Policies

Terms of Service Privacy Policy Code of Conduct

Terms of Service

Last updated: 27/08/2026

1. Introduction

1.1 By using the Spot app ("App") and our services ("Services"), you agree to these terms ("Terms"), which form an agreement between you and Spot Payments Limited ("Spot", "we", "us"). These Terms are governed by English law, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from them.

1.2 These Terms apply to two kinds of user:

Different parts of these Terms apply to each. Sections 9 to 15 apply only to Business Users.

1.3 These Terms are written in English. Please contact us if anything is unclear.

1.4 We may update these Terms. Section 22 explains how.

2. Who we are and how to contact us

2.1 Spot Payments Limited is registered in England and Wales, company number 13762907. Our registered address is 35 Ballards Lane, London, N3 1XW.

2.2 You can contact us by email at support@spot-app.co.uk, by WhatsApp on +447778276897, or by post at our registered address.

2.3 We will contact you through the App, or by the email address or phone number registered to your account. Please keep those details current. By using the App you consent to receiving communications from us electronically.

2.4 Our Privacy Policy explains how we handle your personal information and forms part of your agreement with us. You can read it at spot-app.co.uk/policies#privacy.

3. Our regulatory position

Please read this section carefully. It explains what Spot does and does not do.

3.1 Spot is a technology provider, not a payment service provider. Spot is not authorised or regulated by the Financial Conduct Authority. Spot does not at any time hold, receive, control or have access to your money.

3.2 The regulated payment services available through the App are provided by third parties:

3.3 Because Spot is not a regulated payment service provider, complaints about the payment service itself must be directed to Yapily or Stripe as appropriate. Section 20 explains how.

4. Who can have a Spot account

4.1 You must be at least 18 years old and resident in the United Kingdom.

4.2 You must give us accurate and complete information when you register, and keep it up to date. We, Yapily or Stripe may carry out identity, credit, sanctions, anti-money-laundering or other compliance checks, and may ask you to provide documents to verify your identity, your address or your business.

4.3 You may hold only one Spot account. We may close duplicate accounts.

4.4 The bank account you connect to Spot must be in your name, or in the name of the business you are registering.

4.5 We may decline to open an account, and we do not have to give a reason.

5. Types of account

5.1 Individual Accounts are for personal, non-commercial use. Individual Users can send and receive bank payments only. Card payments, digital wallet payments and Tap to Pay are not available on Individual Accounts.

5.2 Business Accounts are for sole traders, freelancers and businesses receiving payment for goods or services. Business Users can accept both bank payments and card and digital wallet payments, subject to completing the additional registration described in section 10.

5.3 If you use an Individual Account to receive payment in the course of a business, we may convert it to a Business Account or suspend it.

5.4 Business Users are charged transaction fees. Section 16 explains them.

6. Using your Spot account

6.1 Depending on your account type, Spot lets you connect a UK bank account, request and receive payments through payment links and QR codes, generate and display QR tiles, and use the other features we make available from time to time.

6.2 Until you have completed identity verification, there may be restrictions on the amounts you can transact.

6.3 We may add, change or withdraw features. Section 19 explains availability.

7. Payment methods

7.1 Spot supports two types of payment, on different rails, provided by different regulated firms:

Bank Payments — your customer authorises a payment directly from their bank account through Open Banking. Section 8 applies.

Card and Digital Wallet Payments — your customer pays by debit or credit card, Apple Pay, Google Pay, Tap to Pay on iPhone or Tap to Pay on Android. Sections 9 to 12 apply.

7.2 Both types of payment can be taken through a Spot payment link or a Spot QR tile.

7.3 The two types work differently in ways that matter to you, particularly around refunds and disputes. Section 12 sets out the differences.

8. Bank Payments

8.1 Bank Payments are initiated through Yapily Connect Ltd. Spot does not initiate, process, hold or receive these payments.

8.2 When you connect a bank account, or when your customer makes a Bank Payment, you and they enter into an agreement with Yapily. Yapily's End User Service Agreement is at yapily.com/legal/end-user-terms and its Privacy Notice is at yapily.com/legal/privacy-policy.

8.3 Funds from a Bank Payment move directly from your customer's bank account to your bank account. They do not pass through Spot.

