Card Payments

Additional Privacy Information

1. SFP Restructuring Limited work with Opayo (which is a trading name of Elavon Financial Services DAC (UK Branch)), you can find out more about Opayo here (https://www.opayo.co.uk/).
2. This information is additional to our own privacy notice which you can find here (https://www.sfpgroup.com/privacy-policy).
3. Opayo will process personal data in the course of providing the card payment facility, you can find their privacy notice here (https://www.opayo.co.uk/policies/privacy-policy).
4. Our merchant bank is Barclays.
5. As part of this information will be contributed to third parties in order to detect fraud, these third parties are selected by Opayo.

Purpose

6. Opayo will process personal data in order to:
   1. provide the card payment facility services and manage and administer those services;
   2. fulfil their contractual obligations under this our agreement with them;
   3. liaise with regulators, banks, payment schemes, law enforcement agencies (including the police) and fraud detection parties;
   4. otherwise in accordance with their privacy policy as set out above.
7. In some circumstances, Opayo will process personal data as a data controller (this means that they determine the purposes and means of the processing of personal data), for more information please refer to their privacy notice which is linked above.

Transfers of Personal Data

8. Opayo may disclose information to other companies in the Elavon Financial Services DAC group of companies, their contractors, and other organisations for example, they may disclose information to:
   1. Elavon Financial Services DAC;
   2. organisations which Opayo use to help them send communications;
   3. law enforcement agencies and fraud detection parties;
   4. third parties (if any) used by Opayo to perform their services;
   5. any other person in order to meet any legal obligations on Opayo, including statutory or regulatory reporting;
   6. the payment schemes;
   7. the merchant acquirer; and
   8. your issuing bank.
9. Opayo is part of the Evalon Group, they are a large multinational group and as such this may result in transfer of personal data outside of the UK and/or the EEA, they do this on the basis of their Master Data Processing and Transfer Agreements, which incorporate the European Commission’s standard contractual clauses.
10. The provision of the card payment services by Opayo may require the Processing of Personal Data by sub-processors in countries outside the EEA or the United Kingdom. Opayo indicate that unless we consent that this will only take place where appropriate safeguards are in place and set these out as follows:
    1. an adequacy decision; or
    2. appropriate safeguards (in accordance with Article 46 of the GDPR); or
    3. binding corporate rules (in accordance with Article 47 of the GDPR),