1. Who we are
Paymentsave Ltd is the main company and data controller. CEPos is its trading name. Paymentsave Ltd is registered in England and Wales under company number 09872986, with registered office at Unit 4 Stanton Gate, 49 Mawney Road, Essex, England, RM7 7HL.
For privacy questions, contact support@cepos.uk.
2. Information we may collect
- Identity and contact details, such as your name, role, business name, email address, telephone number and postal address.
- Enquiry and project information, including requirements, correspondence, feedback, approvals and support requests.
- Account and service information where a custom system includes user access.
- Technical information such as IP address, browser type, device information, referral source and website interaction data.
- Marketing preferences and records of consent.
- Business records needed to administer proposals, contracts, invoices and support.
- Content or personal information you choose to provide within a project.
We ask clients not to send special-category or highly sensitive personal information unless it is genuinely required and suitable safeguards have been agreed.
3. How we collect information
We collect information directly from you through enquiries, calls, forms, meetings, proposals and project activity. We may also receive information from your colleagues, authorised representatives, publicly available business sources, analytics tools, service providers and third-party platforms you ask us to integrate with.
4. How we use information and our legal bases
| Purpose | Typical legal basis |
|---|---|
| Responding to enquiries and preparing proposals | Legitimate interests; steps before entering a contract |
| Delivering and supporting contracted services | Contract; legitimate interests |
| Managing client relationships, records and invoices | Contract; legal obligation; legitimate interests |
| Improving website, systems and services | Legitimate interests; consent where required |
| Protecting systems, preventing misuse and resolving disputes | Legitimate interests; legal obligation |
| Sending optional marketing communications | Consent or legitimate interests where permitted by law |
| Meeting legal, tax and regulatory duties | Legal obligation |
Where we rely on legitimate interests, we consider the impact on your rights and use information only where those interests are not overridden.
6. International transfers
Some technology providers may process information outside the United Kingdom. Where this happens, we use an approved safeguard where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses.
7. How long we keep information
We retain information only for as long as reasonably necessary for the purpose collected, including contractual, support, legal, accounting and dispute-resolution needs. Typical business and contract records may be retained for up to six years after the relevant relationship ends. Enquiries that do not proceed are normally deleted or anonymised sooner unless there is a valid reason to retain them.
8. Security
We use proportionate technical and organisational measures designed to protect personal information, including access controls, secure service providers, staff confidentiality and appropriate backup and review processes. No internet service is completely secure, so users should also protect their own devices and credentials.
9. Your data protection rights
Depending on the circumstances, you may have the right to:
- access your personal information;
- correct inaccurate or incomplete information;
- request erasure;
- restrict or object to processing;
- receive certain information in a portable format;
- withdraw consent at any time; and
- challenge a decision based solely on automated processing, where applicable.
Rights are not absolute and legal exceptions may apply. We may need to verify your identity before responding. We normally respond within one month.
10. Marketing choices
You can opt out of marketing communications at any time by using an unsubscribe option where provided or contacting us. Service and project communications are not marketing and may still be sent where necessary.
12. Contact, complaints and updates
Contact us at support@cepos.uk or write to the registered office above. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
We may update this policy when our services, technology or legal obligations change. The effective date above identifies the current version.
If we build software that processes personal information on behalf of your business, your business may be the controller and CEPos may act as a processor. The project agreement should define those responsibilities.