WHO WE ARE?

When we mention ACE, "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the ACE Group responsible for processing your data. “Personal information” means information that is about you or from which we can identify you. This privacy notice describes how we deal with your personal information. We are the data controller of this information under relevant data protection laws because in the context of our business relationship with you, we decide how and why it is processed in the ways explained in this privacy notice.

We can be contacted at any time including if you have queries about this privacy notice or wish to exercise any of the rights mentioned in it.

You will see at the end of this privacy notice that we mention the privacy notices of relevant third parties. We do need to share these with you. Please read them carefully and contact those organisations if you have questions (their details are in their notices).

This privacy notice may be updated from time to time. You should check https://aceunion.com/Privacy-Policy this webpage regularly so that you can read the up-to-date version. We may send you an updated copy (depending on whether we are required to do that or not).

WHAT KINDS OF PERSONAL INFORMATION ABOUT YOU DO WE PROCESS?

We may collect certain personal information which (either on its own or when combined with other information we hold about you) allows us to identify you as an individual and which is about you. We set out below the personal information that we generally process in connection with all our products and services.

PERSONAL INFORMATION THAT WE GENERALLY PROCESS IN CONNECTION WITH ALL OUR PRODUCTS AND SERVICES

This includes:

• Basic Personal Data
  • Your title, full name, signature, and contact details, including for instance your email address, home and mobile telephone;
  • Your home address;
  • Your date of birth and/or age;
  • Your place of birth, nationality;
  • Demographic information such as age and gender
  • GPS location;
• Data to comply with Money Laundering Regulations:
  • Proof of your identity, such as a passport, driving license, national ID card or residence permit;
  • Proof of address, such as a utility bill or bank statement;
  • Details on the source of funds being sent, for example, occupation details, payslips, credit card statements, tax rebate receipts or bank loan agreements.
• Personal information obtained from third-party sources (where you have provided the relevant permission), including:
  • Facebook, Twitter and Google profile contact information, images and names;
  • Banks and payment service providers used to transfer money to us;
  • Advertising networks; and
  • Search engine providers (such as Yahoo or Google).
• Technical data, including:
  • Information about your visit to our website, including page views, the length of visits to certain pages;
  • App downloads;
  • Operating system;
  • IP address; and
  • Browser type.

When you download our Mobile App, in addition to the information mentioned above we collect and process:

• Information you give us: This is the information that you consent to give to us about you when you download or register to use the Mobile App, subscribe to our services or correspond with us. This information includes identity, contact, financial marketing and communications data. If you contact us we will keep a record of that correspondence.
• Information we collect about you and your device: Each time you use our Mobile App we will automatically collect information on the type of device you use, operating system version, and system and performance indication. We may send you push notifications from time to time to update you about any events or promotions that we may be running. If you no longer wish to receive these types of communications, you may turn them off at the device level. To ensure you receive proper notifications, we will need to collect certain information about your device such as operating system and user identification information.
• Location Data: We collect your location-based information for the purpose of locating your address on account opening and also to customize our services.
• Mobile Analytics Data: We may collect this data to allow us to better understand the functionality of our mobile software on your phone. This software may record information such as how often you use the mobile app, the events that occur within it, aggregated usage, performance data, and where the mobile app was downloaded from.

WHAT IS THE SOURCE OF YOUR PERSONAL INFORMATION?

We will generally collect your personal information from you directly. If you are introduced to us by a broker, other ACE Group company or other intermediary, we will obtain some personal information about you indirectly from them when they introduce you to us.

In addition, we obtain your personal information from other sources such as Fraud Prevention Agencies, and other organisations to assist in the prevention and detection of crime, police and law enforcement agencies.

Some of the personal information obtained to verify your account will have originated from publicly accessible sources. In particular, the information will draw on court decisions, bankruptcy registers, and the electoral register (also known as the electoral roll).

DATA THAT YOU PROVIDE ABOUT THIRD PARTIES

At your request, where you provide us with information about third parties, e.g. recipients of transfers, we will also collect personal information in relation to those people (“Receiver / Payee Information”). By providing us with such information you confirm that you have obtained any necessary permissions from such persons to the reasonable use of the Receiver / Payee Information for such purposes in accordance with this notice, or are otherwise permitted to give to us the Receiver / Payee Information on their behalf. Please ensure that those other people are aware of this notice and that the provisions of this notice are clearly communicated to them.

WHAT DO WE DO WITH YOUR DATA AND WHO DO WE SHARE IT WITH?

