App Privacy Policy

1.​ Introduction

1.1.​ Paylio Ltd ("Paylio", "we", "our" or "us") is committed to protecting the privacy of everyone who uses our platform. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when customers, tradespeople and other users access or use the Paylio platform.

1.2.​ The Paylio platform enables customers and tradespeople to create projects, agree Milestones, administer payments through regulated payment providers, communicate with one another and access the contractual processes made available through the platform, including dispute administration and payment workflows.

1.3.​ We recognise the importance of protecting personal information and are committed to processing personal data fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

1.4.​ This Privacy Policy explains what information we collect, how we use it, the circumstances in which it may be shared, how long it is retained and the rights available to individuals in relation to their personal data.

1.5.​ This Privacy Policy forms part of the contractual documentation governing the use of the Paylio platform and should be read together with our Platform Terms and Conditions, Dispute Resolution Framework, Chargeback and Payment Reversal Policy, Acceptable Use Policy and Cookie Policy.

1.6.​ Certain services available through the Paylio platform, including payment processing and related regulated payment services, are provided by independent regulated payment providers that process personal data under their own legal and regulatory obligations. This Privacy Policy applies only to the personal data processed by Paylio unless expressly stated otherwise.

1.7.​ By accessing or using the Paylio platform, users acknowledge that their personal data may be processed as described in this Privacy Policy.

2.​ Definitions

For the purposes of this Privacy Policy, the following definitions apply unless the context requires otherwise.

2.1.​ Personal Data means any information relating to an identified or identifiable natural person, as defined under applicable data protection legislation.

2.2.​ Processing means any operation or set of operations performed on Personal Data, whether by automated or non-automated means, including collection, recording, organisation, storage, use, disclosure, transfer, restriction, deletion or destruction.

2.3.​ User means any individual who accesses or uses the Paylio platform, including customers, tradespeople, authorised representatives and account holders.

2.4.​ Customer means a User who purchases or requests services through the Paylio platform.

2.5.​ Tradesperson means a User who offers or provides services through the Paylio platform.

2.6.​ Payment Provider means Stripe Payments UK, Ltd. and Stripe Payments Europe, Limited (together "Stripe"), regulated electronic money institutions, or any other regulated payment service provider responsible for processing payments, administering payment arrangements or providing regulated payment services in connection with the Paylio platform.

2.7.​ Platform Documentation means the Platform Terms and Conditions, the Dispute Resolution Framework, the Chargeback and Payment Reversal Policy, the Acceptable Use Policy, the Cookie Policy and any other contractual documents governing the use of the Paylio platform, as amended from time to time. Unless otherwise stated, words and expressions defined in the Platform Terms and Conditions have the same meaning when used in this Privacy Policy.

3.​ Who We Are

3.1.​ Paylio Ltd is the operator of the Paylio platform and is responsible for determining how personal data is processed in connection with the services made available through the platform. For the purposes of applicable data protection legislation, Paylio is the data controller in relation to the personal data described in this Privacy Policy, except where another organisation independently determines the purposes and means of processing.

3.2.​ Paylio Ltd is a company registered in England and Wales under company number 16938257, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. Paylio is registered with the Information Commissioner's Office (ICO) under registration number ZC284194. Privacy questions and requests can be sent to privacy@paylio.co.uk.

3.3.​ Unless expressly stated otherwise, Paylio acts as the controller of the personal data described in this Privacy Policy.

3.4.​ The Paylio platform allows customers and tradespeople to create projects, communicate with one another, manage Milestones, administer payment workflows through regulated payment providers and access the contractual processes that support the operation of the platform. In providing these services, Paylio processes personal data that is necessary to establish user accounts, administer projects, facilitate communications, support payment workflows, manage disputes, maintain platform security and comply with applicable legal and regulatory obligations.

3.5.​ Certain payment services made available through the platform are provided by regulated payment providers. Those organisations process personal data for their own purposes in connection with payment processing, identity verification, fraud prevention, anti-money laundering compliance, sanctions screening and other regulated payment services. Where a regulated payment provider processes personal data as an independent controller, its processing activities will be governed by its own privacy documentation and regulatory obligations.

