Privacy Notice
Nova Advisory Ireland Limited
Trading as Ummah Pay
Last updated: 19 October 2026
AT A GLANCE
This summary highlights the key points; please read the full notice below for the detail.
Who we are: Nova Advisory Ireland Limited (trading as Ummah Pay), a company incorporated in Ireland that provides software and integrated payment functionality to businesses, charities and other organisations. The regulated payment services are provided by Adyen, not by us.
When this notice applies: it covers the personal data we use as a controller — our Customer contacts and platform users, the directors, trustees, owners and officers we verify, and website visitors. It does not cover our Customers’ own use of personal data, data we handle as a processor, or Adyen’s own processing.
What we collect: contact and account data, organisation data, verification and screening data, transaction data, support records, technical data and marketing preferences (Section 3).
Why we use it: to provide and administer the platform, verify Customers and the people behind them, prevent fraud and financial crime, meet our legal obligations and run our business (Section 4).
Who we share it with: Adyen, acquirers and card schemes, our service providers, advisers, regulators and law enforcement (Section 8).
International transfers, retention and security are explained in Sections 9, 10 and 11. Your rights and how to complain are explained in Sections 13 and 16.
Contents: 1. About this notice; 2. Which parts of this notice apply to you; 3. Personal data we collect; 4. How and why we use personal data; 5. Verification, financial crime checks, and screening; 6. Charity customers and donations; 7. Payers and donors; 8. Who we share personal data with; 9. International transfers; 10. How long we keep personal data; 11. Security; 12. Marketing; 13. Your rights; 14. Cookies; 15. Changes to this notice; 16. How to complain.
1. ABOUT THIS NOTICE
1.1 This notice explains how Nova Advisory Ireland Limited (trading as Ummah Pay), a company incorporated in Ireland (company number 778985) whose registered office is at 12 Boroimhe Blackthorn, Swords, Dublin, K67 VK57, Ireland (“we”, “us”, “our”), collects and uses personal data where we decide how and why it is used. In data protection language, this notice covers the processing for which we are a controller.
1.2 We provide software and integrated payment functionality to businesses, charities, and other organisations (our “Customers”), enabling them to accept payments and donations from their own customers, clients, and donors (“Payers”). The regulated payment services themselves are provided by Adyen N.V. (“Adyen”), not by us.
What this notice does not cover
1.3 This notice does not apply to:
our Customers’ own use of personal data. Where a Customer uses our platform to take payments or donations, that Customer decides how and why the personal data of its Payers is used and is the controller of it. If you are a Payer, please read the privacy notice of the organisation you are paying or donating to;
personal data we process on behalf of, and on the documented instructions of, a Customer in order to provide the platform. In those circumstances we act as a processor, and our processing is governed by our data processing addendum with that Customer rather than by this notice. Section 7 explains the limited circumstances in which we are nevertheless a controller of Payer data;
Adyen’s own processing. Adyen acts as an independent controller when it provides acquiring services and carries out identity verification, financial crime checks, and its own legal compliance. Information you provide to Adyen is not within our control and is dealt with under the Adyen privacy statement at www.adyen.com/privacy-policy; and
other websites we link to, which have their own privacy notices.
1.4 If you have any questions about this notice, about how we use personal data, or if you wish to exercise any of your rights, contact us at support@ummah.com or write to us at the address above.
1.5 We operate more than one payment brand. As well as Ummah Pay, we operate Minted Pay, which runs on the same company, platform, systems, and teams. This means that personal data we hold may be used across our brands for verification, fraud prevention, risk management, customer support, and analytics. Because our brands are operated by the same legal entity, this is a matter of the purposes for which we use personal data, and not a sharing of your data with anyone outside our organisation. A request you make in connection with one brand — for example to exercise your rights or to opt out of marketing — is treated as a request to us as a whole and applied across our brands.
2. WHICH PARTS OF THIS NOTICE APPLY TO YOU
Different parts of this notice apply depending on your relationship with us. You may fall into more than one category.
