PayPilot Technologies ("PayPilot", "we", "us", "our") is a private limited company registered in Scotland. We operate PilotOS — a cloud-based operating platform designed for independent sales organisations (ISOs) and payment companies, covering CRM, merchant onboarding, analytics, white-label portals, MCA origination, and related services.

For the purposes of UK data protection law, PayPilot Technologies is the data controller for the personal data of website visitors and for the account, billing, and contact details of our customers ("Tenants"). For all other personal data processed through the PilotOS platform on behalf of a Tenant, PayPilot acts as a data processor and the Tenant is the data controller. See our GDPR & Data Policy for full details on this distinction.

Our registered office address and contact details are available at legal@paypilot.plus.

We collect personal data in the following categories:

Website visitors (paypilot.plus):

• IP address and approximate location (derived from IP)
• Browser type, device type, and operating system
• Pages visited, time on site, and referral source
• Information you voluntarily submit via consultation request or contact forms (name, email, company name, job title, phone number)

Tenant account holders (PilotOS platform):

• Name, job title, and work email address of the account owner and invited administrators
• Billing name, address, and payment method details (processed via our payment provider)
• IP addresses and session metadata for security and audit logging
• Communications you send to our support team

We do not collect sensitive special category data from website visitors. We do not use automated decision-making or profiling on this website.

We use the personal data we collect for the following purposes, each with the corresponding lawful basis:

• To respond to enquiries and consultation requests — Legitimate interests / pre-contractual steps
• To operate and maintain your PilotOS account — Performance of contract
• To process subscription payments and issue invoices — Performance of contract / legal obligation
• To send service notifications, security alerts, and product updates — Legitimate interests / performance of contract
• To improve the website and platform through analytics — Legitimate interests
• To comply with legal and regulatory obligations (e.g. anti-money laundering, tax records) — Legal obligation
• To send marketing communications, where you have opted in — Consent

We will never sell your personal data to third parties or use it for purposes incompatible with those described here.

This website uses cookies and similar tracking technologies. We use a minimal set of cookies necessary to operate the site and, where you consent, analytics cookies to understand how visitors interact with our content.

• Strictly necessary cookies — these are required for the site to function and cannot be disabled
• Analytics cookies — used to measure page views and navigation patterns (opt-in only)
• Preference cookies — used to remember your cookie consent choice

You can withdraw your consent to non-essential cookies at any time by clearing your browser cookies. We do not serve advertising cookies.

We share personal data only with trusted sub-processors that assist us in delivering our services. All sub-processors are bound by data processing agreements and are required to handle data in accordance with UK GDPR.

• Cloud infrastructure providers (hosting and storage)
• Payment processing providers (for billing and subscription management)
• Email delivery providers (for transactional and notification emails)
• Customer support software providers
• Analytics services (where consent has been given)

We may also disclose personal data where required by law, court order, or a competent regulatory authority, or where necessary to protect the rights, property, or safety of PayPilot, its customers, or others.

PayPilot Technologies is based in the United Kingdom. Where we or our sub-processors transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including UK International Data Transfer Agreements (IDTAs) or adequacy decisions.

We will not transfer your data to a country without an adequate level of protection unless we have contractual safeguards in place.

We retain personal data for as long as is necessary for the purposes described in this policy:

• Website enquiry data: up to 24 months from the date of last contact
• Tenant account data: for the duration of the subscription plus 7 years (to meet legal and financial record-keeping obligations)
• Audit logs and security records: up to 7 years
• Marketing opt-in records: until consent is withdrawn

When retention periods expire, data is securely deleted or anonymised in accordance with our internal data retention schedule.

You have the following rights in relation to your personal data:

• Right of access — to receive a copy of the personal data we hold about you
• Right to rectification — to have inaccurate or incomplete data corrected
• Right to erasure — to have your data deleted where there is no legitimate reason to retain it
• Right to restriction — to restrict the processing of your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or direct marketing
• Right to withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, please contact us at legal@paypilot.plus. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These include encryption in transit and at rest, access controls, audit logging, and regular security reviews.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours of becoming aware and will notify affected individuals without undue delay.

We may update this Privacy Policy from time to time. Material changes will be notified to Tenant account holders by email and flagged on this page with an updated effective date. Continued use of the website or platform after the effective date constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

• Email: legal@paypilot.plus
• Subject line: Privacy Enquiry

PayPilot Technologies is registered in Scotland. Governing law for this policy is the law of Scotland.