Privacy Policy

1. About this policy and who we are

This policy explains how Claims Gate Pay handles your personal data when a law firm or other organisation uses our platform to pay you, or when you use the platform yourself.

Claims Gate Pay is operated by Claims Gate Payments Ltd (company number 17075441, registered office 110 Bishopsgate, London EC2N 4AY, ICO registration number ZC260485). It is part of the Claims Gate group, which also includes Media Advancements Limited (company number 11361670, trading as Claims Gate), Claims Gate Global Ltd, Claims Gate Marketing Ltd and Claims Gate Invest Ltd (together, the "Claims Gate group"). In this policy, "we", "us" and "our" mean Claims Gate Payments Ltd unless we say otherwise.

Who this policy covers

Payees: people who receive a payment through Claims Gate Pay, such as a compensation or settlement payment.
Organisation users: staff of law firms and other organisations who log in to manage projects, payees and approvals.
Website visitors and enquirers: people who visit our website or contact us.

The organisation paying you (usually your law firm) will have its own privacy notice. Read it alongside this one: for most payment activity, the law firm decides how your data is used.

Contact us: [email protected] or Claims Gate Payments Ltd, 110 Bishopsgate, London EC2N 4AY. Our data protection lead, who also acts for the rest of the Claims Gate group, is James Jackson, Chief Executive Officer.

2. Our role: controller and processor

For most payment activity we act on the law firm's instructions, as its processor. We act as an independent controller for our own platform operations, for the claim record described in section 7A, and for anything you choose to opt into with us directly.

Activity	Who decides how your data is used	Our role
Setting you up as a payee, checking your details and paying you	The organisation paying you	Processor
Identity, sanctions, PEP and fraud checks run on the organisation's behalf	The organisation paying you	Processor
Executing the payment and holding funds	The regulated payment provider (e.g. LinkFX)	Not involved: the provider is a separate controller
Running, securing and improving the platform; accounts for organisation users	Claims Gate Payments Ltd	Controller
Keeping records to meet our own legal obligations and defend legal claims	Claims Gate Payments Ltd	Controller
Keeping a record of your claim to check eligibility for future claims, avoid unwanted contact and do the other things in section 7A, where the organisation paying you has agreed	Claims Gate Payments Ltd and Claims Gate group companies	Controller
Marketing, group products and sharing with partners, only if you opt in	Claims Gate Payments Ltd (and each partner you choose)	Controller

What this means for you

When we act as processor, we use your data only on the law firm's documented instructions under a written data processing agreement. Requests about that data are best made to the law firm; if you send them to us we will pass them on promptly.
When we act as controller, we are responsible for your data and you can come to us directly.
We never hold client money or execute payments. Funds are held and payments made by a regulated payment provider (see section 8).
We use sub-processors, such as cloud hosting and identity-check providers, under contracts that require them to protect your data. The law firm authorises these in advance, and we tell it before we add or replace one.

3. Personal data we collect

Category	Examples	Whose data
Identity	Full name, previous names, date of birth	Payees, organisation users
Contact	Postal address and address history, email, mobile number	Payees, organisation users
Claim and payment	Law firm and project (e.g. mis-sold car finance), claim or settlement reference, payment reference, amount paid, approval history, payment status and receipts	Payees
Bank details	Account name, sort code, account number, Confirmation of Payee result	Payees
Verification and screening	Results of electronic identity checks, sanctions, politically exposed person (PEP) and insolvency screening, fraud signals and reference numbers. ID documents only if a check refers, fails or needs enhanced review. Credit report information only where needed (section 6)	Payees
Communications	Messages we send you, whether they were delivered and opened, your replies and support requests	Payees, organisation users
Technical	IP address, device and browser details, log-in times, pages visited, security logs	All users
Account and audit	Username, role, permissions, and an unchangeable log of actions taken on the platform	Organisation users
Preferences	Your marketing and sharing choices and when you made them	Payees, website visitors

Special category and criminal offence data. We do not ask for health, ethnicity or other special category data. Sanctions or PEP screening can sometimes reveal information about criminal allegations or political roles. Where it does, we process it only to carry out the checks, under the conditions in Schedule 1 of the Data Protection Act 2018 (preventing fraud and meeting regulatory requirements), and never for any other purpose.

Children. Claims Gate Pay is not intended for anyone under 18. If a payment is due to a child, it is handled by their parent, guardian or litigation friend through the law firm.

