Plum Fintech CY Limited and Plum Money CY Limited (we, our, us, Plum) are committed to protecting and respecting your privacy. This Privacy Policy (Privacy Notice) describes how we collect, use, process, and disclose your information, including personal information, as you use, and access the Plum app. This Privacy Notice is designed to help you understand what kind of personal data we collect, and how we process and use this data. It also sets out your rights in relation to how we look after your personal data.

For the purpose of the General Data Protection Regulation (GDPR) the data controller is Plum Fintech CY Limited registered at Libra House, 6th Floor, 21 Panteli Katelari, 1097 Nicosia, Cyprus. If you have any further questions, you can reach our Data Protection Officer on dpo@withplum.com.

Highlights from this policy

We process data collected from you, your bank, and third parties, to make Plum work for you, and comply with regulatory obligations. In short, most importantly we use:

• Your personal details (names, address including email address, date of birth), to comply with our obligations to know our customer;
• Your bank transaction data (but not your bank logins!) to make Plum work, that is to give you insights and recommendations and to determine how much to save for you;
• Data about your use of Plum to help us make Plum better.

We share your data with other companies to fulfil our contract with you, or comply with regulation:

• E-Money Providers (Modulr Finance B.V.) — who maintain the e-wallet which holds your funds.
• Account Aggregation Providers (TrueLayer (Ireland) Limited, Tink AB, ITBS Finance SMPC - trading as “Finker”) — who securely connect your bank account to Plum.
• KYC Provider (Onfido Ltd) — who helps us check the identity information you give us.
• Screening Provider (ComplyAdvantage) — who provides screening (sanctions, PEPs, adverse media) services.
• Direct Debit Provider (GoCardless Ltd) — who manages your direct debits.
• Stock Investing Services (Alpaca Securities LLC).
• Other selected service providers (as these will be communicated to you from time to time subject to GDPR rules).

GDPR gives you the right to see, erase, or challenge the data we hold about you (among other rights). Our support team can help with this. Read the full Privacy Policy for further details on how we use your information.

Information we collect about you

You may give us information about yourself by accessing our website withplum.com, by using the app service or by corresponding with us by email, in app or otherwise.

Information you give us on sign up

This is information necessary to provide the Plum Service (means the products and services made available to you by or through Plum, or through third party provider(s) to fulfil the contract between us) and to comply with regulatory obligations to 'Know Your Customer' (KYC):

• First and last name
• Email
• Address
• Date of birth
• Nationality
• Source of funds/source of wealth (as may be required during the KYC process)

Certain additional information may be collected depending if you have asked for certain services to be offered or provided to you, e.g. occupation, name of employer.

Information you may provide us upon request

This is information we require to unlock additional features upon your request and to fulfil the associated contract, or information we might request from you to perform our regulatory obligations:

• Identity documents and address proof — for example, a picture of your passport or driving licence.
• National insurance number — in order to operate an investment account for you.
• Phone number and previous addresses.

Information we automatically collect from your use of Plum

When you use Plum, or visit our website, we automatically collect information, including personal information, about the parts of the Plum Service you use, and how you use them. This information is necessary for the adequate performance of the contract between us, to enable us to fulfil our regulatory requirements, and given our legitimate interest in being able to provide the Plum Service:

• Information about your device — your visits to and use of the site or the Plum Service (including without limitation your IP address, geographical location, browser/platform type and version), internet service provider, operating system.
• Information about your use of the product — length of visit, page views, website navigation and search terms that you use, referral source/exit pages.

Information we receive from third parties

We receive the following personal information about you from our third party service providers who assist us in providing some or all of the Plum Service:

• Your bank (through our Aggregation Providers) — bank account number, sort code, balances, and transaction data, in order to fulfil the contract with you.
• Our KYC/CDD providers — in order to perform money-laundering, sanctions, PEPs and other checks.
• Public and Commercial Sources — in order to perform our KYC obligations, we might collect information from public sources such as sanctions lists or credit reference agencies.

How we use the information we collect from you

We only process your information where we have a lawful basis for doing so.

To provide and improve the Plum product — we process the information we collect given our legitimate interest in improving the Plum Service, and in order to fulfil the contract we have with you:

• Provide you with access to Plum, and to enable your interaction with Plum
• Provide customer service, including, sending you support messages, updates, security alerts, and account notifications;
• Provide you with insights, and balance updates (if you've opted into this);
• Provide you with recommendations for products we feel may be of interest or benefit to you;
• Comply with the applicable laws and regulations;
• To administer our site and the Plum Service and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.

To prevent misuse and fraud, and ensure compliance with laws and regulatory obligations — we process the information we collect given our legitimate interest to protect us from fraud, and to comply with our regulatory obligations:

• Detect fraud;
• To verify your identity, and check it against sanction lists;
• To keep our platform secure.

