Privacy Policy
Privacy Policy
This privacy policy describes how we use your personal data.
1. Who we are and how to contact us
We are Altery Ltd (Altery) (or we / us / our) and we are the “controller” of your personal data under European Union (EU) and UK data protection laws. Altery is a limited company incorporated in England and Wales with registered number 06984177. Altery is registered with the Information Commissioner’s Office and its registration number is ZA572310. We trade under the name of Altery.
Our contact details are as follows:
Post: Office 24, HGS 24, One Canada Square, E14 5AB, London, United Kingdom
Email: [email protected]
If you have any questions regarding this privacy policy, please contact us at [email protected]
2. This notice
This notice describes how we use your personal data in connection with:
- Customer and/or member services: This means the provision of payment and e-money products and services (including through our online platform and/or our Altery card) by us to actual and prospective customers and/or members (collectively known as “customers”)
- Affiliate or introducer schemes: This is where you take part in our affiliate or introducer schemes such as when you introduce us to your friends who register to use our services
- Supplier services: This means the provision of products and services by suppliers to us
- Website activities: This means the provision of personal data you provide through your use of our website(s)
Please note that any references to customers, suppliers, agents or other third parties include their staff whose personal details we process as part of our business relationship with such parties.
This notice tells you what personal data we collect about you, how we collect it, how we use it, why we use it, whom we share it with, and the rights to which you may be entitled.
Your privacy is important to us. We aim to be open about how we use your personal data.
If you have any questions or need any further clarity, please contact us using the contact details above.
This notice relates only to use of your personal data by Altery or on our behalf.
3. Personal data collection and usage
We will collect, store and use your personal data for the purposes set out in Section 2. Personal data includes any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Certain types of personal data are more sensitive than others. Special categories of personal data include information about your race, ethnicity, sex life, sexual orientation, political opinions, religious or philosophical beliefs, trade union membership, health, genetic and biometric data. In specific circumstances, we may collect, receive and use special category data about you.
We may also collect and use personal data about your criminal offences (or alleged offences).
We have identified the types of personal data we may use about you, the method of collection and how and why we will use them in the table below.
We may process your personal data for more than one legal basis depending on the purpose for which we are using your personal data. Separately, please note that where we base our use of your personal data on legitimate interests, as indicated in the table below, this will apply only where we consider that our legitimate interest is not overridden by the individual’s interests or rights which require protection of their personal data. You can obtain further information about this from our Data Protection Officer.
| What personal data we collect and how we collect it | How we use your personal data | Legal basis for processing | |
| a. | Personal data that our customers give us to register with us:
| We use this personal data to:
| We use this personal data because:
|
| b. | Know Your Client (KYC) personal
| We use this personal data to:
| We use this personal data because:
|
| c. | Personal data you provide as part
| We use this personal data to:
| We use this personal data because:
|
| d. | Personal data relating to your use
| We use this personal data to:
| We use this personal data because:
|
| e. | Personal data that we collect from
| We use this personal data to:
| We use this personal data because:
|
| f. | Personal data that we collect
| We use this personal data to:
| We use this personal data because:
|
| g. | Special category data or criminal
| We use this personal data to:
| We use this personal data because:
|
| h. | Personal data that we collect from
| We use this personal data to:
| We use this personal data because:
|
| i. | Personal data that we collect from
| We use this personal data to:
| We use this personal data because:
|
| j. | CCTV personal data | We use this personal data to:
| We use this personal data because:
|
4. Direct Marketing
Please note that if you have given explicit consent for marketing communications, this can be withdrawn at any time. You can also unsubscribe from our marketing communications. You can opt out of receiving electronic communications by clicking on the unsubscribe link at the bottom of any electronic communication or through following the opt-out instructions provided in any marketing communication. You can also contact us to unsubscribe using the details listed in Section 1.
Please be aware that from time to time we may need to contact you regarding operational issues or to adhere to the performance requirements of our contract with you. These will not be marketing communications and we will operate under legitimate interests in order to contact you for these reasons.
5. Automated Decision Making
We will make automated decisions regarding you and using your personal data.
