EasyPay Express Privacy Policy

Last updated: 22 October 2026

This policy explains how Easypay Express Ltd handles personal information when you visit easypay.express, use pay.easypay.express, contact us or pay an invoice through our payment portal.

1. Who we are and how to contact us

EasyPay provides payment facilities on behalf of our business clients. We use information supplied by the business identified on your invoice and its systems to look up the invoice, facilitate payment and communicate payment information back to that business.

For processing carried out on a business client’s instructions, we act on its behalf. The business is responsible for the underlying customer and invoice records it controls. EasyPay is responsible for its own website administration, security and handling of privacy correspondence.

You can write to us about privacy, your rights or a data-protection complaint at:

Privacy enquiries
Easypay Express Ltd
P R House, Hortonwood 30
Telford, Shropshire
TF1 7ET
England

Company number: 16716287. This is also our registered office.

2. Information we process

Depending on how you use the service, we process:

• Contact information: your name and email address.
• Invoice information: invoice number, amount, currency, status and information determining which payment methods are available.
• Enquiry information: messages you send and information needed to investigate or route your enquiry.
• Payment information: payment method, transaction references, amounts, payment status and associated invoice details.
• Technical information: session identifiers and connection or device information, such as IP address and browser information, used in operating and protecting the service.

EasyPay does not store your card details. Card information is entered into Stripe’s payment form and handled by Stripe. Payment references and status information are used to match payments to invoices.

Please avoid including unnecessary sensitive information in enquiry messages.

Information needed to use the service

To look up an invoice and start an online payment through the portal, we need its invoice number and registered email address. Without matching details, we cannot retrieve the invoice through this journey. These are service requirements; this policy does not make providing them a statutory obligation.

The enquiry form identifies its required fields. Without the information needed to identify and investigate an enquiry, we may be unable to resolve it. You do not need a payable invoice to make a privacy request or complaint using the postal contact above.

3. Where information comes from

We receive information directly from you when you enter your details, contact us or make a payment. Relevant invoice and payment information also comes from the business identified on your invoice, its customer relationship management system and payment providers. Technical information is generated when your browser interacts with our websites.

4. Why we use information

We use information to:

• Match your invoice number and email address to an invoice.
• Display invoice details and available payment methods.
• Arrange payments and communicate payment information for reconciliation with the relevant invoice.
• Provide bank-transfer instructions and related communications.
• Respond to enquiries and coordinate them with the relevant business.
• Protect the service, investigate suspected misuse and manage payment risks.
• Handle privacy requests, complaints and applicable legal obligations.

5. Our responsibilities and lawful bases

Where we process information on a business client’s instructions, that business is responsible for determining the lawful basis for the processing it controls.

For processing that EasyPay controls, we rely on legitimate interests in operating a reliable payment service, dealing with service enquiries and protecting our websites against misuse. Processing must be necessary for those purposes and take account of your interests, rights and freedoms.

Where processing is necessary to meet a legal obligation that applies to EasyPay, including applicable data-protection duties, we rely on that obligation. If an activity requires consent, we will request it separately and explain how it can be withdrawn without affecting earlier lawful processing.

6. Payments and available methods

Card payments through Stripe

We use Stripe Checkout to collect online payments. EasyPay does not store your card details. Card information is handled through Stripe’s embedded payment form, and Stripe may retain payment information under its own responsibilities and privacy policy.

The portal exchanges relevant invoice, email, amount and transaction information with Stripe to arrange payments and communicate their status. Depending on the activity, Stripe processes information on instructions or for its own purposes. See the Stripe Privacy Policy.

Klarna and Afterpay/Clearpay

Where available and selected, these providers process information to assess eligibility and provide their payment services. Their terms and privacy notices apply to that processing. See Klarna’s privacy information and the Clearpay Privacy Policy.

Bank transfers and payment restrictions

Your bank and the receiving bank process the information needed to make a transfer. Relevant payment references and transaction information may be used to match the payment to your invoice.

Available payment methods can depend on invoice status, amount and restrictions supplied through the invoice system. Payment providers may also apply their own eligibility rules. If you believe an invoice restriction is incorrect, contact the business identified on your invoice. You can also write to EasyPay about information processed through this payment service.

