Renopay Privacy Policy

Customer Privacy Notice  |  Version 2.2
Last updated: 5 October 2026

Renopay Limited  |  Company No. 16521097  |  Registered in England and Wales
Registered office: 124-128 City Road, London, EC1V 2NJ

This privacy notice explains what Renopay Limited (“Renopay”, “we”, “us”, “our”) does with your personal information when you use the Renopay platform, website, and app (the “Platform”). Where you use the Platform, it forms part of, and should be read together with, the Renopay Master Platform Agreement, and capitalised terms used but not defined here have the meanings given in that Agreement. This notice also applies where you take part in our referral scheme without holding a Renopay account, in which case section 12 sets out the additional information that applies to you and the Master Platform Agreement does not apply.

1. Who we are and how to contact us

Renopay Limited is the controller of the personal data we collect through the Platform for the purpose of operating the marketplace. You can contact us about this notice or about your personal data:

• (a) by email, for data protection and privacy matters, at privacy@renopay.co.uk;
• (b) by email, for general enquiries, at info@renopay.co.uk; or
• (c) by post, at Renopay Limited, 124-128 City Road, London, EC1V 2NJ, United Kingdom.

1.1 Renopay and OPP

Payments on the Platform are processed by Online Payment Platform Ltd (“OPP”), an electronic money institution authorised and regulated by the Financial Conduct Authority (Firm Reference Number 1003976). Renopay and OPP are separate and independent controllers of personal data: Renopay controls the data it processes to operate the marketplace, and OPP independently controls the data it processes to provide its regulated payment, e-money, escrow, and safeguarding services (including its customer due diligence, KYC, and anti-money-laundering checks). OPP processes your personal data under its own privacy policy, available on its website. The respective roles of Renopay and OPP are set out in the arrangements between us and, where applicable, in a data sharing agreement.

2. The personal information we collect and use

Depending on how you use the Platform, we collect and use the following categories of personal information:

• Identity and contact details — your name, email address, postal address, and telephone number.
• Account information — your registration details, account settings, marketing preferences, and information used for security purposes.
• Project information — details of the construction, renovation, or landscaping Projects you create or work on, including Milestones, specifications, photographs, videos, documents, completion evidence, and messages exchanged through the Platform.
• Payment and transaction information — bank account details and records of payments, Milestone funding, escrow deposits, releases, refunds, fees, and related transaction logs. Card details are not collected by Renopay; Milestones are funded by bank transfer or payment initiation. Much of this information is collected and held by OPP as the regulated payment provider.
• Verification and compliance information — identification documents and related information used for identity verification, KYC, anti-money-laundering, sanctions, and fraud-prevention purposes. This verification is carried out by OPP; we may receive verified status and compliance flags from OPP.
• Technical and usage information — your IP address, device and browser information, and information about how you use the Platform, collected partly through cookies and similar technologies (see section 8).
• Correspondence — records of your communications with us, including support queries, complaints, and Dispute records.
• Referral information — where you take part in our referral scheme, your name, email address, referral link and code, the referrals attributed to you, whether you have told us you are referring in a professional capacity, and, where a referral qualifies for a reward, the bank account details we need to pay you and the records of that payment. Referral rewards are paid by Renopay from its own account and not through OPP, so these bank account details are held by Renopay. See section 12.

2.1 Special category and sensitive information

Renopay does not set out to collect special category personal data (such as data revealing health, racial or ethnic origin, or religious beliefs). However, project photographs and messages that you choose to upload may occasionally contain such information — for example, an image of the inside of your home. Where this happens, we rely on your explicit consent, and you should avoid uploading sensitive information that is not necessary for your Project. Identity documents processed for verification are handled by OPP as part of its regulated compliance processes.

3. How we use your information, and our lawful bases

Under UK data protection law we must have a lawful basis for using your personal information. The table below sets out what we use your information for and the lawful basis we rely on. These lawful bases mirror those in Section 13.2 of the Agreement.

Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that our use of your information is proportionate and does not override them. You can ask us for more information about this assessment. Where we rely on consent, you can withdraw it at any time (see section 4); withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

4. Your data protection rights

Under UK data protection law, you have the following rights, which you can exercise free of charge:

• Right of access — to ask for a copy of your personal information.
• Right to rectification — to ask us to correct information that is inaccurate or incomplete.
• Right to erasure — to ask us to delete your information, subject to our legal and regulatory retention obligations.
• Right to restriction — to ask us to limit how we use your information.
• Right to object — to object to our use of your information where we rely on legitimate interests, and to direct marketing at any time.
• Right to data portability — to ask us to transfer certain information to you or another organisation.
• Right to withdraw consent — where we rely on consent, to withdraw it at any time.

To exercise any of these rights, contact us at privacy@renopay.co.uk or use your in-app settings. We will respond without undue delay and in any event within one month, although we may extend this by up to two further months for complex requests, in which case we will let you know. Some rights do not apply in all circumstances, and exemptions may apply.

5. Where we get your information from

We collect most personal information directly from you when you register and use the Platform. We may also receive information about you from:

• OPP — our FCA-authorised payment provider, which carries out identity verification (KYC), AML checks, and manages escrow; we may receive verified user data and compliance flags.
• fraud-prevention and risk tools — where integrated, we may receive alerts or data flagging suspicious activity, duplicate accounts, or higher-risk indicators.
• referrers — where a Builder registers through a referral link issued under our referral scheme, we record which referrer that link belongs to, and we tell the Builder who referred them. We do not ask referrers to give us a Builder's contact details.
• introducers and commercial partners — where a Homeowner or Builder is introduced to us by a trade body, professional practice, or other commercial partner under a separate arrangement, we may receive basic contact information for onboarding.
• regulatory and law-enforcement bodies — where required by law or in connection with the prevention or investigation of crime.
• our service providers — our hosting, communications, analytics, and support providers (see section 6.1) may provide information generated in the course of your use of the Platform.

6. Who we share your information with

We share personal information with:

• OPP, for payment processing, escrow, KYC/AML, and safeguarding, as an independent controller;
• the other party to your Project (your Homeowner or Builder), to the extent necessary to carry out the Project;
• an Expert appointed in any Expert Determination, where relevant to a Dispute;
• our service providers and processors, who process personal data on our behalf and under our instructions (see section 6.1);
• professional advisers, auditors, regulators, and law-enforcement or other authorities, where necessary or required by law; and
• a buyer or successor, if we sell or reorganise our business, subject to appropriate protections.

6.1 Our processors

We use the following service providers to process personal data on our behalf. We have, or will have in place, data processing agreements with each that require them to protect your information and use it only on our instructions.

We keep this list under review and update it as our providers change. Card payment data is handled by OPP and its own payment processors, not by Renopay.

7. International transfers

Your core personal data — including your account, Project information, and the data held in our primary database — is stored in the United Kingdom. We do not transfer your primary account and Project data outside the UK.

However, some of the service providers we use to support specific functions process personal data outside the UK, including in the United States, and OPP's wider group operates in the European Economic Area (EEA). In particular, our email, in-app messaging, error-monitoring, analytics, and advertising measurement providers (such as Resend, GetStream, Sentry, Google Analytics, Mixpanel, Meta, and OpenAI) process certain data in the United States, and our CRM provider (HubSpot) stores data in the EEA with some usage data processed in the United States. This means limited categories of your personal information may be transferred to, stored, or processed in those countries.

Where we transfer personal information outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law. In particular:

• (a) for transfers to the EEA, we rely on the UK Government's finding that the EEA provides an adequate level of protection (UK adequacy regulations);
• (b) for transfers to the United States and other countries without UK adequacy, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK International Data Transfer Agreement), together with any additional measures needed to protect your information; and
• (c) where a provider is certified under the UK Extension to the EU–US Data Privacy Framework, we may also rely on that certification.