We make automated decisions regarding you in the following situations:
- When you instruct us to make a payment from your account, or to request a payment into your account from a bank or other payment services provider, our systems (or systems provided to us by our suppliers) will conduct certain automated checks to help us prevent or detect fraud. These checks are made using algorithms to see if the instructed payment indicates an unusual transaction pattern or location. However, in many cases the decision to withhold or execute the payment is made by a natural person rather than our systems.
- Our systems (or systems provided to us by our suppliers) also make an automated check for authorisation when you use the card allocated to your account. The authorisation is automatically provided or declined by us if there are insufficient funds in your account to pay for the transaction or if your card has been reported as lost or stolen.
If you disagree with the decision you are entitled to contest this by contacting us as described in Section 1.
6. Legal requirements
We need to collect certain types of personal data for compliance with legal requirements relating to our anti-fraud / anti-money laundering / know your customer obligations. If this personal data is not provided we cannot agree to provide a service to you but we shall notify you if this is the case at the time your personal data is collected.
Your personal data may also be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of legal claims. We will not delete personal data if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.
7. How long do we keep your personal data
- Customers: We will keep customers’ personal data for the period you have an account with us and a further five years in accordance with anti-money laundering laws and for our legitimate business interests in maintaining contractual records. Otherwise, we will not keep your personal data for any longer period except where necessary in case of any claim or as necessary to comply with legal, regulatory, accounting or reporting requirements.
- Website visitors: We will keep website visitors’ personal data for up to 12 months from each visit in order to understand how people use our website and any technical issues they have.
- Suppliers: We will keep suppliers’ personal data for the duration of our relationship with the relevant supplier and a further six years for contractual, legal and tax reasons.
Separately please note that we may convert personal data into anonymous or aggregate data in which case it will cease to be personal data (as it will no longer be able to identify a living individual) and we may use this information indefinitely without further notice.
8. Personal data we share
There are certain circumstances where we may disclose and transfer your personal data to persons and entities as indicated below.
In addition, we may convert your personal data into anonymous or aggregated form prior to disclosing and/or transferring your personal data, in which case it will cease to be personal data and is not required to be protected under data protection laws.
| Type of recipient | Industry / sector | Activities | Location |
| Customer support and other customer operations services | Our affiliated companies and other suppliers which provide us with technical services | Provides us with technical services including to operate our payment services platform and provide administration and customer support | Our affiliated companies are incorporated in England and Wales,EEA and other countries outside the EEA. Our suppliers are located in the EEA and in other countries outside the EEA |
| Payment Services and banks | Financial services | Payment services, acquiring services or bank transfers card schemes | EEA, USA, and other countries outside the EEA |
| Suppliers related to financial services or operations | Technical / operational services for financial firms | KYC and sanctions screening, fraud prevention, identity verification, transaction monitoring, customer communications, card supply | EEA, USA and other countries outside the EEA. |
| Internal messaging services suppliers | Messaging services | Messaging services for our staff or our affiliated companies’ staff | EEA, USA and other countries outside the EEA |
| Communications services | Translations and emails/SMS marketing services | Services to assist us to communicate with our customers | EEA, USA and other locations outside the EEA |
| IT services suppliers | Disaster recovery, website hosts, data centres/cloud services, IT tracking systems, customer databases, CRM systems | Disaster recovery, website hosting, data and applications hosting, software application provision and maintenance | EEA, USA |
| Analytics suppliers | Analytics suppliers | Analytics, usually of de-identified data | Analytics suppliers |
| Credit reference agencies, fraud prevention agencies, payment processors and banks | Credit reference; financial services | Credit checking; processing payments | EEA, USA and other countries outside the EEA |
- a processor (acting on our behalf) of your personal data (including personal data or special category data derived from any digital photos and videos of you taken through its online functionality) for the purposes of performing identity verification services in connection with KYC, fraud prevention and anti-money laundering; and
- a controller of your personal data to the extent necessary for developing, testing, improving and altering the functionality of its verification services, and producing anonymized or anonymized and aggregated statistical reports and research. You can contact Sum and Substance Ltd’s data protection officer via [email protected] and can raise a complaint with Sum and Substance Ltd at the Information Commissioner’s Office here. Sum and Substance Ltd’s privacy policy, which outlines how it processes data when acting as a controller (including how it complies with the European Union General Data Protection Regulation 2016/679), can be found here.