We will only use your personal information when the law allows us to do so. Most commonly we use your personal information for the following purposes:

Transactional Purposes

We need to collect your personal information in order to process your transactions. To do so we require you and your beneficiaries bank account details or full name and address. Without the Receiver / Payee Information, we would not be able to fulfil your transactions. We also need to share your personal information with the card issuer and the company delivering the card.

Regulatory Purposes

As a regulated institution, ACE must comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and other applicable regulations. As a result, ACE (and its partners) must conduct Know Your Customer (“KYC”) and Customer Due Diligence (“CDD”) checks to comply with legal and regulatory obligations. Any personal information obtained for the purposes of preventing money laundering or terrorist financing is only used for that purpose. There may be occasions where the use of the data is permitted under another enactment. All of this helps us keep our service safe and secure.

Marketing Purposes

We may process your personal information to provide you with certain types of marketing communication that we believe will be relevant and of interest to you. This helps us to provide a more personalised service. We will always endeavour to make these communications relevant and un-intrusive, and you are able to object to marketing communication from us at any time.

Analytical Purposes

We may collect and analyse data such as website or app visit logs, on our own or by using services of third parties, in order to improve the quality of our service. In addition, we may share your personal data with third parties when it is necessary for the fulfilment of the service or to comply with applicable laws. We set out below some purposes for which we may share your personal information with third parties:

• We may share your personal information with third parties, such as our partners and intermediaries, when they are necessary for the fulfilment of the service; and

Other Purposes

We may share your personal information when required by law, for example for the purposes of security, taxation, and criminal investigations.

We may also, from time to time, ask you for your consent for other purposes, which we will explain to you at that time. Much of what we do with your personal data is not based on your consent and is instead based on other legal grounds. However, for processing that is based on your consent, you have the right to revoke that at any time.

WHAT ARE THE LEGAL GROUNDS FOR OUR PROCESSING OF YOUR PERSONAL INFORMATION (INCLUDING WHEN WE SHARE IT WITH OTHERS)?

Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organisations). For some processing, more than one legal ground may be relevant (except where we rely on consent). Here are the legal grounds that are relevant to us:

1. Processing necessary to perform our contract with you or for taking steps prior to entering into it:

   a) Administering and managing your account and related services, including updating your records and tracing your whereabouts to contact you about your account;
   b) Sharing your personal information with other payment service providers such as when you ask us to share information about your account with them;
   c) All stages and activities relevant to processing your transaction(s) including enquiry, registration, administration, management, and requests for transfers; and
   d) For some of our profiling and other automated decision-making.

2. Where we consider that it is appropriate for us to do so, the processing is necessary for the following legitimate interests which apply to us and in some cases other organisations (who we list below):

   a) Administering and managing your account and services relating to that, updating your records, tracing your whereabouts to contact you about your account and recent transactions, assessing your creditworthiness and advising you in relation to products and services;
   b) To test the performance of our products, services, and internal processes;
   c) To adhere to guidance and best practices under the regimes of governmental and regulatory bodies
   d) For management and audit of our business operations including accounting and insurance;
   e) To carry out searches to verify your account at the time of the first transaction and following notification of any changes to your address;
   f) To carry out monitoring and to keep records (see below);
   g) To administer our good governance requirements and those of other members of our group;
   h) For direct marketing communications insofar as believe that the marketing will be interesting and relevant to you;
   i) For some of our profiling and other automated decision-making (for example when estimating transaction timing); and
   j) When we share your personal information with these other people or organisations;
   

   • Other payment service providers such as when you ask us to share information about your account with them;
   • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
   • Our legal and other professional advisers, auditors, and actuaries;
   • Financial institutions and trade associations;
   • Governmental and regulatory bodies
   • Tax authorities who are overseas for instance if you are subject to tax in another jurisdiction we may share your personal information directly with relevant tax authorities overseas
   • Other organisations and businesses who provide services to us such as backup and server hosting providers, IT software and maintenance providers, document storage providers, and suppliers of other back-office functions;
   • Buyers and their professional representatives as part of any restructuring or sale of our business or assets;
   • Credit Reference Agencies (see below where we explain more); and
   • Market research organisations help us to develop and improve our products and services.

