Privacy notices

We are committed to protecting your privacy when you use our Council Services.

This Privacy Notice explains what personal information we collect about you when you choose to make a payment using the Pay by Bank payment option, how and why we use it, who we share it with, and how we protect it.

1.    Payment Authorisations

By selecting the Pay by Bank option and approving the payment through your bank, your payment will be redirected to your chosen bank for the purpose of authorising the payment transaction. If you do not wish to use Open Banking, alternative payment methods remain available through the Council. Please check if wish to use another payment method.

2.    Personal Data Processed

All personal data in accordance with this Privacy Notice will be processed with respect to the UK General Data Protection Regulation (UK GDPR) 2016, the Data Protection Act 2018 and the Council's Corporate Privacy Notice. Our Data Protection Registration number for the London Borough of Croydon Council is Z5439989.

3.    Information Held About you and Why we Need it

When you pay the Council using the Pay by Bank Service, the Council will need to process certain information about you to enable and administer your payment.

The information collected and processed will include: 

• your name
• your payment reference details
• details of the Council service being paid for
• payment amount
• payment date and time
• transaction status and confirmation details
• bank account identifier information required to process the payment or card details to be used;
• technical information such as your IP address, device information and browser information used when accessing the payment service

The Pay by Bank service is provided using Open Banking technology through Tink Financial Services Limited, part of Visa, which is an authorised and regulated Payment Initiation Service Provider.

When you select Pay by Bank, you will be securely redirected to your bank's online banking service or mobile banking application to authorise the payment.

Neither Croydon Council nor Tink Financial Services Ltd can see or access your online banking password, PIN, security codes or login credentials. These remain private between you and your bank.

The Council will only receive information that is necessary to reconcile and administer your payment and will not receive access to your full banking transaction history.

4.    Purpose of Collecting your Information

The purpose of collecting your information from you will be able to allow you to use Pay by Bank as a payment method and for us to authorise a payment through your bank using Open Banking. Once this is completed payment confirmation information will be returned to the Council and yourself unless you are advised to contact us regarding a payment enquiry, dispute or complaint or technical security issue which may have been generated through your use of the online payment service.

5.    How we will use your Personal Information

We will only use your personal information to:

• process and administer payments
• match payments to your appropriate Council account
• investigate queries
• prevent fraud and maintain security
• comply with legal requirements and improve services

We will always treat your information as confidential and will not use your information for marketing purposes.

6.    Who we will Share your Information with

We may share your information with:

• Tink Financial Services Limited
• your bank or building society
• payment processing providers
• regulatory bodies
• law enforcement agencies
• relevant Council teams 

Where necessary to deliver the service and/or to comply with legal obligations and investigate suspected fraud and/or criminal offences.

7.    Data Controllers

For the purposes of this Privacy Notice, the Council and Tink Financial Services Limited will be considered Independent Data Controllers in relation to the processing of your payment information. Please refer to Tink Financial Services website for their Privacy Notice details which can be found at: Tink Financial Services Limited - Open Banking

8.    The Legal Basis for Processing your Personal Data

The Legal basis the Council will rely on for the processing of your personal information for this service will be Article 6(1)(e) (Public Task) under UK GDPR as this will support the Council’s statutory duties and obligations in respect of the delivery of all Council services, the collection of taxes, rents, service charges, fees and other monies owed. Where we have a contract to fulfill with you, we will may rely on Article 6(1)(b) (Performance of a Contract) under UK GDPR. Where we have a legal obligation or statutory responsibility to fulfill, we may also rely on Article 6(1)(c) (Legal Obligation) under UK GDPR.  

In the main, Public Task will be the main legal basis we will rely on for our statutory data processing activities but there may be some cross-overlap depending on the nature of the activity being processed.

No legal basis is required for special category data as this type of data will not be collected by the Council.

9.    How we will Protect your Information

The Council and its service providers will always use appropriate technical and organisational security measures when processing your personal data to protect it from loss, theft and misuse. Information transmitted through the Pay by Bank service by UK Tink Financial Services Ltd will be encrypted and processed using secure Open Banking standards only. The information will be stored in the UK and across EU location sites Belgium and the Netherlands. AWS will store data in Ireland. Access to your data will be via specific RBAC parameters to ensure only those with a need to do their job get access to your data.  

10.    How Long we Keep your Personal Information

We will retain all information in accordance with the Council's retention schedule and legal obligations. Information will be securely destroyed or deleted when it is no longer required. Typically, payment data has a retention period of 6 years.

11.    Providing us with Accurate Information

If any information relating to your payment is incorrect, please contact the relevant Council service as soon as possible so we can update our records.

12.    Data Legal Rights

The UK GDPR and the Data Protection Act 2018 gives you a number of data legal rights to control what personal information is used and how it is used by us. Information about your individual rights is listed in the Council's Corporate Privacy Notice on the Council's website.

These rights cover:

• your right to be informed
• your right to access information held about you
• your right to delete or stop the processing of your information
• your right to have your data restricted, where necessary
• your right to object to how your data is used
• your right to port data
• your right to automated decision reviews
• your right to compensation

13.    Further Information

If you have questions or concerns about how we collect, store or use your information in relation to Pay by Bank payments, please contact us at:

Croydon Council
Bernard Weatherill House
8 Mint Walk
Croydon
CR0 1EA

Telephone No: 020 8726 6000

You can also contact the Council's Data Protection Officer at: dpo@croydon.gov.uk.

Additional information about what personal information we collect about you, how and why we use it, who we disclose it to, and how we protect it can be found in the Council's Corporate Privacy Notice.

For further information about how Tink Financial Services Ltd processes your  personal information when providing Open Banking services can be found in the attached Tink's Privacy Notice.

14.    Information Commissioner’s Office (ICO)

For independent advice about data protection matters, you can also contact the Information Commissioner's Office at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel. No: 0303 123 1113
Website: www.ico.org.uk

15.    Changes to this Privacy Notice

We reserve the right to amend this Privacy Notice at any time and will keep it under review. 
Any changes will be published via this website.

Last updated: 28th July 2026