1. About this policy and who we are
This policy explains how Claims Gate Pay handles your personal data when a law firm or other organisation uses our platform to pay you, or when you use the platform yourself.
Claims Gate Pay is operated by Claims Gate Payments Ltd (company number 17075441, registered office 110 Bishopsgate, London EC2N 4AY, ICO registration number ZC260485). It is part of the Claims Gate group, which also includes Media Advancements Limited (company number 11361670, trading as Claims Gate), Claims Gate Global Ltd, Claims Gate Marketing Ltd and Claims Gate Invest Ltd (together, the "Claims Gate group"). In this policy, "we", "us" and "our" mean Claims Gate Payments Ltd unless we say otherwise.
Who this policy covers
- Payees: people who receive a payment through Claims Gate Pay, such as a compensation or settlement payment.
- Organisation users: staff of law firms and other organisations who log in to manage projects, payees and approvals.
- Website visitors and enquirers: people who visit our website or contact us.
The organisation paying you (usually your law firm) will have its own privacy notice. Read it alongside this one: for most payment activity, the law firm decides how your data is used.
Contact us: privacy@claimsgatepay.com or Claims Gate Payments Ltd, 110 Bishopsgate, London EC2N 4AY. Our data protection lead, who also acts for the rest of the Claims Gate group, is James Jackson, Chief Executive Officer.
2. Our role: controller and processor
For most payment activity we act on the law firm's instructions, as its processor. We act as an independent controller for our own platform operations, for the claim record described in section 7A, and for anything you choose to opt into with us directly.
| Activity | Who decides how your data is used | Our role |
|---|---|---|
| Setting you up as a payee, checking your details and paying you | The organisation paying you | Processor |
| Identity, sanctions, PEP and fraud checks run on the organisation's behalf | The organisation paying you | Processor |
| Executing the payment and holding funds | The regulated payment provider (e.g. LinkFX) | Not involved: the provider is a separate controller |
| Running, securing and improving the platform; accounts for organisation users | Claims Gate Payments Ltd | Controller |
| Keeping records to meet our own legal obligations and defend legal claims | Claims Gate Payments Ltd | Controller |
| Keeping a record of your claim to check eligibility for future claims, avoid unwanted contact and do the other things in section 7A, where the organisation paying you has agreed | Claims Gate Payments Ltd and Claims Gate group companies | Controller |
| Marketing, group products and sharing with partners, only if you opt in | Claims Gate Payments Ltd (and each partner you choose) | Controller |
What this means for you
- When we act as processor, we use your data only on the law firm's documented instructions under a written data processing agreement. Requests about that data are best made to the law firm; if you send them to us we will pass them on promptly.
- When we act as controller, we are responsible for your data and you can come to us directly.
- We never hold client money or execute payments. Funds are held and payments made by a regulated payment provider (see section 8).
- We use sub-processors, such as cloud hosting and identity-check providers, under contracts that require them to protect your data. The law firm authorises these in advance, and we tell it before we add or replace one.
3. Personal data we collect
| Category | Examples | Whose data |
|---|---|---|
| Identity | Full name, previous names, date of birth | Payees, organisation users |
| Contact | Postal address and address history, email, mobile number | Payees, organisation users |
| Claim and payment | Law firm and project (e.g. mis-sold car finance), claim or settlement reference, payment reference, amount paid, approval history, payment status and receipts | Payees |
| Bank details | Account name, sort code, account number, Confirmation of Payee result | Payees |
| Verification and screening | Results of electronic identity checks, sanctions, politically exposed person (PEP) and insolvency screening, fraud signals and reference numbers. ID documents only if a check refers, fails or needs enhanced review. Credit report information only where needed (section 6) | Payees |
| Communications | Messages we send you, whether they were delivered and opened, your replies and support requests | Payees, organisation users |
| Technical | IP address, device and browser details, log-in times, pages visited, security logs | All users |
| Account and audit | Username, role, permissions, and an unchangeable log of actions taken on the platform | Organisation users |
| Preferences | Your marketing and sharing choices and when you made them | Payees, website visitors |
Special category and criminal offence data. We do not ask for health, ethnicity or other special category data. Sanctions or PEP screening can sometimes reveal information about criminal allegations or political roles. Where it does, we process it only to carry out the checks, under the conditions in Schedule 1 of the Data Protection Act 2018 (preventing fraud and meeting regulatory requirements), and never for any other purpose.
Children. Claims Gate Pay is not intended for anyone under 18. If a payment is due to a child, it is handled by their parent, guardian or litigation friend through the law firm.
