Privacy Policy

Last updated: 7 October 2026

This Privacy Policy explains how Enhanced Merchant Solutions ("EMS", "we", "us" or "our") collects, uses, stores and protects personal information when you use our website, submit an application, contact us, make a referral or use any services provided by EMS.

EMS is a UK-registered company. We are committed to handling personal data responsibly and in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

Depending on how you interact with EMS, we may collect the following information:

Personal and contact information

  • Full name
  • Email address
  • Telephone number
  • Business address
  • Residential or correspondence address where required
  • Other information you provide when contacting us

Business and application information

When you apply for merchant services, we may collect information such as:

  • Business name and trading name
  • Company registration details
  • Business address
  • Business contact details
  • Type of business and industry
  • Estimated or actual card-processing volumes
  • Average transaction values
  • Information relating to your existing payment arrangements
  • Information required to assess and process your application

Bank and payment information

Where required to provide our services, we may collect bank account details such as:

  • Account name
  • Sort code
  • Account number

Sensitive financial information is handled using appropriate security measures and only accessed where necessary for legitimate business purposes.

Referral information

If you refer a business or individual to EMS, we may collect the information you provide about that referral, such as their name, business name, telephone number and email address.

You should only provide another person's personal information where you have a lawful basis to do so.

Communications

We may retain information contained in emails, messages, support requests, application forms and other communications you send to us.

Technical information

When you use our website or online portal, we may collect technical information such as:

  • IP address
  • Browser type and version
  • Device information
  • Operating system
  • Pages visited
  • Date and time of visits
  • Website usage information

This information may be used for security, fraud prevention, troubleshooting and improving our website and services.

2. How We Use Your Information

We may use your personal information to:

  • Process and assess merchant applications
  • Provide payment-processing and related services
  • Communicate with you about your application or account
  • Manage referrals and referral payments
  • Respond to enquiries and support requests
  • Verify information provided to us
  • Prevent fraud, misuse and security threats
  • Maintain and improve our website and services
  • Administer our business relationship with you
  • Comply with legal, regulatory and contractual obligations
  • Keep appropriate business and financial records
  • Send service-related communications

Where we send marketing communications, we will provide an appropriate opportunity to opt out where required by law.

3. Lawful Basis for Processing

Under UK data protection law, we will only process personal information where we have a lawful basis to do so.

Depending on the circumstances, this may include:

  • Contract: where processing is necessary to provide services or take steps at your request before entering into a contract.
  • Legitimate interests: where processing is necessary for the operation, security and development of our business and does not unfairly override your rights.
  • Legal obligation: where we are required to process information to comply with applicable law or regulation.
  • Consent: where you have provided consent for a specific use of your information.

Where we rely on consent, you may withdraw that consent at any time.

4. Sharing Your Information

We may share personal information where reasonably necessary to provide our services or meet our legal obligations.

This may include sharing information with:

  • Payment service providers and acquiring partners
  • Banks and financial institutions where required
  • Technology and hosting providers
  • Identity, fraud and compliance service providers
  • Professional advisers
  • Regulators, law enforcement agencies or other authorities where legally required

We do not sell your personal information to third parties.

Where we use third-party service providers to process personal information on our behalf, we take appropriate steps to ensure that your information is handled securely and in accordance with applicable data protection requirements.

5. International Data Transfers

Some of our service providers may process information outside the United Kingdom.

Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that suitable safeguards are in place in accordance with applicable UK data protection legislation.

6. Data Security

We take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, secure authentication, encryption, secure hosting, monitoring and appropriate staff access restrictions.

However, no online system can be guaranteed to be completely secure. You should take reasonable precautions when providing information online, including keeping passwords and account details confidential.

7. Cookies and Analytics

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function correctly, maintain sessions and provide security.

Where required, non-essential cookies, analytics or similar technologies will only be used with your consent.

You may change or withdraw your cookie preferences through the cookie controls provided on our website.

8. How Long We Keep Your Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

  • Provide our services
  • Maintain business and financial records
  • Resolve disputes
  • Prevent fraud
  • Comply with legal and regulatory requirements
  • Establish, exercise or defend legal claims

When information is no longer required, we will take reasonable steps to securely delete or anonymise it.

9. Your Data Protection Rights

Under UK data protection law, you may have the right to:

  • Request access to your personal information
  • Request correction of inaccurate or incomplete information
  • Request deletion of your personal information in certain circumstances
  • Request restriction of processing in certain circumstances
  • Object to certain types of processing
  • Request transfer of certain personal information to another organisation
  • Withdraw consent where we rely on consent as our lawful basis

These rights are subject to certain legal conditions and exemptions.

To exercise your rights, please contact us using the details provided below.

10. Children's Information

Our services are intended for businesses and adults. We do not knowingly collect personal information from children unless there is a lawful reason to do so.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements or how we process personal information.

12. Contact Us

If you have questions about this Privacy Policy, wish to make a data protection request or have concerns about how your personal information is being handled, please contact us at hello@shift4referrals.com.

Chat with EMS