Privacy Notice for Merchants and Applicants

1. Who we are and what this notice covers

This notice explains how Cervo Ltd uses personal information when you apply for a Cervo merchant account through Cervo Apply (apply.cervopay.co.uk), use the Cervo merchant portal (portal.cervopay.co.uk) or use the Cervo terminal app to take card payments. It applies to applicants, business owners, directors and other people named in an application, merchant staff who use the portal or the terminal app, and customers whose details are added to a payment link.

The data controller is:

Cervo Ltd
Company number: 17451882 (registered in England and Wales)
11 Welbeck Street, Office M, London, England, W1G 9XZ
andrei@cervopay.co.uk
020 3371 1067

Information collected through our public website, including the information request form, is covered by our Privacy Notice.

2. The information we collect

Your account

• Your email address and sign-in details for your Cervo account

Your application

• Business details, such as the business name, legal form, registration number, trading address, industry, what you sell and expected card turnover
• The names, dates of birth and home addresses of directors, owners and other people connected with the business
• Identity documents and other verification documents you upload
• Bank account details for payouts
• A record of your agreement to the terms, including the date and time, the version agreed, your IP address and details of your device and browser

Using the merchant portal and the Cervo terminal app

• Payment and refund records, such as amount, date and time, status, the terminal used and which member of staff took the payment
• The names and email addresses of employees the business owner invites to use the Cervo terminal app, their role and the terminal assigned to them
• Customer contact details (such as name, email address or phone number) that you add to a payment link, so the link can be sent to your customer
• Sign-in records kept by our hosting and database provider, and a record of which user took, refunded or changed each payment, used to keep accounts secure

Card numbers are never stored by Cervo. Card details are captured and processed by our regulated payment services partner, not by Cervo.

Where the information comes from

Most of this information comes from you. Information about directors, owners and employees may be provided by the person completing the application or managing the business's team. We also receive information from our regulated payment services partner, such as the outcome of verification checks and records of payments, refunds and payouts.

3. How we use it and our lawful bases

• To set up and run your account — creating your account, taking your application, passing it to our regulated payment services partner, activating services once approved, providing the merchant portal, the Cervo terminal app, payment links and payouts, and supporting you. Lawful basis: performance of a contract with you, or taking steps at your request before entering into one (Article 6(1)(b) UK GDPR). Where the information relates to someone other than the account holder (for example a director or an employee), our lawful basis is legitimate interests in providing the service the business has asked for (Article 6(1)(f)).
• To carry out verification checks — identity, anti-money-laundering and know-your-customer (KYC) checks on the business and the people connected with it: checks required by our regulated payment services partner and by law before an account can be opened and while it stays open. Lawful basis: performance of a contract, or taking steps at your request before entering into one (Article 6(1)(b)), and legitimate interests in making sure accounts are only opened for verified businesses (Article 6(1)(f)).
• To meet our own legal obligations — keeping accounting and tax records, and responding to lawful requests from regulators, law enforcement and courts. Lawful basis: legal obligation (Article 6(1)(c)).
• To keep a record of the terms you agreed — including the IP address and device used, so that we can show when and how the terms were accepted. Lawful basis: legitimate interests in being able to evidence the agreement (Article 6(1)(f)).
• To prevent fraud and keep our services secure — monitoring sign-ins and account activity and investigating suspicious activity. Lawful basis: legitimate interests in protecting you, your customers and Cervo (Article 6(1)(f)).
• To run and improve our business — managing our relationship with you, handling complaints and improving our services. Lawful basis: legitimate interests (Article 6(1)(f)).

Where we rely on legitimate interests, we have balanced them against your interests and rights. If you do not provide information we need for your application or for legal checks, we may not be able to open or keep your account.

4. Who we share it with

We do not sell your personal information. We share it only as follows:

• Our regulated payment services partner — receives your application, verification information and bank details so that it can assess the application, carry out its own checks, process card payments and make payouts under your merchant agreement with it. It uses the information as a controller under its own privacy notice, which is provided to you when you agree its terms.
• Hosting and database provider — hosts Cervo Apply, the merchant portal, the Cervo terminal app and the database behind them.
• Email provider — sends account emails, such as email confirmation, password resets, team invitations and application updates.
• ipify — an IP-address lookup service. When you agree to the terms, your browser asks ipify for your public IP address (IPv4) so it can be included in the record of your agreement.
• Regulators, law enforcement and professional advisers — where the law requires it, or to establish, exercise or defend legal claims.

Our service providers process personal information only on our instructions and in line with data-protection law.

5. International transfers

Some of our service providers may process personal information outside the United Kingdom. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK International Data Transfer Addendum to the EU standard contractual clauses. Contact us for more information about the safeguards for a particular transfer.

6. How long we keep it

• Account and application information — for as long as your account is open, and afterwards for as long as our partner's regulatory obligations and applicable law require (for example, anti-money-laundering records are generally kept for five years after the relationship ends) or as needed to deal with legal claims.
• Applications that do not go ahead — for as long as needed to deal with any questions about the decision, and as our partner's regulatory obligations and applicable law require.
• Customer contact details on payment links — deleted 90 days after the link is paid or expires.
• Card numbers — never stored by Cervo.

7. Your rights

Under UK data-protection law you have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure — ask us to delete your information in certain circumstances.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Objection — object to our use of your information where we rely on legitimate interests.
• Portability — where we rely on contract and the processing is automated, ask for your information in a structured, commonly used, machine-readable format.

Some rights are limited where information must be kept to meet regulatory or legal requirements. To exercise any of these rights, contact us at andrei@cervopay.co.uk. We will respond within one month and may need to verify your identity first.

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

8. Sign-in cookie

Cervo Apply, the merchant portal and the Cervo terminal app share one sign-in. When you sign in, they store a strictly necessary sign-in cookie for cervopay.co.uk so you stay signed in as you move between them. Where the shared cookie can't be used, they keep you signed in using your browser's local storage instead, which is also strictly necessary. See our Cookie Policy for details.

9. Contact us and changes to this notice

For any question about this notice or your personal information, contact us at andrei@cervopay.co.uk or write to Cervo Ltd, 11 Welbeck Street, Office M, London, England, W1G 9XZ.

We may update this notice from time to time. The date at the top of this page shows when it was last updated.

Privacy Notice · Cookie Policy · Terms of Website Use · Complaints