4. How we collect it

From the organisation paying you. Your law firm gives us the details needed to set you up as a payee: usually your name, contact details, claim reference and the amount due.
From you. You give us or confirm details, such as bank details, when you accept a payment, and you may choose marketing and sharing preferences.
From verification and fraud-prevention providers. Identity, sanctions, PEP, insolvency and Confirmation of Payee checks return results about you.
From our payment partners. The regulated payment provider tells us whether a payment succeeded, failed or was returned.
Automatically. Our platform and emails record technical and usage data (see section 10 on cookies).
From other Claims Gate group companies. Only where you already have an account with them and the notice they gave you allows it.

5. How we use your data and our lawful bases

We use your data only for the purposes below, each with a lawful basis under UK GDPR Article 6. We will not use it for a new purpose unless that purpose is compatible with these, or we have told you first and, where needed, asked for your consent.

Purpose	Our role	Lawful basis
Setting you up as a payee, sending you payment messages and paying you	Processor	The law firm's basis (usually performing its contract with you, or its legitimate interests)
Identity, sanctions, PEP, insolvency and fraud checks before a payment	Processor	The law firm's basis (legal obligation and preventing fraud)
Confirming the bank account belongs to you, and blocking duplicate or changed-account fraud	Processor	The law firm's basis (legitimate interests in paying the right person)
Providing and securing the platform; managing organisation user accounts	Controller	Legitimate interests (running a secure service) and contract with the organisation
Keeping audit records, handling complaints, meeting legal and regulatory duties	Controller	Legal obligation; legitimate interests (defending legal claims)
Improving our service using aggregated or de-identified statistics (e.g. how many payments complete first time)	Controller	Legitimate interests. The output does not identify you
Telling you about other Claims Gate group products and services, including other claims you may be eligible for	Controller	Consent (Schedule A, choice 1)
Sharing your contact details with named partners so they can offer you their products or services	Controller (with each partner as a separate controller)	Consent (Schedule A, choice 2)
Using your claim history to tailor which offers you see	Controller	Consent, given as part of choices 1 and 2

We also rely on legitimate interests for the further purposes in section 7A. Schedule C lists every one, with a summary of how we balanced it against your interests.

Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against yours and your reasonable expectations. You can ask for our assessment and object at any time (section 10).

Consent is always optional. Whether you agree or not does not affect your payment, its amount or its timing in any way. You can withdraw consent at any time, as easily as you gave it.

6. Identity, fraud and anti-money laundering checks

Before a payment is released, the organisation paying you asks us to run electronic checks. These match your details against trusted data sources and sanctions, PEP and insolvency lists. We usually do not need ID documents. We ask for them only if a check does not give a clear result or the payment needs extra review.

Check results are advisory. The organisation paying you makes the final decision on whether to proceed, and the regulated payment provider carries out its own checks.

Credit reports. We do not routinely obtain full credit reports for CG Pay. If we need one, for example to confirm your identity or find your current address when other checks fail, we obtain it through Valifi or Valid8 from Equifax, Experian or TransUnion. Credit report data is covered by the same limits as other check data below. The credit reference agencies explain how they use your data in their joint Credit Reference Agency Information Notice.

Ring-fenced data. Data collected for these checks is used only to prevent fraud, money laundering and terrorist financing, and to meet legal requirements. This covers check results, ID documents, screening matches, and bank details and payment amounts. We never use it for marketing, never share it with partners for their own purposes, and never sell it.

If a check finds a match or suspected fraud, the result may be recorded and shared with the organisation paying you, the payment provider, fraud-prevention agencies or law enforcement, where the law requires or allows. This can affect whether a payment is made.

If you opt in, we may use your contact details to offer you other products and services, and share them with selected partners who can do the same. Each choice is separate. Saying no to any of them has no effect on your payment.

Your choices (full wording in Schedule A)

Claims Gate group offers. Claims Gate companies may contact you about other legal claims you may be eligible for, financial and money-management services, and other products from the group. We may contact you by email, SMS, messaging apps (such as WhatsApp), phone, post, or personalised online and social media advertising, and you can choose which of these to allow.
Partner offers. We may share your name, contact details and a summary of your claim type (not your bank details, payment amount or check results) with partners in the categories listed in Schedule B. Each partner then becomes responsible for your data under its own privacy notice and may contact you about its products.