3.6.​ Payments for jobs made through the platform are processed by Stripe and held until they are released to the business or refunded, for up to one year from the date of payment. Stripe also verifies the identity of businesses that set up a payment account and carries out fraud prevention and anti-money laundering checks, acting as an independent controller under its own privacy policy (stripe.com/gb/privacy).

3.7.​ Throughout this Privacy Policy, references to "Paylio", "we", "our" or "us" refer to Paylio Ltd unless the context requires otherwise.

4. Scope of this Privacy Policy

4.1.​ This Privacy Policy applies to personal data processed by Paylio in connection with the operation of the Paylio platform, including our mobile applications, software, communication tools, project management services, payment administration workflows, dispute administration processes and any other services made available by us from time to time. Our website has its own privacy policy, available at paylio.co.uk.

4.2.​ It applies to customers, tradespeople, prospective users, authorised representatives of business customers and any other individuals whose personal data is processed through their interaction with the platform.

4.3.​ This Privacy Policy does not apply to processing activities carried out independently by regulated payment providers, banks, card issuers, payment networks or other third-party organisations that determine their own purposes and means of processing personal data. Those organisations are responsible for providing their own privacy information where required by applicable law.

4.4.​ Where the Paylio platform contains links to third-party websites, applications or services, this Privacy Policy applies only to the processing activities carried out by Paylio. We are not responsible for the privacy practices, security measures or content of third-party services that operate independently of the platform.

5. Personal Data We Collect

5.1.​ The personal data processed by Paylio will depend upon the way in which the platform is used, the services requested and the information provided by users during the operation of a project.

5.2.​ Information collected may include identification details such as a user's name, business name, contact information, account credentials and profile information necessary to establish and manage a Paylio account.

5.3.​ Where users create or participate in projects through the platform, Paylio may process project-related information including quotations, project descriptions, Milestone information, invoices, schedules, photographs, videos, specifications, communications exchanged through the platform and other documents necessary to administer the contractual relationship between customers and tradespeople.

5.4.​ Where payment functionality is used, Paylio may receive limited payment-related information necessary to administer the platform, such as payment status, transaction references, release instructions and payment history. Sensitive payment credentials, payment card details and regulated payment verification information are generally processed directly by the regulated payment provider rather than by Paylio.

5.5.​ Where a business chooses to receive deposits by bank transfer, Paylio stores the business's bank account details (account name, bank name, sort code and account number) in encrypted form and shows them to the customer on the relevant job so that the deposit can be paid.

5.6.​ Where disputes arise, Paylio may process evidence submitted by customers and tradespeople, including photographs, videos, written statements, project records, communications, inspection reports and any other information provided to support the contractual dispute process.

5.7.​ We may also collect technical information relating to the use of the platform, including device information, browser type, IP address, operating system, log data, session information, usage analytics and security information necessary to protect the platform, detect fraud, investigate security incidents and improvethe services we provide.

5.8.​ With the user's permission, the Paylio app may access the device's location (to find businesses and jobs nearby), microphone (to dictate job descriptions, which the device's built-in speech recognition service provided by Apple or Google converts to text), camera and photo library (to add photos, documents and evidence) and notifications (to send push notifications). Where a user turns on Face ID, Touch ID or another biometric lock, the biometric check takes place entirely on the device and Paylio does not receive any biometric data. Permissions can be withdrawn at any time in the device settings.

5.9.​ Where a user consents to analytics, we use Mixpanel to understand how the app is used, including session replays that record the screens a user views and their interactions with them. Text, images, documents and maps shown on screen are hidden in session replays. Analytics is off unless the user opts in, and can be turned off at any time in the app under Profile, Preferences.

5.10.​ Where an issue is raised on a job, details of the issue, the parties' comments and related job information may be processed using an artificial intelligence service provided by Anthropic to produce a summary for Paylio's resolution team. Anthropic processes this information on Paylio's behalf and does not use it to train its models. Decisions on issues are made by people, not by the artificial intelligence service.

5.11.​ Where a business connects an accounting service (Xero, QuickBooks or Sage), Paylio sends the invoice, customer and payment details that the business chooses to send to that service, at the business's request. The credentials for that connection are stored in encrypted form, and the connection can be ended at any time in the app or in the accounting service.

5.12.​ Business profiles, including reviews and ratings left by customers, are visible to other users of the platform. Jobs posted to the job board are visible to businesses using the platform.

