We use cookies for analytics and marketing, only with your consent. Read our Cookie Notice.
Reject
Accept

PRIVACY NOTICE

Last updated: 25 October 2026

1. Introduction

This Privacy Notice explains how Upprove collects, uses, discloses and protects Personal Data when you visit our Website, contact us, apply for or use our services, or otherwise interact with us.

This Privacy Notice applies to our Website, your Account, our sales and customer communications, our business relationship with merchants, partners and suppliers, and our payment orchestration, gateway and related technology services (together, the “Upprove Services”).

Depending on the context, Upprove may act as an independent Controller, a joint Controller, or a Processor/service provider acting on behalf of a merchant or other customer. Where we act as Processor, we Process Personal Data in accordance with the relevant customer agreement and data processing terms.

This Privacy Notice should be read together with our Cookies Notice and any applicable contract or data processing agreement.

2. Who We Are

Upprove is the trading name used by Payment Scope UK Limited, company number 16138313, registered office at 111 Piccadilly, Manchester, England, M1 2H.

For questions about this Privacy Notice or our data protection practices, contact us at privacy@upprove.com You can also contact us at support@upprove.com for general enquiries.

3. Definitions

For the purposes of this Privacy Notice:

“Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR and any other data protection or privacy law applicable to our Processing of Personal Data;

“Controller”, “Processor”, “Personal Data”, “Process”, “Processing”, and “Special Category Data” have the meanings given to them under Applicable Data Protection Law;

“Cookies” means cookies and similar technologies as described in our Cookies Notice;

“PECR” means the UK Privacy and Electronic Communications Regulations;

“Website” means https://upprove.com/;

“You” means the individual to whom Personal Data relates, including website visitors, business contacts, merchant representatives, partner representatives, supplier representatives and, where relevant, customers of our merchants.

4. Personal Data We May Collect

The Personal Data we collect depends on your relationship with us and may include:

  • Contact and identity details, such as name(s), job title, business email address, telephone number, company name and business address;
  • Account and access details, such as username, authentication credentials, role, permissions and portal activity;
  • Business and due diligence information, such as corporate information, ownership or control information, authorised representatives, risk, compliance and onboarding information, and information required by our customers, partners, acquirers, payment methods or other service providers;
  • Communications data, including emails, support tickets, call notes, meeting notes and feedback;
  • Website and technical data, including IP address, device identifiers, browser type and version, pages visited, time and date of visits, referral URLs, diagnostics and cookie information;
  • Transaction and payment-related data processed through the Upprove Services, which may include payment identifiers, card or account details, transaction amounts, currencies, timestamps, merchant and provider identifiers, risk signals, authentication results and transaction status information. Sensitive authentication data is not retained after authorisation except where permitted by applicable payment security requirements; and
  • Security and fraud-prevention data, such as logs, audit trails, access events, device data and risk indicators.

We do not intentionally collect Special Category Data through the Website. If Special Category Data is provided to us, we will process it only where permitted by law and where necessary for the relevant purpose.

5. How We Collect Personal Data

We may collect Personal Data directly from You, from Your employer or organisation, from merchants or partners using the Upprove Services, from acquirers, payment processors, payment methods, fraud-prevention and identity-verification providers, from public sources, and automatically through the Website and our systems.

6. Purposes and Lawful Bases

We process Personal Data for the following purposes and lawful bases:

Purpose Lawful bases
To respond to enquiries and manage business communications. Legitimate interests and, where applicable, steps prior to entering into a contract.
To provide, operate, maintain and improve the Website and Orchestr Services. Performance of a contract, legitimate interests and, where applicable, legal obligation.
To onboard and manage merchants, partners and suppliers, including due diligence, risk assessment and contract administration. Performance of a contract, legitimate interests and legal obligation.
To process payment-orchestration and gateway data on behalf of merchants and other customers. Where we act as Processor, the merchant or relevant customer determines the lawful basis. Where we act as Controller, lawful bases may include legitimate interests, performance of a contract and legal obligation.
To protect the security, availability and integrity of our systems and to prevent fraud, misuse and financial crime. Legitimate interests and legal obligation.
To comply with legal, regulatory, tax, accounting, audit and dispute-resolution obligations. Legal obligation and legitimate interests.
To send business-to-business marketing and service updates, where permitted by law. Legitimate interests or consent, depending on the channel and applicable rules under PECR and data protection law.