8.4 You may withdraw your consent to the connection at any time by disconnecting the account in the App, deleting your account, or contacting us.

8.5 If a Bank Payment fails, is delayed or is disputed, this is a matter between your customer and their bank. Neither Spot nor Yapily can reverse a completed Bank Payment.

Sections 9 to 15 apply to Business Users only.

9. Registering for card and digital wallet payments

9.1 To accept Card and Digital Wallet Payments you must complete an additional registration with Stripe through the App.

9.2 Registering creates a direct contract between you and Stripe. You will be asked to accept the Stripe Connected Account Agreement (stripe.com/gb/legal/connect-account) and the Stripe Services Agreement (stripe.com/gb/legal/ssa). You should read them. They govern your relationship with Stripe, and Spot is not a party to them.

9.3 By registering, you authorise Spot to pass your personal, business and transaction information to Stripe so that Stripe can verify your identity and your business and provide payment services to you. Our Privacy Policy explains what is shared.

9.4 Stripe carries out its own identity, business, anti-money-laundering and sanctions checks. Stripe may request further information from you at any time, and may decline, restrict, suspend or close your Stripe account at its own discretion. Spot has no control over those decisions and is not responsible for them.

9.5 You are the merchant of record for every Card and Digital Wallet Payment you accept. This means you are the seller for the purposes of card scheme rules, and you are responsible for the transaction, the goods or services supplied, and any dispute.

9.6 Stripe will give you access to a Stripe dashboard, where you can manage your account details, view your payments, manage payouts and respond to disputes. Your use of that dashboard is governed by your agreement with Stripe.

9.7 You must not use Spot or Stripe for any business or activity on Stripe's restricted businesses list (stripe.com/gb/restricted-businesses), or on any prohibited use list we publish. These lists change and it is your responsibility to stay within them.

9.8 We or Stripe may refuse any individual transaction.

10. Tap to Pay

10.1 Tap to Pay on iPhone and Tap to Pay on Android let you accept contactless card and digital wallet payments using a compatible phone, without separate hardware.

10.2 Both features have device requirements — a supported model, a supported operating system version, working NFC, and a device that has not been modified or rooted. These are:

Tap to Pay on iPhone: Device model: iPhone XS or later. OS version: iOS 16 or later.

Tap to Pay on Android: OS version: Android 13 or later.

10.3 We do not guarantee that your device is or will remain compatible. Compatibility is determined by Apple, Google and Stripe, not by Spot.

10.4 Additional terms apply to these features and are passed through to you as part of your agreement with Stripe. Tap to Pay on iPhone is subject to Apple's terms; Tap to Pay on Android is subject to Google's terms. Accepting Apple Pay and Google Pay is also subject to the relevant wallet provider's requirements.

10.5 You must keep any device you use for Tap to Pay secure, keep it under your control, and use it only to take payments for your own business.

10.6 Contactless transaction limits and cardholder verification requirements are set by the card schemes and the customer's bank, not by Spot.

10.7 You must give your customer a receipt where card scheme rules require one. The App provides a way to do this.

11. Payouts

11.1 Card and Digital Wallet Payments are settled by Stripe to the bank account registered on your Stripe account. Spot does not hold or transmit these funds.

11.2 Your payout schedule is set in your Stripe account. Stripe may hold your first payouts for longer while it completes verification.

11.3 Payout timing depends on Stripe and on the receiving bank. We do not control it and do not guarantee it.

11.4 You must keep your payout bank details accurate. If a payout fails because your details are wrong or out of date, you are responsible for the consequences, including any fee charged.

11.5 Stripe may delay a payout, hold funds or require a reserve where it identifies risk, suspected fraud, unusual activity or a pending investigation. Those decisions are Stripe's and are governed by your agreement with Stripe.

12. Refunds, chargebacks and disputes

12.1 Bank Payments cannot be reversed. There is no scheme chargeback mechanism for Open Banking. If you need to refund a Bank Payment, you must send the money back to your customer yourself. Neither Spot nor Yapily can do it for you.

12.2 Card and Digital Wallet Payments can be refunded through your Stripe account. Fees already charged on the original transaction may not be returned to you.

12.3 A chargeback is where a customer asks their card issuer to reverse a payment. It can happen months after the original transaction. Chargebacks are governed by card scheme rules, not by these Terms.