7. Who receives information

Where necessary for the purposes described in this policy, information is shared with:

• The relevant business identified on your invoice.
• Organisations operating the associated invoice, customer relationship management and enquiry systems.
• Stripe and your selected payment-method provider.
• Banks involved in processing payments.
• Hosting, email, IT and security service providers.
• Professional advisers or public authorities where there is a lawful reason for disclosure.

These organisations may process information on instructions or under their own responsibilities, depending on the activity.

8. International processing

Payment and technical service providers may process information outside the UK. Their privacy information explains the locations, responsibilities and safeguards applicable to their services. Stripe describes its international processing in its privacy policy.

Where EasyPay is responsible for arranging a restricted international transfer, UK data-protection requirements apply. Depending on the transfer, these require an applicable adequacy arrangement or other permitted safeguards, such as approved contractual provisions. You can write to us for information about the arrangements relevant to information we process for you and how to obtain details of applicable safeguards.

9. How long information is kept

Our business clients determine retention of the underlying customer and invoice records they control. Where EasyPay processes information only on a client’s behalf, retention and deletion follow the applicable instructions and agreed arrangements.

The relevant retention criteria depend on the information and its purpose:

• Payment-session information: invoice and checkout context supports continuation, return and verification of the payment journey. It is held in a server-side session, subject to session expiry and server cleanup. Closing a browser does not necessarily delete the server-side information immediately.
• Enquiry and privacy correspondence: retention takes account of whether the enquiry or request has been resolved, any outstanding dispute or complaint, and information needed to explain the response or meet legal obligations. Forwarding an enquiry to a business client does not itself establish that a local form copy has been deleted.
• Technical and security records: retention takes account of operational troubleshooting, investigation of misuse or security incidents, and applicable legal requirements.
• Backup copies: where information is included in backups, its retention also depends on the applicable backup replacement and deletion cycle.

Information should not be kept longer than necessary for its purpose. There may be a continuing need to retain particular information for unresolved disputes, legal claims or applicable recordkeeping requirements. You can write to us for information about retention relevant to your request.

Stripe and your selected payment provider retain information under their own applicable responsibilities and privacy notices.

10. Cookies and external resources

The payment portal uses a session cookie, PHPSESSID, to maintain information needed during the payment journey. The browser cookie identifies the session; invoice and checkout context is held on the server.

Our main website loads fonts from Google’s servers. These requests disclose technical connection information, such as your IP address, to Google. See Google Fonts privacy information.

Stripe and selected payment providers may use cookies or similar technologies when you interact with their services. Their privacy and cookie information explains those uses and any applicable choices.

You can manage cookies through your browser settings. Blocking cookies needed for the payment session may prevent the portal from working correctly. Where a particular use requires consent, that consent must be obtained separately; reading this policy does not itself provide consent.

11. Your rights

Depending on the circumstances and applicable law, you can request access, correction, deletion, restriction or transfer of your personal information. You can withdraw consent where processing relies on it and exercise applicable rights concerning significant automated decisions.

Your right to object

Where processing relies on legitimate interests, you can object for reasons relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Rights have conditions and exceptions. For example, some information may need to be retained to meet legal obligations. Write to the privacy contact in section 1 to exercise your rights. You do not need a payable invoice, a particular form or legal terminology. Rights requests can be made verbally or in writing; the postal address is our published privacy contact.

We may request proportionate information where needed to verify your identity. We respond without undue delay, normally within one calendar month. Where the law permits additional time, clarification or identity checks that affect the timetable, we explain the reason and relevant deadline. Requests are normally handled free of charge; we will explain any lawful exception.

Where a request concerns information controlled by the business identified on your invoice, we will assist with directing or handling the request under the relevant responsibilities.

12. Complaints

If you are concerned about how information is handled, write to the privacy contact in section 1. You do not need an invoice to make a privacy complaint.

We acknowledge data-protection complaints within 30 days of receipt. We make appropriate enquiries, keep you informed and communicate the outcome without undue delay.

You can also raise a concern with the UK data-protection regulator through the ICO complaints service.

13. Changes to this policy

We will update this policy when our processing or applicable requirements change. The published version shows its revision date. Where necessary, we will draw significant changes to your attention. If we plan to use information for a new purpose, we will provide the required information before that processing begins and obtain consent where applicable.