Privacy Statement

What we collect

Identity data

Legal name, date and place of birth, nationality, photograph and identity document details, signature, and tax identification number and residency.

Contact data

Residential and correspondence address, email address, telephone numbers.

Financial data

Account and card numbers, balances, transaction history, counterparties, income and employment information, source of funds and wealth, credit history and affordability information.

Relationship data

Products held, applications made, preferences, marketing consents, and records of your contact with us including support tickets and call recordings.

Technical data

IP address, device and browser identifiers, operating system, approximate location derived from network data, authentication events, and pages viewed on this website.

Behavioural and risk data

Login patterns, device fingerprints, transaction patterns and risk scores generated by our fraud and financial-crime monitoring.

We collect this from you directly, from your use of our services, and from third parties such as identity verification providers, credit reference and fraud prevention agencies, sanctions and politically-exposed-person screening providers, payment networks, and public registers.

Why we use it, and on what legal basis

Automated decisions and profiling

We use automated processing in three main places: identity verification, fraud and financial-crime monitoring, and credit and affordability assessment.

• Fraud monitoring scores transactions and login attempts in real time, and may block or hold an instruction pending review.
• Credit decisions may be made or supported by automated scoring using information you supply and data from credit reference agencies.
• Screening compares your details against sanctions, politically-exposed-person and adverse-media data.

Where a decision that produces a legal or similarly significant effect is made solely by automated means, you have the right to ask for human review, to express your point of view and to contest the decision. Use our contact page to do so.

Who we share it with

We share personal data only where there is a clear reason to:

• Payment networks, correspondent and beneficiary banks, in order to execute the payments you instruct. Payment messages necessarily carry your name and account details.
• Service providers acting on our instructions under contract — including cloud hosting, identity verification, card issuing and processing, communications and analytics providers.
• Credit reference, fraud prevention and identity agencies, which may retain a record of the search.
• Regulators, tax authorities, law enforcement and courts where we are legally required or permitted to disclose.
• Professional advisers, auditors and insurers, under duties of confidentiality.
• A purchaser or successor in the event of a reorganisation, merger or transfer of business.

We require every processor acting for us to protect personal data to at least the standard we apply ourselves, and to use it only for the purpose we specify.

International transfers

Banking is inherently cross-border. Where we transfer personal data outside — for example to execute an international payment or to use a service provider based elsewhere — we make sure an appropriate safeguard is in place.

• A determination that the destination country provides an adequate level of protection.
• Standard contractual clauses approved by the competent authority.
• Binding corporate rules, or another recognised transfer mechanism.
• Where necessary for the performance of a contract with you, such as sending a payment to a beneficiary abroad.

You may request details of the safeguard applied to a specific transfer through our contact page.

How long we keep it

We keep personal data only as long as we need it for the purpose we collected it, and for as long as the law requires us to.

How we protect it

• Encryption of personal data in transit and at rest.
• Role-based access granted on a least-privilege basis, with access logged and reviewed.
• One-way hashing or tokenisation of credentials and card data, so they cannot be read back.
• Continuous monitoring, independent testing and a documented incident response process.
• Staff training, confidentiality obligations and background screening appropriate to the role.

Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

Access

Obtain confirmation that we process your data, and a copy of it.

Rectification

Have inaccurate data corrected and incomplete data completed.

Erasure

Ask us to delete data where we no longer have a lawful reason to keep it. Statutory retention periods override this.

Restriction

Ask us to limit processing while a dispute about accuracy or legitimacy is resolved.

Objection

Object to processing based on legitimate interests, and to direct marketing at any time and without reason.

Portability

Receive data you provided to us in a structured, machine-readable format, or have it transmitted to another provider.

Withdraw consent

Withdraw consent where processing is based on it, without affecting processing already carried out.

Human review

Request human intervention in a decision made solely by automated means.

To exercise a right, write to us from our contact page or raise a support ticket from inside online banking. We will verify your identity first — we will not act on an unverified request, because doing so would itself be a security risk. We respond within the statutory period, normally one month.

Exercising a right is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain why.

Cookies and tracking

This website uses cookies and similar technologies. Strictly necessary cookies keep your session secure and cannot be switched off; everything else is optional and set only with your consent.

Complaints about privacy

If you are unhappy with how we have handled your personal data, tell us first through our contact page — we would like the chance to put it right.

You also have the right to complain to the data protection authority in your country of residence. Complaining to us does not affect that right.

Changes to this statement

We review this statement regularly and update it when our processing changes or the law does. The current version is always published here. Where a change materially affects you, we will notify you directly through online banking or by email.