Pre-launch review: 1 unfilled fact in the Privacy Policy

This document has not been through legal sign-off. The items below are still placeholders. They are collected automatically from the copy, so this list cannot fall out of step with the text.

ICO registration number

Privacy Policy

Applies from a date to be confirmed.

1. Who we are and what we are the data controller for

QuestPay Ltd ("we", "us", "Quest") is the data controller for the personal data described in this notice. Our registered office is 195-197 Whiteladies Road, Bristol, England, BS8 2SB, and our company number is 17357263. We are registered with the Information Commissioner as [[ICO registration number]].

This notice explains what personal data we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it. It applies to this website and to the transfers you arrange through it.

2. What we collect

You give us

Identity data: your name, date of birth, nationality, residential address, and the identity documents you upload for verification, including the document image, its number, and its expiry date.
Contact data: your email address, telephone number, and any message you send us.
Transaction data: the amount you send, the currency, the reference number, the destination, the fee, the exchange rate applied, the date and time, and the status of the transfer.
Recipient data: your recipient's name, their contact details, and their identity documents, where we are required to verify them.
Account data: your account identifier, your login details, and your settings.
Anything else you choose to tell us, including in support messages.

We collect automatically

Technical data: your IP address, the type of device and browser you use, your operating system, screen resolution, and your language settings.
Security data: sign-in times, failed sign-in attempts, and the device and network a session comes from. We use this to spot account takeover and fraud.
Usage data: which pages you visit, what you click, and how you move around the site, which helps us see where the service is confusing.
Cookies and similar technologies - see section 11.

We receive from others

From the bank you pay from: your name, account identifiers, the amount, and the payment status.
From our payout partner: whether a transfer reached your recipient, and when it was collected, so we can tell you.
From identity-verification and sanctions-screening providers: confirmation that an identity check passed or failed, and any mismatch they flag, such as a document in the wrong name.
From fraud-prevention databases: whether your details, your device, or your payment instruments appear on a fraud or sanctions list.
From public registers, where we have checked a company's details.

We do not ask for, and you should not send us, data about anyone else - a family member, a colleague - unless they are the recipient of a transfer or have told us themselves. We do not collect special category data unless it arrives unavoidably as part of an identity document.

3. Why we use it, and the lawful basis

Under UK data protection law we can only use your personal data where we have a lawful basis. We rely on the following.

Contract - to provide the service you asked for

To create and maintain your account, take your payment, arrange the transfer, pay the recipient, and handle your support requests. Without this we cannot send money.
To verify your identity and your recipient's identity, because we are legally required to before we can provide a money transfer service.
To calculate and apply our fee, and to hold a rate for the transfer you accept.
To keep records of transactions for five years, which we are required to do.

Legal obligation - because the law requires it

Identity verification and customer due diligence, under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
Sanctions screening, under UK and international sanctions regimes. This means we must know who you and your recipient are before we can send.
Reporting suspicious activity to the National Crime Agency where the law requires it, and responding to lawful requests from law enforcement and courts.
Keeping the records the Money Laundering Regulations and tax law require.

Legitimate interests - our business, balanced against your rights

Preventing fraud, and investigating a transaction that looks suspicious, so that your money and other customers' money are protected.
Securing our systems, and diagnosing faults and outages.
Improving the website and the service, using aggregated usage data.
Deciding which products and features to offer, and whether a transaction looks like our normal pattern for you.
Establishing, exercising or defending legal claims, and responding to complaints.

Where we rely on legitimate interests, we have balanced our interest against your rights and freedoms, and we have considered whether the impact on you would be minor. You can object to processing based on legitimate interests at any time - see section 9.

Consent, where we ask for it

Non-essential marketing, if you have asked to receive it. You can withdraw consent at any time without affecting anything we did before.
Optional analytics or session-recording cookies, which are off until you accept them.

We do not use your personal data for automated decisions that produce legal effects or similarly significant effects about you. We do use systems to flag transactions that look like fraud, but a person reviews those flags, and you can ask us to review the outcome and correct anything wrong - see section 10.

