Privacy Policy

This website and pilot are operated by Yoco Technologies (Pty) Ltd (registered in South Africa as Yoco Technologies Proprietary Limited), company registration number 2013/203377/07, whose registered office is at 20 Kloof Street, Gardens, Cape Town, 8001, South Africa ("we", "us", "our"). We are the controller of your personal information.

As we are based outside the UK, we are required to appoint a UK representative under Article 27 of the UK GDPR. Our UK representative is DP Data Protection Services UK Ltd. (Attn: Ono Connect B.V.), 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom. Website: www.dp-dock.com. Email: yoco@gdpr-rep.com. Incoming queries to that address are forwarded to privacy@yoco.com.

We are in the process of registering with the Information Commissioner's Office (ICO); our registration number will be added here once registration is complete.

If you have any questions about this policy or about how we use your personal information, contact us at privacy@yoco.com.

This policy applies to:

• visitors to getyoco.co.uk
• people who join our waiting list
• people who make a sales enquiry, or who our field sales team speak to
• people who submit their details through a Google lead form in one of our ads
• prospective and pilot merchants using Counter point of sale software and hardware

Depending on how you interact with us, we may collect:

• your name
• your email address
• your phone number
• your business name and business type
• your job or role
• your town, city or postcode
• the content of messages you send us, including over WhatsApp, email or web chat
• information about how you use our website, such as pages viewed, your approximate location based on your IP address, device and browser information, and the cookie and analytics identifiers described in section 9
• for pilot merchants, account and setup details needed to give you the Counter software and hardware, and basic records of your enquiries and support requests

We do not collect payment card numbers through this website, and we do not process card transactions in the UK.

We do not intentionally collect information about children through this site.

Most information comes from you directly, when you fill in a form, contact us, or speak to our sales team.

Some information is collected automatically by your device when you use our website, through cookies and similar technologies.

Some information may come from Google when you submit a Google lead form in one of our ads, and from advertising and analytics providers who help us understand how people find and use our site.

Under UK GDPR we must have a lawful basis for each use of your personal information. The table below sets these out.

Where we rely on legitimate interests, our interest is in running, promoting and improving our UK pilot. We have weighed this against your rights and will always stop if your rights outweigh our interest. You can ask us for more detail on this balancing test.

Where we rely on consent, you can withdraw it at any time. This will not affect anything we did before you withdrew it.

You do not have to give us any personal information. If you do not, we may not be able to add you to the waiting list, answer your enquiry, or set you up on the pilot. Providing your information is not a statutory requirement. For pilot merchants, some information is needed under our contract with you so that we can provide the software and hardware.

We share personal information with service providers who help us run the website and the pilot. They act on our instructions under a written contract. They are:

• Framer — hosts the website. Personal data submitted through the site may be processed on Framer's infrastructure.
• Typeform — captures form responses while it is in use (being replaced by a native form).
• Supabase — the database that stores waiting list and lead records in our hosted CRM.
• Lovable — the platform used to build and run our CRM.
• Google — Google Ads and Google lead forms (advert delivery and lead capture), Google Analytics 4 (website measurement) and Google Search Console (search performance).
• WhatsApp Business (Meta) — where you choose to message us on WhatsApp.
• Slack and Notion — internal tools where enquiry and lead information may be handled by our team.

We may also share information with our professional advisers, and with authorities or others where the law requires it or to protect our legal rights.

We do not sell your personal information.

We are based in South Africa, so your personal information is transferred to South Africa. The UK has not decided that South Africa provides an adequate level of data protection. We therefore rely on the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as our safeguard for this transfer, and we have carried out a transfer risk assessment. You can ask us for a copy.

Some of our other service providers are also based outside the UK, including in the United States and the European Union. Where we send your personal information to a country that the UK has not judged to provide adequate protection, we put in place a safeguard approved under UK law — usually the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the safeguard we use.

When you first visit getyoco.co.uk we show you a cookie banner. We only set non-essential cookies if you accept them. You can change or withdraw your choice at any time using the "Manage cookies" link on the site.

We use these categories of cookies:

Strictly necessary cookies. These make the website work and keep it secure. They do not need your consent.

Analytics cookies. We use Google Analytics 4 to understand how people use the site. These set cookies such as _ga and _ga_[container-id] to tell visitors apart and remember sessions. We ask for your consent before these are set.

Advertising cookies. We use Google Ads to measure and improve our adverts. These set cookies such as _gcl_au (the Google Ads conversion linker) and use the Google Click Identifier (gclid) to link ad clicks to sign-ups. We ask for your consent before these are set. Advertising and cross-site tracking always need your consent.

If you reject non-essential cookies, none of the analytics or advertising cookies above will be set. We keep our cookie banner and this section in step with each other.

We keep your information only as long as we need it:

• waiting list and marketing contacts: until you unsubscribe or ask us to stop, after which we remove or suppress your details
• sales enquiries and leads: for the length of our discussions and for a reasonable period afterwards
• pilot merchant records: for the pilot and for as long as we have a legal reason to keep them afterwards
• website analytics: for the retention period set in our analytics tools

When we no longer need your information we delete it or make it anonymous.

We use appropriate technical and organisational measures to keep your information secure, including access controls, encryption in transit, and limiting access to staff who need it.

Under UK data protection law you have the right to:

• be informed about how we use your information (this policy)
• ask for a copy of the information we hold about you
• ask us to correct information that is wrong
• ask us to delete your information
• ask us to restrict how we use your information
• object to us using your information, including for direct marketing, which we will always honour
• ask us to move your information to another provider (data portability)
• withdraw your consent at any time, where we rely on consent
• not be subject to a solely automated decision that has a significant effect on you (we do not make such decisions on this site)

To exercise any of these rights, contact us at privacy@yoco.com. We will respond within one month.

If you are unhappy with how we have handled your information, please contact us first at privacy@yoco.com so we can try to put it right.

You can also contact our UK representative for complaints relating to UK GDPR matters: DP Data Protection Services UK Ltd. (Attn: Ono Connect B.V.), 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom. Website: www.dp-dock.com. Email: yoco@gdpr-rep.com. Queries sent there are forwarded to privacy@yoco.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

We may update this policy from time to time. The date at the top shows when we last changed it. Please check back regularly.