Get Started

Privacy Policy

Version: 1.0 
Last updated: [29 /10/2026] 

Respecting the right to privacy of those who entrusted MAP e-Pay Solutions Limited(“MAP ePay”, “we”, “us”), we would like to declare that we process the data collected in accordance with the applicable legal framework and under conditions ensuring their security. 

This Privacy Policy explains how MAPe‑Pay collects and uses personal data when you: 

  1. use our websites, apps and customer portals; 
  2. use our electronic money and payment services (including making or receiving payments); 
  3. contact us (including support, complaints, disputes and chargebacks); 
  4. apply for a job or work with us (employees, contractors and representatives); 
  5. interact with us as a business customer, merchant, supplier, partner, or as a representative of one. 

Who we are (Data Controller) 

MAP e‑Pay Solutions Limited (company number 13627304) 
Registered office: 1 Kings Avenue, London, United Kingdom, N21 3NA 
Trade name: MAP ePay 

Contact (privacy):info@mapepay.uk 
Postal contact: 1.12 Executive Office, 34 Lime Street, London, EC3M 7AT, UNITED KINGDOM 
Data Protection Officer: Nicola Christofides, Nicola.christofides@mapepay.uk 


The types of personal data we collect 

We may collect and use the following categories of personal data (depending on your relationship with us): 


1. Identity and contact data 

Name, date of birth (where needed), email, telephone number, address, nationality (where needed), and similar identifiers. 


2. Account and customer relationship data 

Customer/account references, onboarding information, customer communications, support tickets, preferences. 


3. Transaction and payment data 

Payment instructions, beneficiary/payer details, merchant details, transaction amounts, dates/times, reference/description fields, refunds/chargebacks, and related records. 


4. Verification, compliance and risk data (KYC/AML/fraud) 

Information to verify identity and manage financial crime and other risks, such as: 

  • identity verification results (pass/fail/flags); 
  • sanctions/PEP screening results (flags/matches); 
  • fraud indicators, device/behavioural signals, and monitoring alerts; 
  • information required to meet legal and regulatory obligations.

5. Technical and usage data (website/app) 

IP address, device identifiers, browser type, app version, session data, logs, and analytics events (subject to your cookie/technology choices). 


6. Business/merchant and representative data 

If you are a business customer/merchant/partner/supplier (or its representative): business contact details, role/title, corporate ownership/structure information (where required), and communications. 


7. Recruitment and HR data (if you apply to work with us) 

CV/resume, employment history, references (where provided), right-to-work checks (where required), and recruitment communications. 


Special category data: We do not intentionally collect or use special category data (e.g., health information) as part of our standard services. If it is provided to us, we will handle it appropriately and only use it where permitted by law. 


Where we get personal data from 

We collect personal data: 

  1. directly from you or your authorised representatives (forms, onboarding, support, communications); 
  2. from your employer/organisation if you act for a business customer/merchant/supplier; 
  3. from third parties involved in providing our services (e.g., banks, payment scheme participants, technology providers); 
  4. from verification and risk providers (e.g., identity verification and fraud prevention providers); 
  5. from public sources where relevant (e.g., company registers). 

How we use personal data and our lawful bases 

We process personal data for the purposes below. Where we rely on legitimate interests (Article 6(1)(f) UK GDPR), we do so to operate and protect our business, provide secure services, prevent fraud, and communicate with business customers/suppliers/partners in a proportionate way. You can object to processing based on legitimate interests in certain circumstances. 

Processing table (integrating your document, amended for UK GDPR) 


How we use personal data and our lawful bases 

We process personal data for the purposes below. Where we rely on legitimate interests (Article 6(1)(f) UK GDPR), we do so to operate and protect our business, provide secure services, prevent fraud, and communicate with business customers/suppliers/partners in a proportionate way. You can object to processing based on legitimate interests in certain circumstances. 

