Legal documents
Privacy policy
This privacy policy explains how Alvyn collects, uses, shares and protects personal information when you use our websites and services.
- ControllerAlvyn Tech Limited
- Privacy contacthello@novopay.uk
- Last updated14 September 2026
1About this policy
This privacy policy explains how Alvyn collects, uses, shares and protects personal information when you:
- visit alvyn.uk or another Alvyn website;
- contact us, request a quote, book a demonstration or submit an enquiry;
- apply for, access or use an Alvyn product or service, including our payment, checkout, payment-link, point-of-sale, dashboard and mobile-app services;
- work for, represent or are connected with a business that uses or may use our services; or
- make a payment to a business using Alvyn, where we use your information for our own purposes.
This policy should be read together with any additional privacy information shown when we collect your information. Our Cookie Policy explains how we use cookies and similar technologies.
2Who we are
Alvyn Tech Limited trading as Alvyn, a company registered in England and Wales under company number 17415021. Registered office: Plaza 668, 668 Hitchin Road, Luton, England, LU2 7XH.
For the purposes of applicable UK data protection law, Alvyn Tech Limited (trading as Alvyn) is the controller of personal data collected through alvyn.uk, unless a specific product or service privacy notice states otherwise.
In some cases, we process personal information on behalf of an Alvyn merchant. In that situation, the merchant is the controller and we act as its processor. You should read the merchant's privacy policy for information about how it uses your information. This policy applies to the activities for which Alvyn Tech Limited is a controller.
To ask a privacy question or exercise your rights, contact us at:
- Email: hello@novopay.uk
- Telephone: 0203 924 0381
- Post: Data Protection, Alvyn Tech Limited, Plaza 668, 668 Hitchin Road, Luton, England, LU2 7XH
3Personal information we collect
The information we collect depends on how you interact with us.
3.1Website visitors and people who contact us
We may collect:
- your name, job title and business name;
- your email address, telephone number and other contact details;
- information you include in an enquiry, application or message;
- supporting documents uploaded with a partner application, including identity documents, proof of address and proof of bank;
- your marketing preferences;
- your IP address, device type, browser, operating system and approximate location;
- website activity, referral source, pages viewed and interaction data; and
- cookie and consent choices.
3.2Merchants, applicants and business contacts
If you apply for or use an Alvyn service, or you are an owner, director, partner, beneficial owner, employee, authorised user or representative of a merchant, we may collect:
- identity and contact details;
- date of birth, nationality and residential address where verification is required;
- business, trading, ownership and company-registration information;
- information about directors, partners, shareholders and beneficial owners;
- identity-verification information, such as identification documents and verification results;
- bank-account, settlement, billing and tax information;
- account credentials, permissions and user IDs;
- information about your products, customers, sales channels, transaction volumes and business activity;
- communications, support requests, complaints and call records;
- device, login, audit, security and usage data; and
- information used to prevent fraud, manage risk, meet legal obligations and assess eligibility for services.
Please do not send us special-category information — such as information about health, ethnicity, religion, political opinions or sexual orientation — unless we specifically request it and explain why it is needed.
3.3People making payments
When a payment is made through an Alvyn service, we may collect or receive:
- payer and recipient details;
- payment amount, currency, date, time and status;
- transaction, order, invoice, refund and dispute details;
- payment-method information, which may include a card type, masked card number, token or last four digits;
- billing, delivery and contact information supplied during checkout;
- device, IP address and security information; and
- information used for authentication, fraud prevention, chargebacks and regulatory compliance.
Payment credentials may be collected directly by a regulated payment provider rather than by Alvyn. The information available to us depends on the payment method and the services involved.
4How we receive personal information
We collect information:
- directly from you;
- from the business you own, work for or represent;
- from merchants whose customers use Alvyn;
- from payment processors, acquiring banks, card schemes, financial institutions and payment-method providers;
- from identity-verification, fraud-prevention, risk, credit-reference and compliance providers;
- from service providers that support our websites, communications, sales, customer service and technology;
- from public sources, such as Companies House, professional websites and public registers; and
- automatically from devices, browsers, cookies, logs and similar technologies.
If you give us information about another person, you must have a lawful reason to do so and, where appropriate, tell them about this policy.
5How and why we use personal information
UK data-protection law requires us to have a lawful basis for each use of personal information. We rely on the following bases, depending on the circumstances.
Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and whether your rights and interests override ours.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.
| Purpose | Personal information typically used | Lawful basis |
|---|---|---|
| Responding to enquiries, arranging demonstrations and preparing proposals | Contact, business and enquiry information | Taking steps at your request before entering a contract; legitimate interests in responding to and developing business enquiries |
| Assessing applications and onboarding merchants | Identity, contact, business, ownership, verification, bank and risk information | Contract; legal obligation; legitimate interests in assessing eligibility, preventing fraud and managing commercial risk |
| Providing and administering Alvyn services | Account, contact, merchant, transaction, device, usage, support and payment information | Contract; legitimate interests in providing secure services to a business and its authorised users |
| Processing, routing, reconciling, refunding and reporting payments | Payment, transaction, account, device and security information | Contract; legal obligation; legitimate interests in operating payment services and maintaining accurate records |
| Preventing fraud, misuse, financial crime and security incidents | Identity, verification, transaction, device, network, login and risk information | Legal obligation; legitimate interests in protecting Alvyn, merchants, customers and the payment ecosystem |
| Meeting legal, regulatory, tax, accounting, audit and law-enforcement requirements | Identity, business, financial, transaction, communication and account information | Legal obligation; legitimate interests in establishing, exercising or defending legal rights |
| Operating, monitoring, troubleshooting and improving our websites, apps and services | Device, cookie, log, usage, support and feedback information | Legitimate interests in operating and improving secure, effective services; consent where required for cookies or similar technologies |
| Providing customer service and handling complaints or disputes | Contact, account, communication, transaction and support information | Contract; legal obligation; legitimate interests in resolving issues and protecting legal rights |
| Sending service messages | Contact and account information | Contract; legal obligation; legitimate interests in keeping users informed about service and security matters |
| Sending marketing and measuring its effectiveness | Contact, business, preference and engagement information | Consent where required; otherwise legitimate interests in marketing relevant business services, subject to your right to object |
| Business administration, reporting, corporate transactions and protection of legal rights | Business, account, financial, communication and usage information | Legal obligation; legitimate interests in managing our business and protecting our legal and commercial interests |
6If you do not provide information
Some information is required so that we can verify an application, enter into a contract, process payments, meet legal obligations or keep our services secure. If required information is not provided, we may be unable to open or maintain an account, provide a service, process a transaction or respond fully to a request.
7Fraud checks and automated tools
We may use automated tools and risk rules to help identify fraud, unauthorised activity, security threats or other risks. These tools may flag, delay or decline activity for review.
Where we make a decision based solely on automated processing that produces legal or similarly significant effects, we will do so only where permitted by law and will provide the safeguards required by law. Depending on the circumstances, you may have the right to request human intervention, express your point of view and challenge the decision. Contact us if you would like more information about a decision affecting you.
9International transfers
Some of our service providers or payment partners may process personal information outside the United Kingdom.
Where UK data-protection rules on restricted transfers apply, we use a lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard. Where required, we assess whether the information will receive an appropriate level of protection and apply additional safeguards.
Contact us if you would like more information about the safeguards relevant to your information.
10How long we keep personal information
We keep personal information only for as long as it is reasonably needed for the purposes described in this policy, including to provide services, meet legal and regulatory obligations, resolve disputes, prevent fraud and enforce agreements.
Retention periods vary according to the type of information and the reason we hold it. In setting them, we consider:
- how long an account or business relationship remains active;
- the nature, amount and sensitivity of the information;
- payment, accounting, tax, anti-money-laundering and regulatory requirements;
- limitation periods for legal claims;
- fraud, security, complaints and dispute-resolution needs; and
- whether the information can be safely deleted or anonymised.
As a general guide, core merchant, contractual and transaction records may be kept for up to six years after the relevant relationship or transaction ends, and longer where the law, a regulatory requirement or an active dispute requires it. Enquiry information that does not lead to a customer relationship is normally kept for a shorter period. Marketing suppression records may be kept so that we can continue to respect an opt-out.
When personal information is no longer needed, we delete it, anonymise it or securely restrict its use.
11How we protect personal information
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or use. These measures include access controls, encryption where appropriate, monitoring, staff procedures, supplier controls and security testing.
No website, application or transmission method is completely secure. You are responsible for keeping your account credentials confidential and for contacting us promptly if you believe your account or information has been compromised.
12Marketing choices
We may send information about Alvyn products, services and events where the law permits. You can stop direct marketing at any time by:
- using the unsubscribe link in a marketing email; or
- contacting hello@novopay.uk.
We may still send non-marketing messages about an account, transaction, service, legal notice or security issue.
13Your data-protection rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information;
- ask us to restrict how information is used;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain information in a portable format and ask us to transfer it to another organisation;
- withdraw consent at any time where processing is based on consent; and
- ask for safeguards relating to certain solely automated decisions.
These rights are not absolute and exemptions may apply. We may ask for information to verify your identity before responding. We normally respond within one month, although the law allows longer in some circumstances.
To exercise a right, email hello@novopay.uk.
14Complaints
Please contact us first if you have a concern about how we use your information so that we can try to resolve it.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. Information about making a complaint is available at ico.org.uk/make-a-complaint.
15Third-party websites and services
Our websites and services may link to websites, applications or services operated by other organisations. We are not responsible for their privacy practices. Please read their privacy information before providing personal information.
16Children
Alvyn's services are designed for businesses and are not intended for children. We do not knowingly offer accounts to, or collect personal information directly from, anyone under 18. If you believe a child has provided information to us, contact us so that we can investigate and take appropriate action.
17Changes to this policy
We may update this policy to reflect changes to our services, practices or legal obligations. We will publish the updated version on this page and change the "Last updated" date. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people.
18Contact us
For questions about this policy or our use of personal information, contact Data Protection at the address, email and telephone number shown on this page.