Privacy policy

Helmpay Limited, trading as Helm, is the controller of the personal data described in this policy. We are a company registered in England and Wales with company number 16417022, whose registered office is at 2 Frederick Street, London, England, WC1X 0ND.

You can contact us about this policy or about your personal data at contact@helm.business, or by writing to us at our registered office.

This policy explains how we collect, use, share and protect personal data when you visit our website, apply for a Helm account, use the Helm platform, or communicate with us.

Our customers are businesses. The personal data we process therefore relates mainly to the individuals connected with those businesses, including directors, officers, beneficial owners, authorised signatories and team users, and to individuals connected with the counterparties our customers pay or are paid by.

Identity data: name, date of birth, nationality, photograph or likeness from an identity document, identity document number and issuing details, and signature.

Contact data: email address, telephone number, business address, and residential address where required for verification.

Business data: role and position, shareholding and beneficial ownership details, directorship history, and information about the business you are connected with and its trading activity.

Verification and screening data: the results of identity verification and of sanctions, politically exposed person, adverse media and other screening checks, and information obtained from company registries, credit reference agencies and other third party sources.

Transaction data: details of payments made and received, including amounts, currencies, dates, references, counterparty and beneficiary details, and information you provide about the purpose of a transaction or the underlying commercial arrangement.

Technical data: IP address, device and browser information, operating system, log data, and information about how you interact with our website and platform.

Communications data: the content of and metadata relating to your correspondence with us, including emails and support enquiries.

We do not deliberately collect special category personal data. Where an identity document reveals information capable of indicating racial or ethnic origin, we process it only as incidental to identity verification and not for any separate purpose.

From you, when you apply for an account, use the platform, give a payment instruction, respond to an information request or contact us.

From our customers, where you are a director, officer, beneficial owner, team user, counterparty or beneficiary of a business that uses Helm. In that case the business that provided your data will normally have obtained it from you.

From third parties, including identity verification providers, company registries and other public registers, credit reference agencies, sanctions and watchlist providers, adverse media sources, our banking and payment partners, and payment networks.

Automatically, through cookies and similar technologies when you use our website, as described in our Cookie Policy.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests, rights and freedoms. You may request further information about that assessment.

We use automated processing in our verification and transaction screening. This includes automated matching against sanctions, watchlist and adverse media data, and automated rules that may cause a transaction to be held for review or an application to be flagged.

Automated processing may result in a payment being delayed or held, an application being referred for further review, or an account being restricted pending review.

Where automated processing produces an outcome that is adverse to you, a member of our team reviews that outcome before any decision to refuse an application, to close an account or to permanently reject a payment takes effect.

You may ask us to explain the general nature of the processing that led to an outcome, may express your point of view, and may contest an outcome by contacting us at contact@helm.business. There are circumstances in which we are prohibited by law from explaining the reason for an outcome, and in those cases we will tell you only what we are permitted to tell you.

Our banking, payment and technology partners, who provide elements of the service including account issuance, payment execution, custody and identity verification. These partners process personal data as controllers in their own right for their own compliance purposes, and their own privacy notices apply to that processing.

Payment networks and financial institutions involved in executing a payment, including intermediary banks and the recipient's bank. Payment messages typically carry the payer's and payee's details, and that information is visible to the institutions in the payment chain.

Verification and screening providers, company registries, credit reference agencies and fraud prevention agencies.

Professional advisers, including lawyers, accountants, auditors and insurers.

Regulators, law enforcement, tax authorities, courts and other public authorities, where we are required to disclose or where disclosure is necessary to protect our legal position.

Service providers who process personal data on our behalf, including hosting, infrastructure, communications and support providers. Those providers act on our instructions under a written contract and may not use the data for their own purposes.

A purchaser or prospective purchaser of our business or assets, subject to appropriate confidentiality protections.

We do not sell personal data.

Some of our partners and service providers are located outside the United Kingdom, including in the United States.

Where we transfer personal data outside the United Kingdom, we do so on the basis of one of the following:

the receiving country has been determined by the UK Government to provide an adequate level of protection;

the transfer is made under the International Data Transfer Agreement, or under the UK Addendum to the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment; or

another lawful transfer mechanism or derogation applies, including where the transfer is necessary for the performance of a contract with you or in your interest, or is necessary for the establishment, exercise or defence of legal claims.

Where a payment is made to a jurisdiction outside the United Kingdom, information about that payment necessarily travels to that jurisdiction in order for the payment to be executed.

You may request further information about the safeguards applied to a particular transfer.

We keep personal data for as long as necessary for the purpose for which it was collected, and for as long as we are required to keep it by law.

Records relating to customer due diligence, and records relating to transactions, are retained for five years after the end of the business relationship or the date of the transaction, in accordance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and may be retained for longer where a regulator or law enforcement authority requires it.

Accounting and tax records are retained for six years from the end of the relevant accounting period.

Records relating to an application that did not proceed are retained for five years from the date of the application, so that we can evidence the basis on which the application was assessed.

General correspondence and support records are retained for three years from the date of the last communication, unless they form part of a record we are required to retain for longer.

Records relevant to an actual or anticipated legal claim are retained until the claim is resolved and any applicable limitation period has expired.

When personal data is no longer required, we delete it or anonymise it.

Under UK data protection law you have the right to:

be informed about how we use your personal data, which is the purpose of this policy;

access the personal data we hold about you and receive a copy of it;

have inaccurate personal data corrected and incomplete personal data completed;

have your personal data erased in certain circumstances;

restrict our processing in certain circumstances;

receive your personal data in a portable form, where processing is based on consent or on a contract and is carried out by automated means;

object to processing based on our legitimate interests, and to object at any time to processing for direct marketing; and

withdraw consent, where we rely on consent, at any time, without affecting the lawfulness of processing before withdrawal.

These rights are not absolute. In particular, we are frequently unable to erase or restrict personal data that we are required by law to retain, including customer due diligence and transaction records. We are also unable to disclose information where doing so would prejudice the prevention or detection of crime, or would amount to unlawfully alerting a person that a report has been made.

To exercise a right, contact us at contact@helm.business. We will respond within one month, which we may extend by a further two months where a request is complex or where we have received a number of requests from you. We may ask you to verify your identity before we act.

There is normally no charge. We may charge a reasonable fee, or refuse to act, where a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your personal data, contact us first at contact@helm.business and we will try to resolve it.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk, by telephone on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We maintain technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, authentication requirements, encryption in transit and at rest, logging and monitoring, and restrictions on which of our personnel can access which data.

No system is entirely secure. You are responsible for keeping your own credentials confidential and for notifying us promptly if you suspect unauthorised access.

The services are provided to businesses and are not directed at children. We do not knowingly collect personal data relating to children.

We may update this policy. The current version is always available at helm.business/legal/privacy, and the date shown on the page indicates when it was last updated.

Where a change is material, we will notify you by email or through the platform.