This notice explains what personal data SeaPay® collects, why we use it, who we share it with and the rights you have.

1. Who we are

SeaPay® is a brand of Seapay Ltd, a company registered in England and Wales under company number 14523418, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Seapay Ltd is registered with the Information Commissioner’s Office under registration number ZB626725.

Seapay Ltd is the controller of the personal data described in this notice, except where a partner named in section 5 acts as a controller in its own right — for example the licensed provider of your account or the issuer of your card.

For anything about this notice or your personal data, write to privacy@seapay.me. For everything else, write to info@seapay.me or call +44 203 807 0720.

2. The data we collect

• Identity and verification data: name, date of birth, nationality, passport or ID card, proof of address, photographs, and the results of identity, sanctions and politically-exposed-person checks.
• Contact details: postal address, email address and phone numbers.
• Company and ownership data: registration details, directors, shareholders, ultimate beneficial owners (UBOs) and authorised signatories.
• Account and transaction data: account details, balances, payments in and out, counterparties, and the documents attached to them.
• Card data: card details and card transactions, which the card issuers handle with us.
• Payroll and crew data: employment contracts, salaries, tax and social-security details, payslips and certificates, where we run payroll or crew services.
• Documents you upload: invoices, receipts, contracts and statements, including those sent from our apps.
• Device, log and usage data: IP address, device and browser type, sign-in times, security events, and how you use our websites and apps.
• Communications: messages, emails, calls and chats with our team, including the concierge.
• Cookies and similar technologies, described in section 10.

Most of this comes from you or from the company you work with. Some comes from others: identity-verification and screening services, public registers, banks and card issuers, and people who introduce you to us.

3. Why we use it, and our lawful basis

To provide our services — contract

Opening and running accounts, executing payments, issuing cards, running payroll, escrow and the other services you ask for, and providing our apps and support.

To meet our legal obligations — legal obligation

Verifying identity and ownership, screening against sanctions lists, monitoring transactions and reporting suspicious activity under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and keeping tax and accounting records.

To run and protect our business — legitimate interests

Preventing fraud, keeping our systems and your accounts secure, improving our services, and managing our relationship with you. We rely on legitimate interests only where your rights do not outweigh them.

With your consent

Sending you marketing, and automatically reading documents you choose to submit, such as invoices scanned in our apps. You can withdraw consent at any time; this does not affect what was done before.

4. Automated checks

We use automated tools to check identity documents, screen names against sanctions lists and categorise transactions. These tools flag cases for our team: a person reviews and decides every refusal or closure of an account.

5. Who we share it with

• PRIVAT 3 MONEY Ltd, the licensed electronic money institution that provides the financial services behind SeaPay® accounts.
• Card issuers: Cornèr Banca SA (SeaPay® Visa cards) and SatchelPay UAB (SeaPay® Mastercard® cards).
• Seapay Payments Ltd, which manages payment processing.
• SeaPay payroll companies, which employ crew on behalf of owners.
• Nave Magna Ltd, for provisioning and legal support.
• Service providers bound by contract — hosting, IT, communications and document-reading services — who use the data only on our instructions.
• Banks, correspondent banks and payment networks needed to complete a payment.
• Regulators, law-enforcement and tax authorities, and courts, where the law requires it.

We do not sell personal data.

6. International transfers

These are the partners and service providers that handle personal data for us, what they do and where they are:

• PRIVAT 3 MONEY Ltd — the licensed provider of the financial services behind SeaPay® accounts — United Kingdom.
• Seapay Payments Ltd — payment processing — United Kingdom.
• Nave Magna Ltd — provisioning and legal support — United Kingdom.
• SeaPay payroll companies — employment and payroll of crew — the country named in the crew member’s contract.
• Cornèr Banca SA — issuer of SeaPay® Visa cards — Switzerland.
• SatchelPay UAB — issuer of SeaPay® Mastercard® cards — Lithuania (EU).
• Didit Identity Spain, S.L. — identity verification — Spain (EU).
• Gandi SAS — hosting of our websites and web apps — France (EU).
• Plausible Insights OÜ — cookie-free website statistics — Estonia (EU), with data stored in Germany.
• Anthropic, PBC — automatic reading of documents you choose to submit — United States.
• Google Workspace — email and office tools — United States.

The European Union and Switzerland are covered by UK adequacy regulations. For the United States we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. A payment you send abroad necessarily shares the details needed with the receiving bank.

7. How long we keep it

• Account, identity and transaction records: for as long as our relationship lasts, then at least five years after it ends, as anti-money-laundering law requires.
• Accounting records: six years.
• Support messages, emails and chats: six years.
• Security, access and server logs: 12 months.
• Marketing preferences: until you withdraw consent.
• Anything else: only as long as needed for the purpose it was collected for.

8. How we protect it

Data is encrypted in transit and at rest. Company views published by our apps are encrypted on the device before they leave it, and open only with the company’s SeaPay UID and passphrase. Statements, certificates and payslips carry digital signatures, so any change can be detected. Access is limited to the people who need it, and access to company records is logged.

9. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we are no longer required to keep it;
• restrict how we use it;
• receive it in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it.

To use these rights, write to privacy@seapay.me. We reply within one month. If you are not satisfied with our answer, you can complain to the Information Commissioner’s Office, the UK data-protection regulator, at ico.org.uk or on 0303 123 1113.

10. Cookies

Our websites and web apps use only essential cookies, to keep you signed in and to protect your session; they cannot be switched off. We count website visits with Plausible, which sets no cookies and collects no personal data, so there is no cookie banner. We do not use advertising or tracking cookies.

11. Changes to this notice

We update this notice when our services or the law change, and tell you about important changes. The date at the top shows when it last changed.

Seapay Ltd · company number 14523418 · 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ · ICO ZB626725 · privacy@seapay.me · +44 203 807 0720