Personal Data Collected

Purpose

Basis for processing

1. Information you give us "Submitted Information": This is information you give us about you by filling in forms or on the App and/or the Site, or by corresponding with us (for example, by e-mail or). It includes information you provide when you register for an Amaiz account,, subscribe to any of our services, enter into any transaction (such as a Top Up, Instant Transfer, Amaiz Bank Transfer, Electronic Money Exchange), participate in discussion boards or other social media functions, enter a competition, promotion or survey and when you report a problem with your account, the Services, or the Site. If you contact us, we will keep a record of that correspondence, and may use redacted information for other services. The information you give us may include your name, address, date of birth, e-mail address, phone number, username, password and other registration information, financial, details of your account including the bank account number, sort code, IBAN, details of your debit and credit cards including the long number, relevant expiry dates and CVC, identification document numbers, copies of identification documents (for example, passport, driving licence and utility bill) personal description and photograph and any other information you provide us in order to prove your eligibility to use our Services.

   
   

2. transaction information including date, time, amount, currencies used, exchange rate, beneficiary details, details and location of the merchant or ATMs associated with the transaction, IP address of sender and receiver, sender's and receiver's name and registration information, messages sent or received with the payment, device information used to facilitate the payment and the payment instrument used;

   
   

3. details of your transaction details relating to your use of our

• to manage and administer the Services;

• to enable you to use the Services;

• to deal with enquiries, complaints and feedback from you;

• To give you any notices under any agreement with you;

• To keep you informed about your relationship with us;

• To update our records;

• To identify, prevent, detect or tackle fraud, money laundering and other crime;

• To carry out checks required by applicable regulation or regulatory guidance;

• To carry out our obligations arising from and exercise our rights under, any agreements between you and either of us or other users of the Service;

• To check any instructions given to us, for training purposes, for crime prevention and to improve the quality of our customer service.

  For the above purposes, each of we may disclose your personal data to any member of our group, which means our subsidiaries, in any part of the EEA or elsewhere.

  To disclose to third parties:

• If it is under a duty to disclose or share your personal data in order to comply with any legal obligation;

• To enforce this Privacy Policy or any other agreement with you;

• to a credit reference agency to check your identity and to prevent fraud, (it will also keep a record of your request and use it whenever anyone applies to be authenticated in your name);

1. processing is

   necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;

   
   

2. processing is necessary for compliance with a legal obligation to which we are subject;

(f) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

services, including who you have sent money or electronic money to, foreign exchange transactions you have entered into, the time, date and location of the place the transaction was entered into.

c) location Information. We use GPS technology and your IP address to determine your location – this may be used when the App is running in the foreground and the background of your Device. This is used to prevent fraud, for instance if your mobile device is saying that you are based in the UK, but your card is being used to enter into an ATM Withdrawal or point of sale purchase in Spain, we may not allow that transaction to be processed. Our card protection and fraud-prevention measures require this personal data for the feature to work.

• to our banking and financial service providers, card manufacturing, personalization and delivery service providers agents and subcontractors, acting for the purpose of operating the Services;

• to debt collectors and other third parties to trace you and recover any debt;

• to provide a unified service across all of our products and services, we may disclose your personal information to any member of the Amaiz group, which means any of our subsidiaries or related entities. Companies in the Amaiz group will be acting as joint controllers or processors in order to provide the Amaiz Services;

• In the event that we sell any business or assets, in which case it may disclose your personal data to the prospective seller or buyer of such business or assets;

• To protect the rights, property, or safety of us, our customers, or others (which includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction);

• To investigate, prevent or detect fraud or carry out checks against money laundering;

• For audit purposes and to meet obligations to any relevant regulatory authority or taxing authority.