Customer contacts and platform users — you work for, or represent, an organisation that uses our platform, or you have registered an account. Sections 3 and 4 apply to you.
Directors, trustees, owners, and officers — your details have been provided to us as part of verifying a Customer organisation, whether or not you use the platform yourself. Sections 3, 4, and 5 apply to you.
Sole traders and other individuals who are our Customer in their own name, rather than through a company or charity. Sections 3, 4, and 5 apply to you, and Section 5 explains how automated checks are used.
Website visitors and enquirers — you have visited our website, contacted us, or asked about our services. Sections 3 and 4 apply to you.
Payers, including donors — you have paid or donated to one of our Customers. Section 7 explains our limited role, and directs you to the right organisation for most questions.
3. PERSONAL DATA WE COLLECT
3.1 We collect the following categories of personal data:
Category
Examples
Where it comes from
Contact and account data
Name, job title or role, business email address, telephone number, account credentials, communication preferences
From you, or from the Customer organisation you represent
Organisation data
Organisation name, registered address, company or charity registration number, website, description of activities, bank account details
From you or the Customer organisation
Verification data
Identity document details, date of birth, residential address, nationality, ownership or trustee details, and the results of identity, sanctions, politically exposed person, and adverse media checks
From you, from the Customer organisation, and from verification, screening, and credit reference providers
Transaction and account activity data
Transaction records, payout records, fees, chargebacks, refunds, disputes, and risk indicators relating to the Customer’s account
Generated by your use of the platform, and received from Adyen
Support and correspondence data
Records of your contact with us, including emails, support tickets, and, where applicable, call recordings or notes
From you
Technical and usage data
IP address, device and browser information, log-in records, pages viewed, and actions taken on the platform
Collected automatically. See our cookie policy at https://www.ummah.com/legal/cookie-policy
Marketing data
Your marketing preferences and engagement with our communications
From you, and generated by your interactions
3.2 We do not deliberately collect special category data (such as data about health, religion, or political opinions) about Customer contacts. Screening carried out for financial-crime purposes may nevertheless return special category data, or data relating to criminal allegations, convictions, or political exposure. Where it does, we process that data only for the purposes described in Section 5 — the prevention and detection of fraud, money laundering, and other unlawful acts. Our lawful basis for this processing is our compliance with legal obligations that apply to us directly (such as financial sanctions obligations), together with our legitimate interests in preventing and detecting fraud and financial crime (Article 6 of the GDPR).
3.3 Our screening is carried out by our compliance team in the United Kingdom, and that processing is subject to the UK GDPR. For special category data (Article 9 of the GDPR) and for data relating to criminal allegations and convictions (Article 10 of the GDPR), we rely on the condition for preventing or detecting unlawful acts in Schedule 1 to the UK Data Protection Act 2018, and we rely on it without seeking your consent because doing so would prejudice the purpose of the screening. We maintain an appropriate policy document recording our safeguards, as that Schedule requires. Where processing of this kind is carried out in the context of our Irish establishment, we rely on the equivalent provisions of Irish data protection law.
3.4 Where verification of your identity involves biometric data, we rely on your explicit consent. You may withdraw that consent at any time, in which case we will offer an alternative means of verifying your identity.
3.5 In each case we apply suitable and specific measures to protect this data, including restricted access, defined retention limits, staff training, access logging, and encryption or pseudonymisation.
3.6 Where verification data about you has been given to us by a Customer organisation rather than by you, we rely on that organisation to have told you that it would do so. Where we are required to and have your contact details, we will provide you with this notice directly.
4. HOW AND WHY WE USE PERSONAL DATA
The table below sets out what we use personal data for and the legal basis on which we rely. Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and you may object as described in Section 13.