4. How we collect it
- From the organisation paying you. Your law firm gives us the details needed to set you up as a payee: usually your name, contact details, claim reference and the amount due.
- From you. You give us or confirm details, such as bank details, when you accept a payment, and you may choose marketing and sharing preferences.
- From verification and fraud-prevention providers. Identity, sanctions, PEP, insolvency and Confirmation of Payee checks return results about you.
- From our payment partners. The regulated payment provider tells us whether a payment succeeded, failed or was returned.
- Automatically. Our platform and emails record technical and usage data (see section 10 on cookies).
- From other Claims Gate group companies. Only where you already have an account with them and the notice they gave you allows it.
5. How we use your data and our lawful bases
We use your data only for the purposes below, each with a lawful basis under UK GDPR Article 6. We will not use it for a new purpose unless that purpose is compatible with these, or we have told you first and, where needed, asked for your consent.
| Purpose | Our role | Lawful basis |
|---|---|---|
| Setting you up as a payee, sending you payment messages and paying you | Processor | The law firm's basis (usually performing its contract with you, or its legitimate interests) |
| Identity, sanctions, PEP, insolvency and fraud checks before a payment | Processor | The law firm's basis (legal obligation and preventing fraud) |
| Confirming the bank account belongs to you, and blocking duplicate or changed-account fraud | Processor | The law firm's basis (legitimate interests in paying the right person) |
| Providing and securing the platform; managing organisation user accounts | Controller | Legitimate interests (running a secure service) and contract with the organisation |
| Keeping audit records, handling complaints, meeting legal and regulatory duties | Controller | Legal obligation; legitimate interests (defending legal claims) |
| Improving our service using aggregated or de-identified statistics (e.g. how many payments complete first time) | Controller | Legitimate interests. The output does not identify you |
| Telling you about other Claims Gate group products and services, including other claims you may be eligible for | Controller | Consent (Schedule A, choice 1) |
| Sharing your contact details with named partners so they can offer you their products or services | Controller (with each partner as a separate controller) | Consent (Schedule A, choice 2) |
| Using your claim history to tailor which offers you see | Controller | Consent, given as part of choices 1 and 2 |
We also rely on legitimate interests for the further purposes in section 7A. Schedule C lists every one, with a summary of how we balanced it against your interests.
Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against yours and your reasonable expectations. You can ask for our assessment and object at any time (section 10).
Consent is always optional. Whether you agree or not does not affect your payment, its amount or its timing in any way. You can withdraw consent at any time, as easily as you gave it.
6. Identity, fraud and anti-money laundering checks
Before a payment is released, the organisation paying you asks us to run electronic checks. These match your details against trusted data sources and sanctions, PEP and insolvency lists. We usually do not need ID documents. We ask for them only if a check does not give a clear result or the payment needs extra review.
Check results are advisory. The organisation paying you makes the final decision on whether to proceed, and the regulated payment provider carries out its own checks.
Credit reports. We do not routinely obtain full credit reports for CG Pay. If we need one, for example to confirm your identity or find your current address when other checks fail, we obtain it through Valifi or Valid8 from Equifax, Experian or TransUnion. Credit report data is covered by the same limits as other check data below. The credit reference agencies explain how they use your data in their joint Credit Reference Agency Information Notice.
Ring-fenced data. Data collected for these checks is used only to prevent fraud, money laundering and terrorist financing, and to meet legal requirements. This covers check results, ID documents, screening matches, and bank details and payment amounts. We never use it for marketing, never share it with partners for their own purposes, and never sell it.
If a check finds a match or suspected fraud, the result may be recorded and shared with the organisation paying you, the payment provider, fraud-prevention agencies or law enforcement, where the law requires or allows. This can affect whether a payment is made.
7. Marketing, group products and sharing with partners
If you opt in, we may use your contact details to offer you other products and services, and share them with selected partners who can do the same. Each choice is separate. Saying no to any of them has no effect on your payment.
Your choices (full wording in Schedule A)
- Claims Gate group offers. Claims Gate companies may contact you about other legal claims you may be eligible for, financial and money-management services, and other products from the group. We may contact you by email, SMS, messaging apps (such as WhatsApp), phone, post, or personalised online and social media advertising, and you can choose which of these to allow.
- Partner offers. We may share your name, contact details and a summary of your claim type (not your bank details, payment amount or check results) with partners in the categories listed in Schedule B. Each partner then becomes responsible for your data under its own privacy notice and may contact you about its products.
