Handepay's Privacy Policy
Handepay Ltd- General Privacy Notice
Handepay Limited is part of the PayPoint Group and is responsible for the merchant services you use. References to ‘Handepay’, ‘we’, ‘us’ and ‘our’ mean Handepay Limited unless stated otherwise. Handepay respects your privacy and is committed to protecting your personal data. Where a merchant is a sole trader or partnership, information about the business may also be personal information about the owner or partners. Please note that we process this information in a business context, regarding you as a merchant business and not as an individual. However, this policy applies whenever the information identifies or relates to an individual. Handepay Limited is the controller responsible for the personal information described in this Privacy Policy.
This policy explains what personal data we collect from visitors to our website and users of our services, why we collect it, how it is used, stored and protected, and the rights available to you. We encourage you to read it carefully so that you fully understand how we handle your personal data. This policy should be read alongside any other privacy policy or data protection information we provide in specific contexts, for example, when you make a purchase or register for a service. Where a separate policy applies, it will supplement this policy rather than replace it. Our website terms and conditions and cookie policy (accessible via the links in the footer of our website) also apply to your use of our website and should be read together with this policy.
Contents:
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
Sharing information outside the UK
Use of Artificial Intelligence
Contact details and complaints
Contact details
Telephone
Attention: Privacy Team
What information we collect, use, and why
1. PROVISION OR ARRANGEMENT OF SERVICES TO YOU
We collect or use all or some of the following information to provide services to you and/or arrange services for you. Where we arrange services for you, we will share some or all of the following information with the relevant third party service provider, but will only do so if we have received specific and informed consent from you first.
Names and business contact details
Business addresses
Bank information where we may need to set up a Direct Debit on your account in relation to the services
Credit reference information
Information relating to loyalty programmes
Website user information (including cookie tracking)
Call recordings
Identification documents (where necessary or requested by third parties when we arrange services for you)
Information relating to complaints
Information on your customers, where you have agreed to share this for the purpose of using or accessing a service provided to you. This will be limited to customer name and status on any transaction they have with you.
We may also collect or use (and share) the following special category information where you provide it, in order to ensure that any services provided or arranged for you are suitable given the information you shared.
Health information, such as any disability which may impact the way services are provided to you.
This information is sensitive and receives additional protection. We only use it where you have provided it to us, and we will not ask you for it unless necessary.
2. PREVENTION OR DETECTION OF CRIMES
We may also process the following information to assist relevant organisations with the prevention or detection of criminal activity:
Names and contact information
Customer or client accounts and records
Call recordings
Transaction information, where we are provided with this from a relevant third party for onward provision to you
3. PROVISION OF SERVICE UDATES AND MARKETING
We collect or use the following information to provide you with relevant service updates and marketing communications, including in relation to the Handepay Loyalty Programme:
Names and contact details
Addresses
Marketing preferences
Website and app user journey information
Records of consent, where appropriate
We may also collect or use the following special category information in relation to service updates (in order to ensure we communicate with you in a way that supports any health information you have provided).
Health information, such as any disability which may impact the way services are provided to you
This information is sensitive and receives additional protection. We only use it where you have provided it to us, and we will not ask you for it unless necessary.
4. COMPLIANCE WITH LEGAL REQUIREMENTS
We collect or use the following information to comply with legal requirements:
Name
Contact information
Any other personal information required to comply with legal obligations.
5. CUSTOMER SUPPORT AND COMPLAINT HANDLING
We collect or use the following personal information for dealing with queries and complaints:
Names and contact details
Address
Service history
Call recordings
Relevant information from previous investigations
Customer or client accounts and records
Financial transaction information (to the extent and detail provided to us from your third party provider in relation to services we have organised for you)
Correspondence
Health information - This information is sensitive and receives additional protection. We only use it where you have provided it to us, and we will not ask you for it unless necessary.
We may also collect or use the following special category information in relation to service updates, in order to ensure we communicate with you in a way that supports any health information you have provided.