5.13.​ The categories of personal data processed by Paylio may change as the platform develops. Where we introduce new processing activities that materially affect users' privacy rights, this Privacy Policy will be updated accordingly.

6.​ How We Collect Personal Data

6.1.​ Paylio collects personal data directly from users when they create an account, complete their profile, submit information through the platform, communicate with other users, create or accept projects, upload documents or evidence, participate in disputes or otherwise interact with our services.

6.2.​ We also collect information automatically when users access or use the platform. This may include technical information relating to devices, browsers, operating systems, IP addresses, session information, usage data, log files and security events. This information helps us maintain the security of the platform, monitor performance, investigate technical issues and improve the services we provide.

6.3.​ In some circumstances, personal data may be received from regulated payment providers, service providers or other third parties where this is necessary to support the operation of the platform. For example, we may receive payment status updates, transaction references, verification results or other information that enables us to administer payment workflows or contractual processes. We do not receive all information processed by regulated payment providers, particularly where they process personal data independently for regulatory purposes.

6.4.​ We may also receive information from Companies House when verifying a business, and from address lookup services when a user searches for an address.

6.5.​ Personal data may also be obtained from other users where this forms part of a project, communication, dispute submission or contractual process carried out through the platform. This may include information contained within quotations, invoices, project documentation, correspondence, photographs, videos or other evidence submitted during the normal operation of the platform.

6.6.​ Where we receive personal data from third parties, we process that information only where there is an appropriate legal basis for doing so and only to the extent reasonably necessary to provide our services, administer the platform or comply with our legal obligations.

7.​ How We Use Personal Data

7.1.​ Paylio processes personal data only where there is a legitimate purpose connected with the operation of the platform or where processing is otherwise permitted under applicable data protection legislation.

7.2.​ We use personal data to create and administer user accounts, verify account information, provide access to platform functionality and enable customers and tradespeople to manage projects through the Paylio platform.

7.3.​ Where a business uploads its certificate of incorporation, we use it, together with information from Companies House, to verify that the business is a registered company.

7.4.​ Personal data is used to facilitate communications between users, administer Milestones, support payment workflows, record payment instructions, maintain project records and enable users to access the contractual services available through the platform.

7.5.​ Where disputes arise, we process personal data to review evidence, administer the contractual dispute process, maintain appropriate records, communicate with the parties involved and support the operation of the payment workflow in accordance with the Platform Documentation.

7.6.​ We also process personal data to maintain platform security, prevent fraud, investigate misuse, protect users, detect unauthorised activity, improve the performance of our services and maintain appropriate audit records.

7.7.​ Where necessary, personal data may be processed to comply with legal obligations, respond to regulatory enquiries, cooperate with regulated payment providers, protect our legal rights, establish or defend legal claims and enforce our contractual documentation.

7.8.​ From time to time, we may also process limited usage information to understand how the platform is being used, improve user experience, develop new features and ensure that our services continue to operate efficiently. Where analytics or similar technologies are used, further information is provided in our Cookie Policy.

7.9.​ We do not sell personal data to third parties or use personal information for unrelated commercial purposes that are incompatible with the reasons for which the information was originally collected.

8.​ Legal Bases for Processing

8.1.​ Paylio processes personal data only where an appropriate legal basis exists under the UK General Data Protection Regulation and the Data Protection Act 2018.

8.2.​ In most cases, processing is necessary for the performance of a contract with the user or in order to take steps at the user's request before entering into a contract. This includes creating accounts, administering projects, supporting payment workflows, providing platform functionality and operating the contractual processes described in the Platform Documentation.

8.3.​ Certain processing activities are necessary for compliance with legal obligations. These may include responding to lawful requests from regulators, courts or competent authorities, maintaining records where required by law and cooperating with regulated payment providers where necessary to comply with legal or regulatory requirements.

8.4.​ We also process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by the rights and freedoms of the individual. Our legitimate interests include maintaining platform security, preventing fraud, improving our services, protecting users, administering disputes, enforcing our contractual rights, maintaining business records and ensuring the reliable operation of the platform.

8.5.​ Where consent is required under applicable law, such as for certain categories of cookies or electronic marketing communications, we will request consent before carrying out the relevant processing. Individuals may withdraw their consent at any time where processing is based on consent, although this will not affect the lawfulness of processing carried out before consent was withdrawn.

