Privacy Notice

Ace Union Limited: Privacy Notice
(Effective from and including 1st November 2021)

Our contact details

Ace Union Limited (“Ace Union”) is a company incorporated under the laws of England and Wales with company registration number 09530233. Our registered office address is Piccadilly House, 49 Piccadilly, Manchester M1 2AP, United Kingdom.

You can reach our Data Protection Officer using the contact details below:

Mr Mohammad Naeem, Ace Union Limited, Piccadilly House, 49 Piccadilly, Manchester, M1 2AP

Email:      [email protected]
Phone:    +441614140040

What is a privacy notice?

Ace Union take protecting your personal data seriously. We believe in your privacy rights as a data subject under The Data Protection Act 2018 (“DPA”) which is the UK's implementation of the General Data Protection Regulation (GDPR).

This Privacy Notice provides you (our “customer”, “data subject”) with important information such as:

  • confirming that Ace Union act as a data controller;
  • how to contact our Data Protection Officer (“DPO”); and
  • the purposes for which Ace Union collect, use, share and retain your personal data defined under DPA as any information relating to an identified or identifiable natural person (“data subject”).

We will inform you in this Privacy Notice of:

  • why we process your personal data;
  • what purpose we are processing it for;
  • how long we store it for;
  • other recipients of your personal data; and
  • any transfer of your personal data to another country.

We are committed to protecting and keeping your personal information private - whether we receive it from you directly or from third parties - and we will take all reasonable steps to ensure its security.

Ace Union as a Data Controller

Data controller is a legal term under UK data protection laws. Ace Union is registered with the Information Commissioner’s Office (“ICO”) in the United Kingdom (“UK”) as a data controller under registration number: ZA565263.

Ace Union as a data controller:

  • decides how and why your personal data is collected and processed;
  • decides what the purpose or outcome of any processing is;
  • decides what personal data should be collected;
  • decides which individuals we collect personal data about (for example our customers or employees); and
  • can makes decisions about our customers or employees as part of or as a result of any processing of personal data.

Ace Union exercise professional judgement in the processing of your personal data and as a data controller we have complete autonomy as to how personal data is processed.

The type of personal information we collect

When you download our App (iOS and Android) we collect and process a range of information. For example:

  • basic personal identifiers, contacts and characteristics (for example, your first and last name, home address, date of birth and up to date contact details);
  • any data Ace Union require to comply with legal and regulatory obligations (for example identification documents such as passport, utility bills or driving licences; and financial details such as source of funds, bank statements, source of wealth as and when required);
  • any online identifiers such as your IP address, location data or device data; and
  • any information about you in your role as either a sole trader or company director.

Ace Union have a lawful basis for relying on processing your information where we have:

  • your consent which you can remove at any time. You can remove consent by contacting us on the contact details within this Privacy Notice;
  • you are a customer because we have a contractual obligation (see our Terms and Conditions);
  • we have a legitimate interest; and
  • we have a legal obligation.

As per our Terms and Conditions you explicitly consent to us collecting, accessing, processing, sharing and retaining any information you provide to us, for the purposes of providing products and services to you. This does not affect your respective rights and obligations under UK data protection legislation.

You may withdraw such consent by closing your Account. If you withdraw consent in this way, we will cease using your data for the purpose of offering payment services and e-money.

We may continue to process your data for other purposes where we have lawful grounds to do so, such as where we are legally required to keep records of transactions.

Special Category Data:

Special category data is a type of personal data that needs more protection because it is sensitive. For example, data revealing criminal convictions or ethnic origin. If we require special category data during our business relationship with you as our customer, and for any reason we require explicit consent in relation to special category data then we will contact you. Additional grounds for processing may apply, for example, the use of such data is necessary for the purpose of preventing unlawful acts or making a report to external authorities in line with our legal obligations.

Regulation and Law:

The main aims under the UK’s DPA are:

  • to protects individuals such as our customers by controlling how their information can be used; and
  • enables organisations (such as Ace Union) to use personal information to benefit business needs (in our case to offer you payment services and e-money).

UK’s DPA is based around principles such as:

  • fair, lawful, and transparent processing of your personal data;
  • limiting the purposes for collection and use of your personal data;
  • minimising data where possible;
  • maintain accurate records of personal data (also applies to the accuracy of personal data provided by you);
  • data retention periods;
  • data security; and
  • accountability.

The Payment Services Regulations 2017 (regulation 97) states that we must not access, process or retain any personal data for the provision of payment services we offer you, unless we have your explicit consent to do so. Such consent is given by you within our app.