What we share with partners, and what we never share
| May be shared with your consent | Never shared for marketing or partner use |
|---|---|
| Name | Bank details and Confirmation of Payee results |
| Email, mobile number, postal address | Payment amounts and payment history |
| Claim type (e.g. "car finance claim") and whether a payment was completed | Identity, sanctions, PEP, insolvency and fraud check results; ID documents |
| Your stated preferences and interests | Data the law firm has not allowed us to use for our own purposes |
How we keep this fair
- Partner list. Schedule B lists the categories of partner and names each current partner. When we add a partner, we share your data with it only if you consented after it was listed, or after we ask you again.
- Partner vetting. Before sharing, we check each partner's data protection standards. Every partner signs a data-sharing agreement that limits it to the purposes you agreed to and requires it to honour opt-outs.
- Group companies. Group companies use your data only for the purposes you agreed to. Each is a separate controller and is bound by this policy's commitments.
- Profiling. If you opt in, we may use your claim type and interactions to choose which offers to show you. We do not make decisions with legal or similarly significant effects about you this way.
- No sale of your data without consent. We do not sell or rent your data to anyone unless you have chosen to share it with partners under choice 2.
- Withdrawing consent. Use the unsubscribe link in any message, reply STOP to texts, update your preferences in your account, or email us. We will stop, and tell partners we shared your data with to stop, promptly, and in any case within 28 days. Withdrawing does not affect anything done lawfully before.
- Keeping it current. If you do not engage with any of our messages for 36 months, we will stop marketing to you and ask you again before using your data for marketing.
7A. Using your claim record for future claims and running our business
We keep a record of the claim you were paid for. We use it to make sure you get a fair chance to join future claims you may be eligible for, and to avoid contacting you about claims you have already made. We do this on the basis of our legitimate interests, where the organisation paying you has agreed. It does not need your consent, but you can object at any time and we will stop.
What your claim record includes
- Your name, contact details, date of birth and postcode
- The claim type (e.g. mis-sold car finance), the defendant or lender, and the approximate dates of the agreement or event
- The law firm that acted for you, and whether and when the claim settled
- The settlement value. This is used only for claim research and anonymised statistics, and seen only by a small number of authorised staff
- Your contact preferences, objections and opt-outs
It never includes your bank details, payment instructions, or identity, sanctions or fraud check results.
What we use it for
- Avoiding unwanted and duplicate contact. We keep a suppression list so we do not market a claim to you that you have already made with any firm, or contact you after you have opted out.
- Checking eligibility for new claims. When a new group claim is launched, we check whether your claim history suggests you may qualify.
- Telling you about claims you may qualify for. We do this by post, or by phone if your number is not registered with the Telephone Preference Service. We use email, SMS, messaging apps or personalised online advertising only if you have agreed (section 7).
- Claim research. We analyse patterns across our records (for example by lender, dates or agreement type) to identify possible new claims and estimate how many people they affect. Anything shared outside the Claims Gate group is aggregated or anonymised.
- Preventing fraud and duplicate claims across claims and firms.
- Tracing people we owe money to or cannot reach, using tracing agencies and address-update services.
- Keeping records accurate, including checking change-of-address and bereavement registers so we do not contact people who have moved or died.
- A single record across the Claims Gate group, so group companies can support you, keep your preferences consistent and avoid duplicate contact.
- Quality, training and service improvement, including call recordings, reviewing messages and testing changes to our journeys.
- Developing products, using pseudonymised data wherever possible.
- Reporting to litigation funders and investors about claim outcomes, pseudonymised and under confidentiality terms.
- Settlement insight, such as settlement rates and values by claim type or lender, published or shared only in anonymised form.
- Customer feedback surveys about your experience. These do not promote anything.
- Signposting free, independent help, such as free debt or money advice.
- Handling complaints, disputes and regulator enquiries, and business transactions such as investment, sale or restructuring.
Limits we keep to
- We use your record only to exclude you from marketing by other firms. We never use it to encourage you to switch law firm.
- We do not share your individual record with anyone outside the Claims Gate group without your consent (section 7).
- We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
- Before we start using your record for any new purpose, we check it is compatible with the ones above, complete a new assessment and update this policy.
Your right to object. You can object to any of these uses by emailing privacy@claimsgatepay.com or using the link in our messages. For marketing, we will always stop. For the other uses, we will stop unless we have compelling reasons to continue, such as preventing fraud. If you object, we keep only enough information to make sure we do not contact you again.
8. Payment partners, sub-processors and other recipients
We share your data only with the recipients below, and only what each one needs.