4. Special category and criminal offence data

Identity documents may contain a photograph, which is biometric data, and may reveal information about health, ethnicity or political opinions if the document or the photograph shows it. We do not ask for this deliberately, but it can arrive as part of a document you send us for identity verification. It is therefore special category data under data protection law.

We use it only to satisfy our legal obligation to identify you, and we do not use it for any other purpose, we do not share it beyond section 6, and we do not retain it beyond the period set out in section 8. Sanctions and fraud screening may also require us to record whether a person has a criminal conviction or a regulatory sanction, which is criminal offence data - we use that on our legal obligation, again not on our legitimate interests.

Where we rely on special category data, we rely on the condition that the processing is necessary for compliance with a legal obligation, and on the substantial public interest condition where we screen for sanctions and fraud. We are subject to the exemption in Schedule 1 Part 2 paragraph 8 of the Data Protection Act 2018.

5. How we use the data on a transfer

For every transfer we use your data to identify you and your recipient, screen both against sanctions and fraud, take your payment, hold a rate, release the funds to the payout partner, and record the transaction for as long as the law requires. If the transfer is cancelled or fails, we use it to refund you.

6. Who we share it with

We do not sell personal data, and we do not share it for marketing. We share it only with the categories below, and only to the extent each one needs.

Our payout partners

We pass your recipient's name, their reference number, the amount, and the payout location, because that is what is needed to pay them and to let them release the money.
This is how your transfer reaches your recipient. They become the controller of that data for the payout, and their own privacy terms also apply to it.

Service providers, acting on our instructions

Identity-verification and sanctions-screening providers, who check documents and identity against authoritative sources.
Fraud-prevention providers, who assess whether a transaction looks like fraud.
Our hosting, cloud, analytics, email and customer-support providers.
Our bank, to receive your payment and hold funds until the transfer is paid out.
Each is bound by a written contract that limits it to our instructions and to keeping the data secure.

Authorities and others

HM Revenue & Customs, the Information Commissioner's Office and other public authorities, where we are obliged to report or disclose.
The police and other law-enforcement bodies, where we suspect money laundering, terrorist financing, or fraud, or where we receive a lawful request.
A professional adviser, an auditor, or a buyer of the business, in confidence and subject to the same protections.
Anyone else, only where the law requires or allows it, and where we are satisfied it is necessary.

We do not disclose your data to a third party in a way that is incompatible with the purposes in section 3, and we do not share it for another party's own purposes.

7. Transfers outside the UK

The countries you send to and collect in are outside the UK, so some of your data will necessarily be processed abroad - by a payout partner in the destination country, for example, so they can pay your recipient. This is an international transfer of personal data.

Where we transfer personal data outside the UK, we rely on a lawful transfer mechanism. Depending on the country and the recipient, that is the UK IDTA or Addendum to the EU Standard Contractual Clauses, or an adequacy regulation covering that country. Where a transfer is necessary for the service to work - because your recipient is being paid in their own country - we rely on the explicit consent you give by instructing the transfer, and on the contractual necessity of providing that service.

Where we do rely on consent, you can withdraw it at any time by contacting us, and we will stop the relevant processing. Withdrawing consent does not affect anything we did before you withdrew it. If you withdraw consent for a transfer we cannot complete, the transfer will be cancelled and refunded in line with section 11 of our Terms of Service.

Our current list of transfer destinations, and the mechanism used for each, is available on request from support@questpay.com (subject line "Data protection"). We keep a record of our transfer risk assessments and will tell you about any material change to how a destination is protected.

8. How long we keep it

We keep personal data only for as long as we need it for the purposes in section 3, and for as long as the law requires us to keep it. Retention periods are set by the regulatory obligations that apply to each type of record, and we do not keep data simply because it is useful to us.

Current retention periods

Identity verification records: five years after the end of the business relationship, as the Money Laundering Regulations require.
Transaction records: five years after the transaction.
Records needed for tax: six years, as HMRC requires.
Support correspondence: two years after the matter is closed.
Fraud and security logs: two years, unless the matter is escalated to an investigation, in which case the longer investigation period applies.
Marketing data, where you have consented: until you withdraw consent, then a short period to record that you did.
Aggregated, anonymised statistics: indefinitely, because they can no longer be linked back to you.

