Privacy Policy

Last updated: June 18, 2026

DeflectDispute Ltd, a company incorporated in England and Wales under company number 17207769, with its registered office at 128 City Road, London, England, EC1V 2NX (trading as "Deflect Dispute", and together with its affiliates and subsidiaries, the "Company", "We", "Us", or "Our"), takes the privacy and security of Personal Data seriously.

This Privacy Policy explains how we collect, use, store, disclose, and protect Personal Data when you visit our website, contact us, register for our Services, request a demo, use our platform, or otherwise interact with us.

"Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is someone who can be identified, directly or indirectly, including by reference to an identifier such as a name, email address, identification number, location data, online identifier, or one or more factors specific to that person.

This Privacy Policy applies to Personal Data that we process as a data controller, including information relating to website visitors, prospective customers, customers, business contacts, account users, and representatives of companies that use or may use our Services.

Where we process Personal Data contained in payment alert, chargeback, dispute, transaction, fraud prevention, Ethoca, RDR, CDRN, or similar service data on behalf of our customers, we generally act as a data processor. In those cases, our customer is usually the data controller, and we process such data in accordance with our customer's instructions, our agreement with that customer, and applicable data protection laws.

We may update this Privacy Policy from time to time. When we make changes, we will update the "last updated" date above and make the revised version available on our website.

Personal Information You Provide to Us

We collect Personal Data that you voluntarily provide to us when you use our website, create an account, request a demo, contact us, communicate with our team, complete onboarding forms, subscribe to communications, or otherwise interact with our Services.

The Personal Data we collect directly from you may include:

Basic identification information, such as your name, username, job title, and company role;
Business contact details, such as your email address, telephone number, mailing address, and billing address;
Account information, such as login details, account preferences, user permissions, and information associated with your use of the Services;
Company information, such as company name, website, business type, payment operations information, and other details about your organization;
Commercial and onboarding information, such as how you heard about us, the problems you are trying to solve, your current dispute or chargeback workflows, and information you provide during sales, onboarding, support, or account setup;
Payment and billing information, such as billing address, invoice details, subscription details, and payment status. Where card payments are used, payment card information may be processed by a third-party payment processor. We do not intentionally store full payment card numbers on our own systems;
Any other information you choose to provide to us, including information submitted through forms, emails, calls, chats, surveys, support requests, or other communications.

Business and Service Information Provided During Registration and Onboarding

When you register for our Services, request a demo, complete onboarding, or discuss a potential commercial relationship with us, we may ask you to provide business and operational information that helps us assess, configure, provide, and improve our Services.

This may include:

Your name, email address, telephone number, job title, and other business contact details;
Your company name, company website, business address, and other business identification information;
Information about how you learned about our Services;
Contact details of individuals responsible for chargebacks, disputes, fraud prevention, payment operations, finance, or related business functions within your organization;
Information about your chargeback, dispute, fraud prevention, Ethoca, RDR, CDRN, alert, refund, representment, or similar workflows;
Estimated or actual volumes of disputes, chargebacks, Ethoca alerts, RDR alerts, CDRN alerts, or similar cases;
Information about your current or estimated costs relating to Ethoca, RDR, CDRN, dispute management, chargebacks, alerts, refunds, or similar services;
Monthly revenue ranges, transaction volume ranges, payment processing information, and other business metrics that you choose to provide to us;
Any additional information you provide during the sales, onboarding, account setup, support, or service configuration process.

We use this information to evaluate whether our Services are suitable for your business, configure the Services, provide support, improve our products, communicate with you, and manage our commercial relationship with you.

Information We May Collect Automatically

When you access or use our website or Services, we may automatically collect certain information, including:

Usage Information: information about how you use our website and Services, including pages viewed, features used, actions taken, time spent, clickstream data, and interactions with our platform;
Device Information: information about the device and software you use to access our website or Services, including browser type, operating system, device identifiers, language, time zone, and network information;
Log Information: server logs and technical information, including access times, referring URLs, IP address, browser type, Internet Service Provider, and error logs;
Cookie and Tracking Information: information collected through cookies, pixels, web beacons, local storage, and similar technologies, including information used to remember preferences, understand website usage, improve performance, measure campaign effectiveness, and support security;
Approximate Location Information: information inferred from your IP address or device settings, such as country, region, or city. We do not collect precise GPS location unless we specifically ask for permission and you choose to provide it.

Information We Collect from Third Parties

We may receive Personal Data and business information from third parties where permitted by law and where relevant to our Services.

This may include information from:

Customers, merchants, business partners, payment processors, dispute management providers, fraud prevention providers, or other service providers involved in chargeback, dispute, alert, or payment operations;
Ethoca, RDR, CDRN, card networks, acquirers, payment processors, payment gateways, fraud prevention providers, dispute management providers, and similar alert or payment-related systems, where our customer has authorised us to access or process that information;
CRM, analytics, advertising, marketing, enrichment, or lead generation providers, where permitted by applicable law;
Publicly available sources, such as company websites, business directories, professional profiles, or public company information;
Other users or representatives of your organization who invite you to use the Services or provide your contact details to us.

