Legal

Privacy Policy

Last updated: 14 August 2026

1. Who we are

Veletis Ltd (“Veletis”, “we”, “us”) is a payment processing software provider registered in England & Wales under company number 15204877, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Veletis acts as the data controller for personal data described in this policy, except where we process data on behalf of our merchant clients, in which case we act as a data processor.

2. Data we collect

We collect and process the following categories of data:

• Business contact data — name, business email address and company details you provide when contacting us.
• Transaction data — payment data processed through our platform on behalf of merchant clients, including truncated card numbers, tokens, transaction amounts, currencies and authorisation outcomes.
• Technical data — IP addresses, device and browser information, and server logs necessary to operate and secure our services.

Full primary account numbers (PANs) are handled exclusively within our PCI DSS Level 1 certified environment and are never stored in plaintext.

3. How we use data

• To provide, operate and secure our payment processing services;
• To detect and prevent fraud and comply with anti-money-laundering obligations;
• To respond to enquiries and provide integration support;
• To meet legal, regulatory and card scheme obligations.

4. Legal bases

We rely on the performance of a contract, compliance with legal obligations, and our legitimate interests in securing and improving our services, as permitted under the UK GDPR and the Data Protection Act 2018.

5. Data sharing

We share data only with parties necessary to deliver our services: acquiring banks, card schemes, fraud prevention providers and infrastructure suppliers — each bound by contractual confidentiality and data protection obligations. We do not sell personal data.

6. Retention

We retain transaction data for the periods required by card scheme rules, tax law and financial regulation, and business contact data for as long as necessary for the purposes described above.

7. Security

Veletis maintains PCI DSS Level 1 Service Provider certification. Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access follows least-privilege principles and is logged and monitored continuously.

8. Your rights

You have the right to access, correct, erase and port your personal data, and to object to or restrict its processing. To exercise these rights, contact [email protected]. You may also lodge a complaint with the Information Commissioner's Office (ICO).

9. Contact

Questions about this policy: [email protected]
Veletis Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.