Privacy Policy
Introduction
Welcome to Ayan Capital Ltd’s Ayan Pay privacy policy (“Ayan”, “we”, “us”, “our”).
Ayan Pay is a Sharia-compliant, interest-free regulated deferred payment credit product provided by Ayan Capital Ltd. It allows eligible customers to spread the cost of goods or services purchased from a partner merchant over fixed instalments.
This privacy policy explains who we are, what personal data we collect, why we collect it, how we use it, who we share it with and how long we keep it when we provide Ayan Pay to customers, receive enquiries from prospective merchants, or work with individuals acting on behalf of partner merchants. It also explains your rights and how to contact us or the ICO.
A partner merchant may start an Ayan Pay application while you are present by entering limited customer and purchase details directly into the Ayan merchant portal. You then complete the application on your own device. Ayan assesses the application and, if it is approved and you proceed, provides and administers the credit. Ayan, rather than the merchant, communicates with you about the application, agreement, payments and any missed payments or arrears. The merchant remains responsible for its own retail sale, fulfilment, delivery, returns and customer relationship. It tells Ayan when it has approved a cancellation or refund and the amount. Ayan administers any resulting adjustment to the credit balance, repayment schedule or refund under the Ayan Pay agreement. This does not affect any rights you may have against Ayan under your agreement or applicable law.
Controller and DPO
This privacy policy applies to Ayan Pay, which is provided by Ayan Capital Ltd.
Ayan Capital Ltd is the controller of your personal data when it provides Ayan Pay or when you use or browse an Ayan Pay website, customer journey or portal.
Our registered office is:
Ayan Capital Ltd: 20 Wenlock Road, London, England, N1 7GU
Our external Group Data Protection Officer is Harper James.
Your right to complain
If you have any concerns about how we collect, use, or handle your personal data, you have the right to make a complaint to us.
You can do this by contacting us using the details below:
Email: dpo@ayancapital.co.uk
Phone: +44 20 3802 0292
Please provide enough information to help us understand and investigate your complaint.
We will acknowledge your complaint within 30 days of receiving it and will respond without undue delay. If we need further information from you in order to investigate your complaint, we may contact you.
We encourage you to contact us first so that we have the opportunity to investigate and try to resolve the issue. However, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Further information about how to do this can be found on the ICO’s website: https://ico.org.uk.
Keeping your data up to date and policy updates
Please keep us informed if your personal data changes during your relationship with us.
We keep this policy under regular review.
Last updated: September 2026
Third-party links and services
Our website may contain links to third-party websites, plugins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.
1. What data we collect
Personal data means any information about an individual from which that person can be identified.
Customers and prospective customers
We may collect the following categories of personal data when you seek to use Ayan Pay:
Identity Data: including name, title, date of birth and proof of identity documentation (such as passport or driving licence, ID card, and utility bills), where required. This also includes identity-verification and fraud-prevention results.
Contact Data: including home address, email address, telephone number. In some cases, we can ask for the contact info of your friends or relatives, for use as an additional contact point if we are unable to reach you.
Profile Data: including account details and authentication data, application history, training records relating to merchant personnel, feedback or survey responses, communication history with us and call recordings.
Marketing and Communications Data: including marketing preferences, consent records and opt-in or opt-out history.
Application Information: including information provided during your Ayan Pay application about your employment, household and housing circumstances.
Purchase and Agreement Data: including the partner merchant, the goods or services, cash price, the Down Payment due when you enter the agreement, amount of credit, instalment term, repayment schedule, agreement status, returns and refunds.
Financial Data: including bank account details, affordability information, income and expenditure information, open banking data where provided, credit-reference and relevant public-record information, and creditworthiness and affordability results.
Transaction Data: including payments to and from you, information relating to purchases and Ayan Pay finance agreements.
Technical Data: including IP address, device information, browser type and version, login and security data, website usage information and portal audit logs.
Prospective merchants and merchant personnel
If a business applies to become an Ayan Pay partner merchant, we deal with the individual who submits the merchant enquiry or due diligence questionnaire and with relevant representatives of the business. The relevant categories listed above also apply to these individuals.