When a retention period ends, we delete the data or anonymise it so it can no longer identify you. Deleting a transaction record is not something we can do on request, because the law requires us to keep it - but we can restrict its use while you exercise a right such as erasure, and we will tell you if a request you make cannot be met and why.

9. Your rights

You have the following rights under UK data protection law. To use any of them, contact us at support@questpay.com (subject line "Data protection"). We will not charge you, we will not ask you for a reason, and we will not make you go through your bank.

Access - ask what personal data we hold about you, why we hold it, who we shared it with, how long we will keep it, and whether we use automated decision-making. We will give you a copy.
Rectification - ask us to correct data that is wrong or incomplete. We will correct it, unless doing so would interfere with another person's rights or the accuracy of a transaction record we must keep.
Erasure - ask us to delete your data. We will do it where we have no overriding legal reason to keep it. We usually cannot erase transaction or identity records, because we are required to keep them - but we will tell you clearly if that applies to your request rather than silently ignoring it.
Restriction - ask us to stop using your data while a dispute about accuracy or legitimate interests is resolved, while a complaint is being handled, or where you have objected.
Object - object to processing based on legitimate interests, including our use of transaction data to build a profile of your activity. We will stop unless we can show a compelling reason that overrides your interests, in which case we will explain that reason and how to complain.
Withdraw consent - at any time, where we relied on consent. This does not affect processing we did before you withdrew it.
Portability - ask for certain data you gave us, in a structured, commonly used, machine-readable format. This applies to data we process on consent or on contract, and it does not include records we must keep for regulatory reasons.
Complain - to the Information Commissioner's Office, at ico.org.uk, if you think we have mishandled your data. We would rather you raised it with us first, but you are not required to, and asking us will not stop you complaining to the ICO.

We respond to a rights request within one month, and we will tell you promptly if we need more time and why. We may ask you to confirm your identity before we act, to stop someone else pretending to be you.

10. Automated decision-making

We use systems to monitor transactions for fraud, and identity-verification providers use automated checks to compare a document and a face against authoritative sources. These can produce a flag that stops a transfer.

Where a flag stops a transfer, a member of our staff reviews it and makes the decision. We do not use automated decision-making alone to refuse you a service, and we do not use it to produce legal or similarly significant effects about you. This means you do not have a right to human intervention in respect of a purely automated decision - but in practice a person is always involved, and you can ask to speak to them.

If a check fails and you believe it is wrong - because a document is in an old name, or a passport is damaged - tell us and we will look again, and we will consider what other evidence to accept. See our identity verification help topic.

11. Cookies

Strictly necessary

These keep you signed in, protect forms against cross-site request forgery, remember your cookie choices, and let the site load. The site does not work properly without them, so they do not need consent.

Optional, off until you accept

Analytics cookies tell us which pages are used and where people get stuck. They help us improve the site, and they are not set until you accept them.
You can change your choice at any time through the cookie settings link in the footer. Refusing optional cookies does not stop you using the service.

12. How we keep it secure

We use encryption in transit and at rest, access control on a need-to-know basis, multi-factor authentication for staff who can see customer data, and logging of access to customer records. Personal data is held in the UK and in the country of the relevant service provider or payout partner, as set out in section 7.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to you, we will tell you without undue delay and we will notify the Information Commissioner where the law requires it.

13. Children

The service is for adults. We do not knowingly collect personal data from anyone under 18, and we cannot open an account for a child. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this notice

We update this notice when we change what we do, what we collect, or the law. The date at the top of this page is the version in force. If a change materially affects how we use data you have already given us, we will tell you before it takes effect, and you can object - see section 9.

15. How to contact us

Write to our Data Protection Officer at support@questpay.com (subject line "Data protection"), or to 195-197 Whiteladies Road, Bristol, England, BS8 2SB. Our registered office is 195-197 Whiteladies Road, Bristol, England, BS8 2SB and our company number is 17357263. Our data protection regulator is the Information Commissioner's Office, ico.org.uk.

Quest is a trading name of QuestPay Ltd, registered in England and Wales.