12.4 As merchant of record, you are responsible for responding to chargebacks on your own account, through your Stripe dashboard, within the deadline set by the card scheme. If you do not respond in time, the chargeback will usually be decided against you automatically.

12.5 Stripe debits chargebacks, refunds and any related fees from your Stripe balance. Under the arrangement between Spot and Stripe, Stripe — not Spot — bears responsibility for unrecovered negative balances on your account. Spot has no ability to reverse, influence or appeal the outcome of a chargeback, and is not liable to you for it.

12.6 You will reimburse Spot for any amount Stripe or any other third party recovers from Spot as a result of your acts, omissions or breach of these Terms.

12.7 Repeated chargebacks may cause Stripe to restrict, suspend or close your account, and may lead to fines under card scheme rules. We may suspend your access to Card and Digital Wallet Payments if your chargeback rate becomes excessive.

13. Card scheme rules and acceptable card use

13.1 You must comply with the rules of the card schemes (including Visa, Mastercard and American Express) as they apply to you and as they change from time to time.

13.2 You must not add a fee or surcharge to a customer for paying by consumer debit or credit card. This is prohibited by regulation 6A of the Payment Services Regulations 2017. Your own costs may differ between payment methods, but you may not pass a card fee on to a consumer.

13.3 You must not:

(a) process a payment on your own card, or on a card belonging to someone connected with you, other than for a genuine sale; (b) process payments for any business other than your own, or on behalf of a third party; (c) split a single sale across multiple transactions to avoid a limit or an authorisation; (d) process a payment before you and your customer have agreed the sale; (e) provide cash or a cash equivalent in exchange for a card payment; (f) set a minimum or maximum card transaction value where card scheme rules prohibit it.

13.4 You must describe accurately, in the App and to your customers, which payment methods you accept.

13.5 You must not use Spot for anything unlawful, or in any way that damages or interferes with the App, our systems, or any network or equipment used to provide the Services.

14. Tips and gratuities

14.1 Where the App lets your customer add a tip, the tip is paid to you along with the transaction amount.

14.2 Spot does not allocate or distribute tips. If you have staff, you are responsible for distributing tips to them.

14.3 If you have employees or eligible workers, you have obligations under the Employment (Allocation of Tips) Act 2023 and its statutory code of practice, including allocating qualifying tips fairly, paying them by the end of the following month, and having a written tipping policy. Meeting those obligations is your responsibility, not Spot's.

15. Your relationship with your customers

15.1 Spot is not a party to the contract between you and your customer. You are solely responsible for the goods or services you supply, for your own terms of sale, for your cancellation and refund policy, and for complying with consumer protection law.

15.2 You are responsible for verifying the identity of the person paying you where that matters to your business.

15.3 Because Spot has no direct relationship with your customers, you must tell your customers that their information is shared with Spot and refer to Spot in your own privacy notice. Our Privacy Policy explains what we process about your customers.

The remaining sections apply to all users.

16. Fees

16.1 Spot is free for Individual Users.

16.2 Business Users pay a fee on each transaction. Our current fees are set out below.

16.3 Fee basis:

*Amex: an additional 1% fee applies

16.4 Fees are shown in the App before you complete a transaction.

16.5 Higher fees apply to American Express and may apply to certain other card types.

16.6 We may change our fees. We will give you at least 30 days' notice before an increase takes effect, unless a change is required sooner by law, by a regulator or by a card scheme. If you do not accept the change you may close your account before it takes effect.

16.7 You are responsible for all taxes on your own sales, including VAT where it applies.

16.8 You are responsible for any fine, penalty or assessment imposed by a card scheme, a regulator or Stripe as a result of your use of the Services.

17. Keeping your account safe

17.1 Keep your device, your Spot login and any passcode secure, and do not let anyone else use your account.

17.2 Tell us immediately if you think someone has accessed your account without your permission.

17.3 Check your transaction history regularly and tell us straight away about anything you do not recognise.

18. Licence to use the App

18.1 We grant you a limited, personal, non-exclusive, non-transferable, revocable licence to download and use the App for the purposes set out in these Terms.

18.2 We and our licensors own all intellectual property rights in the App, the Services and their content. You get no rights other than the licence in 18.1.