You can ask us for more information about the safeguards we use, and for a copy of the relevant transfer mechanism, by contacting us at privacy@renopay.co.uk.

8. Cookies and similar technologies

We use cookies and similar technologies on our website and Platform. Cookies are small files placed on your device that help a website function and allow us to understand how it is used.

We use two broad categories of cookie:

• Essential cookies — these are necessary for the website and Platform to work and to keep them secure (for example, to keep you signed in, to remember your cookie choices, and to protect against fraud and misuse). These cookies do not require your consent.
• Analytics cookies — these help us understand how visitors use our website and Platform so that we can improve them. We use analytics and monitoring providers including Google Analytics, Mixpanel, and Sentry, and our hosting provider (Vercel) may set cookies necessary for performance and delivery. With your consent, Mixpanel also records how visitors move through our website (pages viewed, clicks and scrolling) so that we can find and fix problems. The text on the page and anything you type are hidden in these recordings. These cookies are only set where you have given your consent.
• Advertising cookies — with your consent, Meta (the Meta Pixel) and OpenAI (the ChatGPT Ads pixel) set cookies that help us measure our advertising, for example whether someone who clicked one of our ads went on to start signing up or download one of our free tools. We don't give them your name, email address or phone number. These cookies are only set where you have given your consent.

Non-essential cookies, including analytics cookies, are only set where you have given your consent through our cookie banner. You can accept or reject non-essential cookies when you first visit, and you can change your preferences at any time through the banner or your browser settings. Withdrawing consent will not affect the lawfulness of anything done before you withdrew it. Cookies typically last from the duration of your browsing session up to around 24 months, depending on the cookie and provider.

Where you arrive at our website through a referral link, the referral code is contained in the link itself (in the web address) and is recorded when a Builder registers, so that we can attribute the referral correctly. We do not use a cookie stored on your device to track referrals, so this does not require your consent.

Some analytics providers are based outside the UK; where that involves a transfer of personal data, the safeguards described in section 7 apply. You can find out more about how to manage cookies in your browser at aboutcookies.org.

8.1 Using the Renopay mobile apps

You can use the Platform through the Renopay apps for iOS and Android (the “Apps”). When you use an App, we process your personal data in the same way as described elsewhere in this notice. This section explains the additional points that apply specifically to the Apps.

Device permissions. The Apps may ask for permission to use certain features of your device. We only ask for permissions that are needed for a feature you are using, and you can grant or withdraw them at any time in your device settings:

• Camera and photos — so that you can take and upload photographs and videos of your Project, for example as Milestone completion evidence. We do not access your photo library beyond the images you choose to upload.
• Notifications — so that we can send you push notifications about your Projects, such as Milestone completion claims, approval requests, Dispute updates, and the notifications required under the Auto-Release safeguards in the Master Platform Agreement. We do not send marketing by push notification unless you have separately opted in, and you can turn push notifications off at any time in your device settings.
• Biometric sign-in — if you choose to sign in using Face ID, Touch ID, or your device's fingerprint or face recognition, that authentication is carried out on your device by your device's operating system. We do not receive or store your biometric data.

App store providers. When you download an App from the Apple App Store or Google Play, the operator of that store (Apple or Google) processes personal data about the download, such as your account with them and the device you use, under its own privacy policy. We do not control that processing. Apple and Google are not parties to the Master Platform Agreement and do not provide the payment, escrow, or safeguarding services, which remain provided by OPP.

App analytics and diagnostics. The Apps use the same analytics and error-monitoring providers described in this notice (including Mixpanel and Sentry) to help us understand how the Apps are used and to fix problems. As with our website, analytics in the Apps is only enabled with your consent, which you can give or withdraw within the App. Where your device offers an operating-system level tracking permission (such as Apple's App Tracking Transparency prompt), we will only track your activity across other companies' apps and websites if you allow it, and we do not currently use the Apps for that kind of cross-app tracking.

