Privacy Policy

This Privacy Policy explains how Tech Infrastructure and Technical Services Limited, a company registered in England and Wales and trading as “BDRelay” (“BDRelay,” “we,” “us,” or “our”), collects, uses, and shares information about you when you visit our website, communicate with us, or use our payment-integration service (collectively, the “Service”). For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, BDRelay is the “controller” of the personal data described here.

1. Scope of this policy

This policy applies to information about our business customers, their representatives, and visitors to our website. When your customers pay through a checkout we configure, their payment information is collected and processed by Stripe and, where applicable, by you as the merchant. BDRelay does not receive or store full payment card numbers.

2. Information we collect

We may collect the following categories of information:

• Business and contact information — your name, business name, email address, phone number, and role.
• Onboarding and verification information — details needed to set up your checkout and, where required, to support identity verification performed by Stripe (such as business type, website, and bank account details you provide).
• Communications — messages, support requests, and other correspondence you send us.
• Usage and device information — information about how you interact with our website, such as IP address, browser type, pages viewed, and referring URLs, collected through standard log files and, where used, cookies or similar technologies.
• Transaction metadata — high-level, non-card information about payments processed through your checkout (such as amount, currency, timestamp, and status) used to provide, support, and bill for the Service.

We do not collect or store full payment card numbers. Card data is collected and handled directly by Stripe.

3. Sources of information

We collect information directly from you (for example, during setup and support), automatically through your use of our website, and from service providers such as Stripe in connection with your connected account.

4. How we use information

• To set up, provide, maintain, and improve the Service;
• To configure and manage your checkout and connected account;
• To calculate and collect our platform fees;
• To communicate with you about setup, support, and service updates;
• To detect, prevent, and address fraud, security, and technical issues;
• To comply with legal obligations, including anti-money-laundering and “know your customer” requirements; and
• To protect our rights and the rights of our customers and their end users.

5. How we share information

We may share information with:

• Stripe, to enable payment processing, verification, and payouts through your connected account;
• Service providers that perform functions on our behalf (such as hosting, analytics, and communications), bound by confidentiality obligations;
• Legal and safety recipients, when we believe disclosure is required by law or reasonably necessary to protect rights, safety, or the integrity of the Service; and
• Successors, in connection with a merger, acquisition, financing, or sale of assets.

We do not sell your personal data, and we do not disclose it for third-party advertising.

6. Payments and Stripe

Payment processing is provided by Stripe. When you or your customers submit payment information, it is transmitted to and processed by Stripe under Stripe’s Privacy Policy. We encourage you to review Stripe’s policy to understand how it handles payment data.

7. Data retention

We retain information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information and the purpose for which it was collected.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights under UK GDPR

If you are in the UK, the UK GDPR and the Data Protection Act 2018 give you the following rights in respect of your personal data:

• Access — to be told whether we hold personal data about you and to obtain a copy of it;
• Rectification — to have inaccurate or incomplete personal data corrected;
• Erasure — to have your personal data deleted in certain circumstances (the “right to be forgotten”);
• Restriction — to ask us to limit how we use your personal data in certain circumstances;
• Portability — to receive certain personal data in a structured, commonly used, machine-readable format;
• Objection — to object to our processing of your personal data where we rely on legitimate interests; and
• Withdraw consent — where we rely on your consent, to withdraw it at any time without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at hello@bdrelay.com. We will respond within the time limits set by the UK GDPR and may need to verify your identity before acting on a request. Exercising your rights is free of charge in most cases.

You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), if you believe we have not handled your personal data properly. We would, however, appreciate the chance to address your concerns before you approach the ICO.

10. International data transfers

Some of our service providers, including Stripe, are based outside the UK, which means your personal data may be transferred to and processed in countries whose data protection laws differ from those of the UK (for example, the United States). Where we transfer personal data outside the UK, we rely on an appropriate safeguard recognised under the UK GDPR — such as UK “adequacy” regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — so that your personal data remains protected.

11. Children's privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice as required by law.

13. Contact

If you have questions about this Privacy Policy or our privacy practices, contact us at hello@bdrelay.com.