18.3 You must not copy, modify, distribute, sell, rent, sub-licence, reverse engineer, decompile or disassemble the App or any part of it, except where the law says you may.

18.4 You must not use the App or the Services to build a competing product or service.

18.5 Your use of the App is also subject to the terms of the app store you downloaded it from. You acknowledge and agree that the availability of the App is dependent on the third-party marketplace from which you received it (e.g. the Apple App Store or Google Play Store). You acknowledge that this agreement is between you and Spot, and not with Apple Inc. ("Apple") or Google LLC ("Google"). You acknowledge and agree that Apple, Google, and their respective subsidiaries, are third-party beneficiaries of this agreement. Upon your acceptance of these Terms, Apple and/or Google will have the right (and will be deemed to have accepted the right) to enforce this agreement against you as a third-party beneficiary thereof.

18.6 Spot and the Spot logo are our trademarks. "Tap to Pay on iPhone", "Apple Pay", "Google Pay" and "Tap to Pay on Android" are the trademarks of their respective owners and are used here only to identify those services.

19. Availability and updates

19.1 We may need to update the App, and some updates may be required for it to keep working.

19.2 We try to keep the Services available, but we do not guarantee that they will be uninterrupted, timely or error-free.

19.3 We may suspend, withdraw or restrict all or part of the Services, for business or operational reasons. Where we can, we will give you notice.

20. Complaints

20.1 If you are unhappy with Spot, contact us at support@spot-app.co.uk. We will acknowledge your complaint and work to resolve it.

20.2 Spot is not authorised or regulated by the Financial Conduct Authority, and complaints about Spot are not within the jurisdiction of the Financial Ombudsman Service.

20.3 If your complaint is about the payment service itself, raise it with the regulated firm providing it:

20.4 If you are an eligible complainant and you are not satisfied with the outcome of a complaint to Yapily or Stripe, you may be able to refer it to the Financial Ombudsman Service (www.financial-ombudsman.org.uk). Whether you are eligible depends on your circumstances and on the firm you are complaining about.

20.5 If your complaint is about a payment from your own bank account that you did not authorise, contact your bank as soon as possible.

21. Suspension and closure

21.1 You may close your account at any time through the App, or by contacting us.

21.2 We may suspend or close your account, immediately and without notice, if:

(a) you breach these Terms; (b) Stripe or Yapily restricts, suspends or closes your account with them; (c) we reasonably suspect fraud, money laundering or other unlawful activity; (d) we are required to by law, by a regulator or by a card scheme; (e) your account has been inactive for an extended period.

21.3 Where we can lawfully do so, we will tell you why.

21.4 When your account closes, we stop accepting new payments to it. Transactions already in progress will complete. Your Stripe account, any balance in it, and any pending chargebacks remain governed by your agreement with Stripe.

21.5 Sections 12.6, 15, 16.7, 16.8, 18, 22 and 23 survive closure.

21.6 Some information and payment records will be retained after closure where we are required to keep them. Our Privacy Policy explains for how long.

22. Changes to these Terms

22.1 We may change these Terms. We will give you at least 30 days' notice of any change that materially affects you, through the App or by email.

22.2 We may make a change immediately, without notice, where it is required by law, by a regulator or by a card scheme, or where it is needed for security reasons.

22.3 If you continue to use the Services after a change takes effect, you accept it. If you do not accept it, you may close your account.

23. Our liability

23.1 Nothing in these Terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

23.2 Subject to 23.1, we are not liable to you for:

(a) any act or omission of Stripe, Yapily, Apple, Google, a card scheme, a bank or any other third party; (b) any chargeback, refund or dispute; (c) any fine, penalty or assessment imposed by a card scheme or regulator; (d) any failure by you to supply goods or services to your customer, or any dispute between you and your customer; (e) any loss arising from your breach of these Terms, of card scheme rules, or of your agreement with Stripe or Yapily; (f) any failure of your own hardware, software or internet connection.

23.3 Subject to 23.1, we are not liable for loss of profit, loss of business, loss of revenue, loss of opportunity, loss of goodwill, business interruption, or any indirect or consequential loss.

23.4 We are liable for loss you suffer that is a foreseeable result of our breaking this agreement.

23.5 Subject to clause 23.1, if you are a Business User, our total liability to you for all claims arising in any twelve-month period, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of (i) the total fees you paid us in the twelve months before the claim arose and (ii) £5,000.