What we share with partners, and what we never share

May be shared with your consent	Never shared for marketing or partner use
Name	Bank details and Confirmation of Payee results
Email, mobile number, postal address	Payment amounts and payment history
Claim type (e.g. "car finance claim") and whether a payment was completed	Identity, sanctions, PEP, insolvency and fraud check results; ID documents
Your stated preferences and interests	Data the law firm has not allowed us to use for our own purposes

How we keep this fair

Partner list. Schedule B lists the categories of partner and names each current partner. When we add a partner, we share your data with it only if you consented after it was listed, or after we ask you again.
Partner vetting. Before sharing, we check each partner's data protection standards. Every partner signs a data-sharing agreement that limits it to the purposes you agreed to and requires it to honour opt-outs.
Group companies. Group companies use your data only for the purposes you agreed to. Each is a separate controller and is bound by this policy's commitments.
Profiling. If you opt in, we may use your claim type and interactions to choose which offers to show you. We do not make decisions with legal or similarly significant effects about you this way.
No sale of your data without consent. We do not sell or rent your data to anyone unless you have chosen to share it with partners under choice 2.
Withdrawing consent. Use the unsubscribe link in any message, reply STOP to texts, update your preferences in your account, or email us. We will stop, and tell partners we shared your data with to stop, promptly, and in any case within 28 days. Withdrawing does not affect anything done lawfully before.
Keeping it current. If you do not engage with any of our messages for 36 months, we will stop marketing to you and ask you again before using your data for marketing.

7A. Using your claim record for future claims and running our business

We keep a record of the claim you were paid for. We use it to make sure you get a fair chance to join future claims you may be eligible for, and to avoid contacting you about claims you have already made. We do this on the basis of our legitimate interests, where the organisation paying you has agreed. It does not need your consent, but you can object at any time and we will stop.

What your claim record includes

Your name, contact details, date of birth and postcode
The claim type (e.g. mis-sold car finance), the defendant or lender, and the approximate dates of the agreement or event
The law firm that acted for you, and whether and when the claim settled
The settlement value. This is used only for claim research and anonymised statistics, and seen only by a small number of authorised staff
Your contact preferences, objections and opt-outs

It never includes your bank details, payment instructions, or identity, sanctions or fraud check results.

What we use it for

Avoiding unwanted and duplicate contact. We keep a suppression list so we do not market a claim to you that you have already made with any firm, or contact you after you have opted out.
Checking eligibility for new claims. When a new group claim is launched, we check whether your claim history suggests you may qualify.
Telling you about claims you may qualify for. We do this by post, or by phone if your number is not registered with the Telephone Preference Service. We use email, SMS, messaging apps or personalised online advertising only if you have agreed (section 7).
Claim research. We analyse patterns across our records (for example by lender, dates or agreement type) to identify possible new claims and estimate how many people they affect. Anything shared outside the Claims Gate group is aggregated or anonymised.
Preventing fraud and duplicate claims across claims and firms.
Tracing people we owe money to or cannot reach, using tracing agencies and address-update services.
Keeping records accurate, including checking change-of-address and bereavement registers so we do not contact people who have moved or died.
A single record across the Claims Gate group, so group companies can support you, keep your preferences consistent and avoid duplicate contact.
Quality, training and service improvement, including call recordings, reviewing messages and testing changes to our journeys.
Developing products, using pseudonymised data wherever possible.
Reporting to litigation funders and investors about claim outcomes, pseudonymised and under confidentiality terms.
Settlement insight, such as settlement rates and values by claim type or lender, published or shared only in anonymised form.
Customer feedback surveys about your experience. These do not promote anything.
Signposting free, independent help, such as free debt or money advice.
Handling complaints, disputes and regulator enquiries, and business transactions such as investment, sale or restructuring.

Limits we keep to

We use your record only to exclude you from marketing by other firms. We never use it to encourage you to switch law firm.
We do not share your individual record with anyone outside the Claims Gate group without your consent (section 7).
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
Before we start using your record for any new purpose, we check it is compatible with the ones above, complete a new assessment and update this policy.

Your right to object. You can object to any of these uses by emailing [email protected] or using the link in our messages. For marketing, we will always stop. For the other uses, we will stop unless we have compelling reasons to continue, such as preventing fraud. If you object, we keep only enough information to make sure we do not contact you again.

8. Payment partners, sub-processors and other recipients

We share your data only with the recipients below, and only what each one needs.

