Privacy policy
What we collect, why we collect it, who sees it, and what you can ask us to do with it. Written to be read rather than skimmed past.
Who we are
This policy covers personal information handled through scalapayapply.com and the Scalapay application process. Scalapay operates through a regulated payment institution subject to financial supervision, which shapes much of what follows — several things we collect are collected because regulation requires it, not because we chose to.
Details of the regulated entity and its supervision are set out on our licences and compliance page.
What we collect
Broadly, three categories.
Information you give us
- Identity details such as your name, date of birth and address
- Contact details including email address and mobile number
- Payment card details, handled under payment industry security standards
- Information you submit through the application form
Information collected automatically
When you use the site or the app we receive technical information automatically.
- Device and browser type, operating system and screen size
- IP address and approximate location derived from it
- Pages viewed, links followed and time spent
- Cookie and similar identifiers, covered in our cookie policy
Information from third parties
Some information reaches us from others rather than from you directly.
- Identity and fraud checks performed by verification providers
- Confirmation of an order from the retailer you are buying from
- Assessment outcomes from our banking partner where you apply for longer financing
- Payment outcomes from card networks and payment processors
Why we use it
Each use has a purpose, and we do not collect information without one.
- To verify your identity, which is a legal requirement for a regulated payment provider
- To assess whether an individual order can be approved
- To take payments on the schedule you agreed and to send reminders before each one
- To detect and prevent fraud and money laundering
- To provide support when you contact us
- To meet legal, regulatory and record-keeping obligations
- To improve the site and the application experience
The application form on this site
The application form on our apply page is operated by an application partner. Information you enter there is submitted to that partner over an encrypted connection and is handled under their privacy terms as well as this policy. If you would rather not use it, you can start an application through the Scalapay app instead.
How long we keep it
Different information has different retention periods, driven mostly by regulation rather than preference. Identity and transaction records connected to a regulated payment service must be kept for a period set by financial regulation, even after an account is closed. Marketing preferences are kept until you change them. Technical logs are kept for a shorter period.
Where we no longer have a purpose or a legal obligation, information is deleted or anonymised.
Your rights
Depending on where you live, you may have some or all of the following rights. We will not charge you for exercising them and will not treat you differently for doing so.
- Access — ask for a copy of the personal information we hold about you
- Correction — ask us to fix information that is wrong or incomplete
- Deletion — ask us to delete information, subject to our legal retention obligations
- Portability — ask for certain information in a portable format
- Objection and restriction — object to certain uses or ask us to limit them
- Opt out of sale or sharing — we do not sell personal information, and you can opt out of sharing for cross-context advertising
- Withdraw consent — where we relied on consent, you can withdraw it at any time
To exercise any of these, contact us through the help centre. We may need to verify your identity first, which is itself a protection for you.
Security
Card details are handled under payment industry security standards rather than stored in plain form, and information is transmitted over encrypted connections. Access inside the company is limited to people who need it for the purposes described above.
No system is perfectly secure, and we would rather say that than imply otherwise. If you believe your account has been accessed without permission, freeze it in the app and report it immediately. Our security page covers what a genuine message from us will and will not ask for.
Children
Our services are not directed at children and we do not knowingly collect information from anyone under the age of majority in their state. If you believe a child has provided us with information, contact us and we will delete it.
Changes to this policy
We update this policy when our practices or the law change. The date at the top reflects the most recent revision. Material changes will be communicated through the app or by email rather than only being posted here.
Questions about your data?
The help centre is the fastest route to a person who can look at your account.