Legal
Privacy Notice
Last updated: 31 October 2026
1. Who we are
The data controller for this website is:
Cervo Ltd
Company number: 17451882
11 Welbeck Street, Office M, London, England, W1G 9XZ
support@cervopay.co.uk
020 3371 1067
This notice explains what personal information we collect through this website, why we collect it, the lawful basis for each purpose, how long we keep it, and your rights under UK data-protection law (UK GDPR and the Data Protection Act 2018).
This notice covers only the information we collect through this website. If you apply for a Cervo merchant account, use the Cervo merchant portal or use the Cervo payment app, our Privacy Notice for Merchants and Applicants explains how we use your information.
If you use the Cervo app for iPhone and Android, our Cervo App Privacy Notice explains what the app collects and why.
2. What information we collect and why
Information request form
When you submit the request form on this website, we collect:
- Business name
- Contact name
- Business email address
- Telephone number
- Type of locksmith business
- Estimated monthly card turnover (optional)
- Any message or question you choose to include
- Whether you opted in to marketing updates
- Submission time, the type of request and the page from which you submitted
- Your IP address and browser details (recorded automatically by our form processor)
Purpose: To record your request for information about Cervo's merchant services, to contact you about it and to answer your questions.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is to respond to your enquiry and to tell you about Cervo's merchant services. We have balanced this against your interests and rights and consider this processing proportionate given that you have actively submitted the form.
Retention: We will retain request data for up to 24 months from submission, or until you ask us to delete it, whichever is sooner. If you go on to apply for a merchant account, our Privacy Notice for Merchants and Applicants applies to your application.
Form processing: Form submissions are received and stored on our behalf by our website hosting provider, Netlify, Inc., which also emails each submission to us.
Complaints
When you make a complaint using the form on our Complaints page or by email, we collect:
- Your name and email address
- Your phone number, business name and a reference, if you give them
- What your complaint is about and what you tell us
- The date and time you sent it, and your IP address
Purpose: To record, look into and answer your complaint, to send you a reference and our reply, and to learn from complaints to improve our services. We also use your IP address and email address to stop the form being misused, by limiting how many complaints can be sent in a short time. We keep your IP address only in a scrambled (hashed) form. If your complaint is about a payment, we share the details needed with our regulated payment provider. If it is about a locksmith business that uses Cervo, we may share them with that business so it can put things right.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is to handle complaints fairly, keep a record of them and protect our services from misuse.
Retention: We keep complaint records for 3 years from when we receive them, so that we can deal with any follow-up questions, and then delete them.
Processing: The form sends your complaint straight to Cervo's own systems, which are run for us by our hosting and database provider. Our business email provider delivers it to our complaints team and sends you an acknowledgement.
Card payment queries
When you use our Check a card payment page, or email us about a card payment, we collect:
- The date and amount of the payment and the last 4 digits of the card (never the full card number)
- Your name and email address
- Your message, if you write one
- The date and time you sent it, and your IP address
Purpose: To find out whether a business that uses Cervo took the payment, to show you which business it was and how to contact it, to tell that business about your query so it can help you, to email you a reference, and to follow your query up if the business does not answer. If we find the payment, we send that business your name, email address, message and the payment details you entered, so it can contact you. The email we send you repeats only the details you entered and the business's contact details, never a receipt or other details of the payment. We also use your IP address and email address to stop the page being misused, by limiting how many checks can be made in a short time. For this we use your IP address only in a scrambled (hashed) form and delete it within about a day; our hosting provider may also keep it briefly in its logs.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is to help cardholders find out about a payment and get it resolved with the business that took it, and to protect our services from misuse.
Retention: We keep each payment query (the details listed above, other than your IP address) for 2 years from when we receive it, so that we can deal with any follow-up questions or disputes about the payment, and then delete it.
Processing: The page sends your query straight to Cervo's own systems, which are run for us by our hosting and database provider. Our business email provider sends the emails. To ask about your query or your data, email support@cervopay.co.uk.
