Orka Pay Privacy Policy

Introduction

Orka Pay Ltd is committed to ensuring that your privacy is protected and we comply with the General Data Protection Regulation and other applicable data protection rules (including the Data Protection Act 2018 and marketing and cookies laws, together with associated guidance) (the “Data Protection Laws”).

This policy explains how we use, store and share the information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy. This policy supplements any other fair processing or privacy notice that may be provided to you from time to time. Please contact us by email at info@orkapay.co.uk. if you have any questions, comments or concerns about this policy or how we handle your personal information, or if such information changes at any time.

The Orka Pay mobile app (the “App”) is run by Orka Pay Ltd (company no. 12578838 with registered office at Xyz Building, 2 Hardman Boulevard, Manchester M3 3AQ) (“we” and “us”). For the purpose of the Data Protection Laws, we are the controller of the personal information processed for the purposes set out below and we are responsible for looking after it.

Any changes to this policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to this policy.

What personal data we collect and why we collect it

Under the Data Protection Laws, we are required to explain what information we collect from you and how and why we use your personal information (the “processing activity”). We are also required to have a “lawful basis” on which to process your personal information. This is summarised in the table below.

Processing activity: Why we use your information?

  • We require your information in order to set up, maintain and manage your account and in order to comply with our statutory and regulatory obligations. A failure to provide this information will mean you will not be able to open an account and receive our services
  • To respond to your queries and to provide you with information about our products and services.
  • To improve our service and protect against fraud.
  • To send you promotional emails about products, services, offers and other things we think might be relevant to you.

What information is collected?

  • Name, title, address, postcode, phone number, email address, bank account details, employee payroll number, national insurance number.
  • Name, telephone number, email address and details of your query.
  • Device and other usage information.
  • Name, telephone number and email address.

Lawful basis of processing

  • To take steps at your request to enter a contract with you and for the ongoing performance of such contract. Our legitimate interests.
  • To perform our contract with you. Legitimate interests in dealing with your complaint or query. Your consent.
  • Legitimate interests administering and/or improving the service we provide to you.
  • Your consent.

Where is the information collected from?

  • From you via our App or when you contact us.
  • The ‘Help’ section of the App or as part of your registration with us.
  • Automatically through your use of our service.
  • As part of your registration with us.
  • How long do we keep the information for?For the duration you hold an account with us and for 6 years following closure of your account.

A legitimate interest is when we have a business or commercial reasons to use your information (for example, to enhance our services or to carry out direct marketing). However, this legitimate interest must not unfairly go against what is right for you. We will therefore ensure that any collection and processing of your personal information:

• is not overly intrusive to you;

• is proportionate in order to meet our legitimate interests; and

• will always be kept to a minimum.

We consider that it is reasonable for us to process your information for the purposes of our legitimate interests outlined above as: (a) we process your information only so far as is necessary for such purpose; and (b) it can be reasonably expected for us to process your information in this way.

[Marketing and Promotional material

We may use your personal information to provide you with marketing and promotional materials (as stated above). We do so for our own purposes and will never sell or share your personal information with third parties for marketing purposes.

You may opt-out of receiving marketing and promotional materials from us at any time by emailing us at info@orkapay.co.uk, using the ‘unsubscribe’ link in the marketing or promotional email, or texting ‘STOP’ and the relevant number in the text. You may also update your preferences to receive marketing or promotional materials by visiting our App.]

Sharing your personal information

We will only disclose your personal information to:

• your employer to be able to provide the service and App to you;

• Modulr FS Limited in order to make payments to you – details of how Modulr will handle your personal information can be found here: https://www.modulrfinance.com/privacy- policy;

• companies within our group;

• our professional advisors (including without limitation tax, legal or other corporate advisors

who provide professional services to us);

• other third party suppliers, business partners and sub-contractors for business administration, support, processing, services, or IT purposes;

• analytics or search engines, that enable us to optimise and improve your App experience;

• other third party suppliers for marketing purposes;

• third parties that you approve (including without limitation, social media sites and third party

payment providers);

• our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters; and

• HMRC or other tax bodies or agencies to comply with our legal and regulatory obligations.

We will disclose your personal information to third parties:

• in the event that we consider selling or buying any business or assets, in which case we will disclose your personal information to any prospective sellers or buyers of such business or assets;

• in the event we are the subject of any insolvency situation (e.g. the administration or liquidation);

• if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us about our customers will be one of the transferred assets;

• in order to enforce or apply our terms and conditions;

• to protect our rights, property, or safety, or that of our staff, our customers, or others. This includes exchanging information with other companies and organisations (including without limitation HMRC, the local police or other local law enforcement agencies) for the purposes of staff and customer safety, crime prevention, fraud protection and credit risk reduction; and

• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime].

International Transfers

[We may transfer personal information to countries other than the country in which the data was originally collected (for example, outside the UK/EEA) in order to provide you with our services. These countries may not have the same data protection laws as the country in which you initially provided the information and may not provide the same level of protection.

If we transfer personal information to countries outside of the EEA, we may rely on a decision from the European Commission determining that the country provides an adequate level of protection to the Data Protection Laws (for example, we may rely on the EU-US Privacy Shield Framework where the transfer is to a US entity). Alternatively, we may rely on appropriate safeguards in respect of transfers of personal information to a country outside of the EEA, for example, by agreeing standard contractual clauses adopted by the European Commission.

A copy of the standard contractual clauses are available on the European Commission’s website here and for more information about the EU-US Privacy Shield Framework for US companies, please click here].

Your Rights

To be informed:

A right to be informed about the personal information we hold about you.

Of access:

A right to access the personal information we hold about you.

To rectification:

A right to require us to rectify any inaccurate personal information we hold about you.

To erasure:

A right to ask us to delete the personal information we hold about you. This right will only apply where (for example):

  • we no longer need to use the personal information to achieve the purpose we collected it for;
  • where you withdraw your consent if we are using your personal information based on your consent; or
  • where you object to the way we process your data (in line with Right 6 below).

To restrict processing:

In certain circumstances, a right to restrict our processing of the personal information we hold about you. This right will only apply where (for example):

  • you dispute the accuracy of the personal information held by us;
  • where you would have the right to ask us to delete the personal information but would prefer that our processing is restricted instead; or
  • where we no longer need to use the personal information to achieve the purpose we collected it for, but you need the data for the purposes of establishing, exercising or defending legal claims.

To data portability:

In certain circumstances, a right to receive the personal information you have given us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal information to another organisation, at your request.

To object:

A right to object to our processing of the personal information we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process the personal information which override your rights or which are for the establishment, exercise or defence of legal claims.

In relation to automated decision making and profiling:

A right for you not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you.

To withdraw:

A right to withdraw your consent, where we are relying on it to use your personal information (for example, to provide you with brochures and newsletters).

We welcome your views about our App and this policy. If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please email us at: info@orkapay.co.uk or write to us at: Orka Pay Ltd, ABC Buildings, 21-23 Quay Street, Manchester, M3 4AE.

If you would like this notice in another format (for example audio, large print, braille) please contact us using the details above.

We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your personal information. However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to our supervisory authority, which is the UK’s Information Commissioner’s Office. Their

A right to require us to rectify any inaccurate personal information we hold about you.

Their address is: First Contact Team, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.