Purpose
What this involves
Legal basis
Providing and administering accounts
Setting up and maintaining Customer accounts, authenticating users, providing the platform and payment functionality, configuring settings with Adyen
Performance of a contract, or steps taken at your request before entering into one. Where you are not yourself a party, our legitimate interest in administering our contract with the Customer
Customer support
Responding to queries, investigating issues, and handling complaints, including in relation to payments, payouts, and disputes
Performance of a contract; our legitimate interest in supporting our Customers and improving service quality
Onboarding and verification
Verifying the identity, ownership, standing, and activities of Customer organisations and the individuals connected with them, and passing information to Adyen for its own verification
Our legitimate interests in verifying who we contract with, meeting our obligations to Adyen and the card schemes, and preventing fraud and financial crime. Compliance with a legal obligation, where one applies to us directly (for example, sanctions and proceeds of crime legislation)
Fraud prevention and risk management
Monitoring transactions and account activity, applying fraud controls, assessing chargeback and credit risk, and taking protective measures such as adjusting payouts or requiring a deposit
Our legitimate interests in preventing fraud and unlawful activity, protecting our Customers and Payers, and managing the financial exposure we carry for our Customers’ chargebacks and fines
Billing and collections
Calculating and collecting our fees, passing on scheme fines and charges, invoicing, and recovering amounts owed
Performance of a contract; our legitimate interest in recovering sums due to us
Records, audits, and cooperation
Keeping records of transactions and account activity, responding to requests from Adyen, acquirers, card schemes, regulators, and law enforcement, and cooperating with audits and investigations
Compliance with a legal obligation; our legitimate interests in meeting our contractual obligations to Adyen and the card schemes and in establishing and defending legal claims
Service improvement and analytics
Analysing how the platform is used, and producing aggregated or anonymised insights to improve and develop our products and services. We do not use one Customer’s data to provide insights about it to another Customer
Our legitimate interest in understanding and improving our services
Security
Protecting the platform, detecting and responding to security incidents, and maintaining logs
Our legitimate interest in keeping our systems and our Customers’ data secure; compliance with a legal obligation
Marketing
Sending information about our products and services to business and organisational contacts, and measuring engagement
Our legitimate interest in promoting our services; consent, where required. See Section 12
Corporate and legal
Managing our business, taking professional advice, dealing with insurers, and handling corporate transactions
Our legitimate interests in running and protecting our business; compliance with a legal obligation
5. VERIFICATION, FINANCIAL CRIME CHECKS, AND SCREENING
5.1 Before a Customer can accept payments, and periodically afterwards, information about the organisation and about its directors, trustees, owners, and authorised representatives must be verified. This includes identity verification and screening against sanctions lists, politically exposed person lists, and adverse media sources.
5.2 These checks are carried out both by us and by Adyen. Adyen carries them out as the regulated provider of the payment services and acts as an independent controller when it does so. We carry them out in order to decide whether to provide our services, to meet the obligations we owe Adyen and the card schemes, and to prevent fraud and financial crime.
5.3 We may share the information described in Section 3 with Adyen, and with identity verification, screening, and credit reference providers, and may receive information back from them. A search made with a credit reference agency may be recorded, and the agency may retain a record of it.
5.4 If verification information is not provided within the time required, or if checks cannot be completed satisfactorily, an account may be suspended, payouts may be withheld, or we may decline or end the relationship. Adyen may also decline or end its relationship with the Customer independently of us.
5.5 Some of our onboarding and monitoring involves automated processing. We use automated tools to carry out identity, know-your-business, and anti-money-laundering checks on every Customer and the individuals connected with it, through our verification providers Sumsub and Onlayer, and to screen and flag transactions and accounts for review. We also use factors such as industry type, location, expected revenue, and length of time in business to determine the standard pricing we offer. A person becomes involved where a check raises a query, or where further information or clarification is needed.
5.6 Some decisions reached in this way — in particular a decision to refuse, suspend, restrict, or end a relationship — may be made solely by automated means and may produce legal or similarly significant effects for an individual (for example a sole trader, or a director or beneficial owner whose screening result causes an organisation to be declined). Where that is the case, we rely on the ground that the decision is necessary to enter into or perform our contract with you. You have the right to obtain human intervention on our part, to express your point of view, and to contest the decision, and you may exercise those rights using the contact details in Section 1. Decisions about organisations that are not individuals, such as companies and incorporated charities, are not covered by this safeguard.