8.6.​ Processing based on consent includes analytics and session replay in the app, and marketing communications by email, SMS or push notification. Each of these is off unless the user opts in, and can be changed at any time in the app's privacy and notification settings.

9. Who We Share Personal Data With

9.1.​ Paylio does not sell personal data to third parties. We share personal data only where it is necessary to operate the platform, provide our services, comply with legal obligations or protect our legitimate interests.

9.2.​ Personal data may be shared with regulated payment providers that process payments, administer payment arrangements, carry out identity verification, fraud prevention, sanctions screening, anti-money laundering checks and other regulated payment services. These organisations process personal data in accordance with their own legal and regulatory obligations and are responsible for providing their own privacy information.

9.3.​ We may also share personal data with trusted service providers that support the operation of the platform. These may include providers of cloud hosting, software infrastructure, customer support, email services, security monitoring, analytics, backup services and other technology services. These providers process personal data only on our instructions and are required to protect it using appropriate technical and organisational measures.

9.4.​ These service providers currently include: Supabase (database, file storage and hosting, in the United Kingdom); Stripe (payments, as described in section 3); Resend (email delivery); Zoho Desk (customer support, for messages sent through the contact form, feedback and support emails, with data stored in the European Union); Expo, Apple and Google (push notifications); Mixpanel (analytics and session replay, with data stored in the European Union); Anthropic (artificial intelligence used to summarise issues); Apple Maps and Google Maps (maps shown in the app on iPhone and Android respectively); Ideal Postcodes (address lookup); postcodes.io (finding the approximate location of a postcode, to show distances and nearby businesses and jobs); and Companies House (business verification). Apple and Google also process personal data where users sign in with Apple or purchase a subscription through the App Store or Google Play.

9.5.​ Where users participate in a project through the platform, certain personal data will be shared between the customer and the tradesperson to enable the project to proceed. Where a dispute arises, relevant information may also be shared between the parties where necessary to administer the dispute process and the payment workflow.

9.6.​ Where a dispute cannot be resolved between the parties, Paylio may refer it to an independent dispute resolution provider, Consumer Dispute Resolution Limited (CDRL), an approved alternative dispute resolution body, whose decision is binding on the parties under the Platform Documentation. In that case Paylio shares the information needed to resolve the dispute, including the parties' names and contact details, job details, messages, evidence and payment records.

9.7.​ We may disclose personal data where required by law, to respond to lawful requests from courts, regulators, law enforcement agencies or other competent authorities, to establish or defend legal claims, investigate fraud or protect the rights, property or safety of Paylio, its users or others.

9.8.​ If Paylio undergoes a merger, acquisition, investment, corporate restructuring or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

9.9.​ Paylio does not disclose personal data to third parties for their own direct marketing purposes without the individual's consent where such consent is required by applicable law.

10. International Transfers of Personal Data

10.1.​ Paylio may use service providers, technology partners and regulated payment providers located both within and outside the United Kingdom. As a result, personal data may be transferred to or accessed from countries outside the United Kingdom where this is necessary for the operation of the platform or the delivery of our services.

10.2.​ In particular, Stripe, Resend, Expo, Anthropic, Apple and Google may process personal data in the United States, and Mixpanel stores analytics data in the European Union. For transfers to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the recipient is certified under it, and otherwise on the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

10.3.​ Where personal data is transferred internationally, Paylio will ensure that appropriate safeguards are implemented where required under applicable data protection legislation to protect the information being transferred.

10.4.​ Depending on the circumstances, these safeguards may include transfers to countries recognised as providing an adequate level of protection, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or any other lawful transfer mechanism recognised under applicable data protection legislation.

10.5.​ Where regulated payment providers or other independent organisations process personal data for their own purposes outside the United Kingdom, they remain responsible for ensuring that their own international transfers comply with the legal requirements applicable to their services.

10.6.​ Paylio reviews its international data transfer arrangements periodically to ensure that appropriate contractual, organisational and technical safeguards remain in place as our services, suppliers and legal obligations develop.

10.7.​ Individuals who wish to receive further information about the safeguards applied to international transfers of their personal data may contact Paylio using the contact details provided at the end of this Privacy Policy.

