Privacy Policy
Last updated: 12 May 2026
Your privacy matters. This policy explains how Stored Payments Limited collects, uses and protects personal data when you interact with our website, register as a merchant, or use any of our products and services. We aim to be clear, fair and transparent about every step.
1. Introduction
This Privacy Policy applies to personal data we process about merchants, prospective merchants, website visitors, employees of business customers and end-cardholders whose data passes through our services. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you are a cardholder making a payment to one of our merchants, please remember that the merchant is the controller of your relationship with them; Stored acts as a processor on their behalf for that transaction.
2. Who we are
Stored Payments Limited is the data controller for personal data processed in connection with our services to merchants. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB987654.
Our registered office is at 4th Floor, 86–90 Paul Street, London EC2A 4NE. Our Data Protection Officer can be contacted at dpo@joinstored.com.
3. Information we collect
We collect different categories of personal data depending on how you interact with us:
Identity and contact data
Name, business name, job title, email address, postal address, phone number and date of birth (for directors and beneficial owners).
Financial and verification data
Bank account details (sort code and account number), trading history, business documentation, identification documents (passport, driving licence) and beneficial ownership information required by anti-money laundering rules.
Transaction data
Card transaction amount, currency, timestamp, terminal ID, MCC, transaction reference and limited cardholder data (truncated PAN and expiry). Stored does not store full card numbers; PCI-sensitive data is handled by our acquiring partners.
Technical and usage data
IP address, device identifiers, browser type and version, operating system, pages visited, referral source, and merchant portal activity logs.
Communications data
Records of your correspondence with our sales, support and compliance teams, including emails, call recordings and in-app chat transcripts.
4. How we use your information
We use personal data for the following purposes:
- To onboard you as a Stored merchant, including KYC, KYB and sanctions checks
- To provide, operate, maintain and improve our products and services
- To process card transactions and settle funds to your nominated account
- To prevent fraud, money laundering and other financial crime
- To comply with our legal, regulatory and scheme obligations
- To provide customer support and respond to your enquiries
- To send service updates, security notifications and (where you have consented) marketing communications
- To carry out analytics, research and product development
5. Legal bases for processing
We rely on the following legal bases under UK GDPR:
- Contract, processing necessary to enter into or perform our contract with you
- Legal obligation, for KYC, AML, sanctions screening, regulatory reporting and tax obligations
- Legitimate interests, to operate and grow our business, prevent fraud, secure our platform and improve our services, provided your rights do not override these interests
- Consent, for non-essential cookies and direct marketing where required
6. Sharing your information
We share personal data only where necessary and only with parties who provide appropriate protection. Recipients fall into the following categories:
Acquiring and processing partners
Worldpay (UK) Limited and Cashflows Europe Limited act as our acquiring partners and process transaction and merchant data under their FCA permissions. Clover Network UK Limited processes data when supplying point-of-sale hardware and software.
Technology providers
Cloud hosting (AWS in eu-west-2), analytics (Mixpanel), error monitoring (Sentry), email and communications (Postmark, Twilio), customer support (Intercom) and identity verification (Onfido, ComplyAdvantage).
Regulators and law enforcement
We disclose data to the Financial Conduct Authority, HMRC, the National Crime Agency, the ICO, courts and other competent bodies where we are legally required to do so.
Professional advisors and acquirers
Lawyers, auditors, insurers, and any party we may share data with in connection with a business sale, restructure or financing event.
7. International transfers
Stored primarily processes personal data in the United Kingdom and the European Economic Area. Where data is transferred to a country outside these regions (for example, a sub-processor located in the United States), we put in place appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses combined with the UK Addendum.
You may request a copy of the transfer safeguards in place for any specific recipient by contacting our DPO.
8. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, plus any additional period required by law:
- Merchant onboarding and KYC records: 5 years after account closure (Money Laundering Regulations 2017)
- Transaction records: 6 years (UK tax and accounting requirements)
- Marketing preferences: until you withdraw consent
- Support tickets and call recordings: 2 years
- Website analytics: 14 months
When the retention period ends we securely delete or anonymise the data.
9. Your rights
Under UK GDPR you have the following rights:
- Access, obtain a copy of the personal data we hold about you
- Rectification, correct inaccurate or incomplete data
- Erasure, have your data deleted where retention is no longer necessary
- Portability, receive your data in a structured, machine-readable format
- Objection, object to processing based on legitimate interests or for direct marketing
- Restriction, restrict processing while a dispute is resolved
- Withdraw consent, where processing relies on consent, you may withdraw it at any time
To exercise any of these rights, email dpo@joinstored.com. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk.
10. Cookies
Our website uses cookies and similar technologies to remember your preferences, analyse traffic and personalise content. Full details, including the categories of cookies we set and how to manage them, are available in our Cookie Policy.
11. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, annual penetration testing and an ISO 27001-aligned information security programme.
No system is perfectly secure, however. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform you directly.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be highlighted on this page and, where appropriate, notified to you by email or via the merchant portal. The “Last updated” date at the top reflects the most recent revision.
13. Contact
To exercise your rights, ask a question, or raise a concern about how we handle your personal data:
- Data Protection Officer: dpo@joinstored.com
- Post: Data Protection Officer, Stored Payments Limited, 4th Floor, 86–90 Paul Street, London EC2A 4NE
- ICO: ico.org.uk · 0303 123 1113