Please click on the headings below for full information about how your personal data is processed.
When you register for an Ozan account, we collect the following information (Account Information):
We collect the following information to enable you to make payments using Ozan (Payment Information):
To comply with our regulatory obligations, we need to verify your identity. To do this, we will ask you to provide one or more of the following (KYC Information):
Sometimes we need to ask you for information to verify the source of your funds or to conduct enhanced due diligence in accordance with our legal requirements (DD Information). This will depend on the situation and we will make it clear to you at the time what information we require from you. Examples include a copy of a shareholder’s agreement, copies of bank statements or proof of gambling winnings.
We will collect any other personal data that you voluntarily provide to us if you communicate with us, for example by corresponding with us (by phone, email, post or social media) or by taking part in competitions, promotions or surveys (Voluntary Information).
Where users sign up to use Ozan on behalf of a merchant, we collect much of the same information as set out above for individual customers. It will be clear from the data collection forms what information is collected about you when you sign up and use Ozan on behalf of a merchant.
If you are using Ozan on behalf of a merchant, instead of using your personal data to provide Ozan to you, we will use it to run and manage the account that you set up to use Ozan on behalf of the merchant. We may also market to you in a different way if you sign up on behalf of a merchant. If you use Ozan on behalf of a merchant, any payment information submitted will not be personal data as this will relate to the merchant’s business.
We carry out credit checks on our merchants to ensure that we are able to contract with them. If you are a user on behalf of a merchant that is a limited partnership or company,this does not require the use of any personal data as we only use information about the business. However, if the merchant is a sole trader or unlimited partnership merchant, information about the merchant’s business counts as “personal data”. Credit checks involve us passing your data to a credit reference agency, which will carry out a check against the data they hold on your business and provide us with a score to help us assess our risk in contracting with the business.
Data protection law says that we have to tell you the “legal basis” that we rely on to process your personal data for the purposes that we have notified to you. The table below tells you what that legal basis is in relation to each of the purposes set out above.
|Purpose||Personal data used||Legal basis|
|Providing Ozan to you and allowing you to use Ozan||Account Information, Payment Information and confirmation of fingerprint match||We process this personal data for this purpose on the basis that this information is necessary in order to perform our contract with you to provide Ozan and to allow you to use Ozan and/or to run and manage your user account.|
|Identity Verification and Due Diligence||Account Information, KYC Information and DD Information
|We process this personal data for this purposes on the basis that this information is necessary to enable us to comply with legal obligations, including compliance with anti-money laundering legislation and obligations to prevent and detect fraud.
If we do not have a legal obligation to process personal data for any of these purposes, we process the data on the basis that it is necessary to do so in our legitimate interests. We have an interest in complying with regulatory guidelines and investigations and ensuring that we protect our business against risks of criminal activity. You may have a right to object to your personal data being used in these ways, but please note that this right will not apply in a number of circumstances, including where the processing is necessary to prevent or detect crime.
|Corresponding with you||Account Information and Voluntary Information||We process this personal data for this purpose on the basis that it is necessary to do so for our legitimate interests. We have an interest in making sure that comments and queries are handled appropriately so that they can be resolved for our users. We also have an interest in running and allowing participation in competitions, promotions and surveys in order to promote and improve our business.You may have a right to object to your personal data being used for these purposes, but please note that we may not be able to handle your correspondence appropriately if you exercise this right.|
|Monitoring trends, analysing and improving Ozan||Account Information, Voluntary Information and Technical Information, Payment Information||We process this personal data for this purpose on the basis that this information is necessary for our legitimate interests. We have an interest in ensuring that we continue to improve Ozan and provide our users with the best and most effective service possible. You may have a right to object to your personal data being used for these purposes.|
|Marketing||Your email address, telephone number and/or postal address.
|We process this personal data for this purpose on the basis that it is necessary in our legitimate interests to do so. We have an interest in promoting and marketing our business so that our business continues to grow.You always have a right to opt out of receiving direct marketing communications. If you wish to do so, please follow the instructions in each marketing communication to unsubscribe.|
Some types of personal data are designated as special categories of personal data in data protection laws. This means that they are more sensitive types of personal data and we therefore need to take additional steps to protect this data.
The only special category of personal data we collect is biometric data, in the following circumstances:
We need the majority of the information we collect from you to perform our contract with you and/or to comply with legal obligations. This means that if you refuse to provide us with any of the information that we ask for, it is likely that we will be unable to provide Ozan to you.
Ozan Limited is part of the OpenPayd group of companies. We share personal data with our group companies in the UK, the EEA and Turkey to provide customer support services, software development and IT services. Please see section 10 below for more information about transfers of personal data to Turkey.
We share personal data with third parties in the following circumstances:
Our cloud storage provider hosts personal data within the UK and the EEA, so your information is generally stored within this area.
As mentioned above, we do share personal data with our OpenPayd group company in Turkey (Codespace Software and Consultancy Services Limited) for the purposes of customer support, software development and provision of IT services. We have put in place model contract clauses (MCCs) with this company to protect your personal data. MCCs are a standard set of clauses that are approved by the European Commission and/or the UK authorities to allow the transfer of personal data to countries whose data protection laws are not as strict as those in the UK and the EEA. They require our Turkish group company to treat personal data in the same way as it is treated by us in the UK. For more information, please contact us using the contact details below.
Some of our other service providers will transfer personal data outside of the UK and the EEA. Generally, this is done on the basis of MCCs (either between us and our service providers or between our service providers and their own suppliers) or under the Privacy Shield framework. This is an arrangement between the EU and the USA which allows the transfer of personal data to US companies that agree to certain principles governing how they handle personal data.
We will keep all your personal data for as long as your account remains open and for seven years thereafter. Occasionally we may need to keep your personal data for longer than this, for example to deal with any ongoing claims, complaints or issues.
You have a number of rights under data protection law. These rights and how you can exercise them are set out in this section. We may need to ask you for proof of your identity before we can respond to a request to exercise any of the rights in this section and we may need to ask you for more information, for example to help us to locate the personal data that your request relates to.
We will respond to any requests to exercise your rights as soon as we can and in any event within one month of receiving your request and any necessary proof of identity or further information. If your request is particularly difficult or complex, or if you have made a large volume of requests, we may take up to three months to respond. If this is the case we will let you know as soon as we can and explain why we need to take longer to respond.
If you want to exercise any of these rights, please contact us using the contact details below.
Address: Ozan Limited, 9th Floor, The Shard, London Bridge Street, LondonSE1 9SG
We work hard to ensure that we protect our customers’ personal data in accordance with our legal obligations. If you are unhappy with how you think we have processed your personal data, please contact us using the details above and we will do our best to resolve your complaint.
You can find out how to do this by visiting www.ico.org.uk.
Last updated 12 April 2019