6. CHARITY CUSTOMERS AND DONATIONS
6.1 Where our Customer is a charity or other organisation accepting donations, we verify its charitable registration or equivalent status and may collect information about its trustees as part of the verification described in Section 5.
6.2 Donor information is generally processed by us on behalf of the charity, which is the controller of it. Section 7 explains the limited circumstances in which we process donor information for our own purposes.
7. PAYERS AND DONORS
7.1 If you have paid or donated to one of our Customers, that organisation decides how your personal data is used and is the controller of it. Please read its privacy notice, and contact it directly in the first instance about your data. We will process your information on its instructions in order to provide the platform, under our data processing addendum with it.
7.2 There are limited purposes for which we use Payer information for our own purposes, and are a controller of it. Those purposes are: detecting, investigating, and preventing fraud, financial crime, and misuse of the platform; handling chargebacks, refunds, and disputes; meeting our obligations to Adyen, acquirers, card schemes, regulators, and law enforcement; producing aggregated or anonymised analytics that do not identify you; and establishing, exercising, or defending legal claims. We rely on our legitimate interests in those purposes, and on compliance with legal obligations where they apply.
7.3 Card and payment credential details are collected and processed by Adyen, not by us. We receive limited transaction information, such as the amount, date, reference, and outcome.
7.4 Because of the nature of some of our Customers and the causes they support, a payment or donation may reveal information about a Payer, such as their religious or philosophical beliefs, which is special category data. Where we process such data for our own purposes under clause 7.2, we do so only so far as is necessary for those purposes, and we rely on the same Article 9 condition as is described in clause 3.3, and apply the suitable and specific measures described in clause 3.5.
8. WHO WE SHARE PERSONAL DATA WITH
We share personal data with:
Adyen, as the provider of the payment services and as an independent controller for acquiring, verification, financial crime checks, and its own legal compliance;
acquirers, card schemes, and other payment method providers, where required in connection with transactions, disputes, fines, or scheme rules;
our service providers, including hosting, infrastructure, security, communications, analytics, identity verification, and screening providers, who act as our processors and may only use the data on our instructions;
our professional advisers, auditors, insurers, and banks;
regulators, law enforcement, courts, and other authorities, where required or permitted by law, or where necessary to establish or defend legal claims;
the Customer organisation you are connected with, where appropriate, for example in relation to account activity or support; and
a buyer or prospective buyer of our business or assets, and their advisers, in connection with a corporate transaction.
To request a list of our current sub-processors, contact us at support@ummah.com.
9. INTERNATIONAL TRANSFERS
9.1 We are established in Ireland, and we also have an establishment in the United Kingdom through our people and operations there. Our processing is therefore subject both to the EU General Data Protection Regulation and, for our UK establishment and our UK-facing activities, to the UK GDPR, each applying to us directly rather than one reaching across a border. Our lead supervisory authority for the EU General Data Protection Regulation is the Irish Data Protection Commission; the Information Commissioner’s Office has jurisdiction over our processing under the UK GDPR, and the EU one-stop-shop mechanism does not extend to that UK processing. We and our service providers may process personal data outside the European Economic Area, including in the United Kingdom, the United States, and Australia. Adyen is established in the Netherlands. Transfers to the United Kingdom are covered by the European Commission’s adequacy decision for the United Kingdom.
9.2 Where we transfer personal data to a country that is not the subject of an adequacy decision, we put in place appropriate safeguards, usually the European Commission’s standard contractual clauses, together with an assessment of the transfer. Where a recipient in the United States is certified under the EU-US Data Privacy Framework, we may rely on the European Commission’s adequacy decision for that Framework; and, for transfers subject to the UK GDPR, we may rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the recipient participates in it. Where instead we rely on standard contractual clauses for a transfer subject to the UK GDPR, we use the UK International Data Transfer Agreement or the UK Addendum to those clauses. You may request further information about these safeguards using the contact details in Section 1.