Optional marketing updates
If you tick the optional marketing box on the request form, we will use your email address to send you updates about Cervo's products and services.
Lawful basis: Consent (Article 6(1)(a) UK GDPR). Ticking the box is a separate, freely given, specific and informed choice. You can withdraw your consent at any time by emailing support@cervopay.co.uk or by clicking the unsubscribe link in any marketing email we send. Withdrawal does not affect the lawfulness of processing before withdrawal.
Retention: We will retain your marketing consent record and email address for this purpose until you withdraw consent or ask us to stop.
Partnership and general correspondence
If you contact us directly by email with a partnership or general enquiry, we will collect your name, email address, and the content of your message.
Lawful basis: Legitimate interests — to respond to your enquiry and manage our business relationships.
Retention: Correspondence is retained for as long as necessary to manage the relationship, and in any event for no longer than 3 years unless a longer period is required by law.
Technical and security logs
Our website hosting infrastructure automatically records standard server logs, which may include IP addresses, browser type, operating system, referring URL, and the date and time of requests. These logs are used solely for security monitoring, spam prevention, and diagnosing technical issues.
Lawful basis: Legitimate interests — to maintain the security and proper operation of this website.
Retention: Server logs are retained by our hosting provider in line with its standard log retention.
Cookie preferences
This website sets no cookies of its own and does not display a cookie-consent banner. If you sign in to one of Cervo's merchant sites, a strictly necessary sign-in cookie is stored for cervopay.co.uk. See our Cookie Policy for details.
3. Who we share your information with
We do not sell your personal information. We may share it with the following categories of service provider who process it on our behalf:
- Website hosting and form processing provider (Netlify, Inc.) — hosts this website and its server infrastructure, and receives, stores and emails to us the form submissions made on this website.
- Spam-filtering service (Akismet, used by Netlify) — checks form submissions for spam on Netlify's behalf.
- Business email provider — hosts our business email accounts.
- Hosting and database provider — stores the complaints and card payment queries sent through our forms.
- Our regulated payment provider, or the locksmith business concerned — only the details needed to resolve a complaint about a payment or about that business, or to answer a card payment query about a payment that business took.
All service providers are required to process your information only on our instructions and in accordance with applicable data-protection law.
We may also disclose your information where required by law, court order, or to protect the rights, property, or safety of Cervo, our users, or others.
4. International transfers
Some of our service providers may process personal information outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or transfers to countries with UK adequacy regulations in force.
Our hosting and form processing provider, Netlify, Inc., is based in the United States. Transfers to Netlify rely on Netlify's data processing agreement together with the UK International Data Transfer Addendum.
If you would like further information about the safeguards we rely on for any specific transfer, please contact us at support@cervopay.co.uk.
5. Your rights
Under UK data-protection law you have the following rights:
Access: You can request a copy of the personal information we hold about you.
Rectification: You can ask us to correct inaccurate or incomplete information.
Erasure: You can ask us to delete your personal information in certain circumstances.
Restriction: You can ask us to restrict how we use your information in certain circumstances.
Portability: Where processing is based on consent or contract and carried out by automated means, you can ask us to provide your information in a structured, commonly used, machine-readable format.
Object to legitimate-interest processing: You have the right to object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims.
Object to direct marketing: You have an absolute right to object to your information being used for direct marketing at any time.
Withdraw consent: Where processing is based on consent (such as optional marketing updates), you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at support@cervopay.co.uk. We will respond within one month. We may need to verify your identity before processing your request.
6. Right to complain
If you are unhappy with how we have handled your personal information, please contact us first at support@cervopay.co.uk and we will do our best to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint or by calling 0303 123 1113.
7. Changes to this notice
We may update this Privacy Notice from time to time, for example as our services develop or legal requirements change. The date at the top of this page shows when it was last updated. We encourage you to review this notice periodically.