LayUp

What LayUp is

LayUp is a digital lay by service run by LayUp Technologies, a fintech company based in Cape Town, South Africa. Instead of buying now and paying later, the shopper pays a deposit, then settles the balance in instalments, and the merchant ships the goods once the plan is fully paid. Merchants pay a fee per payment plan created and integrate LayUp through a REST API, or through the official WooCommerce and Magento modules. Orders are then held in a partial payment state until the plan completes.

A note on naming: searches for layupcloud or Layup cloud usually concern Layup, a separate gamified employee learning platform whose login portal runs on layupcloud.com. That product has nothing to do with the LayUp payment service described on this page.

Data and cookies it collects

The integration is server side. The merchant's backend creates an order through the LayUp API with the order amount, products and the customer's contact details such as name, email and mobile number. The shopper is then redirected to the hosted payment widget on shopper.layup.co.za, where they sign in or register, choose a plan and pay by card or instant EFT; card payments are handled by Peach Payments. LayUp sends status updates back to the merchant through webhooks.

Because nothing is embedded in the merchant's pages, LayUp sets no cookies on the merchant site. The hosted widget, which is LayUp's own domain, loads Google gtag, Cloudflare Turnstile bot protection and the Peach Payments checkout, so the shopper may receive analytics and security cookies there. Those are LayUp's responsibility rather than the merchant's.

GDPR and ePrivacy implications

For a European merchant, LayUp mainly raises GDPR questions rather than cookie questions. The data shared is personal data, and LayUp most likely acts as an independent controller for the shopper's account and payment plan, as payment providers usually do. The merchant must inform shoppers in its privacy notice that choosing LayUp shares their data with a South African provider. Art. 5(3) of the ePrivacy Directive, the CNIL rules, TDDDG § 25 and LSSI CE art. 22.2 are not triggered on the merchant site, since nothing is stored on or read from the visitor's device there.

Consent requirements

No cookie consent is needed for LayUp on the merchant site. Sharing order and contact data with LayUp when the shopper actively selects it at checkout is necessary to perform the contract the shopper asked for, so Art. 6(1)(b) GDPR applies. Do not bundle LayUp into a consent banner category; it would make a payment method depend on a cookie choice for no legal reason.

Data transfers outside the EEA

South Africa has data protection legislation, the Protection of Personal Information Act (POPIA), but no adequacy decision from the European Commission. Transfers to LayUp and Peach Payments therefore need a Chapter V mechanism. Where the shopper chooses LayUp, the transfer is generally necessary for the contract under Art. 49(1)(b) GDPR, but for repeated, systematic flows SCC 2021/914 are the more robust route. LayUp's web properties also rely on Cloudflare, Amazon Web Services and Google, which can involve the United States.

Practical compliance steps

Mention LayUp in your privacy notice as a payment provider based in South Africa, with the categories of data shared and a link to LayUp's own policy. Ask LayUp for its data processing terms, confirm its role and whether it runs credit or affordability checks, and document the transfer basis. Keep LayUp out of your cookie banner, but verify with a scan that your WooCommerce or Magento theme does not load LayUp assets on product pages. Finally, describe lay by orders in your terms so shoppers understand when their data is shared.