Privacy Notice

PayCraft Limited | Last reviewed 22 October 2026

Who we are and how to contact us

PayCraft Limited is responsible for the personal information described in this notice. We are registered in England and Wales under company number 16731398. Our registered office is 117 Ffordd Cambria, Pontarddulais, Swansea, Wales, SA4 8AB. Contact us about privacy, your rights or a complaint at admin@paycraft.co.uk, or write to our registered office marked Data protection.

This notice covers our informational website, Home early-access form, About enquiry form, pilot-interest form, retained records of previous optional news signups and related correspondence. The About-page newsletter signup is currently paused. PayCraft is pre-launch. Future application use and actual pilot participation will require appropriate further terms and privacy information before they begin.

Information and purposes

The Home and About enquiry forms ask for first name, last name, email address and a message, all marked required. The pilot-interest form asks for first name, last name and email, with optional trade or project details. You are not legally required to register or enquire. Please do not include bank/card details, identity documents, sensitive information or unnecessary information about customers or other people.

We use these details to answer the request, understand prospective participants’ needs and contact them about relevant early-access or pilot opportunities. Our lawful basis is legitimate interests in managing requested correspondence and developing a relevant pilot. We limit follow-up to the request; registration does not automatically subscribe you to general marketing. You can object to further contact at admin@paycraft.co.uk.

General marketing requires separate valid permission where required. Registering interest or sending an enquiry does not subscribe you to general marketing. If you previously gave consent, you may withdraw it at any time by contacting admin@paycraft.co.uk or using an unsubscribe route included in a message. Withdrawal does not affect earlier lawful processing. We retain minimal information needed to respect a request not to receive marketing.

We receive the information in emails, complaints and rights requests you send us. We handle data-protection complaints and rights requests to meet our legal obligations. Squarespace and Google reCAPTCHA also process technical information to deliver the website and help prevent spam and abuse. Proportionate security processing is assessed separately from optional tracking; our Cookie Notice explains website technologies.

Recipients and international processing

Squarespace supplies the website, native forms and contact/submission handling. Google provides our Workspace business email and reCAPTCHA security checks. The legacy Home and About forms also send notification emails to a founder Gmail mailbox. The pilot form is configured to notify admin@paycraft.co.uk. Authorised people handling enquiries, pilot interest and privacy matters use the information for those purposes.

We may disclose information where legally required or where necessary and lawful to establish, exercise or defend legal rights. Registering interest does not authorise sharing with a future payment provider or unrelated marketing partners.

Our providers may process information outside the UK, including in the United States. We do not promise UK-only storage.

Squarespace’s Data Processing Addendum permits processing in countries where Squarespace and its subprocessors operate. It provides for the UK Extension to the EU–US Data Privacy Framework for covered transfers to Squarespace, Inc. in the United States, with standard contractual clauses and the UK Addendum where required. Its transfer provisions are available at https://www.squarespace.com/dpa.

Google Workspace business email is covered by Google’s applicable Cloud Data Processing Addendum. Google documents use of the UK Extension to the EU–US Data Privacy Framework for covered UK transfers to and onwards from the United States, with contractual transfer provisions for other restricted transfers as applicable. These terms do not mean that email is stored only in the UK. See https://cloud.google.com/terms/data-processing-addendum/ and https://cloud.google.com/terms/alternative-transfer-solution.

Notification copies sent to the founder’s personal Gmail mailbox are distinct from Workspace email. Google’s consumer Privacy Policy and data-transfer framework disclosures apply to that service; we do not represent that the Workspace processing agreement covers personal Gmail. Google’s published transfer information is at https://policies.google.com/privacy/frameworks.

Our forms use Squarespace’s integrated Google reCAPTCHA service for security and spam prevention. Google’s current reCAPTCHA documentation describes Google as a processor of Customer Data under its Cloud Data Processing Addendum. The Squarespace integration’s specific supplier-contract chain has not been independently confirmed, so we do not assert that PayCraft has a separate direct reCAPTCHA processing agreement. See https://docs.cloud.google.com/recaptcha/docs/faq.

Contact admin@paycraft.co.uk to request further information about the transfer arrangements and copies of relevant safeguards.

Retention

We review inactive pilot and early-access registrations after six months. We delete inactive registrations no later than 12 months after registration or the last substantive two-way contact, whichever is later, unless a specific continuing purpose or legal hold justifies longer. An outgoing marketing email alone does not restart the period. Actual participants will receive the separate retention information relevant to participation.

Ordinary enquiry correspondence is retained for up to 12 months after closure. Complaints and privacy-rights correspondence are normally retained for 24 months after closure to document the response and address follow-up. Legal correspondence necessary to handle a claim is reviewed at closure and retained for up to six years afterwards where justified for legal defence; a specific claim or legal hold may require a different period.

Evidence of marketing consent is retained while we rely on it and normally for 24 months after the last marketing use or withdrawal, whichever is later, to demonstrate the permission relied on. Minimal suppression records are retained while needed to prevent further unwanted marketing and reviewed annually. We minimise the details retained. Technical provider logs and backup cycles follow the applicable provider arrangements and are reviewed separately.

Deletion is managed manually across relevant Squarespace records, notification emails and known copies or exports. We do not claim automated deletion. Provider backups may remain for their documented cycles; justified legal holds are recorded and reviewed.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You may object to direct marketing at any time. Contact admin@paycraft.co.uk. We may request proportionate information to understand the request or verify identity.

The interest-registration process is not intended to make solely automated decisions with legal or similarly significant effects. Anti-spam checks may filter a submission; email us if you have difficulty.

Complaints

You have the right to complain directly to PayCraft about how we handle your personal information. Email admin@paycraft.co.uk or write to the registered office marked Data protection complaint. Tell us what happened, when and how we can contact you. You do not need a special form or legal terminology.

We will acknowledge receipt within 30 days. We will begin appropriate enquiries and investigate without undue delay, keep you informed of progress and explain delays, and communicate the outcome and any remedial action without undue delay. The acknowledgement deadline does not postpone the investigation.

You also have the right to complain to the Information Commission (ICO), the UK data protection regulator, at https://ico.org.uk/make-a-complaint/. You do not have to wait for our internal process to finish before contacting the ICO. We will update this notice if our actual processing changes.