Privacy Policy

The data controller is Wajub UK Ltd, 83 Baker Street, London, W1U 6AG, United Kingdom. For any question about the protection of your data, write to hello@wajub.com. For end customer data processed on a merchant's behalf, the merchant is the controller and Wajub the processor, under the DPA.

We collect different categories of data depending on your relationship with Wajub: merchant identification and registration data (company name, registration, contact details), legal representative data (ID document, proof of address), KYC/KYB verification data (including images captured during a liveness check), financial data (bank details), transaction data (amount, currency, date, status, payer phone number), technical data (IP address, browser and device information), approximate location data, and browsing data. Card numbers are typed into the card Provider's own fields or payment window and never reach Wajub's servers.

We process your data for the following purposes: service delivery (contractual basis), AML/CFT verification and compliance (legal obligation), security and anti-fraud via Shield (legitimate interest), communication and support (contractual performance), service improvement (legitimate interest), and recruitment (consent). Processing based on consent includes commercial communications and payment method tokenisation.

Our site sets cookies strictly necessary for its operation (language and country, which sets the display currency). To measure its audience, we use Plausible Analytics and Vercel Web Analytics: neither sets cookies or keeps your IP address, and both only produce aggregate statistics (page views, referring site, country, device type). To understand how visitors move through the site, we use Microsoft Clarity, which records clicks, scrolling and mouse movements as sessions and heatmaps, and may set cookies to link the pages of a single visit. For visits from the European Economic Area, the United Kingdom and Switzerland, Clarity sets no cookies without your consent. Data collected by Clarity is processed by Microsoft under its privacy statement. To detect and fix errors, Sentry records the course of a share of visits and of those where an error occurs, with all text, input fields and images masked. Our support messenger (Intercom) sets its own cookies. Cookies that are not strictly necessary are subject to your consent where applicable regulations require it. The maximum retention period for cookies is 13 months. You can delete or block cookies at any time from your browser settings.

Your data is accessible to authorised persons at Wajub on a need-to-know basis. We share with payment Providers (aggregators, mobile money operators, card providers) the data strictly necessary to process the transaction. We use technical sub-processors for hosting, databases, email and SMS delivery, audience measurement, monitoring, support, identity verification and security. The list of our sub-processors is provided on request at hello@wajub.com.

Your data may be processed in the United Kingdom, the European Union, the United States and the countries where our sub-processors and payment Providers operate, for the purposes of providing the services. Transfers to countries without an adequacy decision are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914) or an equivalent mechanism recognised under the UK GDPR. We contractually require our sub-processors to provide guarantees equivalent to those of the GDPR.

Data is retained for the period necessary for the purposes: registration and account data (duration of the relationship + 5 years), KYC/KYB documents (duration of the relationship + 5 years), transaction data (10 years, accounting obligations), production API logs (1 year), sandbox API logs (90 days), cookies (maximum 13 months), commercial contact data (3 years), and support communications (3 years). At the end of these periods, data is deleted or anonymised.

We implement technical and organisational measures including: encryption of communications (HTTPS), encryption of stored payment Connection credentials, HMAC-SHA256 webhook signatures, isolation of test and production environments in separate databases, two-factor authentication, roles and permissions per team member, and logging of API calls. In the event of a data breach, we notify the competent supervisory authority within 72 hours (Article 33 GDPR) where the law requires it, and the data subjects without undue delay where the breach presents a high risk to their rights.

In accordance with the GDPR and the UK GDPR, you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21) and the right to withdraw your consent. To exercise your rights, contact hello@wajub.com. We respond within 1 month (extendable by 2 months in case of complexity). You have the right to lodge a complaint with the competent supervisory authority, for example the ICO in the United Kingdom or the CNIL in France.

The list of our sub-processors is provided on request at hello@wajub.com. We undertake to only use sub-processors providing sufficient guarantees, to contractually govern these relationships in accordance with Article 28 of the GDPR, to notify the merchant of any change, and to allow the merchant to object to a new sub-processor.

We may modify this Policy at any time to reflect changes to our services, regulatory changes, or recommendations from authorities. In the event of a substantial modification, we will inform you by email, website notification, and by updating the version date. For any questions, write to hello@wajub.com or by post to Wajub UK Ltd, 83 Baker Street, London, W1U 6AG, United Kingdom.