KUBE PAY

Kube Finance Limited

Regulated payment services via Yapily Connect Ltd

Version 1.1 | Last updated: July 2026 | Effective date: July 2026

1. About This Policy

This Privacy Policy explains how Kube Finance Limited (trading as Kube Pay) collects, uses, stores, shares, and protects your personal data when you use the Kube Pay open banking payment platform, visit our website at kubepay.co.uk, or interact with us in any other way.

References to “Kube Pay”, “we”, “us”, or “our” in this policy are references to Kube Finance Limited, a company registered in England and Wales.

Payment initiation and account information services made available through the Kube Pay platform are provided under the FCA authorisation of Yapily Connect Ltd, FCA Financial Services Registration Number 827001, of 86-90 Paul Street, London, EC2A 4NE (“Yapily Connect”). Kube Finance Limited acts as an agent of Yapily Connect in the provision of those regulated services. Yapily Connect is an FCA-authorised Payment Institution regulated under the Payment Services Regulations 2017.

Kube Finance Limited is registered with the Information Commissioner’s Office (ICO) as a data controller in its own right for the personal data it collects and processes in connection with merchant onboarding, account management, and platform operations. For personal data processed in connection with the delivery of regulated payment services, Kube Finance Limited and Yapily Connect may each act as data controller, or as joint controllers, depending on the nature of the processing activity.

We process personal data in accordance with our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. If you have any questions, please contact us using the details in Section 14.

2. Who We Are and How to Contact Us

2.1 Kube Finance Limited (Data Controller: Platform & Merchant Services)

Trading name: Kube Pay

Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England

Company Number: 14579221

ICO Registration Number: ZC115813

Privacy Contact: privacy@kubepay.co.uk

Website: www.kubepay.co.uk

2.2 Yapily Connect Ltd (Regulated Payment Provider)

Payment initiation and account information services delivered through the Kube Pay platform are regulated services provided under the authorisation of Yapily Connect Ltd. For regulated payment data processing, Yapily Connect may act as a data controller or joint controller alongside Kube Finance Limited.

Legal entity: Yapily Connect Ltd

Registered Office: 86-90 Paul Street, London, EC2A 4NE

Company Number: 11598433

FCA Registration Number: 827001

Yapily Connect DPO: info@yapily.com

Yapily Connect’s Privacy Policy is available at www.yapily.com/legal/privacy-policy. Where Yapily Connect acts as a data controller for personal data processed in connection with regulated payment services, their policy governs that processing. We encourage you to read it alongside this policy.

3. What Personal Data We Collect

The categories of personal data we collect depend on whether you are a merchant (business user), a payer (end customer making a payment), or a visitor to our website.

3.1 Merchant / Business Account Holders

Full name and job title of the account holder and any authorised users

Business name, trading name, registered address, and business type

Contact details including email address and telephone number

Know Your Business (KYB) documentation: certificate of incorporation, proof of address, VAT registration, Companies House records

Identity verification documents for beneficial owners and directors (e.g. passport, driving licence, utility bill)

Bank account details used to receive settlement of open banking payments

Transaction history, payment volumes, and associated invoice or reference data

Technical data including IP address, device identifiers, access logs, and session activity

Communications you send us, including support requests and onboarding correspondence

3.2 Payers (End Customers)

When you use Kube Pay to make a bank payment to a merchant, we and our regulated principal Yapily Connect (Yapily Connect Ltd) receive limited personal data from your bank via the open banking infrastructure under the Payment Services Regulations 2017. This includes:

Your name as it appears on your bank account

Your bank sort code and account number, used solely to initiate the specific payment instruction you have authorised

Payment amount, payment reference, and timestamp

Transaction status data returned by your bank following the payment instruction

Device and browser information collected at the point of payment initiation for fraud prevention and security purposes

We do not have ongoing access to your bank account, balances, or transaction history beyond the specific payment you authorise. We do not store your online banking credentials at any point.

3.3 Website Visitors

Name and email address if you submit an enquiry or sign up for updates

Usage and analytics data including pages visited, referral source, and session duration

Cookie data as described in Section 12

IP address and approximate geolocation

4. Regulated Payment Services and Our Principal

Kube Finance Limited offers payment initiation services to its merchant customers as an agent of Yapily Connect Ltd, FCA Financial Services Registration Number 827001. Yapily Connect Ltd is an FCA-authorised Payment Institution under the Payment Services Regulations 2017 (PSR 2017), authorised to provide both Payment Initiation Services (PIS) and Account Information Services (AIS).

As Yapily Connect’s agent, Kube Finance Limited acts within the scope of Yapily Connect’s FCA authorisation when providing regulated open banking payment services. Kube Finance Limited will be listed as an agent of Yapily Connect Ltd on the FCA Register. You can verify our authorisation status at any time at register.fca.org.uk.