11. Data Retention

11.1.​ Paylio retains personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, provide the services available through the platform, comply with legal and regulatory obligations, resolve disputes, protect legitimate business interests and enforce its contractual rights.

11.2.​ The period for which personal data is retained will depend upon the nature of the information, the services used, the contractual relationship with the user and any legal or regulatory requirements that apply. Different categories of personal data may therefore be retained for different periods where this is appropriate.

11.3.​ Account information is generally retained for as long as a user maintains an active account with the platform. Where an account is closed, certain information may continue to be retained for an appropriate period where this is necessary to comply with legal obligations, maintain accounting records, administer unresolved disputes, investigate fraud, protect the security of the platform or establish, exercise or defend legal claims.

11.4.​ Project documentation, communications, quotations, invoices, Milestone records, payment information, dispute documentation, photographs, videos and other evidence submitted through the platform may be retained for an appropriate period following completion of a project where this is reasonably necessary to administer contractual processes, respond to payment disputes, comply with legal obligations or protect the legitimate interests of Paylio and its users.

11.5.​ As a guide: financial and transaction records, including payment, fee and invoice records, are kept for at least six years after the end of the financial year to which they relate, as required by law; job records, messages and evidence are kept for six years after the job is completed or closed, being the period in which legal claims may be brought; session replays are deleted automatically by Mixpanel 30 days after they are recorded; and when a user deletes their account, their profile, contact details, photos and settings are deleted. Records that must be kept for the purposes above, such as jobs, messages, evidence, payment records and invoices, are retained with the user's name and contact details removed, linked only by an internal reference. These records are used only where needed for legal, tax, payment or dispute purposes, and are deleted at the end of their retention period. Invoices are kept as issued, including the customer's name and address, as the law requires.

11.6.​ Technical records, audit logs, security information and system activity records may also be retained for periods that are reasonably necessary to maintain platform security, investigate incidents, prevent fraud, improve system performance and comply with applicable legal or regulatory requirements.

11.7.​ Where personal data is no longer required for the purposes for which it was collected, Paylio will take reasonable steps to securely delete, anonymise or otherwise dispose of the information unless continued retention is required or permitted by applicable law.

11.8.​ Where litigation, regulatory investigations, payment disputes or other legal proceedings are ongoing or reasonably anticipated, Paylio may retain relevant personal data for longer than the standard retention period where this is reasonably necessary to protect its legal rights, comply with legal obligations or support the administration of the relevant proceedings.

12. Data Security

12.1.​ Paylio is committed to protecting the confidentiality, integrity and availability of the personal data processed through the platform. We implement appropriate technical and organisational measures designed to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other forms of unlawful or inappropriate processing.

12.2.​ The security measures implemented by Paylio are designed having regard to the nature of the personal data processed, the risks associated with the processing activities, the state of available technology, the cost of implementation and the likelihood and severity of potential harm to individuals. As the platform develops, our security measures may also be reviewed and updated to reflect changes in technology, legal requirements and industry best practice.

12.3.​ Examples of the measures that may be used to protect personal data include secure authentication procedures, access controls, encryption where appropriate, audit logging, system monitoring, network security controls, data backup procedures, business continuity measures and internal processes designed to restrict access to personal data to individuals who require that access for legitimate business purposes.

12.4.​ For example, access to Paylio's administration tools requires multi-factor authentication, and the credentials for connected accounting services are encrypted.

12.5.​ Access to personal data is limited to authorised personnel, service providers and contractors who require access in order to perform their duties or provide services on behalf of Paylio. Individuals with authorised access are subject to appropriate contractual confidentiality obligations and are expected to handle personal data in accordance with applicable legal requirements and Paylio's internal security procedures.

12.6.​ Although Paylio takes reasonable steps to protect personal data, no online platform, communication network or electronic storage system can be guaranteed to be completely secure. Users are therefore encouraged to maintain appropriate security over their own accounts and devices, use strong passwords, protect their login credentials and notify Paylio promptly if they become aware of any suspected unauthorised access or security incident affecting their account.

12.7.​ Where Paylio becomes aware of a personal data breach, we will investigate the incident, take appropriate steps to reduce the risk of further harm and, where required by applicable law, notify the relevant supervisory authority and affected individuals within the timeframes required by data protection legislation.

