Even assuming paypal aren't crooks - is doing this OK with the Scottish Data Protection Act, Charities commission or Company registration?