23.6 You will indemnify us against any claim, loss, cost or expense we suffer as a result of your breach of these Terms, your breach of card scheme rules, or your dealings with your customers.

24. General

24.1 Severability. If any part of these Terms is unenforceable, the rest continues to apply.

24.2 Waiver. If we do not enforce a term, that does not mean we give up the right to enforce it later.

24.3 Assignment. You may not transfer your rights or obligations under these Terms. We may transfer ours, and will tell you if we do.

24.4 Force majeure. Neither party is responsible for a delay or failure caused by something outside its reasonable control.

24.5 No partnership. Nothing in these Terms creates a partnership, joint venture or employment relationship between us, and neither of us is the other's agent.

24.6 Third-party rights. Except where these Terms say otherwise, no one other than you and us has any right to enforce them.

24.7 Entire agreement. These Terms and our Privacy Policy are the whole agreement between us about your use of the Services.

24.8 Costs. You are responsible for any data or network charges you incur using the App.

25. Definitions

Bank Payment — a payment initiated from a payer's bank account through Open Banking via Yapily.

Business Day — any day other than a Saturday, Sunday or public holiday in England.

Business User — a sole trader, freelancer or business using Spot to receive payment for goods or services.

Card and Digital Wallet Payment — a payment made by debit or credit card, Apple Pay, Google Pay, Tap to Pay on iPhone or Tap to Pay on Android, processed by Stripe.

Card Scheme — Visa, Mastercard, American Express or any other card network whose rules apply to a transaction.

Chargeback — a reversal of a card payment initiated by the payer's card issuer.

Individual User — a person using Spot for personal, non-commercial purposes.

Merchant of Record — the party responsible under card scheme rules for a sale to a customer, including for disputes and for compliance.

Personal Data — as defined in the UK GDPR.

QR Tile — a physical or digital Spot code a customer scans to pay.

Services — the Spot App and the features and functionality we provide through it.

Stripe — Stripe Payments UK Limited, firm reference number 900461.

Yapily — Yapily Connect Ltd.

Privacy Policy

Last updated: 27/08/2026

1. Who we are

Spot Payments Limited ("Spot", "we", "us") is the data controller for the personal information described in this policy. We are registered in England and Wales, company number 13762907, at 35 Ballards Lane, London, N3 1XW.

We are registered with the Information Commissioner's Office under reference ZB540059, valid until 23 April 2027.

This policy explains what personal information we collect, why, who we share it with, and what rights you have. It applies to our app, our website and our services.

We handle personal information in accordance with the UK GDPR and the Data Protection Act 2018.

2. Who this policy covers

This policy covers two groups of people, and different parts apply to each.

Merchants — sole traders, freelancers and businesses who use Spot to take payment, and individuals who use Spot for personal payments. Sections 3, 5 and 6 apply to you.

Customers — people who pay a merchant using Spot, whether by bank payment, card, Apple Pay, Google Pay or Tap to Pay. Section 4 applies to you.

If you are a customer, you will not usually have a direct relationship with Spot. We ask merchants to refer to this policy in their own privacy notice, but we are responsible for the information we hold about you and you have rights over it. Section 12 explains them.

3. What we collect about merchants

When you create an account

Your name, email address, phone number, postal address, and the login details for your Spot account.

When we verify you

Your date of birth, identity documents, proof of address, business details including trading name and company number where you have one, and details of the ownership and control of your business. We collect this to meet anti-money-laundering and know-your-customer obligations. Most of this verification is carried out by Stripe or Yapily rather than by us — section 7 explains what is shared with them.

When you connect a bank account

Your bank account details, and where you have consented, account and transaction information obtained through Open Banking via Yapily.

When you take a payment

The amount, date, time and currency; the payment method used; the payment link or QR tile used; and, for card payments, a tokenised reference to the card, the last four digits, the expiry date, the card brand and the issuing country. We never receive or store a full card number. Card details go directly to Stripe.

When you use Tap to Pay

Information about the device you take the payment on, including a device identifier, the device model, its operating system, its IP address, and the approximate location of the transaction.

When you are paid out

Your bank account details and the amount, date and status of each payout.

