Salt Edge Limited ("we", "us", "our") collects, stores, uses and shares your personal data in connection with the provision to you of Account Information Services (the "Services") via Your App Provider under the Terms of Delegated Account Information Services (the "Terms"). In relation to such processing we are subject to the data protection laws and regulations of the United Kingdom. We take your privacy very seriously. In this Privacy and Cookies Notice (the "privacy notice") we describe our personal data processing activities and practices relating to the provision of the Services and explain your rights in relation to your personal data and how to contact us or the Information Commissioner if you have questions or complaints concerning the processing of your personal data. We also inform you of the cookies we use in connection with the provision of the Services in a separate section 'Cookies' below. Please read this privacy notice carefully and refer to the Terms for a better understanding of the Services and for any key terms that we do not explicitly define here.

It would be helpful to start by explaining some key terms used in this privacy notice in relation to personal data:

In connection with the provision of the Services, we will generate or collect, and process the following personal data about you:

We collect and use this personal data for the purposes described in section 'How and why we use your personal data' below. We do not necessarily always collect and process all the above categories of personal data. Some of this data we collect and process only if required in the circumstances of our interaction with you.

We would like you to know that there is no statutory or contractual requirement or obligation that you provide any personal data to us. Nevertheless, if you do not provide personal data we require, it may delay or prevent us from providing the Services to you and/or addressing your enquiries, requests, and complaints.

Under the UK Data Protection Laws, we can only process your personal data if we have a lawful basis, a proper reason for processing, which may be that:

The table below explains in detail what we use your personal data for and why:

We do not engage in automated decision-making in your respect as a result of processing your personal data in accordance with the Terms and this privacy notice.

While we process personal data in accordance with the purposes and legal bases described above in section 'How and why we use your personal data', we may, at any time, render any such data anonymous by ensuring that you can no longer be identified from such data, and further combine such anonymized data with similar anonymous data collected or derived from the use of our services by other users. We may use the anonymized data for various business purposes, including, but not limited to: providing, maintaining, supporting and improving the Services; conducting analytical research, compiling statistical reports and performance tracking; developing and/or improving other services and products. In connection with this, we can share the anonymized data with members of our group and our subcontractors. Our legal basis for the anonymization operations resides in our legitimate interest to deliver the best services, increase efficiency and realise or grow the value in our business and assets. Anonymized data is not itself personal data, and consequently the provisions in this privacy notice are not applicable to it. For the avoidance of doubt, we will not sell anonymized data.

The UK Data Protection Laws establish special rules for the processing of special categories of personal data, which include: personal data revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data and biometric data processed for the purpose of uniquely identifying an individual; data concerning an individual's health, sex life or sexual orientation.

We do not require to process special categories of personal data in order to provide the Services to you and we do not deliberately solicit, access, collect or process any such data. Special categories of personal data may be occasionally and incidentally contained in the Payment Account Data that we retrieve from your payment accounts. Insofar as this may happen, please be assured that we do not analyse, filter, map, or perform any other processing to identify or single out special categories of personal data. You are requested at all times to refrain from voluntarily providing to us any special categories of personal data by any means of communication, unless we expressly request you to provide such data.

We store your personal data processed for the purpose of providing the Services on our own and third-party servers located in the European Economic Area ("EEA"). We take all adequate measures to ensure that your personal data is at all times treated securely and in accordance with this privacy notice.

We will not keep your personal data for longer than we need it for the purposes described above in section 'How and why we use your personal data'. The retention period will depend on the requirements of the laws or regulations that apply to us, as well as on the legal bases and the purposes of the collection and processing of personal data.

We will delete your Payment Account Data and Account Information from our production systems:

We will delete from our production systems the IT Identifiers associated with any particular connection(s) to your payment accounts within six (6) months after the deletion of the relevant connection(s).

Regardless of the above, we will retain your personal data or portions thereof contained in the Payment Account Data and Account Information, as well as relevant IT Identifiers and your IP address in backup files on our backup servers for a period of up to one (1) month from the date of deletion from our production systems, in accordance with general internal retention procedures.

We will retain some of your IT Identifiers and Session Information in log files as explained in more detail in the section 'How and why we use your personal data' above. We archive such data into log files each month and the retention period for data in log files is five (5) years from the date of their archiving or such longer period as required by the applicable laws and regulations.

Backups and archived log files containing personal data are stored on servers separate from our production servers, using strong asymmetric encryption. The files are not actively processed and are not accessible to personnel in the ordinary course of business operations. All personal data retained in backup files and log files will be automatically deleted after the retention period has elapsed and until such deletion will be treated in accordance with the terms of this privacy notice.

We will retain your Inquiry-related data (please see section 'How and why we use your personal data' above) in our internal systems for a period of at least six (6) years from the date of submission or receipt, as applicable, of the last of the replies in the communication thread to resolve the respective enquiry, request or complaint.

We routinely share personal data with:

We may occasionally also share your personal data:

If you would like more information about who we share your data with and why, please contact us (see 'How to contact us' below).

