Privacy policy
What personal data Helm collects, why, who it is shared with and your rights.
1. Who we are
Helmpay Limited (company number 16417022, registered office 2 Frederick Street, London, WC1X 0ND, United Kingdom) is the controller of the personal data described in this policy. Contact: privacy@helm.business.
2. The data we collect
| Data | Source | Why |
|---|---|---|
| Identity and contact details of directors, owners and users: name, date of birth, nationality, address, identity document, email, phone | You, and public registers | To verify your business and its people, as the law requires, and to operate your account |
| Business details: registration, ownership, trade, counterparties, invoices, bank statements | You | To verify your business and assess the services it needs |
| Account and payment data: balances, payments, recipients, references, device and login records | Your use of the account | To provide the services, screen payments and keep the account secure |
| Website data: pages visited, device, approximate location, cookie identifiers | Your browser | To run the website and understand how it is used; see the Cookies page |
| Correspondence with us | You | To answer you and keep a record |
3. Why we use it and the legal basis
- To enter into and perform the account agreement with your business (performance of a contract).
- To verify your business and its people, screen payments and report where required (legal obligation, including anti-money-laundering and sanctions law).
- To keep the account and website secure and to prevent fraud (legitimate interests).
- To tell you about Helm services relevant to your business (legitimate interests; you can opt out at any time).
4. Who we share it with
Our licensed banking and money transmission partners, who provide the accounts and payments and are named in your account agreement; identity verification and sanctions screening providers; cloud hosting and communications providers under contract; professional advisers; and regulators, law enforcement and courts where the law requires. We do not sell personal data.
5. International transfers
Our partners and providers operate in the United States, the United Kingdom, the European Union and the countries where our clients trade. Where data leaves the country in which it was collected we rely on the contractual safeguards recognised by the applicable law.
6. How long we keep it
Account and verification records are kept for the period required by anti-money-laundering law, which is five years after the account closes in most of the jurisdictions in which our partners operate, and longer where a legal claim or investigation requires. Website data is kept for no longer than the periods on the Cookies page.
7. Your rights
Depending on the law that applies to you, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to complain to a supervisory authority. Some rights are limited where we are required by law to keep or use the data. To exercise a right, email privacy@helm.business.
8. Security
Data is encrypted in transit and at rest. Access within Helm is limited to staff who need it for their role and is logged. See the Security page.
9. Changes
We will post changes to this policy on this page and, where the change is material, tell account holders in writing. Last updated 21 October 2026.