3. Processing necessary to comply with our legal obligations:

   a) For compliance with laws that apply to us;
   b) For the establishment, defence, and enforcement of our legal rights or those of any other member of our group;
   c) For activities relating to the prevention, detection, and investigation of crime;
   d) To carry out identity checks, anti-money laundering checks, and checks with Fraud Prevention Agencies pre-application, at the application stage, and periodically after that.
   e) To carry out monitoring and to keep records (see below);
   f) To deal with requests from you to exercise your rights under data protection laws;
   g) To process information about a crime or offence and proceedings related to that (in practice this will be relevant if we know or suspect fraud); and
   h) When we share your personal information with these other people or organisations:
   

   • Other payment service providers such as when you ask us to share information about your account with them;
   • Other account holders or individuals when we have to provide your information to them because some money paid to you by them should not be in your account;
   • Law enforcement agencies and governmental and regulatory bodies; and
   • Courts and other organisations where that is necessary for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.

4. Processing with your consent:

   a) When you request that we share your personal information with someone else and consent to that;
   b) For direct marketing communications; and
   c) For some of our profiling and other automated decision-making.
   

HOW AND WHEN CAN YOU WITHDRAW YOUR CONSENT?

Much of what we do with your personal information is not based on your consent, instead, it is based on other legal grounds. For processing that is based on your consent, you have the right to take back that consent for future processing at any time. You can do this by contacting us using the details below. The consequence might be that we cannot send you some marketing communications (but this outcome will be relevant only in cases where we rely on explicit consent).

IS YOUR PERSONAL INFORMATION TRANSFERRED OUTSIDE THE UK?

We are based in the UK but sometimes your personal information may be transferred outside the UK. If it is processed within the UK then it is protected by UK data protection standards. Some countries outside the UK do have adequate protection for personal information under laws that apply to us. We will make sure that suitable safeguards are in place before we transfer your personal information to countries outside the UK which do not have adequate protection under laws that apply to us.

From time to time, your personal information may be transferred to, stored in, or accessed from a destination outside the UK. It may also be processed by staff operating outside of the UK who work for us, or one of our Group Companies or Service Providers.

We share your personal information within the ACE Group. We ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Regulator.
• Where we use certain service providers, we may use specific contracts approved by the UK Regulator which give personal data the same protection it has in the UK.

All information you provide to us is stored on our secure servers. Our servers are hosted in the United Kingdom, and the information is encrypted.

Our service also facilitates the transfer of currency to jurisdictions across the globe. The recipient pay-out partner may request information to verify the identity of the sender. Your personal information will therefore be transferred to the jurisdiction to which you choose to transfer the currency.

For more information about suitable safeguards and (as relevant) how to obtain a copy of them or to find out where they have been made available you can contact us using the details above.

Unfortunately, the transmission of information via the internet cannot be considered completely secure. We do our utmost to protect your personal information; however, we cannot guarantee the security of those transfers. Any transmission of your personal information is at your own risk.

Once we have received your personal information, we will use strict procedures and security controls to try to prevent unauthorised access.

WHAT SHOULD YOU DO IF YOUR PERSONAL INFORMATION CHANGES?

You should tell us without delay so that we can update our records.

DO YOU HAVE TO PROVIDE YOUR PERSONAL INFORMATION TO US?

We are unable to provide you with products and services or to process your application without having personal information about you. Your personal information is required before you can open an account with us, or it is required during the life of that contract, or it is required by laws that apply to us.

In cases where providing some personal information is optional, we will make this clear. For instance, we will say in application forms.

DO WE DO ANY MONITORING INVOLVING PROCESSING OF YOUR PERSONAL INFORMATION?

In this section, monitoring means any listening to, recording of, viewing of, intercepting of, or taking and keeping records (as the case may be) of calls, email, text messages, social media messages, in-person face-to-face meetings, and other communications.

We may monitor where permitted by law and we will do this where the law requires it. In particular, where we are required by the Financial Conduct Authority’s regulatory regime to record certain telephone lines or in-person meetings (as relevant) we will do so.

Some of our monitoring may be to comply with regulatory rules, self-regulatory practices, or procedures relevant to our business, to prevent or detect crime, in the interests of protecting the security of our communications systems and procedures, to have a record of what we have discussed with you and actions agreed with you, to protect you and to provide security for you (such as in relation to fraud risks on your account) and for quality control and staff training purposes.

Some of our monitoring may check for obscene or profane content in communications.

We may conduct carefully controlled monitoring of your activities on your account(s) where this is necessary for our legitimate interests or to comply with our legal obligations. For instance, where we suspect fraud, money laundering or other crimes.

Email exchanges, web chats, telephone calls and in-person meetings between us and you in connection with your application and/or your account(s) may be recorded to make sure that we have a record of what has been discussed and what your instructions are. We may also record these types of calls for quality control and staff training purposes.