10. HOW LONG WE KEEP PERSONAL DATA
10.1 We keep personal data only for as long as we need it for the purposes described in this notice, and then delete or anonymise it. In general:
transaction and account records are kept for at least seven (7) years after the end of the relationship, reflecting the record-keeping obligation in Clause 10.4 of our Customer Terms of Service and applicable law;
verification and screening records are kept for five (5) years after the end of the relationship, or longer where required, reflecting anti-money-laundering record-keeping requirements;
support and correspondence records are kept for three (3) years from the date of the last contact;
marketing data is kept until you opt out, and for a short period afterwards to give effect to your preference; and
technical and log data is kept for twelve (12) months, other than where retained for security investigation purposes.
10.2 We may keep personal data for longer where necessary to establish, exercise, or defend legal claims, or to comply with a legal obligation or a request from a regulator or law enforcement.
11. SECURITY
11.1 We take the security of personal data seriously and maintain technical and organisational measures designed to protect it against unauthorised access, loss, misuse, or alteration. These measures include encryption of personal data in transit and at rest, access controls and authentication, network and application security controls, logging and monitoring, and confidentiality obligations and training for our staff.
11.2 Card and payment credential details are collected and processed within Adyen’s PCI DSS-compliant environment rather than by us; we do not store, process, or transmit cardholder data. Where Adyen requires us to complete a service-provider self-assessment questionnaire, we maintain compliance with the PCI DSS requirements applicable to our limited role. Additionally, the Payment Card Industry Data Security Standard (PCI DSS) applies to the payment chain. We do not operate our own cardholder data environment. Where we are in scope as a service provider, we maintain PCI DSS compliance appropriate to our role and validate it through the self-assessment applicable to our integration.
11.3 No method of transmission or storage is completely secure. Where we are required to do so, we will notify the relevant supervisory authority, and affected individuals, of a personal data breach in accordance with applicable data protection law. Please keep any account credentials secure and contact us immediately if you believe your account has been compromised.
12. MARKETING
12.1 We may send information about our products and services to business and organisational contacts. Where we are required to obtain your consent, we will do so, and you may withdraw it at any time. You can opt out of marketing at any time using the unsubscribe link in our messages or by contacting us. Opting out of marketing does not stop us sending you service messages about your account.
13. YOUR RIGHTS
13.1 Subject to the conditions and exemptions in data protection law, you have the right to: be told how your personal data is used; obtain a copy of it; have inaccurate data corrected; have data erased; restrict how we use it; receive certain data in a portable form; object to processing based on our legitimate interests, including profiling; object to direct marketing at any time; and withdraw consent where we rely on it.
13.2 Some of these rights are limited. For example, we may be unable to erase or stop processing information we are required to retain for record-keeping, financial crime, or legal claim purposes, or where doing so would prejudice the prevention or detection of fraud or crime.
13.3 To exercise your rights, contact us at support@ummah.com. We may need to verify your identity. We will respond to your request without undue delay and in any event within one month of receiving it. Where your request is complex, or you have made a number of requests, we may extend that period by up to a further two months and will tell you if we do. Exercising your rights is free of charge, although we may charge a reasonable fee, or decline to act, where a request is manifestly unfounded or excessive. If your query concerns data held by a Customer organisation as controller, or by Adyen, we will tell you and, where appropriate, direct you to them.
14. COOKIES
14.1 Our use of cookies and similar technologies is explained in our cookie policy at https://www.ummah.com/legal/cookie-policy.
15. CHANGES TO THIS NOTICE
15.1 We may update this notice from time to time. The date at the top shows when it was last updated. Where changes are significant, we will notify Customers by email or through the platform. Previous versions are available on request.
16. HOW TO COMPLAIN
16.1 If you are unhappy with how we have used your personal data, please contact us first at support@ummah.com so that we can try to resolve it. You also have the right to complain to a data protection supervisory authority. Our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie, +353 578 684 800). If you are in the United Kingdom, you may complain to the Information Commissioner’s Office (ico.org.uk). You may also complain to the supervisory authority in the country where you live or work. If your complaint concerns Adyen’s processing, you may complain to Adyen or to the Dutch Data Protection Authority.