Who we are
Glass Pay is a trading style of Marketing Management Consultants Ltd. In this policy, "Glass Pay", "we", "us" and "our" refer to Marketing Management Consultants Ltd, which operates this website and provides business payment services in the United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Marketing Management Consultants Ltd is the data controller for the personal information described in this policy. We have not appointed a statutory Data Protection Officer; data protection matters are handled by our data protection lead, who can be reached using the details in the Contact us section below.
Scope of this policy
This policy explains how we handle personal information about:
- visitors to this website;
- directors, owners, employees and other representatives of businesses that enquire about, apply for or use our services;
- individuals whose details appear in payment transactions we process on behalf of a business customer, such as payees and counterparties; and
- anyone who contacts us by email or otherwise requests information.
Where we process transaction data purely on the instruction of a business customer, we act as a processor and that business is the controller. Their own privacy notice governs how they use that information, and you should direct requests to them in the first instance.
This policy does not cover the practices of third-party institutions that supply banking or payment services to you. Each of those providers publishes its own privacy notice.
Information we collect
Depending on how you interact with us, we may collect:
- Identity and contact details — your name, business name, job title, email address, telephone number and business address.
- Enquiry details — what you tell us about your business model, the countries you trade in, expected payment volumes, currencies and the challenges you are trying to solve.
- Onboarding and compliance information — company registration details, ownership and control information, identification documents, and the results of anti-money laundering and sanctions screening. We are required to collect this before providing services.
- Transaction and settlement information — payment amounts, currencies, rails, references, timestamps, refunds, refunds, payment routes and the timestamps attached to each transaction.
- Technical and usage information — IP address, device and browser type, approximate location derived from IP, referring page and the pages you view. Some of this is only collected through analytics cookies after you consent.
- Communications — the content of emails and other correspondence with us, including records of support requests.
We do not intentionally collect special category data (such as health, biometric or political data) and we ask that you do not send it to us.
How and why we use your information
We use personal information to:
- respond to your enquiry and provide the information you asked for;
- assess an application, carry out know-your-business and anti-money laundering checks, and confirm which regulated partners can serve you;
- set up and operate your accounts and payment services, including processing transactions, settlement and reconciliation;
- manage chargebacks, disputes, refunds and fraud and financial crime risk;
- provide support, service updates and notices about your account;
- maintain our own records, resolve complaints and enforce our terms;
- understand how this website is used so that we can improve it, where you have consented to analytics cookies; and
- meet our legal, regulatory, tax and accounting obligations.
Our lawful bases for processing
Under UK GDPR we must have a lawful basis for each purpose. We rely on the following:
- Performance of a contract — to assess your application, set up your services, process payments and support you during the life of our agreement.
- Legal obligation — to carry out anti-money laundering, sanctions, fraud-prevention, tax and record-keeping requirements that apply to regulated payment and financial services.
- Legitimate interests — to respond to business enquiries, protect our systems and our customers from fraud and abuse, improve our services, and pursue or defend legal claims. We balance these interests against your rights and expect the impact on you to be minimal.
- Consent — to set analytics cookies and, where required by law, to send you marketing by email. You can withdraw consent at any time without affecting the services you receive.
You are in some cases obliged to provide information because anti-money laundering law requires it. If you do not provide it, we may not be able to provide the services requested.
International transfers
Some of our service providers and payment partners operate outside the United Kingdom. Where personal information is transferred outside the UK, we ensure that an appropriate safeguard is in place, normally:
- a transfer to a country covered by UK adequacy regulations; or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.
You can ask us for more detail about the safeguards we rely on for any particular transfer.
How long we keep your information
We keep personal information only as long as we need it:
- Enquiries that do not proceed — normally up to 24 months from our last contact, so that we can pick the conversation up again if you return.
- Customer and transaction records — for the duration of the relationship and then for the statutory record-keeping period that applies to regulated payment services, which is generally five years after the relationship ends, and longer where a legal hold, dispute or investigation requires it.
- Anti-money laundering and identity records — for the minimum period required by UK anti-money laundering legislation.
- Website analytics — for the retention period stated in our cookie policy.
When a retention period ends, we securely delete or irreversibly anonymise the information.
How we protect your information
We use technical and organisational measures appropriate to the risk, including encrypting data in transit with TLS 1.3 and at rest with AES-256, restricting access on a least-privilege basis, separating client money from our own operating funds, continuous fraud and security monitoring, and regular review of our suppliers. Payment data is handled in line with the security standards that apply to the services we provide.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform you where the law requires it.
Your rights under UK GDPR
You have the right to:
- Be informed — about how we use your information, which is what this policy sets out.
- Access — a copy of the personal information we hold about you, together with information about how it is used.
- Rectification — have inaccurate or incomplete information corrected.
- Erasure — ask us to delete your information where there is no overriding legal reason for us to keep it.
- Restriction — ask us to limit how we use your information while a question about it is resolved.
- Data portability — receive information you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller, where our basis is consent or contract and the processing is automated.
- Object — to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent — at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.
- Not be subject to solely automated decisions that produce legal or similarly significant effects, without safeguards. We do not make such decisions.
To exercise any of these rights, email hello@glasspay.com. We will respond within one calendar month, and will tell you if we need to extend that period. We may ask for information to confirm your identity before acting, and there is no charge unless a request is manifestly unfounded or excessive.
Some rights are limited — for example, we cannot delete information we are legally required to retain for anti-money laundering purposes, and we may need to keep records to establish, exercise or defend legal claims. Where we refuse a request, we will explain why and tell you how to complain.
Marketing
We may send service and security notices that are part of the service you receive, as these are not marketing. We will only send you marketing about other services where you have asked for it or where we are permitted to contact a business you represent, and every message includes a way to opt out. You can also opt out at any time by emailing hello@glasspay.com.
Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe we have done so, contact us and we will delete it.
Changes to this policy
We may update this policy to reflect changes in our practices, our services or the law. The "last updated" date at the top of this page always shows the current version, and where a change is material we will make that clear on this website.
Complaints and the Information Commissioner's Office
If you are unhappy with how we have handled your information, please contact us first at hello@glasspay.com so that we can try to resolve it.
You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. You can complain to the ICO at any time and do not need to contact us first.
Contact us
For any question about this policy or your personal information:
- Email: hello@glasspay.com
- Post: Data Protection Lead, Marketing Management Consultants Ltd, United Kingdom
Please include enough detail for us to identify you and understand your request. Our full contact options are listed on the contact page.