KUBE PAY

Kube Finance Limited

Agent of Wonderful Payments Ltd (trading as Asima)

Version 1.1 | Last updated: March 2025 | Effective date: March 2025

1. About This Policy

This Privacy Policy explains how Kube Finance Limited (trading as Kube Pay) collects, uses, stores, shares, and protects your personal data when you use the Kube Pay open banking payment platform, visit our website at kubepay.co.uk, or interact with us in any other way.

References to “Kube Pay”, “we”, “us”, or “our” in this policy are references to Kube Finance Limited, a company registered in England and Wales.

Payment initiation and account information services made available through the Kube Pay platform are provided under the FCA authorisation of Wonderful Payments Ltd (trading as Asima), FCA Financial Services Registration Number 964289, of 41 Luke Street, London, EC2A 4DP (“Asima”). Kube Finance Limited acts as an agent of Asima in the provision of those regulated services. Asima is an FCA-authorised Payment Institution regulated under the Payment Services Regulations 2017.

Kube Finance Limited is registered with the Information Commissioner’s Office (ICO) as a data controller in its own right for the personal data it collects and processes in connection with merchant onboarding, account management, and platform operations. For personal data processed in connection with the delivery of regulated payment services, Kube Finance Limited and Asima may each act as data controller, or as joint controllers, depending on the nature of the processing activity.

We process personal data in accordance with our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. If you have any questions, please contact us using the details in Section 14.

2. Who We Are and How to Contact Us

2.1 Kube Finance Limited (Data Controller — Platform & Merchant Services)

Trading name: Kube Pay

Registered Address: [Insert Registered Address], England

Company Number: [Insert Company Registration Number]

ICO Registration Number: [Insert ICO Reference Number]

Privacy Contact: privacy@kubepay.co.uk

Website: www.kubepay.co.uk

2.2 Wonderful Payments Ltd trading as Asima (Regulated Principal)

Payment initiation and account information services delivered through the Kube Pay platform are regulated services provided under the authorisation of Wonderful Payments Ltd (trading as Asima). For regulated payment data processing, Asima may act as a data controller or joint controller alongside Kube Finance Limited.

Legal entity: Wonderful Payments Ltd (trading as Asima)

Registered Office: 41 Luke Street, London, EC2A 4DP

Company Number: 12601267

FCA Registration Number: 964289

Asima DPO: compliance@wonderful.co.uk

Asima’s Privacy Policy is available at asima.co.uk/privacy-policy. Where Asima acts as a data controller for personal data processed in connection with regulated payment services, their policy governs that processing. We encourage you to read it alongside this policy.

3. What Personal Data We Collect

The categories of personal data we collect depend on whether you are a merchant (business user), a payer (end customer making a payment), or a visitor to our website.

3.1 Merchant / Business Account Holders

Full name and job title of the account holder and any authorised users

Business name, trading name, registered address, and business type

Contact details including email address and telephone number

Know Your Business (KYB) documentation: certificate of incorporation, proof of address, VAT registration, Companies House records

Identity verification documents for beneficial owners and directors (e.g. passport, driving licence, utility bill)

Bank account details used to receive settlement of open banking payments

Transaction history, payment volumes, and associated invoice or reference data

Technical data including IP address, device identifiers, API access logs, and session activity

Communications you send us, including support requests and onboarding correspondence

3.2 Payers (End Customers)

When you use Kube Pay to make a bank payment to a merchant, we and our regulated principal Asima (Wonderful Payments Ltd) receive limited personal data from your bank via the open banking infrastructure under the Payment Services Regulations 2017. This includes:

Your name as it appears on your bank account

Your bank sort code and account number, used solely to initiate the specific payment instruction you have authorised

Payment amount, payment reference, and timestamp

Transaction status data returned by your bank following the payment instruction

Device and browser information collected at the point of payment initiation for fraud prevention and security purposes

We do not have ongoing access to your bank account, balances, or transaction history beyond the specific payment you authorise. We do not store your online banking credentials at any point.

3.3 Website Visitors

Name and email address if you submit an enquiry or sign up for updates

Usage and analytics data including pages visited, referral source, and session duration

Cookie data as described in Section 12

IP address and approximate geolocation

4. Regulated Payment Services and Our Principal

Kube Finance Limited offers payment initiation services to its merchant customers as an agent of Wonderful Payments Ltd (trading as Asima), FCA Financial Services Registration Number 964289. Wonderful Payments Ltd is an FCA-authorised Payment Institution under the Payment Services Regulations 2017 (PSR 2017), authorised to provide both Payment Initiation Services (PIS) and Account Information Services (AIS).

As Asima’s agent, Kube Finance Limited acts within the scope of Asima’s FCA authorisation when providing regulated open banking payment services. Kube Finance Limited will be listed as an agent of Wonderful Payments Ltd on the FCA Register. You can verify our authorisation status at any time at register.fca.org.uk.

