Version 2026-09-27 · Last updated: 27 September 2026
This policy explains what personal data OPPay collects, why we collect it, and what rights you have. We are committed to handling personal data carefully and lawfully.
OPPay Limited is a company registered in England and Wales under company number 17388049, registered office 22 Normandy Crescent, Saighton, Chester, CH3 6FT. We are the data controller for the personal data described in this policy, with one exception we have not yet settled: for the name and contact details a merchant gives us to send a payment request, we may instead be acting on the merchant's behalf. We are taking legal advice and will update this policy when it is settled. Until then, you can ask us about that data as described in section 8, and we will pass on any request that is for the merchant to answer.
We are registered with the Information Commissioner's Office (ICO) under registration number ZC226552.
| Who | Data we collect | Why |
|---|---|---|
| Merchants applying for an account | Business name, contact name, email address, telephone number, business address, Companies House number, VAT number, business bank account number and sort code | To assess the application, verify the business, set up the account and route payments correctly |
| Merchant users | Email address and a securely hashed password | To provide secure access to the merchant account |
| Customers paying a merchant | Payment amount, payment reference, transaction status and time. Where a merchant sends a payment request, the name, email address or mobile number the merchant gives us to send it. Authentication takes place in the customer's own banking app — we do not collect or see banking credentials | To process and confirm the payment, and to give the merchant a record of it |
| Website visitors | Technical data such as IP address and browser type, collected by our hosting provider in server logs | To keep the service secure and available |
We share personal data only where necessary, with:
We do not sell personal data, and we do not share it for third-party advertising.
Our application and database are hosted by Railway in the United States; we plan to move them to its region in the Netherlands before we take on live merchants. Our terminal gateway and our encrypted backups are with DigitalOcean in London. For data processed in the United States we rely on standard contractual clauses with the UK International Data Transfer Addendum, in Railway's data processing addendum.
We keep merchant account records for as long as the account is open and for six years after the end of the accounting period in which it closes, for tax and accounting law. Payment records are kept for whichever is longer: five years after the merchant relationship ends, under anti-money-laundering law (and no more than ten years after the payment), or six years after the end of the accounting period in which the payment was made. Records of the checks we carry out on merchants under anti-money-laundering law are kept for five years after the business relationship ends; after that, personal data collected for those checks is deleted unless another law requires it, it is needed for legal proceedings, or you have agreed. Unsuccessful applications are kept for up to twelve months. Payment requests that are never paid are deleted, with the contact details entered for them, twelve months after they expire or are cancelled. Our hosting provider shows us server logs for seven days, for security. Backups are kept for about two weeks, so deleted records leave them within about sixteen days — longer only while backups are failing.
We protect data using encryption in transit, hashed passwords, access controls and secure hosting. Banking credentials are never entered into OPPay — customers authenticate directly with their own bank.
Under UK data protection law you have the right to:
To exercise any of these, email sales@oppay.co.uk. We will respond within one month.
We use only the storage necessary to keep merchants logged in and to operate the service. We do not use advertising or third-party tracking cookies.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
We may update this policy. The date at the top shows when it was last changed, and we will tell merchants directly about significant changes.
