Privacy Notice.
Who we are
This site is operated by Modular Consultancy Ltd (Company No. 13055378), an independent payments consultancy and the data controller for personal information collected through this website. Registered office: Flat 7 Reigate Court, Reigate Road, Worthing BN11 5LD. Trading office: 1st Floor Suite, 109 Shirland Road, London W9 2EL. For any privacy question or request, contact audit@modularconsultancy.com.
What we collect
When you request a free payment audit, we collect the details you enter into the form: your full name, job title, mobile number and email address; and your business details — trading name, limited company name, website, business category, number of outlets, location, current payment provider, current EPOS provider, approximate monthly card turnover and contract renewal date.
If you choose to upload a merchant statement, we also collect that document and its contents. A merchant statement can contain commercially sensitive information about your card transactions and fees. Please upload statements only, and avoid including unrelated personal or banking information.
We also automatically receive a small amount of technical information with every form submission, including your IP address, the date and time, and the page the form was sent from. This is collected by our hosting provider as a standard part of processing the submission. We use it only to protect the forms from abuse and fraudulent enquiries, on the basis of our legitimate interest in keeping the service secure, and we delete it along with your enquiry.
Why we use it, and our lawful basis
We use this information solely to review your current payment arrangements, prepare your payment cost audit (your "Payment Profile") and respond to you. Our lawful basis is our legitimate interest in providing the audit you have asked for, and taking steps at your request before any engagement. We do not use your information for unrelated marketing without your consent, and we never sell it.
Referral partners
If you apply to join our referral partner programme, we collect the details you enter into the sign-up form: your name, role, email address and phone number, your business type, the kinds of clients you work with, how many introductions you expect to make, and any message you add. We use this to assess your application, set you up as a partner and stay in touch with you about the programme. Our lawful basis is our legitimate interest in operating the programme and taking steps at your request before any agreement, together with your consent where you have given it for us to contact you.
If you are a partner referring a client to us, we collect the client details you provide: the business name, your contact’s name, role, email address and phone number, the sector, number of locations, current provider, approximate monthly card turnover, and any notes or statement you upload. We also record your Partner ID so the introduction is credited to you.
Because these details come from the partner rather than from the client directly, we ask every partner to confirm they have the client’s permission before submitting them. When we first contact a referred client we tell them who introduced us and how we obtained their details, and they can ask us to delete their information at any time. Our lawful basis for handling a referral is our legitimate interest in responding to a business introduction made with the client’s knowledge.
How your information is handled, and who processes it
We use a small number of trusted service providers ("processors") to run the form and upload:
- Uploadcare — securely receives and stores any statement you upload; the file is sent directly from your browser to Uploadcare's storage.
- Netlify — hosts this website and processes the form submission (your enquiry details and a secure link to any uploaded statement).
- Our email provider — delivers your submission to our business mailbox so we can act on it.
- Meta Platforms (Facebook/Instagram) — receives advertising measurement events described in the section below.
- Microsoft (Clarity) — receives the website usage data described below and uses it as an independent controller under its own privacy statement.
- Calendly — runs the booking calendar on our rate-check page; the details you enter there are handled under Calendly’s own privacy notice as well as ours.
These providers act on our instructions. Some are based outside the UK, so your information may be transferred internationally; where that happens we rely on appropriate safeguards such as UK/EU-approved standard contractual clauses or an adequacy decision.
Advertising measurement (Meta)
We advertise on Facebook and Instagram, and we want to know whether that advertising leads to enquiries. We do this in two ways.
In your browser, only with your consent. If you press Accept on our cookie banner, we load the Meta Pixel, which sets Meta’s own cookies and tells Meta which pages you viewed and whether you completed an enquiry. We also keep the advertising click details from the link you arrived on (a Meta click ID and any campaign labels) together with the page you landed on, the referring site and the time, in a first-party cookie for 30 days so we can credit the right advert. If you press Reject, none of this is loaded and no advertising cookie is set. You can change your choice at any time using the Cookie settings link in the footer of every page.
From our server, only if you accepted. If you accepted advertising cookies and then complete an enquiry — an audit request is received or a rate-check call is booked — our website also sends Meta a confirmation of that event using Meta’s Conversions API. This contains your email address, name and (where you gave one) phone number in hashed (irreversible) form, your IP address and browser type, the page the enquiry came from, the advertising click ID if you arrived from a Meta advert, and the enquiry reference we give you. It never contains your merchant statement, its file name or link, your turnover, your current provider, contract dates, or anything you wrote in free-text fields. Both the browser pixel and this server-side message depend on your consent: if you reject advertising cookies, nothing about you is sent to Meta — by your browser or by our server. Meta uses this information as an independent controller under its own privacy policy.
Each enquiry is given a reference (for example MOD-20260911-AB7K). It appears on the confirmation screen and in our records, and is the only identifier shared between our systems and Meta for that enquiry.
Website analytics (Microsoft Clarity)
Only with your consent. If you press Accept on our cookie banner, we also load Microsoft Clarity, which records how visitors use the site: the pages viewed, where people click, how far they scroll and how they move around a page, together with your screen size, browser, operating system and an approximate location (down to city level) worked out from your IP address, which Microsoft receives. Clarity sets its own cookies, listed in our cookie policy. Anything you type into a form is masked before it leaves your browser, so your name, contact details and statement never appear in a recording; the booking calendar is a separate Calendly frame and is not recorded. We use this to see which parts of the site work and which confuse people. Our lawful basis is your consent, which you can withdraw at any time using the Cookie settings link in the footer of every page. Microsoft keeps session recordings for 30 days (a small random sample, and any recording we mark as a favourite, for up to 9 months) and heatmap and other aggregated data for 9 months. Microsoft uses this information as an independent controller under the Microsoft Privacy Statement, for its own purposes, which include improving its products and services and building user profiles used for advertising. We do not grant Clarity the advertising purpose, only analytics.
How long we keep it
We keep your enquiry and any uploaded statement only as long as needed to prepare and discuss your audit, and then delete the statement. If you ask us to delete your information sooner, we will do so unless we are legally required to keep it.
Your rights
Under UK data protection law you have the right to access, correct, delete or restrict the use of your personal information, to object to certain processing, and to data portability. To exercise any of these, email audit@modularconsultancy.com. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes
We may update this notice as our services change. The current version is always the one published on this page.