Privacy Policy

TalentDesk Pay is a supplier payment product operated by TalentDesk. In this policy, "we" and "us" mean TalentDesk, and "you" means the business using TalentDesk Pay and the people who log in on its behalf.

We are the data controller for the account and usage information described below. Where we instruct a regulated payment partner to move money, that partner acts as a controller for the payment information it needs in order to execute and record the payment.

We collect only what we need to open your account, route a payment and meet our legal obligations:

• Account details — name, work email, company name, role, and a hashed password. We never store your password in readable form.
• Two-factor details — your authenticator secret and single-use recovery codes, held so we can verify a login or approval is really you.
• Business and identity details — company information and, where required, identity documents and a selfie check supplied through our verification partner.
• Supplier and payment details — supplier names, bank details, countries, invoice amounts, currencies and the invoices you upload.
• Approval records — who raised a payment, who approved it, and when. These form an audit trail we cannot edit after the fact.
• Technical information — IP address, browser type and the pages you use, so we can keep the service secure and working.

We do not sell your data, and we do not use your payment or supplier information to train AI models.

We rely on the following legal grounds:

• Performance of a contract — to create your account, produce quotes, route payments and support you.
• Legal obligation — to run identity and sanctions checks and to keep records we are required to keep.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, and improve how the product works.
• Consent — for marketing emails you have opted into. You can withdraw this at any time.

Transactional messages — approval requests, funding instructions, security alerts and payment confirmations — are part of the service rather than marketing, so they are not opt-out while your account is active.

We share data only with the providers needed to deliver the service, each under contract and only for that purpose:

• Regulated payment partners, who execute the payment you approve.
• Our identity verification partner, for business and director checks.
• Our email provider, to deliver account, approval and security messages.
• Our cloud hosting and database providers, who store the service and its data.
• Professional advisers, regulators and law enforcement, where we are legally required to disclose.

Our infrastructure is hosted in the European Union and the United Kingdom. Some providers may process data outside the UK/EEA. Where they do, we rely on UK and EU approved safeguards, such as standard contractual clauses, to protect it.

We keep account and payment records for as long as your account is open, and afterwards for the period required by anti-money-laundering, tax and accounting law — generally several years from the date of the last transaction. Identity verification evidence is kept for the retention period our obligations require. Technical logs are kept for a short period and then deleted.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can also withdraw consent to marketing at any time.

Email pay@talentdesk.io and we will respond within one month. Some data — audit trails and anti-money-laundering records in particular — we are legally required to keep, and we will tell you plainly when that is the case. If you are unhappy with our response, you can complain to your data protection authority; in the UK this is the Information Commissioner's Office.

Passwords are hashed, traffic is encrypted in transit, two-factor authentication is required on every account, and sensitive actions such as approving a payment require a fresh verification code. Approval rights are separated so the person who raises a payment cannot be the only person who approves it. No system is perfect — if we ever suffer a breach affecting your data, we will tell you and the relevant regulator without undue delay.

We use a small number of strictly necessary cookies to keep you signed in and to protect the service against abuse. We do not use advertising cookies or third-party tracking pixels.

If we make a material change we will tell you by email or in the product before it takes effect. The date at the top of this page always shows the current version.