When a payer authorises a payment through Kube Pay, they are redirected to their own bank’s secure authorisation interface. At no point does Kube Finance Limited or Yapily Connect collect or have access to the payer’s online banking username, password, or PIN. The payment instruction is submitted directly to the payer’s bank (ASPSP) via a regulated open banking API.

The lawful bases for processing personal data in connection with regulated payment services are:

Performance of a contract (UK GDPR Article 6(1)(b)): Processing necessary to initiate payments and deliver the contracted service to merchants and payers.

Compliance with a legal obligation (UK GDPR Article 6(1)(c)): Processing required under the PSR 2017, the Money Laundering Regulations 2017, and other applicable financial regulation.

Legitimate interests (UK GDPR Article 6(1)(f)): Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights.

For personal data processed by Yapily Connect (Yapily Connect Ltd) in their capacity as FCA-authorised principal, Yapily Connect’s Privacy Policy at www.yapily.com/legal/privacy-policy applies. Yapily Connect acts as data controller for transaction data processed within their regulated infrastructure.

5. How We Use Your Personal Data

We process personal data for the following purposes, each supported by a lawful basis under UK GDPR:

To provide and operate the Kube Pay platform: Contract performance (Art. 6(1)(b))

To initiate payments on behalf of merchants and process payment instructions for payers, acting as agent of Yapily Connect Ltd: Contract performance (Art. 6(1)(b))

To conduct Know Your Business (KYB) verification and identity checks prior to merchant onboarding: Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

To comply with anti-money laundering (AML), counter-terrorist financing (CTF), sanctions screening, and fraud prevention obligations: Legal obligation (Art. 6(1)(c))

To communicate with you regarding your account, transactions, and service updates: Contract performance (Art. 6(1)(b))

To fulfil our obligations to Yapily Connect (Yapily Connect Ltd) as our regulated principal, including transaction monitoring and compliance reporting: Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

To investigate and resolve disputes, complaints, and payment queries: Legitimate interests (Art. 6(1)(f))

To improve and develop the Kube Pay platform and user experience: Legitimate interests (Art. 6(1)(f))

To send marketing communications (merchants only, with opt-out available): Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f))

To comply with regulatory and legal obligations imposed on us as a financial services business and as agent of an FCA-authorised Payment Institution: Legal obligation (Art. 6(1)(c))

To detect and prevent fraud, unauthorised access, and security threats: Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

6. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of recipient, strictly as required to deliver our services or meet our legal obligations:

Yapily Connect Ltd, regulated principal: As our FCA-authorised principal, Yapily Connect (Yapily Connect Ltd, FCA No. 827001) receives transaction data and compliance-related information necessary for them to meet their regulatory obligations and to oversee our activity as their agent. Yapily Connect acts as a data controller for data processed within their regulated infrastructure.

Banks and Account Servicing Payment Service Providers (ASPSPs): Banks and building societies that process the payment instruction authorised by payers via the UK open banking framework.

Open Banking Limited (OBL) / Financial-grade API (FAPI) Infrastructure: For technical directory services and regulated connectivity to bank APIs, as managed through Yapily Connect’s infrastructure.

Identity Verification and KYB Providers: Third-party services used to verify merchant identity and business legitimacy during onboarding (e.g. document verification, Companies House data).

Cloud Hosting and Infrastructure Providers: Providers who host our platform, databases, and related systems under data processing agreements ensuring UK GDPR compliance.

Fraud Prevention and AML Screening Services: Third-party providers used to screen transactions and account holders against sanctions lists, fraud databases, and PEP registers.

Professional Advisers: Solicitors, accountants, and auditors under obligations of confidentiality.

Regulators and Law Enforcement: The Financial Conduct Authority (FCA), ICO, HMRC, the National Crime Agency, and other authorities where required by law or regulatory obligation.

Business Successors: In the event of a merger, acquisition, or sale of Kube Finance Limited, personal data may be transferred as part of that transaction, subject to equivalent data protection obligations.

7. International Data Transfers

Kube Pay is a UK-based platform and our primary data processing takes place within the United Kingdom. Yapily Connect (Yapily Connect Ltd), as our regulated principal, also processes data within the UK and EEA.

Where any personal data is transferred outside the UK or EEA by Kube Finance Limited or its sub-processors, we ensure appropriate safeguards are in place, including use of the International Data Transfer Agreement (IDTA) approved by the ICO, UK adequacy decisions, or standard contractual clauses.

You may request details of specific transfer safeguards by contacting privacy@kubepay.co.uk.