Customer Data and Our Role as Processor

Our Services help merchants, businesses, and other customers manage payment alerts, disputes, chargebacks, fraud alerts, refunds, representments, and related operational workflows. In order to provide these Services, we may process certain information provided by or made available on behalf of our customers ("Customer Data").

Where we process Customer Data on behalf of a customer, we generally act as a data processor and the customer acts as the data controller. In that role, we process Customer Data only to provide the Services, in accordance with the customer's instructions, our agreement with the customer, and applicable data protection laws.

Customer Data may include:

Alert, dispute, chargeback, refund, representment, fraud alert, Ethoca, RDR, CDRN, or similar case information;
Alert identifiers, case identifiers, transaction identifiers, order identifiers, merchant identifiers, and other reference numbers;
Source provider information, such as whether an alert or case was received through Ethoca, RDR, CDRN, a payment processor, an acquirer, a gateway, a card network, or another dispute or alert provider;
Alert and case status information, such as whether an alert or case is pending, resolved, declined, accepted, refunded, represented, or otherwise actioned;
Alert type and dispute category information, including whether a case relates to fraud, a dispute, a chargeback, an alert, or another payment-related event;
Transaction information, such as transaction amount, currency, transaction date, alert creation date, descriptor, authorization code, acquirer reference number (ARN), and related payment metadata;
Limited payment method information, such as card brand, masked card number, bank identification number (BIN/IIN), last four digits, and other non-full payment card metadata where relevant to the Services;
Limited customer, cardholder, or purchaser information where such information is provided by the customer or relevant provider and is necessary for dispute, alert, refund, fraud prevention, or case management purposes;
Notes, files, communications, audit logs, timestamps, user actions, and other metadata submitted or generated in connection with the use of the Services.

We do not use Customer Data for our own independent purposes except where necessary to provide, secure, maintain, support, analyse, or improve the Services, comply with applicable law, enforce our agreements, or protect our legal rights.

If you are an individual whose Personal Data is included in Customer Data, you should contact the relevant merchant, business, or customer directly to exercise your data protection rights. Where required, we will assist our customer in responding to such requests in accordance with applicable law and our contractual obligations.

How We Use Personal Data

We may use Personal Data for the following purposes:

To provide, operate, maintain, secure, and improve our website, platform, and Services;
To create, manage, verify, and administer user accounts;
To evaluate, configure, and provide chargeback, dispute, alert, refund, Ethoca, RDR, CDRN, fraud prevention, and related services;
To communicate with you about your account, enquiries, demos, onboarding, support requests, contracts, billing, and service updates;
To provide customer support and troubleshoot technical or operational issues;
To analyse usage, monitor performance, improve user experience, develop new features, and enhance our Services;
To send marketing, product, and promotional communications where permitted by law. You may opt out of marketing communications at any time;
To protect the security, integrity, and availability of our Services, systems, users, customers, and business;
To detect, prevent, investigate, and respond to fraud, abuse, security incidents, unauthorized activity, or unlawful conduct;
To comply with legal, regulatory, tax, accounting, reporting, and contractual obligations;
To enforce our agreements, policies, and terms, and to protect our rights, property, and interests.

Legal Bases for Processing

Where UK GDPR, EU GDPR, or similar data protection laws apply, we process Personal Data only where we have a lawful basis to do so.

Depending on the context, our lawful bases may include:

Performance of a contract: where processing is necessary to provide the Services, create and manage accounts, communicate with you about the Services, provide support, or take steps at your request before entering into a contract;
Legitimate interests: where processing is necessary for our legitimate business interests or those of a third party, including operating and improving our Services, managing customer relationships, securing our systems, preventing fraud, analysing business performance, and developing our products, provided those interests are not overridden by your rights and interests;
Legal obligation: where processing is necessary to comply with applicable laws, regulations, tax, accounting, reporting, sanctions, law enforcement, or legal process requirements;
Consent: where we ask for and receive your consent, such as for certain optional marketing communications, non-essential cookies, or other processing where consent is required by law. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Automated Decision-Making and Profiling

Our Services use algorithms, machine learning models, and other automated techniques to detect, prioritise, categorise, and help resolve payment alerts, disputes, chargebacks, and potential fraud, and to generate evidence, recommendations, and outputs in connection with these workflows.

Where we process such data on behalf of our customers, our customer determines the purposes of the processing and is responsible for any decisions taken on the basis of our outputs. We do not use these outputs to take decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing without human involvement, except where permitted by applicable law.

Where automated processing is used in a way that is subject to Article 22 of the UK GDPR, you may have the right to obtain human intervention, to express your point of view, and to contest the decision. If you are an individual whose Personal Data is processed as Customer Data, you should contact the relevant customer to exercise these rights, and we will assist that customer as required by applicable law and our contractual obligations.

How We Share Personal Data

We do not sell your Personal Data. We may share Personal Data where necessary to provide and improve our Services, operate our business, comply with law, or protect our rights and users.