PROFILING AND OTHER AUTOMATED DECISION MAKING

This section is relevant where we make decisions about you using only technology, and where none of our employees or any other individuals have been involved in the process. For instance, in relation to transactions, triggers and events such as account opening anniversaries and maturity dates. We may do this to decide what marketing communications are suitable for you, to analyse statistics and to assess lending and insurance risks.

We can do this activity based on our legitimate interests (and they are listed in the section about legal grounds above) only where the profiling and other automated decision-making does not have a legal or other significant effect on you. In all other cases, we can do this activity only where it is necessary for entering into or performing the relevant contract, is authorised by laws that apply to us, or is based on your explicit consent. In those cases, you have the right to obtain human intervention to contest the decision (see ‘rights in relation to automated decision making which has a legal effect or otherwise significantly affects you’ below). Profiling for direct marketing can mean there is a separate right to object (see ‘rights to object’ below).

FOR HOW LONG IS YOUR PERSONAL INFORMATION RETAINED BY US?

Unless we explain otherwise to you, we will hold your personal information for up to 10 years, in accordance with local regulations as applicable, following the termination of our relationship in case of:

(a) queries from you;
(b) legal claims by you; and/or
(c) legal and/or regulatory requirements to which we are subject.

If you would like further information about our data retention practices, please contact us.

We may retain your contact information collected for the purposes of sending you marketing communications in accordance with this policy for as long as you do not unsubscribe from receiving the data from us.

WHAT ARE YOUR RIGHTS UNDER DATA PROTECTION LAWS?

Here is a list of the rights that all individuals have under data protection laws. They do not apply in all circumstances. If you wish to exercise any of them, we will explain at that time if they are engaged or not. The right of data portability is only relevant from May 2018.

• The right to be informed about your processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• The right to object to processing of your personal information;
• The right to restrict processing of your personal information;
• The right to have your personal information erased (the “right to be forgotten”);
• The right to request access to your personal information and to obtain information about how we process it;
• The right to move, copy or transfer your personal information (“data portability”);
• Rights in relation to automated decision-making which has a legal effect or otherwise significantly affects you.



You have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk/

In addition, you have the right, at any time, to object to the processing of personal data for direct marketing purposes.

If you wish to exercise any of these rights against the Credit Reference Agencies or any other intermediary who is the data controller in its own right, you should contact them separately.

DATA ANONYMISATION AND USE OF AGGREGATED INFORMATION

Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It may then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described in this privacy notice.

We will only share anonymised and encrypted data with third parties. We may also provide our partners with anonymous aggregated data about our customers for marketing and analytical purposes, to help optimise our marketing communications.

YOUR MARKETING PREFERENCES AND WHAT THIS MEANS

We may use your home address, phone number, email address and social media (e.g. Facebook, Google and message facilities in other platforms to contact you to send you communications about offers or promotions that we believe are relevant for you based on your previous use. We will only do this if we have a legal ground which allows it under data protection laws – see above for our legal ground for marketing. You can opt out of our marketing at any time by contacting us or by following the instructions on how to do that in the marketing email or other communication.

DATA PRIVACY NOTICES FROM OTHER ORGANISATIONS

We have mentioned that we share your personal information with Card Issuers, Card Dispatcher beneficiary banks, partners who help us to complete your transactions and Credit Reference Agencies. They require us to pass on to your information about how they will use your personal information to perform their services or functions as data controllers in their own right. These notices are separate from our own.

In addition, when you log into your account via Facebook, Google, YouTube, Instagram, Twitter or LinkedIn your data will be processed by these policies and as such your personal information will also be subject to these third-party privacy notices.

In circumstances where you use your Facebook or Google login credentials to create and/or log in to your account your personal information may be processed by Facebook or Google marketing tools. These tools identify individuals with reference to their particular interests or behaviours to those of our customers.

CHANGES IN PRIVACY POLICY

ACE may change this Privacy Policy from time to time. All changes to this Privacy Policy are effective when they are posted on this page. When we change the policy in a material manner, we will let you know via email and/or a prominent notice on our Site. The date of the most recent update is displayed at the top of the page.

Any dispute or claim arising in connection with this Privacy Policy will be considered in relation to the English version only.

Contact Details

You can contact ACE:
Via our website: https://www.aceunion.com
You can also contact our Data Protection Officer if you have any questions about this notice, would like further information about the points raised or to exercise any of your rights. Contact details for our Data Protection Officer are:
Email: [email protected]