Privacy Policy

Cardstream’s Privacy Notice

Cardstream

Cardstream is a global connector of payments, offering 360° comprehensive solutions.

From a full end-to-end white label payment gateway to modular solutions, covering all your payment requirements in the forever changing payment processing landscape.

The Cardstream website is operated by Cardstream Limited. (Referred as “Cardstream”, “we”, “our”, “us” in this, Privacy Notice)

Cardstream is a private limited company registered in England and Wales under company number 03864244 and we have our registered office at Birches Corner, Heron Gate, Taunton, Somerset, TA1 2LP.

We are registered with the Information Commissioner’s Office (the ICO) with registration number ZA196969.

Cardstream is a PCI DSS Level 1 compliant provider of payment solutions.

We have therefore developed this privacy notice to inform you of the data we collect, what we do with your information, what we do to keep it secure as well as the rights and choices you have over your personal information.

Throughout this policy we refer to Data Protection Legislation which means the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

What Personal Data do we Collect and When?

The type of personal information that we will collect from you, and you voluntarily provide to us on this website or as part of a service or product we provide to you may include some or all of the following:

Identity Data includes first name, maiden name, last name or similar identifier, title, date of birth and gender. (Business owners/ sole traders/ partnerships)

Contact Data includes billing address, delivery address, email address and telephone numbers.

Financial Data includes bank name, sort code and account number, payment card details, VAT number.

Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this site.

Profile Data includes any purchases or orders made by you, your interests, preferences, feedback, and survey responses.

Usage Data includes information about how you use our site, products, and services.

Marketing Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Communications data including emails, telephone calls and post which you receive from us or send to us, and your preferences in receiving information and being contacted by us.

Why and How We use Your Personal Data

We use your personal data to provide the features of the website and the services you request

When you use our website or platform, we will use your personal data to provide the requested product or service. For example, if you make an enquiry on our website, or participate in an event or promotion, we will use the contact information you give us to communicate with you about the enquiry, event, or promotion. If you contact our customer services, we will use information about you, such as enquiry or payment information, or the service you have purchased to help you resolve a problem or question.

We use your personal data to establish you as a Cardstream customer

If you sign an agreement to become a Cardstream customer, we will need to collect and verify information about you and other relevant individuals to set up our products and services for you, including to provide you with support, onboarding, and integration to our platform.

To conduct KYC and Fraud Prevention checks

The personal data we’ve collected from you at agreement or at contract stage will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your or any of your related persons’ identity. If fraud is detected, you could be refused certain services.

When we and/or the fraud prevention agencies process your personal data, we do so on the basis that we have a legitimate interest in verifying your identity and preventing fraud and money laundering, to protect our business and to comply with legal requirements. Such processing is also a contractual requirement of the services requested. We and/or the fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.

To Operate, Improve and Maintain our Business, Products and Services

We use the personal data you provide to us to operate our business. For example, when you make a purchase, we use that information for accounting, audits, and other internal functions. We may use personal data about how you use our products and services to enhance your user experience and to help us diagnose technical and service problems and administer our platform.

To Protect Our or Others' Rights, Property or Safety

We may also use personal data about how you use our website to prevent, detect, or investigate fraud, abuse, illegal use, violations of our Terms of Use, and to comply with court orders, governmental requests, or applicable law.

To Communicate Information about our Products, Services, Events and for Other Promotional Purposes

When you consent, we will send you marketing communications and news concerning Cardstream products, services, events, and other promotions. You can opt-out at any time after you have given your consent.

If you are an existing customer of Cardstream (for example, if you are a service user), we may use the contact details you provided to send you marketing communications about similar Cardstream products or services, where permitted by applicable law (unless you have opted out).

To process transactions / provide our services

In basic terms Cardstream securely manage the payment process for you which includes handling your customers payment information, gaining authorisation for the payment, contacting the card providers and banks involved. A basic flow of the process can be seen below to understand the processing journey.

Using your personal data: the lawful basis and purposes

To process your personal data, we rely on certain lawful basis, depending on how you interact with our website, platform, or services.