We may share Personal Data with:

Service providers and subprocessors that help us provide hosting, infrastructure, analytics, payment processing, communications, CRM, customer support, security, monitoring, data storage, and other business services;
Payment, dispute, fraud prevention, alert, chargeback, Ethoca, RDR, CDRN, processor, gateway, acquirer, card network, and similar service providers where necessary to provide the Services or where authorised by our customer;
Customers and account administrators where information relates to an account, organization, case, workflow, or use of the Services;
Professional advisers such as lawyers, accountants, auditors, insurers, and financial advisers;
Authorities, courts, regulators, law enforcement, or other third parties where we believe disclosure is necessary to comply with applicable law, legal process, or regulatory obligations;
Parties involved in a business transaction such as a merger, acquisition, financing, reorganization, sale of assets, liquidation, bankruptcy, or similar transaction;
Other parties with your consent or where you direct us to share information.

We may also share aggregated, anonymised, or de-identified information where it cannot reasonably be used to identify an individual.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our website and Services, remember preferences, improve performance, analyse usage, support security, and measure the effectiveness of communications and campaigns.

Some cookies are necessary for the website or Services to function. Other cookies, such as analytics or marketing cookies, may be optional and may require your consent depending on applicable law.

Most browsers allow you to remove or reject cookies through browser settings. If you disable cookies, some parts of our website or Services may not function properly.

Data Retention

We retain Personal Data for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, provide the Services, maintain business records, comply with legal, tax, accounting, regulatory, and contractual obligations, resolve disputes, enforce agreements, and protect our rights and interests.

The specific retention period depends on the type of information, the reason we collected it, the nature of our relationship with you, applicable legal requirements, and whether we need the information to provide the Services or protect our legitimate interests.

Customer Data processed on behalf of our customers is retained in accordance with our agreement with the relevant customer, the customer's instructions, and applicable law.

When Personal Data is no longer required, we will delete it, anonymise it, or securely retain it only where we have a lawful reason to do so.

Personal Data Quality

We aim to keep Personal Data accurate, complete, relevant, and up to date. Please contact us if any information you have provided changes or if you believe that information we hold about you is inaccurate, incomplete, or outdated.

Personal Data Security

We use reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction. These measures may include access controls, encryption, monitoring, secure transmission technologies, and internal policies.

However, no method of transmission or storage is completely secure. We cannot guarantee that Personal Data will be completely secure, and you provide information to us at your own risk.

Your Data Protection Rights

Depending on where you are located and subject to applicable law, you may have certain rights in relation to your Personal Data.

These rights may include the right to:

Request access to the Personal Data we hold about you;
Request correction of inaccurate or incomplete Personal Data;
Request deletion of your Personal Data;
Request restriction of processing;
Object to processing based on legitimate interests or direct marketing;
Request portability of Personal Data you provided to us;
Withdraw consent where processing is based on consent;
Lodge a complaint with a data protection authority.

To exercise your rights, please contact us using the details in the "Contact Us About Privacy" section below. We may need to verify your identity before responding to your request.

Where we process Personal Data as a processor on behalf of a customer, we may refer your request to the relevant customer or assist that customer in responding to your request.

Data Breaches

A "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data that we transmit, store, or otherwise process.

Where required by applicable data protection laws, we will notify the relevant supervisory authority of a Data Breach without undue delay and, where feasible, within the required statutory timeframe, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Where a Data Breach is likely to result in a high risk to your rights and freedoms, we will notify you where required by applicable law.

Where we process Customer Data as a processor, we will notify the relevant customer of a Data Breach in accordance with our agreement with that customer and applicable law.

Marketing Communications

We may send you marketing communications about our products, Services, updates, and offers where permitted by law. You can opt out of marketing emails at any time by using the unsubscribe link in our emails or by contacting us.

Even if you opt out of marketing communications, we may still send you non-marketing messages relating to your account, transactions, security, support, legal notices, or use of the Services.

Children's Privacy

Our Services are intended for businesses and are not directed to children. We do not knowingly collect Personal Data from children. If you believe that a child has provided Personal Data to us, please contact us so that we can take appropriate action.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on our website and update the "last updated" date above. Your continued use of our website or Services after an updated Privacy Policy becomes available means that you have had the opportunity to review the updated Privacy Policy.

Contact Us About Privacy

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or believe we have not handled your Personal Data properly, please contact us by:

Email: [email protected]
Post: DeflectDispute Ltd, 128 City Road, London, England, EC1V 2NX

If you are located in the United Kingdom and are not satisfied with our response, you may have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are located in the European Economic Area, you may have the right to lodge a complaint with your local data protection authority.

Consent

Where we rely on consent as our lawful basis, such as for certain optional marketing communications or non-essential cookies, we will ask for your consent before carrying out the relevant processing, and you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

For most of the Personal Data we collect from business contacts, prospective customers, and customers, including information you provide when you register, request a demo, complete onboarding, or communicate with us, we do not rely on consent. We rely instead on the performance of a contract (or steps taken at your request before entering into a contract) and on our legitimate interests in operating, providing, securing, and improving our Services and managing our commercial relationships, as described in the "Legal Bases for Processing" section above. If you choose not to provide information that we reasonably need to evaluate, configure, or provide the Services, we may be unable to provide the Services to you or your organization.