Privacy Policy

01Introduction

We value your privacy and are committed to protecting your personal data. This Privacy Policy (“Policy”) explains how we collect, use, store, and safeguard your information when you use our website and our fraud detection, transaction monitoring, payment routing advisory, dispute resolution and related services (“Services”).

This Policy is issued by SFC GROUP LTD, a company registered in England and Wales under company number 10177969, whose registered address is Suite 7086, 128 Aldersgate Street, Barbican, London, EC1A 4AE, United Kingdom, operating under the ScanFraud brand (“we”, “us”, “our”). You can contact us at [email protected].

We follow applicable data protection laws, including the UK GDPR and the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (GDPR) for individuals located in the European Union. For users outside the UK and the EU, we apply the same principles of fairness, transparency, and security to ensure consistent protection worldwide.

Depending on the purpose of processing, we may act either as:

• a Data Processor, when handling data on behalf of our business clients (“Clients”), including data relating to their end users, when providing the Services to them; or
• a Data Controller, when we process information for our own purposes, such as operating our website, handling enquiries and demo bookings, managing our relationships with Clients and complying with our legal obligations.

02What data we collect

We only collect the data that is necessary to provide and improve our Services. This may include:

• Identification data: full name, date of birth.
• Contact data: residential or registration address, email, and phone number.
• Transaction data: masked card details, transaction amount, currency, date and time.
• Technical data: IP address, device information and identifiers (including device fingerprints), browser type, connection parameters, and operating system.
• Risk data: risk scores, fraud flags and alerts, rule outcomes, and chargeback and dispute data.
• Usage and analytics data: information about how users interact with our website and Services, including page views, clicks, scrolling, navigation paths, session events, error logs, performance data and similar interaction data collected through analytics and monitoring tools.
• Demo booking data: when you book a demo or a meeting with us, your name, business email address, company name, job title, phone number (if provided), time zone, selected date and time, and any other information you provide in the booking form.

We may receive this data directly from you (for example, when you book a demo), indirectly from our Clients through API integration, or automatically via cookies and similar technologies.

03Legal basis and purposes of processing

We process personal data only when a lawful basis exists under applicable data protection laws. These include:

• Contract performance: to provide the Services to Clients under our agreements with them and provide customer support.
• Legal obligations: to comply with tax, accounting and other legal and regulatory requirements.
• Legitimate interests: to prevent fraud, maintain the security and integrity of our website and Services, debug technical issues, analyse user interaction with our website, improve user experience, and improve our Services.
• Pre-contractual steps: to schedule and conduct demos and respond to your enquiries at your request (Article 6(1)(b) GDPR), and our legitimate interest in developing business relationships with prospective clients.
• Consent: where explicitly required, such as for marketing communications, non-essential cookies (including marketing and targeting cookies), analytics tools, session recording technologies or optional service features.

We use your data only for the purposes described above and do not process it further in ways incompatible with those purposes.

04Data retention and security

We retain personal data only for as long as necessary to fulfill the purposes described above or as required by applicable law. Our own financial and accounting records may be retained for up to five (5) years to comply with applicable accounting and tax regulations. After the retention period expires, data is securely deleted or anonymized.

In particular, the following retention periods apply:

• Client due diligence data and our transaction records are normally kept for five (5) years after the end of the relationship or transaction, as required by applicable tax and accounting laws.
• Personal data processed on behalf of Clients (including transaction, device and risk data) is retained in accordance with our agreement with the relevant Client.
• Technical and security logs are stored for up to 12 months to maintain platform stability and prevent fraud.
• Analytics events, session recordings and error monitoring logs are stored for a limited period determined by our internal retention settings and only for as long as necessary for analytics, debugging, product improvement and security purposes.

After the applicable retention period, we securely delete or anonymize the data.

05Recipients and international data transfers

Your data may be processed or stored in countries outside your country of residence, including locations that may have different data protection laws. Whenever such transfers occur, we ensure that your information is handled with the same level of protection as required by this Policy and by applicable laws. We take all necessary steps to keep your data secure, confidential, and protected from unauthorized access, disclosure, or loss regardless of where it is processed.

We may use third-party service providers, including analytics, session recording and error monitoring providers, to help us operate, secure and improve our Services. Where such providers process data outside your country of residence, we implement appropriate safeguards required under applicable data protection laws.

We may share personal data, to the extent necessary, with our Clients (for example, risk scores relating to your transactions), payment service providers (banks, acquirers and payment systems), identity verification and fraud prevention providers, IT, hosting, analytics and scheduling service providers, professional advisers and competent authorities. Transfers outside the UK or the EEA are based on an adequacy decision (including the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses (together with the UK International Data Transfer Addendum, where applicable).

06Automated decision-making and human review

Certain processes, such as fraud detection or risk scoring, may involve automated decision-making. If such a decision produces legal or significant effects on you (for example, a declined transaction), you have the right to:

• request a human review of the decision;
• express your point of view; and
• request that the outcome be reconsidered.

07Your rights

You have the following rights regarding your personal data:

• Access your personal data and obtain a copy of it;
• Rectify inaccurate or incomplete information;
• Request erasure of your personal data where there is no longer a lawful basis for its processing;
• Restrict or object to processing in certain circumstances;
• Request portability of your data to another service provider, where technically feasible;
• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• Lodge a complaint with your local Data Protection Authority if you believe your data has been mishandled.

To exercise your rights, please contact us at [email protected]. We will respond within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We may ask you to verify your identity before we respond. Where we process your personal data on behalf of a Client, please contact the relevant Client directly; if you contact us, we will forward your request to that Client.

08Cookies and similar technologies

We use cookies and similar technologies to ensure our website works smoothly, to improve user experience, and to analyze performance. The types of cookies we use, how you can manage your preferences, and the third-party services embedded on our website are described in our Cookie Policy.

09Data breach notification

We take the security of your information very seriously. In the unlikely event of a data breach that may pose a risk to your rights and freedoms, we will:

• take immediate steps to contain and assess the incident;
• notify affected individuals without undue delay, where legally required; and
• cooperate with supervisory authorities and provide relevant details of the breach and remedial measures taken.

10Updates to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal obligations. Any updates will be published on our website with a revised “Last Updated” date.

Note for UK and EU residents

For individuals in the UK, all processing of personal data is carried out in accordance with the UK GDPR and the Data Protection Act 2018. For individuals in the EU, all processing of personal data is carried out in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). You may contact your local Data Protection Authority for additional information or to file a complaint regarding the processing of your personal data.