Transferring your personal data out of the UK

We have informed you of the location of storage of your personal data in section 'Where and how long do we keep your personal data' above and of routine recipients of your personal data in connection with the Services in section 'Recipients of your personal data' above.

As we and Your App Provider are based in the United Kingdom, while our software solutions that enable us to provide you with the Services are hosted on servers in the EEA, we envisage that your personal data will be routinely transferred between the UK and the EEA.

The UK, the EEA countries, and other countries outside the UK and EEA have differing Data Protection Laws, some of which may provide lower levels of privacy protection. Under the UK Data Protection Laws, we rely on adequacy regulations for transfers of your personal data from the UK to the EEA, whereby the UK government has decided that the countries of the EEA ensure an adequate level of protection of personal data (known as 'adequacy regulations') further to Article 45 of the UK GDPR. A list of countries currently covered by UK adequacy regulations is available here.

Depending on the way Your App Provider operates Your App, in order for you to be able to receive the Services in Your App, Your App Provider may retrieve your Payment Account Data to countries outside the UK and the EEA. We expect that, as controller, Your App Provider duly informed you of the locations where they keep and process your personal data as part of providing Your App to you. Please refer to Your App Provider for more detailed information in this respect.

Occasionally, to ensure troubleshooting, debugging, support, error-fixing of the Services or addressing your requests, inquiries and complaints, your personal data may be remotely accessed, viewed and used by the authorised personnel of our subcontractor, Salt Edge Inc., who may be located in third countries in relation to the United Kingdom and the EEA. In particular, it is expected that such remote access and viewing may be conducted by personnel located in the Republic of Moldova.

In cases we have to resort to transfers of your personal data to countries, we will do so in compliance with the requirements of the UK Data Protection Laws designed to ensure the privacy of your personal data. Under the UK Data Protection Laws, we can only transfer your personal data to other countries, where there is an adequacy regulation in respect of such country or where we ensure that there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you as a data subject. Should we resort to such a transfer, we will do so on the basis of an adequacy regulation or (where it is not available) on the basis of legally approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR.

As there is adequacy regulation in respect of the Republic of Moldova, we have taken appropriate safeguards under the UK Data Protection Laws to ensure that Salt Edge Inc. treats any of your personal data they may remotely access from outside the UK securely and in accordance with this privacy notice at all times.

If you would like further information about whether there your personal data may be subject to transfers outside the UK/EEA and the safeguards we put in place in connection with such transfers, please contact us (see section 'How to contact us' below).

We are committed to maintaining the confidentiality, integrity and security of your personal data. We employ advanced security techniques to safeguard personal data against accidental loss, unauthorized access, use and/or disclosure. We rigorously limit access to personal data to those who have a genuine need to access it and our databases are both physically and logically protected from general employee access. We carefully select the individuals privileged with access to personal data in accordance with our internal security policies and practices, and each such individual is bound by confidentiality obligations. We enforce physical controls on our premises. Security personnel monitor our systems 24/7. Access to our systems requires multiple levels of authentication. To maintain the security of online sessions and protect our systems from unauthorized access, we use, among others, a combination of firewall barriers, encryption techniques and authentication procedures. We test our systems for any failure points that might allow hacking. We are routinely verified for our use of encryption technologies and audited for our privacy practices. We regularly review our privacy and security practices and adapt them as necessary to deal with new regulatory requirements, changes in legislation and/or security standards.

We ensure that we apply adequate contractual (including data protection, confidentiality, and security provisions) and other technical and organisational measures with subcontractors that we may engage from time to time in connection with the provision, operation, security and/or maintenance of the Services. We will restrict access, disclosure and/or transfer of personal data to subcontractors to what is strictly necessary for the performance of their contractual obligations towards us and will ensure that each subcontractor complies with the provisions in this privacy notice.

Although we take appropriate measures to ensure that your personal data is treated and stored securely, unfortunately, the sending of information via the Internet is not totally secure and on occasion such information may be intercepted. Therefore, we cannot guarantee the security of personal data that you choose to voluntarily send to us via electronic means. We expressly disclaim all liability for any interception or interruption of any Internet transmissions sent by you or any resulting losses of, or changes, to data, including personal data.

Under the UK Data Protection Laws, you have the following rights, which you can exercise free of charge:

For more information on each of your rights described above, including the circumstances in which they apply, please contact us (see 'How to contact us' below) or see Guidance from the UK Information Commissioner's Office (ICO) on individuals' rights.

If you would like to exercise any of those rights, please:

We do not need to directly identify you to provide the Services to you and have set our processes to collect as few personal data about you as possible. We organise records in your respect based on IT Identifiers (rather than on data that directly identifies you, such as your name, email address or any identification number assigned to you by institutions). As a result we are not able to readily identify you in order to handle any of your inquiries, complaints or requests to exercise your data subject rights. To address such inquiries, complaints and requests we may need that you provide us with additional identification information and/or may request such information from Your App Provider. It may be easier for you to address your queries and requests directly to Your App Provider, in accordance with the joint controllers arrangement we have described in section 'Joint controllers' below. This does not prevent you from submitting such complaints and requests directly to us and we will do our best to resolve them and ensure that your rights are complied with.