13. Your Privacy Rights

13.1.​ Where the UK General Data Protection Regulation and the Data Protection Act 2018 apply, individuals may have a number of rights in relation to the personal data processed by Paylio. The availability of these rights will depend upon the circumstances of the processing and any applicable legal exemptions.

13.2.​ Individuals may have the right to request confirmation of whether Paylio processes their personal data and, where this is the case, to obtain access to that information together with certain supplementary information relating to the processing activities carried out by Paylio.

13.3.​ Individuals may request that inaccurate or incomplete personal data be corrected where appropriate. Paylio will take reasonable steps to ensure that personal data remains accurate and up to date and encourages users to keep their account information current.

13.4.​ In certain circumstances, individuals may request the deletion of their personal data where there is no longer a lawful basis for continued processing. This right is not absolute and may not apply where Paylio is required to retain information in order to comply with legal obligations, administer ongoing contractual relationships, resolve disputes, establish or defend legal claims or protect its legitimate interests.

13.5.​ Individuals may also have the right to request that Paylio restrict the processing of their personal data in certain circumstances, including where the accuracy of the information is contested or where the lawfulness of the processing is under review.

13.6.​ Where processing is based on legitimate interests, individuals may have the right to object to that processing where their particular circumstances justify such an objection. Paylio will carefully consider each request and will cease the relevant processing unless there are compelling legitimate grounds to continue or another legal basis applies.

13.7.​ Where processing is based on consent, individuals may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the consent was withdrawn.

13.8.​ Where technically feasible and required by applicable law, individuals may also have the right to receive certain personal data in a structured, commonly used and machine-readable format or to request that such information be transmitted directly to another controller where this is technically possible.

13.9.​ Paylio will consider all privacy rights requests in accordance with applicable data protection legislation and will respond within the timeframes required by law. Before responding to certain requests, we may ask for additional information to verify the identity of the individual making the request in order to protect personal data against unauthorised disclosure.

13.10.​ Users can download a copy of their personal data and delete their account from within the app, under Profile, Privacy. We respond to requests within one month, which may be extended by up to two further months for complex requests where the law allows.

13.11.​ The exercise of privacy rights may be subject to legal limitations, exemptions and conditions permitted under applicable data protection legislation. Where Paylio is unable to comply fully with a request, we will explain the reasons for our decision to the extent permitted by law.

14. Cookies and Similar Technologies

14.1.​ Paylio uses cookies and similar technologies to support the operation, security and performance of the platform. These technologies help us recognise users' devices, maintain user sessions, remember preferences, protect accounts, analyse how the platform is used and improve the services we provide.

14.2.​ The Paylio app does not use browser cookies. It uses comparable technologies, such as information stored on the device and software development kits, for the purposes described in this section. Non-essential technologies in the app, such as analytics, are only used with the user's consent.

14.3.​ Some cookies are strictly necessary for the operation of the platform and cannot be disabled without affecting essential functionality. Other cookies or similar technologies may be used for performance measurement, analytics, user experience improvements or other purposes where permitted by applicable law.

14.4.​ Where the use of non-essential cookies requires consent under applicable legislation, Paylio will request that consent before those technologies are placed on a user's device. Users may manage their cookie preferences through the cookie management tools made available on the platform, subject to the limitations of their browser or device settings.

14.5.​ Users may also configure their web browser to refuse certain cookies or notify them when cookies are placed. However, disabling certain cookies may affect the availability or functionality of parts of the platform.

14.6.​ Further information regarding the categories of cookies used by Paylio, their purpose, retention periods and available user choices is provided in our separate Cookie Policy, which should be read together with this Privacy Policy.

15. Children's Privacy

15.1.​ The Paylio platform is intended for use by individuals who are at least eighteen years of age and who have the legal capacity to enter into binding contractual arrangements.

15.2.​ Paylio does not knowingly provide services to children or intentionally collect personal data from individuals under the age of eighteen. If we become aware that personal data has been collected from a child in circumstances where such processing is not permitted by applicable law, we will take reasonable steps to delete the information or otherwise restrict its processing as appropriate.

15.3.​ Where a parent, guardian or other responsible person believes that a child has provided personal data through the platform, they should contact Paylio using the details provided at the end of this Privacy Policy so that the matter can be investigated and appropriate action taken.