When a payment is disputed

Information about the dispute and any evidence submitted in response, which may include correspondence with your customer.

When you contact us

The content of your messages, and a record of our correspondence.

When you use the app or our website

Device and usage information including IP address, device identifiers, app events, approximate location, and how you move through the app and site. Section 10 explains the tools we use.

4. What we collect about customers

If you pay a merchant using Spot, we process:

We do not use your information to build a marketing profile of you, and we do not sell it.

5. Why we use it, and our lawful basis

What we use it forLawful basis
Creating and running your Spot accountPerformance of a contract
Processing payments and payoutsPerformance of a contract
Identity, business and address verification (KYC and KYB)Legal obligation — Money Laundering Regulations 2017
Anti-money-laundering monitoring, sanctions screening and reportingLegal obligation
Detecting and preventing fraudLegitimate interests — protecting merchants, customers and our business
Handling disputes and chargebacksLegitimate interests / performance of a contract
Customer support and correspondencePerformance of a contract / legitimate interests
Keeping the app secure and workingLegitimate interests
Understanding how the app is used, and improving itLegitimate interests
Marketing to merchantsLegitimate interests, or consent where required by the Privacy and Electronic Communications Regulations
Non-essential cookies, SDKs and analyticsConsent
Meeting legal, tax and regulatory obligationsLegal obligation
Establishing, exercising or defending legal claimsLegitimate interests

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights, and concluded that they are not. You can object — see section 12 — and you can contact us to ask how we reached that conclusion.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already happened.

6. Automated decision-making

Payments made through Spot are screened automatically for fraud and risk, using tools operated by Stripe. This screening looks at signals including the card used, the amount, the location, the device and past transaction patterns, and can result in a payment being declined, or an account being restricted or subjected to further checks.

Merchant applications are also subject to automated verification checks during onboarding.

These processes can have a significant effect on you. You have the right to ask for a human to review a decision, to explain it, and to challenge it. Contact us using the details in section 15, or contact Stripe directly where the decision was Stripe's. Because the screening is operated by Stripe, we may need to refer your request to them.

7. Who we share it with

Stripe Payments UK Limited — processes all card, digital wallet and Tap to Pay payments as our processor. It decides how it uses your information and is responsible for protecting it. We share with Stripe: your name, date of birth, contact details, home and business address, business details, bank account details, identity and address verification documents, and transaction data. As a merchant you also enter into a direct contract with Stripe. Stripe's privacy policy is at stripe.com/privacy. We have no control over how Stripe processes your information.

Yapily Connect Ltd — initiates bank payments and provides Open Banking connections. Yapily is a controller in its own right for that activity. Its privacy notice is at yapily.com/legal/privacy-policy.

Apple and Google — where you use Apple Pay, Google Pay, Tap to Pay on iPhone or Tap to Pay on Android, those companies process device and transaction information under their own privacy policies.

Our service providers, who act on our instructions:

Others, where we need to:

We do not sell your personal information.

8. Sending information outside the UK

Some of the organisations above are outside the UK, including in the United States and the European Economic Area.

Where we transfer personal information outside the UK, we rely on one of the following:

You can ask us for more detail about the protections in place. See section 15.

9. How long we keep it

InformationHow long
Identity and anti-money-laundering records5 years from the end of our relationship with you, as required by the Money Laundering Regulations 2017
Transaction and payment records6 years from the transaction
Dispute and chargeback evidenceThrough the full dispute window, then in line with transaction records
Account and correspondence records6 years from your last contact with us
Marketing preferencesUntil you object or unsubscribe, and a record of your objection indefinitely so we can honour it
Analytics and usage data90 days
Anonymised and aggregated dataIndefinitely — this no longer identifies anyone

We may keep information for longer where the law requires it, or where we need it for a legal claim.

10. Cookies, SDKs and analytics

Our website and app use cookies, software development kits, pixels and similar technologies to make the service work, to understand how it is used, and to measure our advertising.

The tools we use include AppsFlyer, PostHog and the Meta SDK. These can collect device identifiers, app events, approximate location and information about how you use the service.

Cookies and technologies that are not strictly necessary are only used with your consent, which you can give or withdraw through the consent banner or in your device settings.

11. Security

We use technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls, and limiting access to those who need it.