Regulated payment providers (separate controllers)
Payments are made through one or more FCA-regulated payment providers, chosen by the organisation paying you. The provider holds the funds in safeguarded accounts, runs its own regulatory checks and makes the payment. It receives your name, bank details, payment amount and reference, and it is a controller of that data under its own privacy notice.
| Provider | What it does | Status |
|---|---|---|
| Link FX plc (company number 03129173, 71 Gloucester Road, London SW7 4SS). Authorised and regulated by the Financial Conduct Authority, registration number 535266 | Holds funds in safeguarded accounts and executes payments | Live |
| National Westminster Bank plc (Payit) | Pay-by-bank payments where the organisation uses this route | Account being set up |
| Other FCA-regulated payment providers | Other payment routes an organisation chooses | Named in Schedule B before first use |
Sub-processors (act only on our instructions)
| Category | Example | Purpose |
|---|---|---|
| Cloud hosting, database, logging | Google Cloud / Firebase | Running and securing the platform |
| Identity, sanctions, PEP and insolvency checks | Valifi | Pre-payment verification |
| Bank account verification | – | Checking the account name matches |
| Email and SMS delivery | – | Sending payment and account messages |
| Customer support and IT security | – | Helping you and keeping systems secure |
Each sub-processor works under a written contract that meets UK GDPR Article 28. Where we act for a law firm, the firm authorises our sub-processors in advance and we give it notice and a chance to object before adding or replacing one. Schedule B holds the current list.
Others
- The organisation paying you. It receives check results, payment status and the audit trail so it can keep its own records.
- Claims Gate group companies. For shared IT, support and administration (as processors), and for marketing only if you opt in (section 7).
- Partners you opt in to. See section 7 and Schedule B.
- Professional advisers (lawyers, auditors, insurers), under duties of confidentiality.
- Regulators, courts, law enforcement and fraud-prevention agencies, where the law requires or allows.
- A buyer or investor. If all or part of our business is sold, restructured or refinanced, your data may pass to the new owner. It must keep to this policy and the choices you have made.
9. International transfers, retention and security
International transfers. We aim to keep your data in the UK. If a provider stores or accesses it elsewhere, we protect the transfer with one of the following: a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework. We also carry out a transfer risk assessment. You can ask us for a copy of the safeguards.
How long we keep it
| Data | Retention | Why |
|---|---|---|
| Payment records, audit trail, check results, credit report data and ID documents | 5 years from the last payment | Money Laundering Regulations 2017 record-keeping; the law firm's instructions |
| Payee contact details held for the law firm | Until the project closes plus 12 months, or as the law firm instructs | Processor role: the law firm decides |
| Claim record (section 7A) | 6 years from settlement, then anonymised | Eligibility for later claims; limitation periods |
| Suppression list entries | For as long as we market claims, reviewed every 6 years | So we don't contact people who opted out or already claimed |
| Marketing and partner consents, and the records proving them | While your consent is active, plus 6 years after you withdraw | Showing we had consent; limitation periods |
| Marketing contact details (if you opted in) | Until you withdraw, or 36 months without engagement | Section 7 |
| Call recordings | 12 months | Quality and training |
| Organisation user accounts | Contract term plus 6 years | Contract and limitation periods |
| Technical and security logs | 12 months | Security and fraud investigation |
At the end of the period we delete the data or anonymise it so it can no longer identify you. We keep your name on a suppression list after you opt out, so we do not contact you again.
Security. Measures include:
- data encrypted in transit and at rest
- each organisation's data kept separate from every other's
- role-based access with named approvers for payments
- an unchangeable audit log
- signed and verified connections with payment providers
- secrets held in a managed vault
- regular penetration testing
If a breach is likely to put you at high risk, we will tell you and the ICO without undue delay. For data we hold for a law firm, we tell the firm.
10. Your rights, automated decisions, cookies and complaints
Your rights. You have the right to:
- access your data
- correct it
- have it deleted
- restrict its use
- receive it in a portable format
- object to our use of it
- withdraw consent at any time
You can always object to direct marketing, and we will stop. Some rights have limits: for example, we must keep AML records for the legal period. We respond within one month, and may extend by up to two months for complex requests. Where we act for a law firm, we pass your request to the firm and help it respond.
Automated decisions. Identity and screening checks are automated, but they are advisory. A person at the organisation paying you reviews any refer or fail result before a final decision. We do not make solely automated decisions with legal or similarly significant effects on you. If that changes, we will tell you and give you the right to human review.
Cookies. We use strictly necessary cookies to keep you logged in and secure. We set analytics or marketing cookies only with your consent through our cookie banner.
Changes to this policy. We will post updates here with a new date. If a change affects how we use data you have already given us, we will tell you before it takes effect and ask again where consent is needed.
