Privacy Policy

01 Introduction

Welcome to Finovo. Protecting your privacy is fundamental to the trust you place in us as your banking partner. This Privacy Policy describes how Finovo ("we", "us", "our") collects, uses, shares, and protects your personal information when you use our website, mobile applications, and financial services.

We are committed to handling your data responsibly and transparently, in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Financial Services and Markets Act 2000, and all applicable laws governing financial institutions and electronic payments in the United Kingdom.

02 Data Controller

Finovo Ltd is the data controller responsible for your personal information. This means we determine the purposes and means of processing your personal data.

Registered Details

• Company Name: Finovo Ltd
• Data Protection Officer: cotexm3@gmail.com
• ICO Registration Number: ZA0000000 (illustrative)
• Regulatory Status: This is a demonstration website and is not authorised or regulated as a financial institution

03 Information We Collect

We collect several categories of personal data to deliver our banking services effectively, fulfil our legal obligations, and prevent fraud. The type of information we collect depends on how you interact with us.

3.1 Information You Provide Directly

• Identity Data: Full name, date of birth, nationality, photograph, government-issued ID (passport or driving licence), and National Insurance number.
• Contact Data: Email address, phone number, residential address, and mailing address.
• Financial Data: Bank account details, card information, transaction history, income, employment status, and credit history.
• Account Credentials: Username, password, PIN, security questions, and biometric data (fingerprint or facial recognition).
• Communication Data: Messages, emails, call recordings, and chat transcripts exchanged with our support team.

3.2 Information Collected Automatically

• Device Data: IP address, device type, operating system, browser version, and unique device identifiers.
• Usage Data: Pages viewed, features used, click patterns, session duration, and in-app behaviour.
• Location Data: Approximate location based on IP address or GPS (with your consent) for fraud prevention.
• Cookie Data: Information collected through cookies and similar tracking technologies (see Section 11).

3.3 Information from Third Parties

• Credit Reference Agencies: Credit scores, repayment history, and financial behaviour.
• Fraud Prevention Agencies: Identity verification, sanctions screening, and PEP (Politically Exposed Person) checks.
• Payment Networks: Visa, Mastercard, and other networks may share transaction information.
• Public Sources: Companies House, electoral roll, and other publicly available information.

04 How We Use Your Data

We use your personal information for the following purposes, all of which are strictly necessary to provide our services, comply with the law, or pursue our legitimate business interests:

• Account Management: Opening, maintaining, and closing your accounts, processing transactions, and managing your profile.
• Identity Verification: Confirming your identity and address in accordance with anti-money laundering (AML) and Know Your Customer (KYC) requirements.
• Fraud Prevention: Monitoring transactions, detecting suspicious activity, and preventing financial crime.
• Service Delivery: Processing payments, transfers, direct debits, standing orders, and card transactions.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance.
• Legal & Regulatory Compliance: Meeting our obligations under FCA rules, tax laws, and other applicable regulations.
• Marketing: Sending you information about products and services (with your consent or where permitted by law).
• Product Improvement: Analysing usage data to develop new features and improve existing ones.
• Credit Assessment: Evaluating your eligibility for loans, credit cards, and overdrafts.

05 Legal Basis for Processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:

06 Sharing Your Information

We do not sell your personal data. We share information only with trusted third parties in the following circumstances:

6.1 Service Providers

We work with carefully vetted service providers who help us deliver our services, including payment processors, cloud hosting providers, identity verification partners, and customer support platforms. All partners are bound by strict confidentiality and data protection agreements.

6.2 Regulatory & Law Enforcement

We may disclose your information to the FCA, HMRC, the National Crime Agency, the police, or other regulators where required by law or where we believe disclosure is necessary to prevent fraud, money laundering, or terrorism financing.

6.3 Credit Reference Agencies

We share information with credit reference agencies (such as Experian, Equifax, and TransUnion) to assess your creditworthiness and to fulfil our reporting obligations.

6.4 Business Transfers

If we sell, merge, or restructure our business, your information may be transferred to the acquiring entity. We will notify you of any such change.

6.5 With Your Consent

We may share your information with other parties where you have specifically consented to do so.

07 International Transfers

Some of our service providers are located outside the UK or the European Economic Area (EEA), particularly in the United States and other jurisdictions. When we transfer your data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the UK Government or European Commission.
• UK International Data Transfer Agreement (IDTA) or Addendum.
• Adequacy decisions where the destination country provides equivalent protection.
• Additional technical measures such as end-to-end encryption.

You can request a copy of the specific safeguards we use by contacting our Data Protection Officer.

08 Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Typical retention periods include:

• Account Data: Retained for the duration of your account, plus 6 years after closure, in accordance with FCA rules.
• Transaction Records: Retained for 6 years from the end of the relevant tax year, in accordance with HMRC requirements.
• KYC / AML Records: Retained for 5 years after the end of the customer relationship.
• Marketing Data: Retained until you withdraw consent or unsubscribe.
• Call Recordings: Retained for 6 years for regulatory and quality purposes.
• Website Analytics: Retained for up to 26 months.

09 How We Protect Your Data

We use industry-leading security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction:

• Encryption: All data transmitted to and from our platform is encrypted using TLS 1.3. Data at rest is encrypted using AES-256.
• Multi-Factor Authentication: We require MFA for account access and high-value transactions.
• Biometric Login: Fingerprint and facial recognition support on all modern devices.
• Access Controls: Strict role-based access controls limit who can view your data internally.
• Monitoring: 24/7 monitoring for suspicious activity and potential security threats.
• Regular Audits: Independent penetration testing and security audits conducted at least annually.
• Staff Training: All employees undergo regular data protection and security training.
• ISO Certification: We maintain ISO 27001 and ISO 27701 certifications.

10 Your Rights

Under the UK GDPR, you have the following rights regarding your personal data. You can exercise any of these rights by contacting our Data Protection Officer at cotexm3@gmail.com.

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data (subject to legal retention obligations).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decisions: Request human intervention where decisions are made automatically.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

We will respond to your request within 30 days. If we cannot comply, we will explain why. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11 Cookies & Tracking

We use cookies and similar technologies to enhance your experience, analyse usage, and support our security measures. Cookies are small text files stored on your device.

Types of Cookies We Use

• Strictly Necessary: Required for the website and app to function — for example, authentication and security.
• Performance: Help us understand how visitors use our site, so we can improve it.
• Functional: Remember your preferences and settings.
• Targeting / Advertising: Used to deliver relevant ads and measure campaigns.

You can manage or disable cookies through your browser settings at any time. For more details, see our Cookie Policy.

12 Marketing Preferences

We may contact you with information about products, services, and offers that we believe may be of interest to you, based on your consent or where we have a legitimate interest to do so.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email.
• Disabling marketing notifications in the app settings.
• Contacting our Customer Support team.

Please note: even if you opt out of marketing, we will still send you important service messages relating to your account (such as security alerts and transaction confirmations).

13 Children's Privacy

Our banking services are designed for individuals aged 18 and over. We do not knowingly collect personal information from children under 16 without parental consent. If you believe we have inadvertently collected data from a child, please contact us so we can take appropriate action.

We offer a separate, dedicated service for junior accounts (16–17 years), which is governed by additional safeguards and parental controls.

14 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you via email or in-app notification at least 30 days before the changes take effect (where required by law).
• Where necessary, seek your explicit consent to the changes.

We encourage you to review this policy periodically to stay informed about how we protect your data.

15 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us using the details below.

Data Protection Officer

• Email: cotexm3@gmail.com

General Support

• Email: cotexm3@gmail.com
• Phone: +44 7754 203697