We may process their personal data during merchant onboarding, including for Know Your Business (KYB), due-diligence and suitability checks, fraud prevention and management of the merchant relationship.
For prospective and partner merchants, we may therefore also collect:
Prospective Merchant Enquiry Data: including your name, company name, email address, telephone number and any website or social-media details you choose to provide through an Ayan Pay merchant enquiry form.
Authority and Company Relationship Data: including your role, directorship, UBO status and authority to act for the merchant.
Merchant Due Diligence Data: including information about relevant legal or regulatory matters, financial standing, and merchant suitability relating to merchant owners, directors and key personnel, where this is personal data.
Website users
When you visit an Ayan Pay website, we may collect Technical Data, including information about how you interact with the website, through cookies and similar technologies.
Aggregated data
We may also use aggregated or statistical data that does not directly identify you.
Special category data
We do not intentionally collect special category personal data (such as data relating to health, racial or ethnic origin, political opinions, religious beliefs, or biometric data).
If you do not provide data
If you do not provide personal data required by law or under a contract with us, we may not be able to provide our services or enter into a finance agreement with you.
2. How we collect your data
Direct interactions
You may provide personal data directly to us when you:
- complete or continue an Ayan Pay application
- create or use a customer account
- communicate with us by phone, email or online
- submit documents or complete identity verification
- authorise an Open Banking connection or provide payment details
- enter into or administer an Ayan Pay agreement
- submit a merchant enquiry form
- provide information during merchant onboarding or due diligence
- create or use a merchant-portal account
- complete forms or surveys
Automated technologies
We collect certain Technical Data automatically when you use an Ayan Pay website, application journey or portal through:
- cookies
- server logs
- analytics tools
Third-party and publicly available sources
We may receive personal data from third parties involved in merchant onboarding or due diligence, the Ayan Pay application, connected purchase, credit checking, identity verification or fraud prevention, including:
- Partner merchants: organisations with whom we partner and who may provide customer and order details in connection with an Ayan Pay application or purchase.
- Credit reference agencies (CRAs): including Experian, accessed through Fintern Technologies Ltd, TransUnion, accessed through Creditsafe Business Solutions Limited, and Infact Systems Limited (Infact) — see section 4 for more information.
- Cifas: fraud-prevention databases.
- Open Banking providers: used for affordability checks where required.
- Identity verification and KYC providers: including Plaid.
- Regulators, courts, law-enforcement bodies, public registers and other due-diligence sources: where relevant and lawful, including to verify information supplied during merchant onboarding.
- Your organisation: if you represent a prospective or partner merchant.
3. How and why we use your data and our lawful bases
We only process personal data where the law allows us to.
The main lawful bases we rely on are:
- Performance of a contract with you or taking steps at your request before entering into a contract;
- Compliance with our legal obligations;
- Legitimate interests — where we rely on legitimate interests as a lawful basis, we process personal data to operate and improve our business, assess eligibility for Ayan Pay, manage risk, prevent fraud, maintain the security of our systems, and provide and improve our services. We ensure that these interests are balanced against your rights and freedoms.
- Consent (where required).