8. Your Rights Under UK GDPR

You have the following rights in respect of your personal data. These rights are not absolute and may be subject to exemptions, particularly where we are required to retain data for regulatory, legal, or compliance purposes under our obligations as agent of an FCA-authorised Payment Institution.

Right of Access (Subject Access Request): You may request a copy of the personal data we hold about you.

Right to Rectification: You may ask us to correct inaccurate or incomplete personal data.

Right to Erasure (‘Right to be Forgotten’): In certain circumstances, you may request deletion of your personal data. This right does not apply where we are required to retain data by law (e.g. AML, KYB, or PSR 2017 records).

Right to Restriction of Processing: You may request that we restrict how we process your data in certain circumstances.

Right to Data Portability: Where processing is based on consent or contract, you may request a machine-readable copy of data you have provided to us.

Right to Object: You may object to processing based on legitimate interests or direct marketing at any time.

Rights Related to Automated Decision-Making: You have the right not to be subject to solely automated decisions producing significant legal or similar effects, unless permitted by law.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact privacy@kubepay.co.uk. We will respond within one calendar month. Where your request relates to personal data processed by Yapily Connect (Yapily Connect Ltd) in their capacity as data controller for regulated payment services, we will direct your request to them accordingly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Security of Your Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

Encryption of data in transit using TLS and at rest using industry-standard protocols

Access controls and role-based authentication for all platform systems

Regular security assessments, penetration testing, and vulnerability management

Strict vendor due diligence for all third-party data processors, including sub-processors engaged by Yapily Connect

Staff training on data protection and information security obligations

Incident response procedures compliant with UK GDPR breach notification requirements (72-hour ICO notification where required)

10. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law or our obligations as agent of Yapily Connect Ltd. Key retention periods are:

Transaction and payment records: 6 years from the date of the transaction, in line with HMRC requirements and the Limitation Act 1980.

KYB / identity verification records: 5 years from the end of the business relationship, in line with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

Merchant account data: For the duration of the business relationship and 6 years thereafter.

AML, sanctions, and fraud screening records: 5 years from the date of screening, or longer if required by law enforcement or regulatory instruction.

Compliance and principal oversight records (Yapily Connect): Retained in line with Yapily Connect’s data retention policy and FCA regulatory requirements applicable to the principal.

Support and correspondence records: 3 years from the date of last contact.

Marketing consent records: Until consent is withdrawn, plus 1 year.

Website analytics data: 13 months, in line with ICO guidance for analytics cookies.

11. Children’s Privacy

Kube Pay is a platform intended for use by adults aged 18 and over. We do not knowingly collect or process personal data relating to children under the age of 18. If you believe that a child’s data has been submitted to our platform, please contact us immediately at privacy@kubepay.co.uk.

12. Cookies and Tracking Technologies

Our website and payment pages use cookies and similar tracking technologies. We categorise these as follows:

Strictly Necessary Cookies: Essential for the operation of the website and payment flow. These are required to maintain session security and payment state and do not require consent.

Functional Cookies: Used to remember your preferences and improve your experience. Set only with your consent.

Analytics Cookies: Used to understand how visitors interact with our website. Set only with your consent. Where applicable, IP addresses are anonymised.

Marketing Cookies: Used to support relevant advertising across third-party channels. Set only with your explicit consent, where applicable.

You may manage your cookie preferences via our cookie consent tool displayed on first visit, or through your browser settings. For full details, please refer to our Cookie Policy at kubepay.co.uk/cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our relationship with Yapily Connect (Yapily Connect Ltd) as our regulated principal, regulatory requirements, or data processing practices. Where changes are material, we will notify you by email (if you have a registered account) or by displaying a prominent notice on our website.

The “Last updated” date at the top of this document indicates when the most recent revision was made. Continued use of the Kube Pay platform following notification of a material change constitutes acceptance of the updated policy.

14. Contact Us

14.1 Kube Finance Limited

By email: privacy@kubepay.co.uk

By post: Data Protection, Kube Finance Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England

Website: www.kubepay.co.uk/privacy

14.2 Yapily Connect Ltd (Regulated Payment Provider)

For queries relating to personal data processed by Yapily Connect Ltd in connection with regulated payment services:

DPO email: info@yapily.com

Address: 86-90 Paul Street, London, EC2A 4NE

14.3 Supervisory Authority

Information Commissioner’s Office (ICO)

Website: ico.org.uk | Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Legal Notice

Payment initiation and account information services are provided under the FCA authorisation of Yapily Connect Ltd (Financial Services Registration Number 827001). Kube Finance Ltd (trading as Kube Pay), company registration number 14579221, ICO registration ZC115813. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England. Kube Pay and the Kube Pay logo are trading names or marks of Kube Finance Ltd.