This Privacy Policy explains how Monellyn collects, uses, shares and protects personal data when you visit our website, contact us, apply for a role or use our services. Monellyn is a business name operated by KOLICHESTER LTD ("Monellyn", "we", "us"), which acts as the data controller for the personal data described here.
01Who this policy covers
This policy applies to:
- Visitors to monellyn.com and its pages, including the documentation and careers pages.
- Representatives, directors, shareholders and ultimate beneficial owners of merchants and partners who contact us or use our services.
- Candidates who apply for a role with us.
- Anyone who contacts us by email or other channels.
Payments processed for merchants through payment service providers ("PSPs") are also subject to the privacy notices of those PSPs and of the merchant concerned.
02Personal data we collect
Depending on how you interact with us, we may collect:
- Contact details, such as your name, job title, company, email address and phone number.
- Business and compliance information needed for KYC and AML checks, such as identity documents, proof of address, company registration documents, UBO details, licences and information about your business model.
- Commercial and technical information you share with us, such as processing volumes, payment methods, integration details and correspondence.
- Recruitment information, such as your CV, work history, the position you apply for and anything else you include in your application.
- Technical data collected when you visit our website, such as your IP address, browser type, device information and the pages you view.
03How we use personal data
We use personal data to:
- Respond to your enquiries and provide tailored offers.
- Introduce merchants to PSPs and support onboarding and account management.
- Carry out KYC, AML, sanctions and fraud checks and meet our legal and regulatory obligations.
- Manage our relationship with you, including contracts, invoicing and service communications.
- Assess job applications and run our recruitment process.
- Operate, secure and improve our website and services.
04Legal bases for processing
Under the UK GDPR and the EU GDPR, where they apply, we rely on the following legal bases:
- Contract: to take steps at your request before entering into a contract, and to perform a contract with you.
- Legal obligation: to comply with AML, sanctions, tax and other legal requirements.
- Legitimate interests: to run and grow our business, secure our website and services, prevent fraud and assess candidates, where these interests are not overridden by your rights.
- Consent: where we ask for it, for example for optional communications. You can withdraw consent at any time.
06International transfers
Some of the recipients above may be located outside the UK or the European Economic Area. When we transfer personal data internationally, we use appropriate safeguards, such as adequacy decisions or standard contractual clauses approved by the relevant authorities.
07How long we keep data
We keep personal data only as long as necessary for the purposes described in this policy. KYC and AML records are kept for the period required by applicable law, which is typically at least five years after the end of a business relationship. Recruitment data is kept for up to 12 months after the recruitment process ends, unless you agree to a longer period. Other data is deleted or anonymised when it is no longer needed.
08Your rights
Depending on where you are, you may have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data, where there is no reason for us to keep it.
- Restrict or object to certain processing, including processing based on legitimate interests.
- Receive your data in a portable format.
- Withdraw consent at any time, where processing is based on consent.
To exercise these rights, email . You also have the right to complain to a data protection authority, such as the Information Commissioner's Office (ICO) in the UK or the supervisory authority in your country.
09Security
We use technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including access controls, encryption in transit and confidentiality obligations for staff and providers. No system is completely secure, so please contact us immediately if you believe your data has been compromised.
11Children
Our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
12Changes to this policy
We may update this Privacy Policy from time to time. The effective date at the top of this page shows when it was last changed. Significant changes will be highlighted on this page.
13Contact us
If you have any questions about this Privacy Policy or how we handle personal data, contact us at .
See also: Terms and Conditions. Questions? Email .