‍

7. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookies Notice. Optional cookies will be used only where we have consent or where another exemption applies under PECR.

8. Sharing Personal Data

We may share Personal Data with:

  • Affiliates and group companies, where necessary for business administration, governance, service delivery and support;
  • Merchants, partners, acquirers, payment processors, payment methods, card schemes, fraud-prevention providers, identity-verification providers, hosting providers, cloud infrastructure providers, support providers, professional advisers and other service providers involved in providing or supporting the Upprove Services;
  • Banks, financial institutions, regulators, law enforcement, courts, tax authorities and public authorities where required or permitted by law;
  • Prospective buyers, investors, funders, advisers or other third parties in connection with a merger, acquisition, reorganisation, financing, transfer, change of control or sale of assets.

Where a third party acts as our Processor, we require appropriate contractual protections. Where a third party acts as an independent Controller, it is responsible for its own compliance with applicable law.

9. International Transfers

We may transfer Personal Data outside the United Kingdom where necessary for the purposes described in this Privacy Notice. Where we do so, we will use an appropriate transfer mechanism, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by Applicable Data Protection Law.

10. Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Website and Upprove Services, manage our relationship with You, comply with legal, regulatory, accounting and tax obligations, resolve disputes, enforce agreements and maintain security and audit records.

Retention periods vary depending on the type of data, the purpose of Processing, contractual requirements and legal obligations. When Personal Data is no longer required, we will delete, anonymise or securely archive it in accordance with our retention procedures.

11. Security

We apply technical and organisational measures designed to protect Personal Data against unauthorised or unlawful Processing and accidental loss, destruction or damage.

These measures may include encryption in transit, access controls, authentication controls, least-privilege access, role-based permissions, logging and monitoring, secure development practices, vulnerability management, vendor due diligence, incident-response procedures, staff confidentiality obligations, backup and recovery measures, and PCI DSS-aligned controls for relevant cardholder data environments.

No method of transmission or storage is completely secure. You are responsible for keeping any login credentials confidential and notifying us promptly of suspected unauthorised access.

12. Your Rights

Subject to applicable conditions and exemptions, You may have the right to:

  • be informed about how we Process Your Personal Data;
  • access Your Personal Data;
  • request rectification of inaccurate or incomplete Personal Data;
  • request erasure of Your Personal Data;
  • restrict Processing;
  • object to Processing based on legitimate interests or to direct marketing;
  • receive Personal Data in a portable format;
  • withdraw consent where Processing is based on consent; and
  • complain to a supervisory authority.

To exercise your rights, contact us at privacy@upprove.com We may need to verify Your identity and may ask for additional information to help us respond.

13. Complaints

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO). We would appreciate the opportunity to address your concerns first, so please contact us at privacy@upprove.com

14. Direct Marketing

We may send business-to-business marketing where permitted by law. You can opt out of marketing at any time by using the unsubscribe link in our messages or contacting us at privacy@upprove.com We will continue to send service, security and transactional communications where necessary.

15. Automated Decision-Making

We do not use the Website to make solely automated decisions about You that produce legal or similarly significant effects. The Upprove Services may support fraud, risk or routing rules configured by merchants, acquirers, payment methods or other customers. Where such Processing is carried out on behalf of a customer, that customer is responsible for providing any required information to affected individuals.

16. Links to Third-Party Websites

Our Website may contain links to third-party websites. We are not responsible for the privacy practices, content or security of those websites. You should read the privacy notices of any third-party websites you visit.

17. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The latest version will be published on our Website and the “Last updated” date will be amended accordingly. Where required by law, we will take additional steps to notify You or obtain consent.

18. Contact Us

If you have any questions about this Privacy Notice or our data protection practices, please contact us at privacy@upprove.com or support@upprove.com