2026-09-11

Privacy policy

What we collect, why, who we share it with and how you stay in control. Draft for legal review.

In short

We collect what we need to open your account, verify you where required, run the service and meet our legal duties.
We share data with our card issuer, account provider, crypto-asset partner, identity verification provider and screening vendors. We do not sell your data.
Some partners are outside your country. We use approved safeguards for those transfers.
We keep records for as long as the law requires, typically [RETENTION PERIOD] after your account closes.
You can ask to see, correct or delete your data, and you can complain to a data protection authority.

Draft for legal review. Not yet in force.

1. Who is responsible

1.1 The controller of your personal data is [LEGAL ENTITY NAME], registered in [JURISDICTION] under number [REG NUMBER], with registered office at [ADDRESS] ("Fundly", "we", "us").

1.2 Our data protection officer can be reached at [DPO EMAIL].

1.3 Our regulated partners ([ISSUER NAME], [EMI PARTNER NAME], [VASP ENTITY NAME]) are separate controllers for the processing they carry out under their own terms. Their privacy notices apply to that processing and are linked on the platform.

2. What we collect

2.1 Identity and contact data. Name, date of birth, nationality, email address, phone number, residential address.

2.2 Verification data. Identity documents, selfie and liveness video, proof of address and, where requested, source of funds information. These are collected through [KYC PROVIDER] on our behalf. Some of this is biometric data, which we process only with your explicit consent or where the law permits it for identity verification.

2.3 Account and transaction data. Deposits, conversions, card payments, transfers, balances, merchant details, card status and limits.

2.4 Blockchain data. The deposit addresses we assign to you, the addresses you send from, transaction hashes and the results of blockchain analytics screening.

2.5 Device and usage data. Device model and identifiers, operating system, IP address, approximate location, browser and platform version, log data, crash reports and how you use the platform and website.

2.6 Communications. Support messages, call recordings where we tell you, and your marketing preferences.

2.7 Data from others. Sanctions and politically exposed person screening results, fraud prevention databases, and information from our partners about your card and account.

3. Why we use it and our legal basis

Purpose	Legal basis
Opening and running your account, issuing cards, processing deposits and payments	Performance of our contract with you
Identity verification, sanctions and PEP screening, transaction monitoring, record keeping	Legal obligation under [AML LEGISLATION]
Fraud prevention, security, device checks, protecting our users	Legitimate interests
Product analytics and improving the platform	Legitimate interests, or consent where required for cookies
Marketing emails and notifications	Consent, which you can withdraw at any time
Responding to support requests and complaints	Contract and legitimate interests
Responding to lawful requests from authorities	Legal obligation

3.2 Where we rely on legitimate interests we have balanced those interests against your rights. You can ask us for details.

4.1 We share personal data with:

[ISSUER NAME], which issues your card and processes card transactions;
[EMI PARTNER NAME], which provides your account and IBAN;
[VASP ENTITY NAME], which receives and converts your crypto-assets;
[KYC PROVIDER], which verifies your identity on our behalf;
sanctions, PEP and fraud screening vendors, and blockchain analytics providers;
[CARD NETWORK] and payment processors, to the extent needed to run the card;
cloud hosting, email, messaging and customer support providers;
[ANALYTICS PROVIDER] for product analytics, subject to your cookie choices;
professional advisers, auditors and insurers;
regulators, law enforcement and courts where the law requires it;
a buyer or successor if Fundly is sold or reorganised.

4.2 We do not sell personal data and we do not share it with advertisers for their own use.

5. International transfers

5.1 Some of the parties above are located outside [JURISDICTION] or the EEA. Where we transfer personal data to a country without an adequacy decision we use approved safeguards, such as standard contractual clauses, and we carry out transfer risk assessments. You can request a copy of the relevant safeguard.

6. How long we keep it

6.1 We keep your data for as long as your account is open and then for as long as we are required to by law. Anti-money-laundering rules require us to keep identity and transaction records for [RETENTION PERIOD] after the end of our relationship with you, typically 5 years, and longer if a regulator asks us to.

6.2 We keep marketing preferences until you change them. We delete or anonymise analytics data after [ANALYTICS RETENTION].

7. Your rights

7.1 Depending on where you live, you have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete data, where we are not required to keep it;
restrict or object to processing, including for direct marketing;
receive your data in a portable format;
withdraw consent at any time, without affecting earlier processing;
complain to [DATA PROTECTION AUTHORITY] or to the authority where you live.

7.2 To exercise a right, email [DPO EMAIL] or use the privacy section on the platform. We will respond within one month. We may need to verify your identity first.

7.3 We do not make decisions with legal effects about you based solely on automated processing, except for sanctions screening and fraud checks that the law requires or allows. You can ask for a human review of these decisions.

8. Cookies

8.1 Our website uses cookies and similar technologies. See our Cookie Policy at /legal/cookies for details and for how to change your choices.

9. Security

9.1 We protect your data with encryption in transit and at rest, access controls, logging, two-factor authentication and regular testing. No system is perfectly secure. If we discover a breach that is likely to affect your rights we will tell you and the relevant authority as the law requires.