Money Laundering and Data Protection laws:

The Fifth Money Laundering Directive (5MLD) came into force in the UK on 10th January 2020. The 5MLD, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Money Laundering and Terrorist Financing (Amendment) Regulations 2019 (together, the MLRs) require Ace Union to collect and retain significant amounts of personal data for example in relation to performing checks to verify your identity.

How we store your information

Your information is securely stored using AWS which is a cloud computing model that stores your data securely. AWS manage and operate data storage on our behalf. Ace Union protect the information received from you against unauthorised access, use, or disclosure. We will retain your personal data for as long as necessary under the UK's MLRs and for the purposes described in our terms and conditions and this privacy notice which for in the majority of cases will be for a period of 5 years from the end of a business relationship with Ace Union.

After we are no longer required to store your personal data it will be destroyed using permanent erasure solutions such as overwriting or degaussing.

Ace Union will not keep personal data for longer than we need it.

Third parties who process your information on our behalf

Ace Union use several third-party service providers who assist us as we offer payment services and e-money to our customers. Such third parties are data processors acting on our behalf and they follow our instructions regarding the processing of personal data. We share your data will following third parties.

ACE Group Companies

We share your personal data within the ACE group of companies in order to provide you service.

Parties who help us to meet our regulatory obligations

We share your data with parties and service provider who help us to complete KYC checks on you and perform Anti Money Laundering and Anti-Terrorist Financing checks. We also share your data with service providers who help us to save you and ourself from fraud.

Third parties to whom you send money

Where you send money from your ACE wallet, we will provide the receiver with your details including name and IBAN.

Entities who help us to provide you services

We share your data with entities who provide us IT, Payment, delivery, banking, payment network, card issuer, manufacturer services including Visa and Mastercard.

Social Media and Advertising Companies

We share your data with our social media and advertising partners who help us to send our adverts and service updates to you or to people who have similar profiles as of yours. We also share data with parties who help us to monitor and track data about visitors to our website and mobile apps. It does this by storing cookies on your browser. Please refer to our Cookies Policy found here for further information.

We may collect this data to allow us to better understand the functionality of our app. We may record information such as how often you use our app, events that occur within it, aggregated usage, performance data, and where our app was downloaded from. We do not link the information we store within the analytics software to any personal data you submit within our app. We may use your personal data to provide you with certain types of marketing communication that we believe will be relevant and of interest to you. This helps us to provide a more personalised service. We will always endeavour to make these communications relevant. You retain a legal right to object to marketing communications from us at any time (see section in this Privacy Notice titled “Your data protection rights” ).

Data Transfer outside UK

UK DPA provides for safeguards for when we transfer any personal data abroad or make it available to persons overseas.

If the recipient is in the EEA or a country deemed to be “adequate” then no further safeguards will be needed. The following countries and territories have a full finding of adequacy:

Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay as well as UK to EU and vice versa.

The following countries and territories have partial findings of adequacy:

  • Japan: adequacy covers private sector organisations;
  • Canada: only covers data that is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Not all data is subject to PIPEDA.

We rely on Standard Contractual Clauses (SCCs) when transferring your data outside the UK to a country who are not deemed adequate.

Ace Union transfer your personal data to employees who are based in Pakistan under SCCs. The UK Government have ruled that SCCs offer sufficient safeguards, meaning they are acceptable methods to transfer data out of the UK.

Your data protection rights

Under the UK’s DPA you have rights including:

  • Right of access: you have the right to ask us for copies of personal information we retain;
  • Right to rectification: you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Right to erasure: you have the right to ask us to erase your personal information in certain circumstances – please see section in this notice regarding record keeping requirements under the UK’s MLRs;
  • Right to restriction of processing: you have the right to ask us to restrict the processing of your personal information in certain circumstances; and
  • Right to object to processing: you have the right to object to the processing of your personal information in certain circumstances for example for direct marketing purposes.
  • Right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances:
    • you will receive your personal data in a structured, commonly used and machine-readable format (for example an open format like CSV, XML or JSON);
    • you can request that we transmits this data directly to another data controller;
    • your rights do not create an obligation for Ace Union to allow you more general and routine access to our systems – only for the extraction of your personal data following a data portability request; and
    • your rights do not create an obligation for Ace Union to adopt or maintain processing systems which are technically compatible with those of other organisations. Ace Union will take a reasonable approach which will not create a barrier to transmission.

You are not required to pay any charge for exercising your rights under law. If you make a request, we have one month to respond to you.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at using the contact details provided within this Privacy Notice.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

Helpline number: 0303 123 1113

ICO website:

Get in touch