Key purposes for processing
| Purpose | Type of data | Lawful basis |
|---|---|---|
| To process and assess finance applications | Identity, Contact, Financial, Application Information, Purchase and Agreement | Taking steps before entering into a contract, performance of a contract and legitimate interests (assessing eligibility for our products, managing financial risk, and ensuring responsible lending) |
| To verify identity, authority to act for a merchant, and company relationship information | Identity, Contact, Authority and Company Relationship, Merchant Due Diligence | Legal obligation where applicable and legitimate interests (verifying that the individual is who they say they are and is authorised to act on behalf of the prospective or partner merchant) |
| To carry out AML/KYC, sanctions screening, credit checks, affordability checks and fraud prevention | Identity, Contact, Financial, Application Information | Legitimate interests (assessing creditworthiness, preventing fraud and financial crime, and managing lending risk) and legal obligation. |
| To respond to merchant enquiries, carry out onboarding and due diligence, and manage merchant-portal access | Prospective Merchant Enquiry, Identity, Contact, Authority and Company Relationship, Merchant Due Diligence, Profile, Technical | Legitimate interests (responding to business enquiries, assessing merchant suitability and developing and operating a secure and compliant merchant network) and legal obligation where applicable |
| To administer and manage finance agreements and payments | Identity, Contact, Transaction, Profile, Purchase and Agreement, Financial | Taking steps before entering into a contract, performance of a contract, legal obligation and legitimate interests (administering accounts and payments, monitoring the performance of finance agreements) |
| Retail direct marketing – sending promotional offers, product updates, newsletters, event invitations and personalised marketing communications to retail customers. | Identity, Contact, Marketing and Communications, Profile. | Consent, where required under applicable marketing laws (including PECR), and/or legitimate interests (promoting products and services and growing the business) |
| Business direct marketing – sending marketing communications about products, services, events and industry updates to business contacts at prospective and existing partner merchants. | Identity, Contact, Marketing and Communications, Profile. | Legitimate interests (promoting products and developing business relationships and marketing relevant products and services to business contacts) |
| To verify identity and comply with regulatory obligations | Identity, Financial | Legal obligation |
| To manage our relationship with customers and applicants | Identity, Contact, Profile | Performance of a contract and legitimate interests (providing customer support, managing communications, and maintaining service quality) |
| To contact you about a finance application you started but did not complete | Identity, Contact, Application Information, Purchase and Agreement, Profile | Taking steps before entering into a contract and legitimate interests (supporting applicants and administering incomplete applications) |
| To make limited information available to the partner merchant so it can complete or administer the connected purchase | Identity; Contact; Purchase and Agreement, limited to the customer and order details entered by the merchant and application status; Transaction, limited to Down Payment confirmation | Taking steps before entering into a contract, performance of a contract and legitimate interests (completing and administering the connected purchase and credit transaction) |
| To apply any merchant-notified cancellation, return or refund to the finance agreement and make any refund due | Purchase and Agreement; Transaction; Financial, only where Ayan needs bank account details for a refund | Performance of a contract and legitimate interests (administering the connected purchase and finance agreement) |
| To record calls with you for training and monitoring purposes. | Identity, Contact, Profile | Legitimate interests (maintaining service quality, staff training, monitoring compliance with internal procedures and regulatory requirements, and resolving complaints or disputes) |
| To administer and protect our business and website | Identity, Contact, Technical | Legitimate interests (operating our business, maintaining network and information security, preventing fraud or misuse of our systems) and legal obligation |
| To analyse and improve our services and website | Technical | Legitimate interests (monitoring usage, improving our products and services, and enhancing user experience) and consent where required for non-essential cookies or similar technologies |
| To meet legal, regulatory and reporting obligations | Any relevant category of personal data depending on the obligation | Legal obligation |
Marketing and surveys
Where we carry out direct marketing communications or customer surveys, we ensure that these are conducted in accordance with applicable marketing laws and consent requirements where necessary.
You can opt out of marketing communications at any time by emailing us: dpo@ayancapital.co.uk
Use of AI tools
We use artificial intelligence tools to support aspects of our business operations.
This includes:
- approved AI-enabled software and analysis tools used to support internal operations, including AI features within approved platforms and AI coding assistants; and
- limited use of general-purpose AI tools, such as Claude or ChatGPT, for internal productivity purposes. We do not input customers’ personal data into these tools.
Where AI tools are used in decision-making, we apply appropriate safeguards and human oversight where required. Further information is set out in section 5 below.
Cookies and similar technologies
Our website and application use cookies, local storage and similar technologies for security, to remember your preferences, to measure how our services are used and, where you accept it, for advertising. Strictly necessary technologies are used without consent under paragraph 4 of Schedule A1 to PECR. Everything else is used only if you accept it in our cookie banner, and you can change or withdraw that choice at any time through the Consent Preferences button in our Cookie Policy.
A full list of the cookies we use, their purpose and how long they last is set out in our Ayan Pay Cookie Policy.
