Privacy Policy
Last updated: 13 August 2026
1. Introduction
1.1 This Privacy Policy explains how Mondsey Fintech Ltd (England and Wales, company number 13227608) ("Mondsey UK") and Mondsey Fintech Ltd (Ireland, company number 688444) ("Mondsey Ireland") (together, "Mondsey", "we", "us", or "our") collect, use, store, and share personal data when you visit our website at mondsey.io (the "Website") or interact with us.
1.2 Mondsey UK and Mondsey Ireland act as joint controllers of the personal data collected through the Website within the meaning of Article 26 of the UK GDPR and the EU GDPR respectively. As between the two entities, Mondsey UK is the primary point of contact for data subjects and is responsible for responding to data subject requests, unless the request relates specifically to processing carried out by Mondsey Ireland in its capacity as compliance proxy in EU member states.
1.3 This Privacy Policy covers data collected from website visitors, prospective merchants, and anyone who contacts us. If you are a registered merchant using the Mondsey Platform, the processing of your personal data in connection with the Services is governed by the Data Processing Agreement forming part of your Merchant Services Agreement, which takes precedence over this Privacy Policy to the extent of any conflict.
1.4 We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this Privacy Policy periodically.
2. Personal Data We Collect
2.1 We may collect and process the following categories of personal data:
Information you give us:
(a) Name, email address, company name, and telephone number when you complete a contact form, request a demo, or subscribe to our mailing list.
(b) Any personal data contained in correspondence you send to us by email, post, or through the Website.
(c) Information provided when you register for an account on the Mondsey Platform, including business name, registered address, VAT number, and the name and contact details of your authorised representative.
Information we collect automatically:
(d) Technical data, including your IP address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and platform.
(e) Usage data, including information about how you use the Website, the pages you visit, the links you click, and the time and duration of your visit.
(f) Cookie data, as described in Section 7 below.
3. How We Use Your Personal Data
3.1 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
| Purpose | Type of Data | Lawful Basis |
|---|---|---|
| To respond to your enquiries and provide information you have requested | Name, email, company name, message content | Legitimate interests (responding to potential customers) |
| To send you marketing communications about our services (where you have opted in) | Name, email address | Consent |
| To administer and improve the Website | Technical data, usage data | Legitimate interests (improving our website and services) |
| To analyse website traffic and user behaviour | Technical data, usage data, cookie data | Consent (for non-essential cookies); Legitimate interests (for essential analytics) |
| To register you as a merchant and provide the Mondsey Platform services | Registration data, business details | Performance of a contract |
| To comply with legal and regulatory obligations | Any relevant personal data | Legal obligation |
3.2 We will not use your personal data for automated decision-making, including profiling, in a way that produces legal effects concerning you or similarly significantly affects you.
4. Data Sharing
4.1 We may share your personal data with the following categories of recipients:
(a) Between Mondsey UK and Mondsey Ireland, as joint controllers, for the purposes set out in this Privacy Policy.
(b) Service providers who perform services on our behalf, including website hosting, email delivery, analytics, and payment processing. These service providers are contractually obligated to process personal data only on our instructions and in accordance with applicable data protection law.
(c) Professional advisers, including lawyers, auditors, and accountants, where necessary for the establishment, exercise, or defence of legal claims.
(d) Regulatory authorities and law enforcement agencies, where we are required to do so by law or in connection with legal proceedings.
4.2 We do not sell your personal data to third parties. We do not share your personal data with third parties for their direct marketing purposes.
5. International Transfers
5.1 Personal data collected through the Website may be transferred between Mondsey UK (United Kingdom) and Mondsey Ireland (European Economic Area). Transfers between the United Kingdom and the EEA are permitted under the applicable adequacy decisions currently in force.
5.2 Where we use service providers based outside the United Kingdom or the EEA, we ensure that appropriate safeguards are in place, including: (a) transfers to countries that have been deemed to provide an adequate level of data protection; (b) the use of standard contractual clauses approved by the UK Information Commissioner or the European Commission, as applicable; or (c) the service provider's participation in an approved certification mechanism or binding corporate rules.
5.3 You may contact us at privacy@mondsey.io for further information about the specific safeguards applied to international transfers of your personal data.
6. Data Retention
6.1 We will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
6.2 In general:
(a) Contact form enquiries and correspondence: retained for 2 years from the date of the last interaction, unless you become a registered merchant (in which case the Merchant Services Agreement governs retention).
(b) Marketing mailing list data: retained until you unsubscribe or withdraw consent, after which it is deleted within 30 days.
(c) Website analytics and cookie data: retained in accordance with the retention periods specified in Section 7 below.
(d) Registered merchant data: retained for the duration of the Merchant Services Agreement and for 7 years thereafter, in accordance with our legal and regulatory obligations.
6.3 When personal data is no longer required, we will securely delete or anonymise it.
7. Cookies
7.1 The Website uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit the Website.
7.2 We use the following categories of cookies:
| Category | Purpose | Example | Retention |
|---|---|---|---|
| Strictly necessary | Essential for the Website to function (e.g. session management, security) | Session cookie | Session / 24 hours |
| Analytics | To understand how visitors interact with the Website and identify areas for improvement | Google Analytics | Up to 26 months |
| Functionality | To remember your preferences (e.g. cookie consent choice) | Cookie consent preference | 12 months |
7.3 We do not use targeting or advertising cookies. We do not participate in cross-site tracking or behavioural advertising.
7.4 When you first visit the Website, you will be presented with a cookie consent banner. Strictly necessary cookies are placed without consent, as they are essential for the Website to function. Analytics and functionality cookies are placed only with your consent. You may withdraw your consent at any time by adjusting your cookie preferences through the link provided in the Website footer.
7.5 You can also control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. If you block all cookies, some parts of the Website may not function properly.
8. Your Rights
8.1 Under the UK GDPR and the EU GDPR, you have the following rights in relation to your personal data:
(a) Right of access - you have the right to request a copy of the personal data we hold about you.
(b) Right to rectification - you have the right to request that we correct any inaccurate or incomplete personal data.
(c) Right to erasure - you have the right to request that we delete your personal data in certain circumstances.
(d) Right to restriction of processing - you have the right to request that we restrict the processing of your personal data in certain circumstances.
(e) Right to data portability - you have the right to request that we transfer your personal data to another organisation, or directly to you, in a structured, commonly used, and machine-readable format.
(f) Right to object - you have the right to object to processing based on legitimate interests or for direct marketing purposes.
(g) Right to withdraw consent - where we rely on consent as the lawful basis for processing, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
8.2 To exercise any of these rights, please contact us using the details in Section 11. We will respond to your request within one month, or inform you if an extension is necessary.
8.3 You will not normally be required to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. In such circumstances, we may also refuse to comply with your request.
8.4 We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
9. Children
9.1 The Website and the Mondsey Platform are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that data.
10. Security
10.1 We have put in place appropriate technical and organisational security measures to prevent the accidental loss, unauthorised access, use, alteration, or disclosure of your personal data. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.
10.2 We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
10.3 We have procedures in place to deal with any suspected personal data breach and will notify you and the relevant supervisory authority of a breach where we are legally required to do so.
11. Contact and Complaints
11.1 If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact us:
Email: privacy@mondsey.io
Post: Mondsey Fintech Ltd, 1 Mark Square, London, EC2A 4EG, United Kingdom
11.2 If you are based in the United Kingdom and are not satisfied with our response to a complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
11.3 If you are based in the European Economic Area, you have the right to lodge a complaint with the supervisory authority in your member state of habitual residence, place of work, or place of the alleged infringement.