Card data is handled in a PCI DSS compliant environment operated by Stripe. Full card numbers never reach Spot's systems, which limits our own exposure. Spot has a PCI Level of 4.

No transmission over the internet is completely secure. While we take reasonable steps to protect your information, we cannot guarantee the security of information sent to us online.

If there is a breach affecting your personal information, we will notify the Information Commissioner's Office and, where required, you.

12. Your rights

You have the right to:

To exercise any of these, contact us using the details in section 15. We will respond within one month. We may need to verify your identity first.

Where the information is held by Stripe or Yapily as controllers in their own right, we may need to direct your request to them, and we will tell you if so.

If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/concerns or on 0303 123 1113.

13. If you are a merchant

Because we have no direct relationship with the people who pay you, you must tell your customers that their information is shared with Spot, and refer to this policy in your own privacy notice. This is a requirement of our Terms of Service and a legal obligation of yours as a controller of your customers' information.

14. Children

Our services are for people aged 18 and over. We do not knowingly collect information about children.

15. How to contact us

By email: legal@spot-app.co.uk
By post: Spot Payments Limited, 35 Ballards Lane, London, N3 1XW

Data controller: Spot Payments Limited
ICO registration: ZB540059

16. Changes to this policy

We may update this policy. When we do, we will publish the new version here and update the date at the top. If a change materially affects you, we will tell you through the app or by email.

Code of Conduct

Spot Payments Limited is committed to conducting business in an ethical manner and demonstrating the highest standard of integrity. This policy outlines our approach to preventing ethical conduct by anyone associated with the firm, considering our obligations under the Bribery Act 2010 and guidance issued by the Ministry of Justice.

1. Scope

This policy applies to all full-time and part-time employees, temporary contractors, interns, agents, and all subsidiaries or branches of Spot Payments operating in the UK, EEA, or any other country. Failure to comply may result in disciplinary action.

2. What is Bribery?

Bribery, as defined by the Bribery Act 2010, is giving or receiving a financial or other advantage in connection with the improper performance of a position of trust. Bribery can take many forms including gifts, lavish treatments, tickets, hospitality, and promising favours.

3. What is Corruption?

Corruption is the abuse of entrusted power for private gain. It includes not only bribery but also other forms of misconduct or improper behaviour that may distort competition, create cartels, or illicitly influence decision-making.

4. Zero Tolerance

Spot Payments does not tolerate bribery or corruption in any form. Representatives are prohibited from offering, promising, requesting or receiving anything of value that would entail improperly performing their position or assisting to facilitate a crime.

5. Responsibilities

Responsible Officer: Charlie Pentol-Levy has been appointed as the Responsible Officer for implementing, maintaining and monitoring compliance with this policy since 01/01/2023.

Senior Management: Fully endorses the policy and is responsible for ensuring the firm conducts business with integrity and developing a corporate culture which prevents bribery and corruption.

Employees: Required to follow this policy, update the gifts and hospitality register, and attend regular training.

6. UK Legislation

Spot Payments adheres to the Bribery Act 2010, FCA Financial Crime Guide, and Ministry of Justice guidance. Key offences include bribing another person, accepting a bribe, bribing a foreign public official, and failure to prevent bribery — all subject to significant penalties including up to 10-year jail terms and unlimited fines.

7. Risk-Based Approach

In line with Ministry of Justice guidance, Spot Payments has adopted a risk-based approach incorporating the six principles: Proportionate Procedures, Top-Level Commitment, Risk Assessment, Due Diligence, Communication (including training), and Monitoring and Review.

8. Due Diligence

Spot Payments applies due diligence measures proportionate to identified risk levels, including identification and verification, scrutiny of business relationships, adverse media checks, and where necessary, direct investigations and research.

9. Training

All employees and agents receive ethical conduct training upon induction and annually thereafter, covering our zero-tolerance approach, key legislation, risk identification, and reporting obligations.

10. Reporting Suspicious Activity

All employees have a responsibility to report incidents or suspicions of bribery to their line manager, who will notify the Responsible Officer. Where appropriate, the Serious Fraud Office (SFO) and Financial Conduct Authority (FCA) will be informed.

11. Record Keeping

Spot Payments maintains records of client identities, verification evidence, business relationships, transaction details, and monitoring records for a minimum of five years after termination of the business relationship.