Change of purpose
We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another compatible reason or where required or permitted by law.
4. Credit Reference and Affordability Checks
To assess your application, affordability, and creditworthiness, and to verify identity, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).
We primarily obtain credit and affordability data from Experian, accessed via our data partner Fintern Technologies Ltd. In some cases, we may also obtain credit and identity information from Creditsafe Business Solutions Limited, which sources consumer data from TransUnion International UK Limited.
We also obtain affordability data from Infact Systems Limited ("Infact"), a credit reference agency authorised and regulated by the Financial Conduct Authority.
Infact provides us with affordability information and predicted affordability metrics, which we use to assess whether the payments under a proposed finance agreement are likely to be affordable for you, and to support responsible lending in line with our regulatory obligations.
The information received from CRAs may include details about your identity, credit commitments, payment history, and public records. We use this information where you have authorised us to do so as part of your Ayan Pay application for purposes such as assessing creditworthiness and product suitability, verifying identity, managing accounts, recovering debts, and preventing fraud.
We may also share information with CRAs on an ongoing basis about the operation of your account, including whether payments are made on time. Credit reference agencies may share your information with other organisations and may link your data with that of financial associates such as joint applicants.
Further information about how credit reference agencies process and share personal data, including the identities of the CRAs we use, can be found in the Credit Reference Agency Information Notices (CRAIN).
You can find further details about how our data partners process your personal data in their respective privacy notices:
- Experian Credit Reference Agency Information Notice (CRAIN): https://www.experian.co.uk/legal/crain/
- Creditsafe Privacy / Transparency Notice: https://www.creditsafe.com/gb/en/legal/transparency-notice-customer-supplier.html
- TransUnion Credit Reference Agency Information Notice (CRAIN): https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference
- TransUnion Bureau Privacy Notice: https://www.transunion.co.uk/legal/privacy-centre/pc-bureau
- Infact Privacy Centre: https://infact.io/uk/privacy-centre
- Infact Credit Reference Agency Information Notice (CRAIN): https://infact.io/uk/infact-crain
As part of the application process, we may also:
- request access to your bank transaction data through open banking to assess affordability (used only for the application process); and
- carry out fraud and identity checks with CIFAS to help prevent fraud and money laundering.
5. Automated Decision Making and Profiling
We use automated decision making and profiling when assessing Ayan Pay applications. This helps us assess applications quickly and consistently while managing credit risk and preventing fraud. These decisions are significant because they may determine whether finance is offered to you and the approved credit amount available.
At the application stage, some decisions may be made automatically without human involvement. This may include:
- automatically approving an application and setting an approved credit amount where eligibility and affordability criteria are met; or
- automatically declining an application where predefined risk criteria are triggered.
Applications that do not clearly meet approval or decline criteria, or that show inconsistencies or risk indicators, are referred to an underwriting officer for manual review.
Information used in the decisioning process
Our systems assess information such as:
- details provided in your application
- credit reference data (for example payment history, defaults, county court judgments and credit scores)
- affordability information, including affordability data and predicted affordability metrics
- fraud prevention and identity verification data
This information is assessed against predefined lending, affordability and fraud-prevention criteria.
Possible outcomes
The possible outcomes of this process include:
- approval of your application and the setting of an approved credit amount
- refusal of your application; or
- referral for manual review by an underwriting officer.
These outcomes may affect whether finance is offered to you and the approved credit amount available.
Your rights
You have the right to request human review of an automated decision, to express your point of view and to contest a decision.
If you would like further information or wish to request a review of a decision, you can contact us at dpo@ayancapital.co.uk.
6. Sharing your data
We may share your personal data with trusted third parties where this is necessary to provide our services, administer your agreement, comply with legal or regulatory obligations, or protect our legitimate interests. These may include:
- Credit reference agencies (see section on Credit Reference and Affordability Checks above).
- Fraud prevention organisations, including CIFAS.
- Open Banking providers used to assess affordability.