App store data disclosures. The information we provide in the Apple App Store “App Privacy” section and the Google Play “Data safety” section summarises the data described in this notice. If there is any difference between those summaries and this notice, this notice is the more complete description of how we process your personal data.

Deleting your account in the Apps. You can delete your Renopay account from within the Apps, as well as through the website. Deleting your account closes it and removes the personal data we no longer need. Some information must be kept for the periods set out in section 9 to meet our legal and regulatory obligations (for example, transaction records and, where held by OPP, verification records), and we will tell you what is retained when you delete your account.

9. How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this notice, and to meet our legal and regulatory obligations. Our usual retention periods are:

Where information is held by OPP as a separate controller (for example, KYC records), OPP applies its own retention periods under its privacy policy. The retention periods above reflect our role; the specific legal basis for a given period may arise from anti-money-laundering law, HMRC requirements, or general limitation periods.

10. How to complain

If you have any concerns about how we use your personal information, please contact us first at privacy@renopay.co.uk so that we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk/make-a-complaint.

If your complaint concerns OPP's handling of your personal data as part of its regulated payment services, you may also contact OPP using the details in its own privacy policy.

11. Changes to this notice

We may update this notice from time to time. Where changes are material, we will take reasonable steps to bring them to your attention. The version in force is the one published on the Platform, and the date of the latest update is shown at the top of this notice.

12. Referral scheme

12.1 Who this section applies to

This section applies if you take part in the Renopay referral scheme, either as a person who requests a referral link (a “Referrer”) or as a builder who registers through one (a “Referred Builder”). You do not need a Renopay account to be a Referrer and you do not need to have used the Platform. This section should be read together with the referral scheme terms at renopay.co.uk/refer/terms.

12.2 Our role, and OPP's

Renopay Limited is the sole controller of the personal data processed for the referral scheme. OPP has no role in the scheme. Referral rewards are paid by Renopay from its own operating account and are not routed through OPP or through any Milestone payment. This means that, unlike the payment information described in section 2, the bank account details you give us to receive a reward are held by Renopay rather than by OPP.

12.3 What we collect from Referrers, and why

You do not have to give us your bank account details, but we cannot pay a reward without them. If you do not want to give them to us, you can simply decline the reward.

12.4 How we attribute referrals

When you request a referral link we generate a unique code and include it in the link. When someone opens that link and registers as a Builder on the Platform, we record the code alongside their registration so that the referral can be attributed to you. Where more than one Referrer has sent a link to the same Builder, attribution is determined under the referral scheme terms.

12.5 Referred Builders

If you register on the Platform through a referral link, we record the referral code and tell you who referred you. Beyond that, your personal data is processed in the same way as any other Builder's, as described in the rest of this notice. We do not ask a Referrer to give us your contact details and we do not send you marketing on the basis of a referral alone.

12.6 Referring in a professional capacity

If you tell us you are referring in a professional capacity, we record that so that we can meet our own record-keeping and transparency obligations. It does not discharge any duty you owe to your own client. If you are an architect, surveyor, designer, or other professional recommending a builder to a client, you are responsible for disclosing to that client that you may receive a payment from us, and for complying with the rules of any professional body you belong to.

12.7 Sharing and retention

We share Referrer personal data with our processors listed in section 6.1, with our bank in order to make the payment, and with our accountants, auditors, and HMRC where required. Referrer data is not shared with OPP. Retention periods for referral records are set out in the table in section 9.

12.8 Your rights

The rights described in section 4, and the complaints route in section 10, apply to Referrers and Referred Builders in the same way as to any other individual. Withdrawing consent to marketing does not end your participation in the referral scheme, and it does not affect any reward already payable to you.

12.9 Tax

Referral rewards are paid gross. We do not deduct tax and we do not give tax advice. You are responsible for declaring the payment to HMRC where required.

— End of Privacy Policy —