15.4.​ Nothing in this section prevents Paylio from processing limited information relating to minors where this is required by applicable law or arises incidentally through information submitted by users during the normal operation of a project or contractual dispute. In such cases, Paylio will process that information only to the extent reasonably necessary for the relevant purpose and in accordance with applicable data protection legislation.

16.​ Changes to this Privacy Policy

16.1.​ Paylio may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, technology, the services available through the platform or the way personal data is processed.

16.2.​ Where appropriate, the most recent version of this Privacy Policy will be published on the Paylio website or made available through the platform together with the date on which the updated version takes effect. Users are encouraged to review this Privacy Policy periodically to remain informed about how their personal data is processed.

16.3.​ Where changes materially affect the way in which personal data is processed, Paylio will take reasonable steps to provide additional notice where required by applicable law.

16.4.​ Continued use of the Paylio platform after an updated version of this Privacy Policy takes effect will constitute acknowledgement of the revised Privacy Policy to the extent permitted by applicable law.

17. Contact

17.1.​ Questions regarding this Privacy Policy or the way Paylio processes personal data may be sent to privacy@paylio.co.uk or submitted in the app through Help, Contact Support.

17.2.​ Individuals wishing to exercise their privacy rights, request access to their personal data, seek correction of inaccurate information or make any other privacy-related request are encouraged to contact Paylio in the first instance. We may request additional information to verify identity before responding to certain requests where this is reasonably necessary to protect personal data.

17.3.​ Where an individual is dissatisfied with the way Paylio has handled their personal data, they may have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (ico.org.uk, telephone 0303 123 1113), or the relevant supervisory authority in their jurisdiction. We encourage individuals to contact Paylio first so that we have an opportunity to address any concerns before a formal complaint is made.

17.4.​ Where questions relate specifically to payment processing, identity verification, anti-money laundering procedures or other regulated payment services performed independently by a regulated payment provider, users may also need to contact that provider directly, as Paylio cannot respond on behalf of organisations that act as independent data controllers.

17.5.​ Nothing in this Privacy Policy limits any rights that individuals may have under applicable data protection legislation.

18. Automated Decision-Making

18.1.​ Paylio may use automated systems to support the operation, security and administration of the platform. These systems may assist with activities such as detecting suspicious account activity, identifying potential fraud, monitoring platform security, preventing abuse of the services and improving the overall reliability of the platform.

18.2.​ Where automated tools are used, they are intended to support operational decision-making rather than replace human judgement. Decisions relating to contractual disputes, payment administration or other matters that may significantly affect users are not made solely by automated means. Where individuals are granted rights in relation to automated decision-making under applicable data protection legislation, Paylio will respect those rights.

18.3.​ One exception is business verification. When a business uploads its certificate of incorporation, the app automatically checks that the company number and name match the business's profile, and rejects the document if they do not. A business that believes its document was wrongly rejected can upload a new document or ask for a member of the Paylio team to review it by contacting us.

19. Data Accuracy

19.1.​Paylio seeks to maintain accurate and up-to-date personal data. However, the accuracy of much of the information processed through the platform depends upon the information provided by users.

19.2.​ Users are responsible for ensuring that the personal data they provide remains accurate, complete and up to date. Where account details, contact information or other relevant information changes, users should update their account promptly or notify Paylio so that appropriate records can be maintained.

19.3.​ Where Paylio becomes aware that personal data is inaccurate or incomplete, reasonable steps will be taken to correct, update or otherwise rectify the information where appropriate. We may also request additional information from users where this is reasonably necessary to verify the accuracy of personal data held by the platform.

20. Data Minimisation

20.1.​ Paylio is committed to the principle of data minimisation and seeks to collect and process only the personal data that is reasonably necessary for the operation of the platform, the delivery of its services and compliance with applicable legal and regulatory obligations.

20.2.​ We regularly review the categories of personal data processed through the platform and seek to limit the collection, use and retention of information to what is proportionate for the purposes described in this Privacy Policy.

20.3.​ Where personal data is no longer required, and there is no legal or legitimate reason for its continued retention, Paylio will take reasonable steps to securely delete, anonymise or otherwise dispose of that information in accordance with its data retention practices and applicable data protection legislation.