Processing table (integrating your document, amended for UK GDPR) 

Purpose of processing 

Lawful basis (UK GDPR) 

Typical retention (summary) 

Legitimate interests (where relied on) 

Contracting and service delivery (concluding and performing contracts with customers; administering the relationship; dealing with service requests) 

Art. 6(1)(b) (contract) and, where relevant, Art. 6(1)(f) (legitimate interests) 

For the duration of the contract and then generally until relevant limitation periods expire (often up to 6 years depending on the claim type and circumstances) 

Operating our services and communicating with individuals acting for business customers/contractors to conclude/perform agreements 

Customer support and complaint handling 

Art. 6(1)(c) (legal obligation) and/or Art. 6(1)(f) (legitimate interests); and where the complaint relates to contract performance, Art. 6(1)(b) (contract) may also apply 

Typically 3 years after complaint closure (may be longer if needed for disputes/litigation) 

Ensuring service quality, resolving issues, preventing recurrence, and defending rights 

Debt recovery and defending legal claims (including disputes, litigation, enforcement) 

Art. 6(1)(f) (legitimate interests) and where relevant Art. 6(1)(b) (contract) 

For the duration of the dispute/claim and any enforcement, plus applicable limitation periods as needed 

Establishing, exercising or defending legal claims; recovering sums due 

Recordkeeping / archiving (contracts, settlement and accounting documents; audit trails) 

Art. 6(1)(c) (legal obligation) and/or Art. 6(1)(f) (legitimate interests) 

For periods required by applicable law and regulatory expectations; where no fixed period applies, retained only as long as necessary for the purpose and to manage legal risk 

Good governance, auditability, continuity of business records 

Marketing without electronic communications (e.g., postal marketing; some B2B relationship marketing) 

Art. 6(1)(f) (legitimate interests) unless consent is required in a particular case 

Until you object/opt out 

Promoting our services in a proportionate way and growing our business 

Marketing using electronic communications (e.g., email/SMS/phone) 

Art. 6(1)(a) (consent) where required; in some cases (e.g., certain B2B relationship marketing), we may rely on Art. 6(1)(f) (legitimate interests). We will send electronic marketing in line with the Privacy and Electronic Communications Regulations (PECR) and your marketing preferences. 

Until you withdraw consent or opt out; we may retain a suppression record (e.g., opt-out) for compliance and audit purposes (typically up to 6 years) 

Promoting our services and managing marketing preferences and suppression lists 

Recruitment 

Art. 6(1)(b) (steps prior to contract) and Art. 6(1)(f) (legitimate interests) are typically used for standard recruitment. Art. 6(1)(c) (legal obligation) may apply to specific checks (e.g., right-to-work where applicable). Art. 6(1)(a) (consent) applies where you opt in to be considered for future roles (talent pool). 

Typically up to 6 months after recruitment closes; if you consent to future roles, typically up to 12 months 

Efficient recruitment, filling roles, managing recruitment queries and potential challenges 

HR management (employees/contractors/associates) 

Art. 6(1)(a), (b), (c) and/or (f) as applicable; where special category data arises in the employment context (e.g., statutory sick pay administration), we may rely on Art. 9(2)(b) UK GDPR where applicable 

As required by employment, tax, social security and other applicable laws; contract records typically up to limitation periods 

Workforce management, security, and organisational administration 

Financial crime compliance (AML/CTF), sanctions screening, fraud prevention, and transaction monitoring 

Art. 6(1)(c) (legal obligation) and, where relevant, Art. 6(1)(f) (legitimate interests) 

Retained in line with applicable AML/CTF and regulatory recordkeeping requirements and as necessary for investigations, audit and regulatory enquiries 

Preventing fraud, protecting customers and the firm, maintaining platform integrity 

 

Retention note: Where retention periods differ (e.g., legal claims vs tax/accounting vs AML/CTF), we retain records for the longer period required/justified for the relevant purpose and legal obligations, and then securely delete or anonymise them. 