Regulated payment providers (separate controllers)

Payments are made through one or more FCA-regulated payment providers, chosen by the organisation paying you. The provider holds the funds in safeguarded accounts, runs its own regulatory checks and makes the payment. It receives your name, bank details, payment amount and reference, and it is a controller of that data under its own privacy notice.

Provider	What it does	Status
Link FX plc (company number 03129173, 71 Gloucester Road, London SW7 4SS). Authorised and regulated by the Financial Conduct Authority, registration number 535266	Holds funds in safeguarded accounts and executes payments	Live
National Westminster Bank plc (Payit)	Pay-by-bank payments where the organisation uses this route	Account being set up
Other FCA-regulated payment providers	Other payment routes an organisation chooses	Named in Schedule B before first use

Sub-processors (act only on our instructions)

Category	Example	Purpose
Cloud hosting, database, logging	Google Cloud / Firebase	Running and securing the platform
Identity, sanctions, PEP and insolvency checks	Valifi	Pre-payment verification
Bank account verification	–	Checking the account name matches
Email and SMS delivery	–	Sending payment and account messages
Customer support and IT security	–	Helping you and keeping systems secure

Each sub-processor works under a written contract that meets UK GDPR Article 28. Where we act for a law firm, the firm authorises our sub-processors in advance and we give it notice and a chance to object before adding or replacing one. Schedule B holds the current list.

Others

The organisation paying you. It receives check results, payment status and the audit trail so it can keep its own records.
Claims Gate group companies. For shared IT, support and administration (as processors), and for marketing only if you opt in (section 7).
Partners you opt in to. See section 7 and Schedule B.
Professional advisers (lawyers, auditors, insurers), under duties of confidentiality.
Regulators, courts, law enforcement and fraud-prevention agencies, where the law requires or allows.
A buyer or investor. If all or part of our business is sold, restructured or refinanced, your data may pass to the new owner. It must keep to this policy and the choices you have made.

9. International transfers, retention and security

International transfers. We aim to keep your data in the UK. If a provider stores or accesses it elsewhere, we protect the transfer with one of the following: a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework. We also carry out a transfer risk assessment. You can ask us for a copy of the safeguards.

How long we keep it

Data	Retention	Why
Payment records, audit trail, check results, credit report data and ID documents	5 years from the last payment	Money Laundering Regulations 2017 record-keeping; the law firm's instructions
Payee contact details held for the law firm	Until the project closes plus 12 months, or as the law firm instructs	Processor role: the law firm decides
Claim record (section 7A)	6 years from settlement, then anonymised	Eligibility for later claims; limitation periods
Suppression list entries	For as long as we market claims, reviewed every 6 years	So we don't contact people who opted out or already claimed
Marketing and partner consents, and the records proving them	While your consent is active, plus 6 years after you withdraw	Showing we had consent; limitation periods
Marketing contact details (if you opted in)	Until you withdraw, or 36 months without engagement	Section 7
Call recordings	12 months	Quality and training
Organisation user accounts	Contract term plus 6 years	Contract and limitation periods
Technical and security logs	12 months	Security and fraud investigation

At the end of the period we delete the data or anonymise it so it can no longer identify you. We keep your name on a suppression list after you opt out, so we do not contact you again.

Security. Measures include:

data encrypted in transit and at rest
each organisation's data kept separate from every other's
role-based access with named approvers for payments
an unchangeable audit log
signed and verified connections with payment providers
secrets held in a managed vault
regular penetration testing

If a breach is likely to put you at high risk, we will tell you and the ICO without undue delay. For data we hold for a law firm, we tell the firm.

10. Your rights, automated decisions, cookies and complaints

Your rights. You have the right to:

access your data
correct it
have it deleted
restrict its use
receive it in a portable format
object to our use of it
withdraw consent at any time

You can always object to direct marketing, and we will stop. Some rights have limits: for example, we must keep AML records for the legal period. We respond within one month, and may extend by up to two months for complex requests. Where we act for a law firm, we pass your request to the firm and help it respond.

Automated decisions. Identity and screening checks are automated, but they are advisory. A person at the organisation paying you reviews any refer or fail result before a final decision. We do not make solely automated decisions with legal or similarly significant effects on you. If that changes, we will tell you and give you the right to human review.

Cookies. We use strictly necessary cookies to keep you logged in and secure. We set analytics or marketing cookies only with your consent through our cookie banner.