When a payer authorises a payment through Kube Pay, they are redirected to their own bank’s secure authorisation interface. At no point does Kube Finance Limited or Asima collect or have access to the payer’s online banking username, password, or PIN. The payment instruction is submitted directly to the payer’s bank (ASPSP) via a regulated open banking API.

The lawful bases for processing personal data in connection with regulated payment services are:

Performance of a contract (UK GDPR Article 6(1)(b)): Processing necessary to initiate payments and deliver the contracted service to merchants and payers.

Compliance with a legal obligation (UK GDPR Article 6(1)(c)): Processing required under the PSR 2017, the Money Laundering Regulations 2017, and other applicable financial regulation.

Legitimate interests (UK GDPR Article 6(1)(f)): Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights.

For personal data processed by Asima (Wonderful Payments Ltd) in their capacity as FCA-authorised principal, Asima’s Privacy Policy at asima.co.uk/privacy-policy applies. Asima acts as data controller for transaction data processed within their regulated infrastructure.

5. How We Use Your Personal Data

We process personal data for the following purposes, each supported by a lawful basis under UK GDPR:

To provide and operate the Kube Pay platform — Contract performance (Art. 6(1)(b))

To initiate payments on behalf of merchants and process payment instructions for payers, acting as agent of Wonderful Payments Ltd (Asima) — Contract performance (Art. 6(1)(b))

To conduct Know Your Business (KYB) verification and identity checks prior to merchant onboarding — Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

To comply with anti-money laundering (AML), counter-terrorist financing (CTF), sanctions screening, and fraud prevention obligations — Legal obligation (Art. 6(1)(c))

To communicate with you regarding your account, transactions, and service updates — Contract performance (Art. 6(1)(b))

To fulfil our obligations to Asima (Wonderful Payments Ltd) as our regulated principal, including transaction monitoring and compliance reporting — Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

To investigate and resolve disputes, complaints, and payment queries — Legitimate interests (Art. 6(1)(f))

To improve and develop the Kube Pay platform and user experience — Legitimate interests (Art. 6(1)(f))

To send marketing communications (merchants only, with opt-out available) — Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f))

To comply with regulatory and legal obligations imposed on us as a financial services business and as agent of an FCA-authorised Payment Institution — Legal obligation (Art. 6(1)(c))

To detect and prevent fraud, unauthorised access, and security threats — Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

6. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of recipient, strictly as required to deliver our services or meet our legal obligations:

Wonderful Payments Ltd (trading as Asima) — Regulated Principal: As our FCA-authorised principal, Asima (Wonderful Payments Ltd, FCA No. 964289) receives transaction data and compliance-related information necessary for them to meet their regulatory obligations and to oversee our activity as their agent. Asima acts as a data controller for data processed within their regulated infrastructure.

Banks and Account Servicing Payment Service Providers (ASPSPs): Banks and building societies that process the payment instruction authorised by payers via the UK open banking framework.

Open Banking Limited (OBL) / Financial-grade API (FAPI) Infrastructure: For technical directory services and regulated connectivity to bank APIs, as managed through Asima’s infrastructure.

Identity Verification and KYB Providers: Third-party services used to verify merchant identity and business legitimacy during onboarding (e.g. document verification, Companies House data).

Cloud Hosting and Infrastructure Providers: Providers who host our platform, databases, and related systems under data processing agreements ensuring UK GDPR compliance.

Fraud Prevention and AML Screening Services: Third-party providers used to screen transactions and account holders against sanctions lists, fraud databases, and PEP registers.

Professional Advisers: Solicitors, accountants, and auditors under obligations of confidentiality.

Regulators and Law Enforcement: The Financial Conduct Authority (FCA), ICO, HMRC, the National Crime Agency, and other authorities where required by law or regulatory obligation.

Business Successors: In the event of a merger, acquisition, or sale of Kube Finance Limited, personal data may be transferred as part of that transaction, subject to equivalent data protection obligations.

7. International Data Transfers

Kube Pay is a UK-based platform and our primary data processing takes place within the United Kingdom. Asima (Wonderful Payments Ltd), as our regulated principal, also processes data within the UK and EEA.

Where any personal data is transferred outside the UK or EEA by Kube Finance Limited or its sub-processors, we ensure appropriate safeguards are in place, including use of the International Data Transfer Agreement (IDTA) approved by the ICO, UK adequacy decisions, or standard contractual clauses.

You may request details of specific transfer safeguards by contacting privacy@kubepay.co.uk.

8. Your Rights Under UK GDPR

You have the following rights in respect of your personal data. These rights are not absolute and may be subject to exemptions, particularly where we are required to retain data for regulatory, legal, or compliance purposes under our obligations as agent of an FCA-authorised Payment Institution.