Information we collect about you and your Device. Each time you visit the App or our Site we will automatically collect the following information:

(i) technical information, including the internet protocol (IP) address used to connect your computer or Device to the Internet, your login

• To identify, prevent, detect or tackle fraud, money laundering and other crime;

• to prevent your Amaiz Card being used fraudulently;

• to improve your browsing experience by personalising the Services;

• To develop and improve the

Service;

(b) processing is

necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;

(f) processing is necessary for the purposes of the

information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, Device information and the type of mobile device you use, a unique Device identifier (for example, your Device's IMEI number, the MAC address of the Device's wireless network interface, or the mobile phone number used by the Device), mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting "Device Information";

(ii) information about your visit, including the full uniform resource locators (URL), clickstream to, through and from our site (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse overs), methods used to browse away from the page, device information;

• To ensure that content on the Services is presented in the most effective manner for you and for your computer;

  
  

  To disclose to third parties:

• To comply with a current judicial proceeding, a court order or legal process served on us or our Services, any request by any regulator who may have jurisdiction over us from time to time or for audit purposes and to meet obligations to any relevant regulatory authority or taxing authority;

• To enforce this Privacy Policy or other agreement with you;

legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

(iv) information stored on your Device, including if you allow Amaiz to access contact information from your address book, login information, photos, videos or other digital content, check ins (Content Information). The App will periodically recollect this information in order to stay up-to- date;

We may make and retain copies of passports or other identification evidence that you provide for anti- money laundering and anti-fraud purposes;

• To identify, prevent, detect or tackle fraud, money laundering and other crime;

• To carry out checks required by applicable regulation or regulatory guidance;

(b) processing is

necessary for the performance of a contract to which you are party or in order to take steps at your

request prior to entering into a contract;

To disclose to third parties for:

• To comply with a current judicial proceeding, a court order or legal process served on us or our Services, any request by any regulator who may have jurisdiction over us from time to time or for audit purposes and to meet obligations to any relevant

(c) processing is necessary for compliance with a legal obligation to which we are subject;

(f) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, except where such

regulatory authority or taxing authority;

• To enforce this Privacy Policy or other agreement with you;

• to a credit reference agency to check your identity and to prevent fraud, (it will also keep a record of your request and use it whenever anyone applies to be authenticated in your name);

interests are overridden by

your interests or

fundamental rights and

freedoms which require

protection of personal data.

Information about your physical or mental health or condition (where necessary and appropriate to comply with regulatory requirements relating to customers with such conditions)

• to meet our employment and related regulatory obligations;

• to manage and administer the Services;

• to enable you to use the Services;

  To disclose to third parties for:

• To comply with a current judicial proceeding, a court order or legal process served on us or our Services, any request by any regulator who may have jurisdiction over us from time to time or for audit purposes and to meet obligations to any relevant regulatory authority or taxing authority;

• To enforce this Privacy Policy or any other agreement with you;

• to agents and subcontractors, acting for us, to use for the purpose of operating the Services;

• to debt collectors and other third parties to trace you and recover any debt;

processing is necessary for the establishment, exercise or defence of legal claims;

An exemption under the Act also applies to records of our intentions in relation to any negotiations with you to the extent that the provisions would be likely to prejudice those negotiations.

Marketing

• To provide you with information, products or services that you request or which we decides may interest you;

• For statistical analysis;

• To identify which elements of the Services or other products might interest you;

• If we decide to engage advertisers to promote our products and services, the

With your consent

Submitted Information, Location Information or transaction information)

Records of any surveys that you may be asked to complete;

We have established an Amaiz Subscription Centre, where you can view and make individual decisions about your personal data use concerning marketing emails. For push notifications, please see

advertisers and their advertising networks may require anonymised personal data to serve relevant adverts to you and others. We will never disclose identifiable information about individuals to advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 700 men aged under 28 have clicked on their advertisement on any given day). We may also use such aggregate information to help our advertising partners provide a tailored and targeted campaign, relevant for a sub-section of our users (for example, women in Manchester). In some instances, we may use personal data we have collected from you to enable our advertising partners to display their advertisement to their target audience; We also use analytics and search engine providers that assist us in the improvement and optimisation of our site;

your mobile device setting for more details.

You will receive marketing communications from us if you have signed up to and/or utilise the Amaiz Services and, in each case, you have not opted out of receiving marketing notifications.

Third-party Marketing: We will obtain your express opt-in consent before we share your personal data with any company outside the Amaiz group of companies for marketing or promotional purposes.

Opting Out: You can ask us or third parties to stop sending you marketing messages at any time by adjusting your marketing preferences by following the unsubscribe links on any marketing message sent to you.

Your Rights and How to Exercise Them

Exception

Right of Access: To obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision- making, including profiling, referred to in Article 22(1) of the GDPR and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

How to exercise:

This Privacy Policy provides confirmation of the details required in relation to your right of access.

Under the DPA, you have a right to access certain personal records that we hold about you. Any access request may be subject to a fee to meet our costs (as the case may be) in providing you with details of the information they hold about you if the request is unfounded or excessive.

If you wish to exercise this right, then please reach out to our support team via the in-App chat function or email dpo@amaiz.com

Right to rectification: to obtain from us without undue delay the rectification of inaccurate personal data concerning you.

We must communication to each recipient to whom the rectified personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

We shall inform the data subject about those recipients if the data subject requests it.

You can exercise the right at any time by contacting us at support@amaiz.com.

Right to erasure: to obtain from us the erasure of personal data concerning you without undue delay where:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

1. you object to the processing based on legitimate interest where there are no overriding legitimate grounds for the processing;

2. the personal data have been unlawfully processed;

3. the personal data have to be erased for compliance with a legal obligation to which we are subject.

We must communication to each recipient to whom the erased personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

We shall inform the data subject about those recipients if the data subject requests it.

You can exercise the right at any time by contacting us at support@amaiz.com.

Processing is necessary for

(b) compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us; or

(e) the establishment, exercise or defence of legal claims.

Where we are not able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. For example, as an FCA authorised firm, Amaiz is under certain obligations to retain certain data for a minimum of 6 years (see above). Please note that these retention requirements supersede any right to erasure requests under applicable data protection laws.

Right to request the restriction of processing concerning you: to obtain from us restriction of processing where:

1. the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;

2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

3. we no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims;

4. you object to the processing based on legitimate interest pending the verification whether our legitimate grounds override yours.

We must communication to each recipient to whom the restricted personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

We shall inform the data subject about those recipients if the data subject requests it.

You can exercise the right at any time by contacting us at support@amaiz.com .

Where processing has been restricted under this right, such personal data shall, except for storage, only be processed:

1. with your consent; or

2. for the establishment, exercise or defence of legal claims; or

3. for the protection of the rights of another natural or legal person; or

4. for reasons of important public interest of the Union or of a Member State.

Please note that any requests in relation to the restriction of the processing of your data means that we may not be able to perform the contract we have or are trying to enter with you (including the Amaiz Services). In this case, we may have to cancel your use of the Amaiz Services, but we will notify you if this is the case at the time.

The right to data portability: to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where:

1. the processing is based on consent or is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract; and

   
   

2. the processing is carried out by automated means.

You have the right to have the personal data transmitted directly from us to another controller, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to the right to erasure.

If you wish to exercise this right, then please reach out to our support team via the in-App chat function or email dpo@amaiz.com

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

The right to object to processing: to object, on grounds relating to your situation, at any time to processing of personal data concerning you which is based on processing necessary for the purposes of the legitimate interests pursued by us or a third party (except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data), including profiling.

You can exercise the right at any time by contacting us at support@amaiz.com,

Where:

1. we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject; or

2. for the establishment, exercise or defense of legal claims.

If you object to the processing of certain data, then we may not be able to provide the Amaiz Services and it is likely we will have to terminate your account.

The right to ask us not to process your personal data for direct marketing purposes: to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

You have the right to ask us not to process your personal data for marketing purposes. Each of we will usually inform you (before collecting your data) if it intends to use your data for such purposes or if it intends to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms used to collect your data.

You can also exercise the right at any time by contacting us at support@amaiz.com

The right not to be subject to automated individual decision-making, including profiling: to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

You can exercise the right at any time by contacting us at support@amaiz.com

If the decision:

1. is necessary for entering into, or performance of, a contract between you and us;

2. is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

3. is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c) we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express his or her point of view and to contest the decision.