Changes to this policy. We will post updates here with a new date. If a change affects how we use data you have already given us, we will tell you before it takes effect and ask again where consent is needed.

Complaints. Please contact us first at [email protected] and we will respond promptly. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Effective date: 28 September 2026 (draft; rolls forward to the publication date until launch)

Schedule A: consent wording for the payee journey

Your payment is not affected by anything on this page.
Claims Gate Pay is provided by Claims Gate Payments Ltd on behalf of [Law Firm]. We'd like to keep in touch about other things that may help you. These choices are optional and you can change them at any time.
☐ Claims Gate offers. I'd like Claims Gate group companies to tell me about other legal claims I may be eligible for, and other products and services from the group. Contact me by: ☐ Email ☐ SMS ☐ WhatsApp/messaging ☐ Phone ☐ Post ☐ Personalised online ads
☐ Partner offers. I'd like Claims Gate to share my name, contact details and claim type with the partners listed [here] so they can contact me about their products and services. My bank details, payment amount and check results will never be shared.
[Continue]
Read how we use your data in our [Privacy Policy].

Schedule B: partner and sub-processor register

Partners (data shared only with consent, choice 2)

Category	Named partner
Law firms running group and consumer claims	None yet
Litigation funders (claims research only, no marketing contact)	None yet
Financial services (vehicle finance)	None yet
Claims management companies	None yet
Insurance and comparison services	None yet

Payment providers (separate controllers)

Provider	Role	Status
Link FX plc (03129173; FCA 535266)	Safeguarding and payment execution	Live
National Westminster Bank plc (Payit)	Pay-by-bank payments	Account being set up

Sub-processors

Sub-processor	Service	Location	Transfer safeguard
Google Cloud / Firebase	Hosting, database, logging	UK: London (europe-west2)	N/A if UK
Valifi Limited	Identity and screening checks; credit report access	UK	N/A
Valid8 Limited	Identity checks; credit report access	UK	N/A

Schedule C: legitimate interests register

#	Purpose	Our interest	Why it's necessary	Balance and safeguards	Fit
1	Suppression and de-duplication	Not wasting marketing spend; not signing people up twice	Can't avoid contacting someone without a record of them	Protects people from unwanted contact; minimal data; used only to exclude	Strong
2	Eligibility matching	Offering new claims to people likely to qualify	Claim history is the best predictor of eligibility	People would reasonably expect claim-related offers; transparent notice; right to object	Strong
3	Contact about new claims (post, non-TPS calls)	Growing claims we run	Direct contact is how claimants learn about claims	Electronic channels only with consent; TPS screening; easy opt-out	Reasonable
4	Claim research and sizing	Identifying new group claims; supporting funders and firms	Needs patterns across many records	Aggregated or anonymised outside the group; restricted access to settlement values	Reasonable
5	Fraud and duplicate-claim detection	Protecting firms, funders and genuine claimants	Needs cross-claim comparison	Recognised legitimate interest; limited access	Strong
6	Tracing unpaid or uncontactable payees	Paying people what they are owed	No other way to reach people who have moved	Clearly in the person's interest	Strong
7	Record accuracy (address updates, bereavement screening)	Accurate records; not distressing bereaved families	Records go stale	Reduces harm; minimal data sent to providers	Strong
8	Single record across the group	Consistent service and preferences; working suppression	Separate records cause duplicate contact	Intra-group admin is a recognised interest; each purpose still limited as listed	Strong
9	Quality, training, service improvement and A/B testing	Better service and payout rates	Needs real interactions	Expected practice; recordings access-limited and time-limited	Strong
10	Product development	Building better products	Realistic data improves testing	Pseudonymised where possible; no production data in insecure environments	Strong
11	Funder and investor reporting	Funding claims; investor oversight	Funders need outcome data	Pseudonymised; confidentiality terms; no contact details	Reasonable
12	Settlement insight	Commercial insight for firms and funders	Needs outcome data	Anonymised only; no individual records leave the group	Reasonable
13	Customer feedback surveys	Improving service	Only customers can tell us	No promotional content, so email or SMS surveys stay outside PECR marketing rules	Reasonable
14	Signposting free help	Supporting customers after payout	Timely point to reach people	Neutral, non-commercial services only	Reasonable
15	Complaints, disputes, regulators; business transactions	Defending claims; running and financing the business	Records are needed for both	Recognised interests; confidentiality on transactions	Strong