9. Where your personal data will be held
Your personal data may be transferred outside the UK and the European Economic Area (EEA) as indicated in Section 8. Some of those countries do not have equivalent data protection laws to those applicable in the EEA. However, to ensure your personal datas properly protected in line with EU and UK data protection law, the transfer of this personal data is, in general, governed by a contract including the Standard Contractual Clauses approved by the European Commission in accordance with Article 46(2)(c) of the General Data Protection Regulation (GDPR), and the UK International Data Transfer Agreement approved by the ICO.
In some limited circumstances, we may also transfer your personal data outside the EEA if the GDPR (under Article 49) allows this. This includes where it is necessary for the performance of a contract between us and you. This also includes where the transfer is necessary in connection with legal proceedings.
10. Your Rights
You have certain rights in relation to your personal data. The availability of these rights and the ways in which you can use them are set out below in more detail. Some of these rights will only apply in certain circumstances. If you would like to exercise, or discuss, any of these rights, please contact our Data Protection Officer as described in Section 1.
You will not have to pay a fee to access your personal data or to exercise any of these rights although we may charge a reasonable fee if your request is manifestly unfounded, excessive or repetitive. Alternatively, we may refuse to comply with your request in these specific limited circumstances. Please be aware that for security reasons, we cannot deal with your request if we are not sure of your identity so we may ask you for proof of your ID. This is to protect your and other individuals’ personal data from unlawful disclosure to third parties.
- Access: you are entitled to ask us if we are processing your personal data and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it. We do not have to provide this information if this would adversely affect the rights and freedoms of others.
- Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected.
- Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances, including where the personal data is being processed by us on the basis of your consent and you have withdrawn consent to our using it or we no longer need it in connection with your account or for other legitimate reasons. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.
- Restriction: you are entitled to ask us to suspend the processing of your personal data in certain circumstances, for example if you want us to establish its accuracy or the reason for processing it.
- Transfer: you may request the transfer of certain of your personal data to another party. This right only applies where we use your personal data based on your consent or if the personal data is processed for the performance of a contract with you personally and we are carrying the processing out by automated means. To help with that you have a right to ask that we provide your personal data in an easily readable format to another company.
- Objection: where we are processing your personal data based on legitimate interests (or those of a third party) you may challenge this however we may be entitled to continue processing your personal data based on our legitimate interests. You also have the right to object where we are processing your personal data for direct marketing purposes.
- Automated decisions: you may contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
You also have a right to lodge a complaint with a supervisory authority. In the UK you can make a complaint to the Information Commissioner’s Office (Tel: 0303 123 1113 or at www.ico.org.uk). However, we would encourage you to contact us in the first instance so we can try and resolve any concerns you may have in relation to our processing of your personal data. You can contact us as detailed in Section 1.
11. Security
We are committed to keeping your personal data safe. Our website is hosted on servers in the EEA. We have physical, technical
and administrative measures in place to prevent unauthorised access or use of your personal data including:
- encryption;
- restricted access measures;
- reviewing, auditing and improving plans for the ongoing confidentiality, integrity, availability and resilience of processing
- systems and services
- business continuity plans to ensure the ability to restore personal data in the event of a physical or technical incident; and
- training programmes for all our staff.
We have put in place procedures to deal with any suspected personal data breach and will notify you and the UK Information
Commissioner’s Office where we are legally required to do so in the event of a personal data breach.
12.Links to third party websites
Our website, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others including our partner networks, advertisers, suppliers, other companies and/or social networks.
The personal data that you provide through these websites is not subject to this privacy policy and the treatment of your personal data by such websites is not our responsibility. If you follow a link to any of these websites, please note that these websites have their own privacy policies which will set out how your personal data is collected and processed when visiting those sites. For more information, please visit the privacy policies of these websites to learn more about how your personal data is collected and used.
13.Children
We do not knowingly collect information from children or other persons who are under 18 years old. If you are under 18 years old, you may not submit any personal data to us or subscribe for the services. If you believe we might have any personal information from or about a person under the age of 18, please contact the Data Protection Officer.
14.Changes to this Notice
This notice will be changed from time to time.
If we change anything important about this notice (the personal data we collect, how we use it or why) we will highlight those changes at the top of the notice and provide a prominent link to it for a reasonable length of time following the change.