- Payment service providers to support certain payment and financial transaction services, including direct debit and card payment processors
- Marketing platforms or providers involved in supporting us in sending direct marketing to our customers
- Identity verification and KYC providers to comply with our legal and regulatory obligations, including anti-money laundering (AML), counter-terrorist financing (CTF), and fraud prevention requirements, to help us verify your identity and assess potential financial crime risks when you apply for our services or during the course of our relationship with you.
- Partner merchants involved in your purchase.
- Regulators, government bodies, law enforcement agencies, and courts where required by law
- Professional advisers, such as lawyers, accountants, and auditors
- Technology, cloud hosting, analytics, and software service providers, including AI-enabled tools used to support our operations and call recordings providers
- Investors, funders, or financing partners who support the provision of our products, or third parties to whom we may choose to sell, transfer or merge parts of our business or our assets.
- Advertising and analytics platforms. Where you accept the relevant cookies, we may share online identifiers and information about how you use our website and application with Google, Meta, Microsoft Advertising, Reddit, TikTok and Hotjar, so that we can measure how our services are used and how our advertising performs. Depending on the provider, they act as our processor or as a separate or joint controller of the data they receive. The information shared with these advertising and analytics platforms does not include the contents of your finance application, credit reference data or the documents you upload. Full details are in our Cookie Policy.
We require all third parties to respect the security of your personal data and to process it only for specified purposes and in accordance with applicable data protection laws.
7. International transfers
Some of our service providers or operational teams may be located outside the United Kingdom. In particular, personal data may be transferred to Tajikistan and Uzbekistan. In this case, we ensure appropriate safeguards are in place to protect your data in accordance with UK data protection law. These safeguards may include contractual protections or equivalent mechanisms.
Where you accept advertising or analytics cookies, information about your use of our website and application is also transferred to the United States by Google, Meta, Microsoft Advertising, Reddit and TikTok. We rely on the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to ensure your data remains protected.
For further information about international transfers, please contact us at dpo@ayancapital.co.uk.
8. Data security
We have implemented appropriate technical and organisational security measures to protect personal data from accidental loss, unauthorised access, alteration or disclosure.
Access to personal data is limited to employees, contractors and service providers who need it for legitimate business purposes and who are subject to confidentiality obligations.
We have procedures in place to deal with suspected personal data breaches and will notify individuals and regulators where required by law.
9. How long we keep your data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, tax, accounting or reporting requirements.
Retention periods may vary depending on the nature of the data and the applicable legal obligations. Data may also be retained for longer where necessary to deal with complaints, disputes or potential legal claims.
For more information about our retention periods, please contact dpo@ayancapital.co.uk.
10. Your rights
Under UK data protection law, you have several rights in relation to your personal data.
You can contact us at dpo@ayancapital.co.uk to exercise any of these rights.
You will not usually have to pay a fee to access your personal data. However, we may charge a reasonable fee or refuse a request where it is clearly unfounded or excessive.
We aim to respond to requests within one month.
Your legal rights
Access: You can request a copy of the personal data we hold about you and check we are processing it lawfully.
Correction: You can ask us to correct incomplete or inaccurate data. We may need to verify the accuracy of the new data.
Erasure: You can ask us to delete your data where there is no good reason for us to continue processing it, where you have objected successfully, where we processed it unlawfully or where we must erase it to comply with law. We may not always be able to comply for specific legal reasons, which we will explain if applicable.
Objection: You can object to processing based on our legitimate interests if you feel it impacts your rights and freedoms, and you can always object to direct marketing. We may demonstrate compelling legitimate grounds to continue processing in some cases.
Restriction: You can ask us to suspend processing where you want us to check accuracy, where processing is unlawful but you do not want erasure, where you need us to keep data to establish, exercise or defend legal claims, or where you have objected and we are considering our grounds.
Portability: You can ask us to transfer your data to you or a third party in a structured, commonly used, machine-readable format. This applies to automated information you provided, where we process it based on consent or contract.
Withdraw consent: Where we rely on consent, you can withdraw it at any time. This will not affect processing carried out before withdrawal. If you withdraw consent, we may be unable to provide certain services and will advise you if so.