Following the sharing of your Payment Account Data and IT Identifiers with Your App Provider for them to provide you with the Services in Your App, Your App Provider acts as controller for the processing of your personal data so shared. Your App Provider is thus solely responsible for complying with their obligations as controller as set forth in the applicable Data Protection Laws, including without limitation with respect to the processing, confidentiality and security of your personal data. We will not be responsible for any subsequent processing carried out by Your App Provider. We are only responsible for the sharing of your personal data with Your App Provider and ensuring that it is shared securely and with the intended recipient.

Nevertheless, we work so close with Your App Provider to provide the Services in Your App, that in respect of the related processing of your personal data we and Your App Provider act as joint controllers by virtue of jointly determining the purposes of such processing.

As part of our joint controllers arrangement, we and Your App Provider have agreed on who is responsible for which obligations under the UK Data Protection Laws and who will fulfil which obligations in respect of your rights under articles 15-22 of UK GDPR (see section 'Your rights' above). You can find in the below table more information on the categories of your personal data which we and Your App Provider process as joint controllers:

For a better understanding of our processing of your personal data specified in the above table please check additionally sections 'What personal data we collect about you' and 'How and why we use your personal data' above.

For the processing of your personal data for joint purposes, we and Your App Provider have assigned between us the responsibilities for compliance with data protection obligations as follows:

Your App Provider is accordingly designated as a single contact point for data subjects in respect of matters relating to the processing of personal data processed by us and Your App Providers as joint controllers. You should be able to find their contact data in the terms of service and privacy notice under which they provide you with Your App. Additionally, you can check Your App Provider's details by checking the heading “Who is this firm connected to?” in our record in FCA's Financial Service Register.

Notwithstanding the joint controller arrangement described above, we and Your App Provider are separately and independently responsible for the processing by each of us of your personal data. You can always address your requests to exercise your rights relating to personal data directly to us as set forth in section 'Your rights' above.

A cookie is a small data file placed on a browser or device (such as computer or mobile phone) when it is used to access a service. Cookies or similar technologies may be used for many purposes, including without limitation remembering you and your preferences and tracking your access and use of information technology services. Cookies work by assigning a number to users that has no meaning outside of the assigning website or application.

We use session cookies and persistent cookies when you use the Services. These types of cookies are essential to their provision. We use them for technical purposes such as verifying the origin of requests to our systems and distinguishing you among other users of the Services during such use. The session cookies are stored in temporary memory and are not retained after you close the browser. Session cookies do not collect information from your computer. They are used to identify the session during which you interact with our systems only for the duration of that session. The persistent cookies are set with an expiration date and are stored on your hard drive until they expire, or you delete them. The persistent cookies we use expire within an hour from the last time you access our systems in any given session of interaction. We use these cookies to remember for a short while your preferences in terms of device theme settings (light/dark) and a presumably more convenient language of the interface; as well as to remember Your App Provider who redirected you to our systems, to ensure that you are redirected back to them when you finish your interaction with us. We do not collect any personal data in our cookies. The cookies we use do not identify you as an individual. All the cookies we use are first-party cookies. We do not use third-party cookies to provide the Services, nor do we use analytical or advertising cookies or social media plugins.

You can disable or control cookies by setting a preference within your web browser or on your device. Thus, if you do not wish that cookies are used in your respect, you can restrict or limit the use of cookies at the individual browser or device level. However, since the cookies we use are necessary for the provision of the Services to you, if you choose to disable cookies some features of the Services may not function properly or we might not be able to provide the Services to you at all. For detailed guidance on how to control, manage and delete cookies, you are advised to visit https://www.aboutcookies.org/.

This privacy notice was published on Dated: 6-Oct-2023.

We may change this privacy notice from time to time. When we do so, we will post an appropriate update notice at the top of this privacy notice page. You are advised to print a copy of this privacy notice for reference and revisit it from time to time to ensure that you are aware of any changes.

Please contact us if you have any queries or concerns about our use of your personal data (see below 'How to contact us'). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner. The Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.

Keep in mind that Your App Provider is designated as a single contact point for data subjects in respect of matters relating to the processing of personal data processed by us and Your App Provider as joint controllers, as explained in section 'Joint controllers' above. You should be able to find their contact data in the terms of service and privacy notice under which they provide you with Your App. Additionally, you can check Your App Provider's details by checking the heading “Who is this firm connected to?” in our record in FCA's Financial Service Register.

Regardless of such joint controllers arrangement, you can contact us and/or our Data Protection Officer by post or email if you have any questions about this privacy notice or the information we hold about you, to exercise a right under the UK Data Protection Laws or to make a complaint regarding our processing of your personal data.

Our contact details are shown below: