image description
Card Programme Data Protection Statement

Card Programme Data Protection Statement

This statement explains how PSI Pay-Ltd and IPS Solutions Ltd processes personal data about cardholders and account holders (“you”) of a card programme operated by our Programme Manager partner (the “Programme Manager”). It is published so that Programme Managers can accurately describe PSI-Pay Ltd and IPS Solutions Ltd role in their own customer-facing terms and conditions and privacy notices.

This statement does not replace the Programme Manager’s own privacy notice, which remains the primary source of information about how your personal data is collected and used in connection with your card and related services. If you have a question about your card or account, please contact your Programme Manager in the first instance.

1. WHO WE ARE

We are PSI-Pay Ltd, authorised and regulated by the UK Financial Conduct Authority under the Electronic Money Regulations 2011 (FCA register number 900011), and IPS Solutions Ltd, an electronic money institution authorised and regulated by the Central Bank of Cyprus (license no. 115.1.3.28) (“we”, “us”). Depending on the card programme, one of us or both entities provides BIN sponsorship, enabling your Programme Manager to issue cards on a card scheme.

2. OUR ROLE AS A DATA CONTROLLER

Your Programme Manager and PSI-Pay Ltd and IPS Solutions Ltd (whichever is relevant to your card programme) each act as independent data controllers for the personal data processed in connection with the programme. This means each party decides for itself why and how it processes your data for its own purposes, rather than deciding this jointly with the other.

PSI-Pay Ltd and IPS Solutions Ltd process personal data for card issuance and administration, transaction processing, fraud and financial crime monitoring, compliance, and regulatory reporting.

The Programme Manager processes personal data for programme administration, onboarding, communications, customer support, CRM, and marketing where lawful.

3. WHAT PERSONAL DATA WE PROCESS

This includes: your name, address and date of birth; card and account identifiers; transaction data (such as amount, date, merchant and location); authorisation and settlement data; and information generated through transaction monitoring and screening.

4. WHY WE PROCESS THIS DATA

  • card issuance and administration;
  • transaction processing;
  • fraud and financial crime monitoring;
  • compliance;
  • regulatory reporting.

5. OUR LEGAL BASIS FOR PROCESSING

We process this data because it is necessary for us to comply with our legal and regulatory obligations, because it is necessary for our legitimate interests in managing risk, fraud and the integrity of the card schemes we sponsor, having balanced those interests against your rights and freedoms, and, where we are a party to your card issuance arrangements, because processing is necessary to perform that arrangement.

6. WHO WE SHARE THIS DATA WITH

Personal data may be shared between PSI-Pay Ltd, IPS Solutions Ltd and your Programme Manager where necessary to provide the programme and card services, prevent fraud and financial crime, manage complaints or disputes, and comply with legal and regulatory obligations. We may also share data with the relevant card scheme, our service providers and processors, our regulators, and law enforcement or other public authorities, where necessary for the purposes mentioned above or required by law.

7. INTERNATIONAL TRANSFERS

Where personal data we process is transferred outside the UK or the European Economic Area, we ensure an appropriate safeguard is in place, such as an adequacy decision or standard contractual clauses.

8. HOW LONG WE KEEP THIS DATA

We retain personal data for as long as necessary for the purposes set out above, and in line with applicable regulatory record-keeping requirements.

9. YOUR RIGHTS

You have rights under data protection law, including the rights of access, rectification, erasure, restriction of processing and objection. Because your Programme Manager and us each act as independent controllers, you may direct a request to any of us. Where a request relates specifically to processing carried out by PSI-Pay Ltd or IPS Solutions Ltd, you may contact us at:

IPS Solutions LTD, registered address: Athalassis 62, Office 101, 2023 Strovolos, Nicosia, Cyprus, e-mail: [email protected].

PSI-Pay Ltd, registered address: Afon Building, Worthing Road, Horsham, West Sussex, United Kingdom RH12 1TL, e-mail: [email protected].

If You are not satisfied with Our response, you have the right to complain:

– to the Information Commissioner’s Office of the Republic of Cyprus. Find out on their website how to report a concern. Please see: http://www.dataprotection.gov.cy.

– to the Information Commissioner’s Office of the United Kingdom. Find out on their website how to report a concern. Please see: https://ico.org.uk/make-a-complaint/.