Privacy Policy
The full policy is below. Here's the short version first — what actually matters about how we handle your data.
We're a B2B business. Most of the personal data we hold is straightforward business contact information — names, email addresses, and phone numbers of people at organisations we work with. We use it to run the service, communicate with clients, and meet our legal obligations. That's it.
On the payment side, the whole point of what we do is that sensitive card data is never stored by us or exposed to our clients' systems. Our DTMF masking technology suppresses card digits at the point of entry, so they're not heard by agents, not captured in call recordings, and not stored anywhere in the contact centre environment. We're a PCI DSS Level 1 certified service provider — data handling is central to our business, and we take it seriously.
Last updated 2 March 2026
Who we are
This notice is from Paytia Ltd, 37th Floor, 1 Canada Square, London E14 5AA, England. It covers what happens when you visit www.paytia.com or any of our sites that link here, use our mobile applications, or deal with us in other ways — marketing and events included.
One distinction matters before anything else. For the data described in this notice — your enquiries, your account details, your visits to our site — we're the data controller: we decide how and why it's processed. But when we process personal data on behalf of our customers as part of delivering the service, the customer is the controller and we act as their processor under a data processing agreement. If your data reached us that way, the organisation you dealt with holds the answers about it — read their privacy policy and direct questions to them.
What we collect
We collect what you give us. When you register interest, use the service, or contact us, that can include your name, phone number, email address, username, password, and billing address. We don't store debit or credit card numbers. Card data entered through our platform passes through our PCI DSS Level 1 certified systems only long enough to be processed and tokenised — it's kept out of system logs and never retained. We don't process sensitive (special category) information, and we don't collect personal information from third-party sources.
Some information arrives automatically when you visit: your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and how and when you use the service. It doesn't reveal who you are on its own — we need it to keep the service secure and running, and for our own analytics.
Our mobile apps may ask permission to send push notifications about your account. You can switch those off in your device settings. Any information we receive from Google APIs is handled in line with the Google API Services User Data Policy, including its Limited Use requirements.
How we use it, and our legal grounds
We process your information to deliver the service you've asked for, and in rare cases to protect someone's vital interests. Anything beyond the purposes in this notice happens only with your prior explicit consent.
Under UK GDPR and EU GDPR, our legal bases are: your consent (which you can withdraw at any time), performance of a contract with you, compliance with our legal obligations, and protection of vital interests. If you're in Canada, we process your information with your express or implied consent, except in the limited cases where the law permits otherwise.
Who we share it with
We don't sell personal information, and we don't share it for third-party marketing. There are two situations where sharing happens: business transfers — if we're involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that deal — and Google Maps Platform APIs, where features rely on them.
Cookies and tracking
We use cookies and similar technologies to keep the service secure, remember your preferences, and understand how the site is used. We also permit third-party analytics and advertising technologies to run on the site. You can manage what runs through the consent banner, and the full detail lives in our cookie policy.
AI-powered features
Some of our products include features powered by artificial intelligence or machine learning. Personal information processed through them is handled under this notice and our agreements with the providers involved — it gets the same protection as everything else we process.
How long we keep it
Only as long as we need it for the purposes in this notice, or as long as the law requires (tax and accounting rules, for example). Account information is kept while you hold an account with us. When there's no longer a business need, we delete or anonymise the data — and where that's not immediately possible, such as backup archives, we isolate it from further processing until deletion is.
How we protect it
We've implemented appropriate technical and organisational measures to protect the personal information we process — data security is the core of our business. That said, no transmission over the internet can be guaranteed 100% secure, so we can't promise that determined attackers will never defeat any safeguard. Use the service in a secure environment.
Children
The service isn't aimed at anyone under 18 and we don't knowingly collect data from them. If you believe we hold data on someone under 18, contact us at privacy@paytia.comand we'll deal with it.
Your rights
If you're in the UK, EEA, Switzerland, or Canada, you can ask us for access to and a copy of your personal information, ask us to correct or erase it, restrict how we process it, object to processing, and where applicable request portability. You won't be subject to decisions with legal or similarly significant effects made solely by automated means — if that ever happens, we'll tell you, explain the main factors, and offer human review. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of anything already done.
To exercise any of these rights, submit a privacy request or email privacy@paytia.com. If you're in the UK and unhappy with how we've handled your information, complain to us first and we'll respond — and you can also complain to the Information Commissioner's Office under UK GDPR and the Data Protection Act 2018. EEA and Swiss residents can contact their local supervisory authority.
Do-Not-Track
No uniform standard for recognising browser Do-Not-Track signals has been finalised, so like most websites we don't currently respond to them. If a standard is adopted that we must follow, we'll update this notice.
US state privacy rights
If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you have rights to access, correct, delete, and get a copy of your personal information, and to withdraw consent. In the past twelve months the only category of personal information we've collected is identifiers (name, contact details, IP address, email, account name) — retained while you hold an account with us. We haven't sold, shared, or disclosed personal information to third parties for commercial purposes, and we don't use or disclose sensitive personal information for inferring characteristics. If we decline a rights request, you can appeal by emailing privacy@paytia.com; California residents can also request the 'Shine the Light' disclosure via our contact form.
Changes to this notice
We update this notice as necessary to stay compliant with relevant laws. The date at the top tells you when it was last revised. If we make material changes, we'll take reasonable steps to let you know.
How to contact us
Our Data Protection Officer is Craig Marston — craig.marston@paytia.com, +44 207 183 3536, or by post: Paytia Ltd, Data Protection Officer, 37th Floor, 1 Canada Square, London E14 5AA, England.
We've appointed Prighter as our privacy representative. For the EEA and Switzerland: Prighter, Schellinggasse 3, 1010 Vienna, Austria — info@prighter.com, +43 1 9974124. For the UK: Prighter, 20 Mortlake High Street, London SW14 8JN.
To review, update, or delete the data we hold on you, raise it at support.paytia.com or use the privacy request form.