Right of Access (Subject Access Request): You may request a copy of the personal data we hold about you.

Right to Rectification: You may ask us to correct inaccurate or incomplete personal data.

Right to Erasure (‘Right to be Forgotten’): In certain circumstances, you may request deletion of your personal data. This right does not apply where we are required to retain data by law (e.g. AML, KYB, or PSR 2017 records).

Right to Restriction of Processing: You may request that we restrict how we process your data in certain circumstances.

Right to Data Portability: Where processing is based on consent or contract, you may request a machine-readable copy of data you have provided to us.

Right to Object: You may object to processing based on legitimate interests or direct marketing at any time.

Rights Related to Automated Decision-Making: You have the right not to be subject to solely automated decisions producing significant legal or similar effects, unless permitted by law.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact privacy@kubepay.co.uk. We will respond within one calendar month. Where your request relates to personal data processed by Asima (Wonderful Payments Ltd) in their capacity as data controller for regulated payment services, we will direct your request to them accordingly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Security of Your Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

Encryption of data in transit using TLS and at rest using industry-standard protocols

Access controls and role-based authentication for all platform systems

Regular security assessments, penetration testing, and vulnerability management

Strict vendor due diligence for all third-party data processors, including sub-processors engaged by Asima

Staff training on data protection and information security obligations

Incident response procedures compliant with UK GDPR breach notification requirements (72-hour ICO notification where required)

10. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law or our obligations as agent of Wonderful Payments Ltd (Asima). Key retention periods are:

Transaction and payment records: 6 years from the date of the transaction, in line with HMRC requirements and the Limitation Act 1980.

KYB / identity verification records: 5 years from the end of the business relationship, in line with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

Merchant account data: For the duration of the business relationship and 6 years thereafter.

AML, sanctions, and fraud screening records: 5 years from the date of screening, or longer if required by law enforcement or regulatory instruction.

Compliance and principal oversight records (Asima): Retained in line with Asima’s data retention policy and FCA regulatory requirements applicable to the principal.

Support and correspondence records: 3 years from the date of last contact.

Marketing consent records: Until consent is withdrawn, plus 1 year.

Website analytics data: 13 months, in line with ICO guidance for analytics cookies.

11. Children’s Privacy

Kube Pay is a platform intended for use by adults aged 18 and over. We do not knowingly collect or process personal data relating to children under the age of 18. If you believe that a child’s data has been submitted to our platform, please contact us immediately at privacy@kubepay.co.uk.

12. Cookies and Tracking Technologies

Our website and payment pages use cookies and similar tracking technologies. We categorise these as follows:

Strictly Necessary Cookies: Essential for the operation of the website and payment flow. These are required to maintain session security and payment state and do not require consent.

Functional Cookies: Used to remember your preferences and improve your experience. Set only with your consent.

Analytics Cookies: Used to understand how visitors interact with our website. Set only with your consent. Where applicable, IP addresses are anonymised.

Marketing Cookies: Used to support relevant advertising across third-party channels. Set only with your explicit consent, where applicable.

You may manage your cookie preferences via our cookie consent tool displayed on first visit, or through your browser settings. For full details, please refer to our Cookie Policy at kubepay.co.uk/cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our relationship with Asima (Wonderful Payments Ltd) as our regulated principal, regulatory requirements, or data processing practices. Where changes are material, we will notify you by email (if you have a registered account) or by displaying a prominent notice on our website.

The “Last updated” date at the top of this document indicates when the most recent revision was made. Continued use of the Kube Pay platform following notification of a material change constitutes acceptance of the updated policy.

14. Contact Us

14.1 Kube Finance Limited

By email: privacy@kubepay.co.uk

By post: Data Protection, Kube Finance Limited, [Registered Address]

Website: www.kubepay.co.uk/privacy

14.2 Wonderful Payments Ltd (trading as Asima) — Regulated Principal

For queries relating to personal data processed by Asima in their capacity as FCA-authorised principal:

DPO email: compliance@wonderful.co.uk

Address: 41 Luke Street, London, EC2A 4DP

14.3 Supervisory Authority

Information Commissioner’s Office (ICO)

Website: ico.org.uk | Tel: 0303 123 1113 | Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Legal Notice

This document is provided for informational purposes and does not constitute legal advice. Kube Finance Limited recommends seeking independent legal counsel to ensure compliance with all applicable data protection, payment services, and financial services regulation, including obligations arising from the agency arrangement with Wonderful Payments Ltd (trading as Asima). Payment initiation and account information services are provided under the FCA authorisation of Wonderful Payments Ltd (Financial Services Registration Number 964289). Kube Finance Limited, Kube Pay, and the Kube Pay logo are trading names or marks of Kube Finance Limited.