Who we share personal data with (recipients) 

We may share personal data with: 

  1. Regulators, law enforcement, courts and public authorities where we are required or permitted to do so. 
  2. Banks and payment service providers involved in processing/settlement, including correspondent/partner banks where relevant. 
  3. Payment and technology providers supporting our services (e.g., hosting, cloud, communications, customer support tools). 
  4. Identity verification, fraud prevention and screening providers (KYC/AML/sanctions/PEP screening; fraud monitoring). 
  5. Our professional advisers and auditors (legal, audit, accounting, consulting). 
  6. Suppliers and service providers acting on our instructions (processors) under appropriate contractual protections. 
  7. We may also share relevant data with counterparties and participants in the payments ecosystem where necessary to process a transaction, investigate disputes/chargebacks, or prevent fraud (for example, payees/payers and their PSPs where relevant). 

Some recipients will act as processors (processing on our instructions). Others may act as independent controllers (for example, banks and certain payment ecosystem participants processing data for their own legal/regulatory purposes). 


International transfers (outside the UK) 

We may transfer personal data to service providers or partners in countries outside the UK. 

Where required, we will ensure appropriate safeguards are in place for such transfers (for example, using approved contractual protections) and we will provide more information on request. 


How long we keep personal data (retention) 

We keep personal data only for as long as necessary for the purposes described above, including: 

  1. to provide our services; 
  2. to meet legal/regulatory recordkeeping requirements; 
  3. to resolve disputes and enforce our agreements. 

Typical retention factors include: the type of product/service, AML/financial crime requirements, limitation periods for legal claims, and regulatory expectations. 

You can request more detail on our retention approach by contacting info@mapeay.uk  


Automated processing and profiling 

We use automated tools to help us: 

  1. verify information; 
  2. detect and prevent fraud and misuse; 
  3. monitor transactions and manage risk; 
  4. improve security and service integrity. 

We do not make decisions that have legal effects (or similarly significant effects) about you based solely on automated processing. Where automated tools suggest an adverse action (e.g., restricting an account or refusing a request), a suitably trained person reviews relevant information before a final decision is made. 

If you have questions about a decision, contact us at info@mapepay.uk 


Your data protection rights 

Depending on the circumstances, you may have the right to: 

  1. request access to your personal data; 
  2. request correction of inaccurate data; 
  3. request erasure (in certain circumstances); 
  4. request restriction of processing (in certain circumstances); 
  5. object to processing (in certain circumstances, including where we rely on legitimate interests); 
  6. request data portability (in certain circumstances); 
  7. withdraw consent (where we rely on consent), without affecting the lawfulness of processing before withdrawal. 

To exercise your rights, contact us at: info@mapepay.uk We may need to verify your identity before responding. 


Complaints 

If you have concerns about how we use your personal data, please contact us first at info@mapeay.uk so we can try to resolve the issue. 

You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO): 
https://ico.org.uk/make-a-complaint/data-protection-complaints/ 


Cookies and similar technologies 

We use cookies and similar technologies on our websites and apps. For more information, including how to manage your cookie preferences, please refer to our Cookie Policy: Cookies – Open an Online Account.


Changes to this Privacy Policy 

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the “Last updated” date above. 

Legal & Policies

Support & Safety

Getting Started

MAP e-Pay – Copyright © 2024-2026. All rights reserved.

MAP e-Pay Solutions Limited is a company registered in England and Wales with Company Number 13627304 and registered office at 1 Kings Avenue, London, United Kingdom, N21 3NA. MAP e-Pay Solutions Limited is authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011 for the issuing of electronic money. FCA Firm Reference Number: 1032863.

Support: info@mapepay.uk
Telephone: +44 (0) 2038468807

Registered office: 1 Kings Avenue, London, United Kingdom, N21 3NA.
Head office: 1.12 Executive Office, 34 Lime Street, London, EC3M 7AT.

Apple, the Apple logo, iPhone, iPad, and iPod touch are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc., registered in the U.S. and other countries. MAP e-Pay application is not affiliated with, endorsed by, or sponsored by Apple Inc.

MAP e-Pay Solutions Limited is authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011 for the issuing of electronic money. FCA Firm Reference Number: 1032863. MAP e-Pay accounts are electronic money accounts and are not bank accounts. Electronic money and payment services are not covered by the Financial Services Compensation Scheme.