If we do process your personal data, we may use one or more of the following lawful basis for processing:

As necessary to perform our contract with you for the relevant product, or service, including:

To take steps at your request prior to entering into it
To decide whether to enter into it
To manage and perform that contract
To assess credit risk
To update our records; and
To trace your whereabouts to contact you about your account and recovering debt

As necessary for our own legitimate interests or those of other persons and organisations, including:

Governance, accounting, managing, and auditing our business operations
To search at credit reference agencies if you as an individual are over 18 and to confirm your identity
To monitor emails, calls, other communications, and activities on your account, product, or service
For market research, analysis and developing statistics
To send you marketing communications, including automated decision making relating to this
To identify and contact potential customers using publicly available information and internal insight; and
To monitor your or their transactions to assess credit risk, and for the detection and prevention of crime.

As necessary to comply with a legal obligation, including:

When you or any of your related persons exercise available rights under data protection law and make requests
For compliance with legal and regulatory requirements and related disclosures
For establishment and defence of legal rights
For activities relating to the prevention, detection, and investigation of crime
To verify your or any of your related persons’ identity, make credit, fraud prevention and anti-money laundering checks; and
To monitor emails, calls, other communications, and activities on your account, product, or service.

Based on your consent, including:

When you request us to disclose your or any of your related persons’ personal data to other people or organisations, such as a person or company handling an account or poject on your behalf, or otherwise agree to disclosures
When we process any special categories of personal data about you or your related persons at your request (e.g., your or any of your related persons’ racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning your health, sex life or sexual orientation); and
To send you marketing communications where we’ve asked for your consent to do so. You are free at any time to change your mind and withdraw your consent.

Sharing of Your Personal Data

We do not sell your personal data.

We may share your personal data with other organisations in the following circumstances:

If the law or a public authority says we must share the personal data (Government bodies and agencies in the UK, e.g., the Financial Conduct Authority, the Information Commissioner’s Office
If we need to share personal data to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk)
External sources of publicly available information such as Companies House, Dun and Bradstreet and credit reference agencies
Payment systems (e.g., Visa or Mastercard) and correspondent banks, who may transfer such personal data to others, as necessary to operate your service and for regulatory purposes, to process transactions, resolve disputes and for statistical purposes.
We use data processors who are third parties who provide elements of services for us. We have Data Processor Agreements in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us or further sub-processors who must comply with our Data Processor Agreement. They will hold your personal data securely and retain it for the period we instruct.
Cardstream entities for the purposes and under the conditions outlined above. This includes Cardstream Limited, its subsidiaries, and affiliated companies.
We may also transfer personal data we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganisation, spin-off, dissolution, or liquidation).

Social media buttons

We use plugins on our website from social media networks such as Facebook, LinkedIn, and Twitter. You can recognise these plugins by their logos. Our plugins will not collect personal data about you unless you click on these logos. If you click on them, these plugins are activated and automatically transmit data to the plugin provider.

We do not have any influence over which data these providers collect from you. If you would like more information about their data processing, this can be found in the respective privacy policies on the websites of these providers.

Cookies

We use cookies and similar techniques, such as tags/beacons and JavaScript’s, which are small text files stored on your device. Using cookies is a way for us to make sure that our website is continuously improved, meets your needs and can be used as a tool to optimise our marketing strategy. For us to do this, we place functional cookies to make the website function as well as marketing cookies which help us target the right people and show them advertisements. Some of these cookies track your use of our website and visits to other websites and allow us to show you advertisements when you browse other websites.

Please view our Cookie Policy for more information on our use of cookies.

Rights under Data Protection Law

The Right to be Informed about our collection and use of personal data

You have the right to be informed about the collection and use of your personal data. We ensure we do this with our internal data protection policies and through our external website privacy notice. These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.

Right to Access Your Personal Information

You have the right to access the personal information that we hold about you in many circumstances, by making a request. This is sometimes termed ‘Subject Access Request’. If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within 1 month from when your identity has been confirmed.

We would ask for proof of identity and sufficient information about your interactions with us that we can locate your personal information.