1. About this notice
This notice explains how UK Payments Initiative Limited (“UKPI”, “we”, “us”) handles personal data when you visit our website at https://www.ukpaymentsinitiative.co.uk (the “Site”) or contact us by email. UKPI is the controller of the personal data described in this notice for the purposes of the UK General Data Protection Regulation as amended by the Data (Use and Access) Act 2025 (“UK GDPR”) and the Data Protection Act 2018.
UKPI is registered in England and Wales (company number 16915455). Our registered office is at c/o Towerhouse LLP, 16 St John’s Lane, London EC1M 4BS. UKPI is registered with the Information Commissioner’s Office as a data controller under reference ZC083642.
2. Personal data we collect
Information you give us. If you email UKPI at legal@ukpaymentsinitiative.co.uk (or any other UKPI email address) we receive your name, email address, the content of your message and any signature or attachment you choose to include.
Information collected automatically. When you visit the Site, our hosting infrastructure records technical information in server logs. This includes your IP address, the date and time of your visit, the page or asset you requested, the response code returned, the referring page (if any) and your browser user agent. We use cookies and analytics in the way described in our Cookie Notice.
We do not collect special category data through the Site, and we do not use the Site to make automated decisions that produce legal or similarly significant effects.
3. Why we use personal data and our lawful basis
We use the personal data described above for the following purposes.
To run and protect the Site (server logs, security monitoring, troubleshooting). Lawful basis: legitimate interests in operating a secure and reliable website (Article 6(1)(f) UK GDPR). The recognised legitimate interest in network and information security applies under Annex 1 of the UK GDPR as introduced by section 70 of the Data (Use and Access) Act 2025.
To analyse Site usage (Google Analytics traffic measurement and aggregate reporting). Lawful basis: your consent given through our cookie banner (Article 6(1)(a) UK GDPR; regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003).
To respond to your email enquiries. Lawful basis: legitimate interests in responding to people who contact UKPI, or where you initiate contact in connection with a contract or pre-contract step, performance of a contract (Article 6(1)(b) UK GDPR).
To meet legal and regulatory obligations. Lawful basis: legal obligation (Article 6(1)(c) UK GDPR).
4. Who we share personal data with
We share personal data with the following categories of recipients, each of which acts as our processor unless stated otherwise.
Hosting and site operator. Rubik Digital Ltd builds and operates the Site for us. Hosting infrastructure is provided to Rubik Digital by DigitalOcean, with servers located in London. They access personal data only as needed to host, operate and secure the Site.
Analytics. Google Ireland Limited and Google LLC provide analytics through Google Analytics and serve the Inter font through Google Fonts. Where you consent to analytics cookies, Google receives the data described in our Cookie Notice. The Google Fonts service receives your IP address each time the Inter font is requested by your browser; we are working with our designer to self-host the font and remove this transfer.
Cookie consent. CookieYes Limited provides our cookie consent platform and records your consent choices on our behalf.
Office and email. Microsoft 365 hosts UKPI email. If you email us, your message and our response are stored in Microsoft 365.
We will also disclose personal data where we are required to do so by law or by a regulator with proper authority, and in connection with an actual or proposed sale, merger or restructuring of UKPI subject to appropriate confidentiality safeguards.
5. International transfers
Some of our processors are based outside the United Kingdom. Where personal data is transferred outside the UK we rely on the UK adequacy regulations (for transfers to the European Economic Area) or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for a summary of the safeguards in place for any specific transfer.
6. How long we keep personal data
We keep server logs for up to 90 days, except where they need to be kept for longer to investigate a security incident. We keep Google Analytics data for the period set out in our Cookie Notice. We keep email correspondence and any related records for as long as we need them for the purpose for which they were collected, and then for a further period reflecting our legal, regulatory and accounting obligations.
7. Your rights
Subject to the conditions in the UK GDPR you have the following rights: to ask for a copy of the personal data we hold about you (right of access); to ask us to correct inaccurate data (right to rectification); to ask us to delete data in certain circumstances (right to erasure); to ask us to restrict processing; to object to processing carried out on the basis of legitimate interests; and to ask for a copy of personal data you have given us in a machine-readable format (right to portability).
Where we rely on your consent you can withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew consent. To exercise any of these rights, contact us using the details in section 9.
8. Complaints
If you are not satisfied with how UKPI has handled your personal data you can complain to us at legal@ukpaymentsinitiative.co.uk. We will acknowledge complaints about data protection within 30 days as required by the Data (Use and Access) Act 2025.
If your complaint is not resolved you can contact the Information Commissioner’s Office at https://ico.org.uk, by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or by phone on 0303 123 1113. You may wish to give us a chance to address your complaint before approaching the ICO, but you do not have to.
9. Contact us
Questions about this notice or about how UKPI handles personal data can be sent to legal@ukpaymentsinitiative.co.uk or by post to UK Payments Initiative Limited, c/o Towerhouse LLP, 16 St John’s Lane, London EC1M 4BS.
10. Changes to this notice
We may update this notice from time to time. The version published on the Site at the date of your visit is the version that applies.