Our lawful bases for the collection and use of your data
Under UK data protection law, we must have a lawful basis for collecting and using your personal information. The lawful bases we rely on in this privacy policy are explained below. Where a processing purpose refers to one of these lawful bases, it has the meaning set out in this section. Our lawful basis for collecting or using your personal information is detailed below:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we (or a third party) can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests: processing is necessary for the legitimate interests of Handepay in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our legitimate interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
1. PROVISION OR ARRANGEMENT OF SERVICES
Consent
Contract
2. PREVENTION OR DETECTION OF CRIMES
Legal obligation
3. PROVISION OF SERVICE UDATES AND MARKETING
Consent
Contract
4. COMPLIANCE WITH LEGAL REQUIREMENTS
Legal obligation
5. CUSTOMER SUPPORT AND COMPLAINT HANDLING
Contract
Where we get personal information from
Directly from you
Credit reference agencies
Providers of marketing lists and other personal information
Suppliers and service providers
How long we keep information
We hold information for a period of 7 years after the end of any contract for services that you have entered into by or through us, in accordance with our retention policy. Our retention policy is updated from time to time to reflect changes in our obligations and legal duties. For more information on how long we store your personal information, or the criteria we use to determine this, please contact us using the details in this privacy policy.
Who we share information with
We may also share your personal information with the following parties:
Financial or fraud investigation authorities
Relevant regulatory authorities
Organisations we’re legally obliged to share personal information with
Debt collection agencies
Suppliers and service providers (including those based outside the EEA)
Other relevant third parties:
Third parties for whom you have given us specific informed consent to share data with, for example, for the provision of products and services by them directly to you.
Credit reference agencies in relation to any credit agreement you enter into through us.
We may share your personal information with other companies within the PayPoint Group where this is necessary:
to provide, administer and support the products and services you use;
to manage our relationship with you and your business;
to prevent fraud, manage risk, comply with legal and regulatory obligations and protect our legal rights;
to improve, develop and market products and services; and
to identify other products or services offered by members of our group that may be relevant to your business.
We will only share personal information within our group where there is a legitimate business need and a lawful basis for doing so, and all group companies are required to handle personal information in accordance with applicable data protection laws.
Sharing information outside the UK
In order to provide certain services or support to you, we may implement cloud-based data storage or other similar technology outside of the UK or use service providers located outside of the UK. These services may include operational, technical and administrative support that is based outside of the UK. Any transfer of personal information outside of the UK shall not be permitted without the appropriate or suitable safeguards to provide an adequate level of protection such as are required under UK GDPR in order to ensure that the level of protection of natural persons guaranteed by UK GDPR is not undermined.
For further information or to obtain a copy of the appropriate safeguards for any of the transfers below, please contact us using the contact information provided in this privacy notice.
Use of Artificial Intelligence
We may use artificial intelligence ("AI"), machine learning and automated technologies to support our business operations and the delivery of our services. For example, our employees may use AI-powered tools to help retrieve information, review and draft documents, analyse data, and prepare summaries.
Where these tools process personal data, we will only do so where we have a lawful basis for the processing and have implemented appropriate technical and organisational security measures to protect that data.
Access to personal data by AI tools is restricted to secure, closed systems operated within the PayPoint Group and approved service providers.
We do not use solely automated decision-making to make decisions relating to you. If this changes, we will notify you in accordance with applicable law.
Your data subject rights
Under the Data Protection Act 2018, you have rights as an individual which you can exercise in relation to your personal data:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
Your right to complain – You have the right to complain about our use of your personal data. Read more about the right to complain.
If you make a request, we must respond to you without undue delay and in any event within one month (30 days for a complaint).
To make a data subject access request, please contact us using the contact details in this privacy policy.
Contact details and complaints
If you want to request information about our privacy policies, exercise a data subject right or make a complaint, you can e-mail us at [email protected] or write to us at:
Data Protection Officer - PayPoint Group
1 The Boulevard
Shire Park
Welwyn Garden City
Hertfordshire
AL7 1EL
If you are not happy with our response to any query or wish to complain you may also contact the Information Commissioner’s Office, which is an independent supervisory authority for data protection in the UK via ico.org.uk/concerns.
We may update this Privacy Policy from time to time and in particular as the legal environment in relation to your information changes.
Revised: October 2026 (v2)
Would you like
a callback?
FIND OUT MORE
Talk to an advisor today...