dozoPrivacy policy
Last updated: 28 September 2026
Who we are
dozo is a service of Incredible Financial Ltd (“dozo”, “we”, “us”). We are registered in England and Wales, company number 14573470. Our registered office is 124 City Road, London, EC1V 2NX.
We are the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy covers our website, dozopay.co, and the dozo app at app.dozopay.co. It explains the data that we collect, why we collect it, who we share it with, and your rights.
Key points
- We verify your identity before you can make payments. For this, we collect your name, date of birth, home address and identity documents.
- We collect the payment and payee details that you give us, so that we can pay your bills.
- We never see or store your full card number. Our payment provider handles your card details.
- We share your data only with the providers that run dozo, and with authorities when the law requires it. We do not sell your data.
- You have rights over your data. To use them, email hello@dozopay.co.
Data we collect
Information you give us
- Account details: your email address. Our sign-in provider handles your password or sign-in code. We do not store your password.
- Identity details: your full legal name, date of birth and home address.
- Identity documents: the proof of ID and proof of address that you upload.
- Payee details: the payee’s name, account type, sort code, account number and payment reference.
- Payment details: the bill name, amount and reference, and any invoice that you upload.
Information we collect automatically
- Device and connection data: your IP address, browser type and operating system. We use this data for sign-in security, to limit abuse, and in our service logs.
- Usage data: the actions that you take in the app, such as payments that you create, and their status.
- Cookies: see Cookies below.
Information from third parties
- Our payment provider: the result of your card payments and subscription payments, and any refunds or disputes.
- Our banking partner: the result of the Confirmation of Payee check on your payee, and the status of each payment to your payee.
- Our sign-in provider: confirmation that you verified your email address.
Information about people you pay
When you add a payee, you give us their name and bank details. We use these details only to check the payee and to make your payment.
We send the full bank details to our banking partner. We do not store the full sort code or account number. We keep:
- the payee’s name and the last 4 digits of their account number
- a fingerprint (hash) of the bank details, which tells us if you add the same payee again
- our banking partner’s reference for the payee. Our banking partner can use this reference to find the full bank details.
- the result of each Confirmation of Payee check
You must have the right to share the details of each payee with us.
How we use your data
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Create your account and let you sign in | Contract |
| Take your card payments and pay your payees | Contract |
| Check the payee’s name with their bank (Confirmation of Payee) | Contract |
| Manage your subscription | Contract |
| Send you emails about your account and payments | Contract |
| Verify your identity before you make payments | Legal obligation (anti-money-laundering rules) |
| Keep records for regulators and for tax | Legal obligation |
| Prevent fraud, review refunds and disputes, and keep dozo secure | Legitimate interests |
| Fix problems and improve dozo | Legitimate interests |
We do not send marketing emails. If we start to send them, we will ask for your consent first. You can withdraw your consent at any time.
Automated decisions
We use automatic checks to prevent fraud and to keep payments safe. If a check blocks you, email us and a person will review the decision.
Who we share your data with
| Type of provider | What they do for us | Data they receive |
|---|---|---|
| Hosting and infrastructure providers | Hosting, database, file storage, service logs and internal tools | All data that we hold |
| Sign-in provider | Sign-in | Email address, IP address, browser type |
| Payment provider | Card payments and subscriptions | Email address, payment amounts, card details (you enter them directly with the provider) |
| Banking partner | Payee name checks and payments to your payees | Payee name, sort code, account number, amount, reference |
| Email provider | Service emails | Email address, email content |
| Font provider | Fonts on our website and app | IP address, browser type |
We also share data with regulators, courts or law enforcement when the law requires it.
International transfers
Some of our providers process data outside the UK, including in the United States. When your data leaves the UK, we use safeguards that UK law approves, such as the UK International Data Transfer Addendum.
How long we keep your data
We keep your data while your account is open. After your account closes, we keep payment and identity records for at least 5 years, because the law requires it.
Some data has shorter limits:
- Service logs: 7 days.
- Full payment notifications from our payment provider: 90 days. After that, we keep only a summary.
To ask us to delete your data, email hello@dozopay.co. We will delete the data that the law does not require us to keep.
How we protect your data
- All data is encrypted when it moves between you and us.
- Our hosting provider encrypts stored data.
- We keep identity documents and invoices in private storage.
- Only staff who need your data can access it. We log each time a staff member opens an identity document.
- Our payment provider holds your card details. We never see your full card number.
Cookies
We use only the cookies that dozo needs to work. They keep you signed in and protect the sign-in process. We do not use analytics or advertising cookies.
Children
dozo is for people aged 18 and over. We do not knowingly collect data from children.
Your rights
Under UK GDPR, you have the right to:
- Access: get a copy of your data.
- Rectification: ask us to correct inaccurate data.
- Erasure: ask us to delete your data.
- Withdraw consent: stop processing that is based on your consent.
- Complain: complain to the Information Commissioner’s Office (ICO).
- Restriction: ask us to limit how we use your data.
- Portability: get your data in a structured, machine-readable format.
- Object: object to processing that is based on legitimate interests.
- Automated decisions: ask for a person to review a decision (see Automated decisions).
To use these rights, email hello@dozopay.co. We reply within one month.
To contact the ICO, go to ico.org.uk or call 0303 123 1113.
Changes to this policy
When we change this policy, we will post the new version on this page. If a change is significant, we will tell you by email or in the app.
Contact us
For questions about this policy, email hello@dozopay.co.
© 2026 Incredible Financial Ltd