Complaints. Please contact us first at privacy@claimsgatepay.com and we will respond promptly. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Effective date: 28 September 2026 (draft; rolls forward to the publication date until launch)
Schedule A: consent wording for the payee journey
Your payment is not affected by anything on this page.
Claims Gate Pay is provided by Claims Gate Payments Ltd on behalf of [Law Firm]. We'd like to keep in touch about other things that may help you. These choices are optional and you can change them at any time.
☐ Claims Gate offers. I'd like Claims Gate group companies to tell me about other legal claims I may be eligible for, and other products and services from the group. Contact me by: ☐ Email ☐ SMS ☐ WhatsApp/messaging ☐ Phone ☐ Post ☐ Personalised online ads
☐ Partner offers. I'd like Claims Gate to share my name, contact details and claim type with the partners listed [here] so they can contact me about their products and services. My bank details, payment amount and check results will never be shared.
[Continue]
Read how we use your data in our [Privacy Policy].
Schedule B: partner and sub-processor register
Partners (data shared only with consent, choice 2)
| Category | Named partner |
|---|---|
| Law firms running group and consumer claims | None yet |
| Litigation funders (claims research only, no marketing contact) | None yet |
| Financial services (vehicle finance) | None yet |
| Claims management companies | None yet |
| Insurance and comparison services | None yet |
Payment providers (separate controllers)
| Provider | Role | Status |
|---|---|---|
| Link FX plc (03129173; FCA 535266) | Safeguarding and payment execution | Live |
| National Westminster Bank plc (Payit) | Pay-by-bank payments | Account being set up |
Sub-processors
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Google Cloud / Firebase | Hosting, database, logging | UK: London (europe-west2) | N/A if UK |
| Valifi Limited | Identity and screening checks; credit report access | UK | N/A |
| Valid8 Limited | Identity checks; credit report access | UK | N/A |
Schedule C: legitimate interests register
| # | Purpose | Our interest | Why it's necessary | Balance and safeguards | Fit |
|---|---|---|---|---|---|
| 1 | Suppression and de-duplication | Not wasting marketing spend; not signing people up twice | Can't avoid contacting someone without a record of them | Protects people from unwanted contact; minimal data; used only to exclude | Strong |
| 2 | Eligibility matching | Offering new claims to people likely to qualify | Claim history is the best predictor of eligibility | People would reasonably expect claim-related offers; transparent notice; right to object | Strong |
| 3 | Contact about new claims (post, non-TPS calls) | Growing claims we run | Direct contact is how claimants learn about claims | Electronic channels only with consent; TPS screening; easy opt-out | Reasonable |
| 4 | Claim research and sizing | Identifying new group claims; supporting funders and firms | Needs patterns across many records | Aggregated or anonymised outside the group; restricted access to settlement values | Reasonable |
| 5 | Fraud and duplicate-claim detection | Protecting firms, funders and genuine claimants | Needs cross-claim comparison | Recognised legitimate interest; limited access | Strong |
| 6 | Tracing unpaid or uncontactable payees | Paying people what they are owed | No other way to reach people who have moved | Clearly in the person's interest | Strong |
| 7 | Record accuracy (address updates, bereavement screening) | Accurate records; not distressing bereaved families | Records go stale | Reduces harm; minimal data sent to providers | Strong |
| 8 | Single record across the group | Consistent service and preferences; working suppression | Separate records cause duplicate contact | Intra-group admin is a recognised interest; each purpose still limited as listed | Strong |
| 9 | Quality, training, service improvement and A/B testing | Better service and payout rates | Needs real interactions | Expected practice; recordings access-limited and time-limited | Strong |
| 10 | Product development | Building better products | Realistic data improves testing | Pseudonymised where possible; no production data in insecure environments | Strong |
| 11 | Funder and investor reporting | Funding claims; investor oversight | Funders need outcome data | Pseudonymised; confidentiality terms; no contact details | Reasonable |
| 12 | Settlement insight | Commercial insight for firms and funders | Needs outcome data | Anonymised only; no individual records leave the group | Reasonable |
| 13 | Customer feedback surveys | Improving service | Only customers can tell us | No promotional content, so email or SMS surveys stay outside PECR marketing rules | Reasonable |
| 14 | Signposting free help | Supporting customers after payout | Timely point to reach people | Neutral, non-commercial services only | Reasonable |
| 15 | Complaints, disputes, regulators; business transactions | Defending claims; running and financing the business | Records are needed for both | Recognised interests; confidentiality on transactions | Strong |