- Billing contacts, Direct Debit mandate status, invoice and payment records. GoCardless handles the bank details entered in its hosted mandate flow.
- Support messages, feedback, enquiries, call or meeting details and communication preferences.
- Campaign source, website interactions and cookie or analytics data where permitted.
- Customer Data a subscriber chooses to place in the Platform, which may include merchant contacts, proposals, residual and payaway information, documents and correspondence.
If we receive business contact data from a colleague, employer, subscriber, public business source, integration or referral partner rather than directly from you, we use it only for the relevant business purpose and provide privacy information where required.
3. Purposes and lawful bases
- Contract: create and administer accounts, provide the Platform, support users, invoice and collect payment.
- Legitimate interests: secure and improve the service, prevent fraud, keep business records, respond to business enquiries, understand product use and communicate relevant B2B services. We balance these interests against individual rights.
- Legal obligation: tax, accounting, fraud prevention, data-protection requests, regulatory and law-enforcement duties.
- Consent: non-essential cookies and any communication or activity where consent is the appropriate basis. Consent may be withdrawn at any time.
Where data is required to create or secure an account, form the contract, set up payment or meet a legal obligation, failure to provide it may mean we cannot provide the relevant service.
4. AI-assisted features and automated decisions
If a subscriber uses an AI-assisted knowledge, analysis, drafting or document-generation feature, the relevant prompt and permitted Platform context may be sent to the AI provider named on our sub-processor list. Outputs may be inaccurate and must be reviewed by an authorised user. Valtura does not use these features to make solely automated decisions that produce legal or similarly significant effects about individuals.
5. Recipients, sub-processors and international transfers
We do not sell personal data. We disclose it only where needed to service providers, professional advisers, group or transaction counterparties under appropriate confidentiality, a subscriber as controller, or public authorities where legally required. Current and conditional Platform providers are listed at /subprocessors.
Where personal data is transferred outside the UK, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, together with supplementary measures where appropriate.
6. Retention
- Active account and Customer Data: for the service term and as instructed under the Platform agreement and DPA.
- Expired trial or terminated workspace: up to 90 days for recovery and export, then deleted or anonymised from active systems; protected backup copies expire through the ordinary backup lifecycle.
- Contracts, acceptance, invoices and payment records: normally six years after the relevant relationship or financial period, or longer where law or a dispute requires.
- Security and audit records: for the period reasonably needed to investigate incidents, evidence account actions and meet legal duties.
- Unsuccessful enquiries and marketing records: only while relevant to the relationship, suppression choice or a legal claim.
7. Security
We use proportionate technical and organisational measures including role-based access, authentication controls, encryption in transit, backups, monitoring, vulnerability and incident-management processes. No internet service can guarantee absolute security.
8. Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or object to processing based on legitimate interests or direct marketing. You may withdraw consent without affecting earlier lawful processing. We may need to verify identity and may lawfully refuse or limit a request in some cases.
Send requests to platform@valturaplatform.co.uk. If Valtura holds the data only as processor, we will refer the request to or assist the relevant subscriber controller.
9. Complaints
You can complain to us at platform@valturaplatform.co.uk. We will acknowledge a data-protection complaint within 30 days, investigate it and respond with the outcome without undue delay. You may also complain at any time to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
10. Cookies, marketing and changes
Essential cookies operate the site and secure sessions. Non-essential analytics or advertising cookies are used only in accordance with the choices shown in our cookie controls. You may object to direct marketing at any time by using an unsubscribe link or emailing us.
We will update this notice when our processing changes materially and show a fixed effective date. Where appropriate, we will also notify account administrators.