Privacy Policy

What we hold depends on how you interact with us. Depending on the situation, this may include:

• Name, business name and job title
• Business address, email address and telephone number
• Enquiry details and anything submitted through a Commerce Review form
• Information about your existing commerce technology setup
• Website and ecommerce information
• EPOS information
• Payment provider and card terminal information
• Banking and settlement information relevant to a Commerce Review
• Accounting and integration information
• Correspondence with us and notes from meetings or calls
• Proposal, quotation and contractual information
• Technical website information such as IP address, browser and device information, and cookie information where applicable

We do not ask for, and you should not send us, full payment card credentials, online banking passwords or other login credentials. Where a provider needs that information, you supply it to the provider directly through their own systems.

• Directly from customers and prospective customers
• Website forms, including Commerce Review requests
• Telephone calls, email and meetings
• During a Commerce Review of your existing setup
• Publicly available business information and business directories
• Professional and social platforms where appropriate
• Technology and service providers we work with
• Referral and partner relationships where appropriate

• Responding to enquiries
• Carrying out Commerce Reviews and understanding your existing technology setup
• Preparing recommendations, quotes and proposals
• Arranging products and services you have asked for
• Implementing agreed services and providing support
• Managing business relationships and maintaining records
• Improving our website and services
• Security, fraud prevention and protecting our systems
• Meeting legal, accounting and regulatory obligations
• Business development and marketing relevant to businesses

Under UK GDPR we rely on different lawful bases depending on the activity:

• Contract — where we are delivering services you have engaged us for, or taking steps at your request before entering an agreement.
• Legitimate interests — for running and developing our business, responding to enquiries, maintaining records, securing our systems and appropriate business-to-business marketing. We consider your interests and rights when relying on this basis.
• Legal obligation — where we must keep records or provide information to meet accounting, tax or regulatory requirements.
• Consent — for optional cookies and similar technologies, and for certain marketing where consent is required. Consent can be withdrawn at any time. We do not rely on consent for everything.

We may contact businesses and business representatives about services that are relevant to them, where permitted by applicable law. This is normally on the basis of our legitimate interest in developing our business, or with consent where that is required.

You can object to marketing or opt out at any time by emailing hello@nodecommerce.co.uk or using an unsubscribe link. Opting out of marketing does not stop essential service, support or contractual communications relating to work we are carrying out for you.

We share information only where there is an appropriate reason to do so — usually because it is necessary to provide the service you have asked for, or because we are required to. Categories include:

• Payment providers and acquirers
• Banking and settlement providers
• EPOS providers
• Ecommerce and website technology providers
• Hosting, cloud and software providers
• Professional advisers such as accountants and lawyers
• Contractors and service providers working on our behalf
• Regulators, law enforcement and legal authorities where required

We do not sell personal information.

Much of our work involves introducing, recommending or helping customers apply for products and services provided by third-party payment, banking or financial service providers.

Where information is supplied to one of those providers — for example as part of an application — that provider will usually become an independent controller of that information, and their own privacy notice and terms will apply to how they use it.

Node Commerce is not a bank, acquirer, payment institution or payment processor. We advise on, supply and help implement commerce systems.

Some of the technology and service providers we use may process information outside the UK. Where that happens, we take steps to ensure an appropriate level of protection is in place, using the safeguards required by UK data protection law.

We keep personal information only for as long as reasonably necessary for the purposes it was collected for, and to satisfy legal, accounting, contractual or regulatory requirements. When it is no longer needed it is deleted or securely disposed of.

We use appropriate technical and organisational measures to protect personal information, including access controls and encryption of data in transit. No system can be guaranteed to be completely secure, and we do not claim otherwise.

Under UK data protection law you may have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete information, where applicable
• Ask us to restrict how we use information
• Object to processing, including direct marketing
• Request portability of information, where applicable
• Withdraw consent where our processing relies on consent

To make a request, email hello@nodecommerce.co.uk. We may need to verify your identity before responding.

If you are unhappy with how we have handled your information, please contact us first at hello@nodecommerce.co.uk so we can put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Details of the cookies and similar technologies used on this website, and how to change your choices, are set out in our Cookie Policy.

We review this notice regularly and will update it when our practices change. The date at the top of this page shows when it was last updated.