Others we share your data with

Service providers — In order to fulfil the contract we have with you, we use certain trusted service providers. These providers will each handle your personal data in accordance with their own Privacy Policy. The most important service providers are highlighted below:

• Aggregation Providers (TrueLayer (Ireland) Limited, Tink AB, ITBS Finance SMPC - trading as “Finker”) — We use account aggregation providers to help us to provide the Plum Service by securely accessing your bank account information ("Account Aggregators"). By using the Account Aggregator's service, you agree and grant them permission to aggregate your personal data, which may then be stored outside of your own country subject to constraints provided by GDPR.
• E-Money Providers (Modulr Finance B.V.) — E-Money Providers help us to provide the Plum Service by providing you with an e-wallet. We will share data with E-Money Providers to fulfil the contract we have with you, and the contract you have with them. E-Money Providers might pass your data on to its own sub-contractors and partners when this data is necessary to fulfil its legal and regulatory obligations as an issuer of electronic money.
• Payment Services Provider (GoCardless LTD) — GoCardless LTD provides you with a direct debit service which is necessary to fulfil the contract we have with you. We will share personal information required to set up a direct debit payment to enable your Plum savings.
• Stock Investing Provider (Alpaca Securities LLC) — provides you with access to stock trading. We will share personal information required to set up a stock investing account to enable you to invest in stocks.
• KYC Provider (Onfido LTD) — Plum will share your personal information (address, names, date of birth, national insurance number if provided), with Onfido LTD in order to verify your identity, and cross-check your identity against sanction list, in order to comply with our regulatory obligations.
• Screening Provider (Comply Advantage) — Plum will share your personal information (address, names, date of birth, national insurance number if provided), with ComplyAdvantage for sanctions, PEP and adverse media checks.
• Customer Services Support (Intercom R&D Unlimited Company) — Data shared with Plum will be made available on platforms that we use for communication with you though our Customer Support team.
• Government Entities — In order to comply with our regulatory obligations to report trading activities and/or activity suspected to be money laundering we might share your information with government entities responsible for this. We may be required by the Central Bank of Cyprus (CBC), the European Banking Authority (EBA), the De Nederlandsche Bank, the Cyprus Securities and Exchange Commission (CySEC) or the Financial Ombudsman of the Republic of Cyprus to share personal data with them.

Other Plum users — in providing a referral programme there is a legitimate interest in sharing your Plum name with the person who invited you, to let them know the invite was successful and in order to fulfil the invite terms.

Aggregated Data — we may also share aggregated information (information about our users that we combine together so that it no longer identifies or references an individual user) and non-personally identifiable information for industry and market analysis, demographic profiling, marketing and advertising, and other business purposes. This is not considered personal data under GDPR as it can’t be used to directly or indirectly identify you.

Business Transfers — in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets. If Plum Fintech CY Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.

Co-branded and Promotional — From time to time we may work with other partners to offer you co-branded services or promotional offers, and we will share some of your personal data with those partners.

Retention Periods

We generally retain your information for as long as it is necessary for the performance of the contract we have with you, or to comply with our regulatory obligations. If you no longer want us to use your information you can send a request to dpo@withplum.com. Please note that if you request erasure of your personal data, we will keep relevant personal information for at least 5 (five) years following the end of our business relationship with you to comply with our regulatory obligations as specified below.

Your Rights under GDPR

A great thing about the GDPR is that consumers have much more control over how companies like Plum use your data. See below how you can assert those rights with Plum.

Getting a copy of your data — you have the right to get a copy of the data we hold about you. This is free of charge. To do this, please reach out to dpo@withplum.com, or talk to our support team by typing 'chat to human' in the Plum App.

Rectification of inaccurate or incomplete information — you have the right to ask us to update any information we hold which may be inaccurate, and which you can't change yourself through the Plum App.

Erasure of data or the right to be 'forgotten' — you have the right to ask us to erase personal information we hold on you, and close your Plum account. In order to exercise this right and request the erasure of your personal data, you should reach out to dpo@withplum.com, or talk to our support team by typing 'chat to human' in the Plum App. If you do this, we will maintain personal information we hold on you which is necessary to comply with our regulatory obligations, or to reduce fraud. In particular, under the anti-money laundering rules we are obliged to keep the following records for five (5) years from the date on which your last transaction has completed or the business relationship with Plum has come to an end:

• The full name(s) and email(s) you’ve used to sign up to Plum;
• Residential address and date of birth;
• Your bank account number and sort code and the history of Plum transactions only (deposits, withdrawals, investments, divestments and bonuses); and
• Any identity document copies including driver’s license or passport.

Withdrawing consent, and restricting processing — to withdraw consent or restrict processing you may contact customer support. If you withdraw consent to share your financial transaction data, we will be unable to provide the Plum Service to you. Some information you have provided us will be retained after you withdraw consent to comply with regulatory obligations as explained above.

Lodging complaints — you have the right to lodge a complaint with the Information Commissioner's office for any processing carried out by Plum. You can contact the Office of the Commissioner for Personal Data Protection contact information can be found here.

Marketing

We may send you certain direct marketing communications if it is in our legitimate interests to do so for marketing and business development purposes, or you have provided us with your consent to do so.

You can withdraw this consent by contacting us in app or by email at complaints@withplum.com.

Where we store your data

All information you provide to us is stored on our secure servers. Any transmission of information to our partners (including information to facilitate payments) are encrypted using TLS technology, the current standard in secure communications over the Internet. Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.

Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. Information we deem sensitive (like your bank account number and sort code and your national insurance number if provided) are stored using state-of-the-art symmetric encryption (AES). We will only send your data outside of the European Economic Area ('EEA') to comply with a legal obligation, or when we work with third parties in providing you the Plum Service. If we do transfer your personal information outside the EEA to our suppliers, we will make sure that it is protected to the same extent as in the EEA.

Changes to our Privacy Policy

Any changes we may make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail or by any instant messaging service we use to provide the Plum Service. Please check back frequently to see any updates or changes to our Privacy Policy.

It is important that you read the Privacy Policies of our third party service providers and partners.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to dpo@withplum.com.