Privacy Notice

• 6th Floor
• 2 Grand Canal Square
• Dublin 2, D02 A342,
• Ireland

• If you are an End-User using either:
  1. our AIS product, through a software tool (the “AIS Tool”); or
  2. our Verification product, through a software tool (the “Verification Tool”)
  which you can use to transmit information (including Personal Data) relating to payment accounts (“Account Information”) that you hold with Account Servicing Payment Service Providers (i.e. any payment service provider, such as a bank or a credit card issuer that maintains an online payment account on your behalf) (“ASPSPs”) to you and your Provider, in accordance with the End-User Terms of Service. When you use the AIS Tool or Verification Tool, we will collect and process the Personal Data contained in the Account Information retrieved from your ASPSP. We may also collect and process Personal Data provided to us by your Provider.Our AIS Tool and/or Verification Tool may merge or aggregate Account Information retrieved from a particular ASPSP with Account Information retrieved from other ASPSPs where you have consented to us accessing and transmitting such information. Our AIS Tool and/or Verification Tool may store your Account Information if this forms part of the Services we are delivering to your Provider, for example, if it is necessary for the functioning of your Provider’s app.
• If you are an End-User using our payment initiation services (“PIS”) product, through a software tool (the “PIS Tool”) which you can use to consent to and authorise a payment as specified by your Provider; this may require that your ASPSP sends us your bank account details. When you use the PIS Tool, we will collect and process the Personal Data that you provide to us (e.g. any Personal Data you include in the payment reference) in order for us to provide the PIS Tool. We may also collect and process Personal Data contained in your bank or payment account details shared with us by your ASPSP.
• If you have registered to use the TrueLayer End-User Portal or console we will collect and process your name, email, username that you provide to us in order to access the End-User Portal and the information about your use of the relvant Tool.
• Through email when you communicate with us.
• When you visit our Site.
• When you provide us with your marketing preferences.

• through our Site when you register as a Customer or use our Services;
• through email when you communicate with us;
• through information that you provide to us, and from third party sources such as Companies House and LexisNexis for due diligence and onboarding purposes;
• when you visit our Site; and/or
• when you provide us with your marketing preferences.

• through cookies or similar tracking technologies that we have set on our Site; and/or
• when you provide us with your marketing preferences through the Site.

• our contractual obligations and rights in relation to the Personal Data involved (including the End-User Terms of Service);
• legal obligation(s) under applicable law to retain data for a certain period of time;
• whether we relied on your consent to use the Personal Data, but you have since withdrawn your consent;
• statute of limitations under applicable law(s);
• our legitimate interests where we have carried out balancing tests;
• fraud and risk management;
• (potential) disputes; and
• guidelines issued by relevant data protection authorities.

• if we reasonably consider that we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation;
• we need to perform, enforce or apply our End-User Terms of Service and other agreements;
• to protect the rights, property, or safety of TrueLayer, our customers, or others;
• if we have to do so to fulfil our legal and regulatory obligations, including, for example, to fraud agencies, regulators and/or ASPSPs for fraud investigations;
• with partners or suppliers who process Personal Data on our behalf (such as our professional advisers, payment schemes, auditors or IT suppliers) - we take the security and protection of your Personal Data seriously and only allow such suppliers to use your Personal Data for specified purposes and in accordance with our instructions;
• with third parties to whom we may sell, transfer or merge parts of our business or assets. If a change like this happens to our business, the new owners may use your Personal Data in the same way as set out in this Privacy Notice; and/or
• to another company in our group, if this is necessary to ensure continuity in the provision of Services to you (including in relation to the UK’s withdrawal from the European Union), or to reflect any business reorganisation or expansion that we may engage in from time to time.

• you have given your prior written authorisation; or
• there is an appropriate transfer agreement or other approved transfer mechanism in place such as Standard Contractual Clauses or an adequacy decision by the European Commission.

• provide you with, and continuously improve our Services;
• enhance your experience of our Site;
• better understand how our Site is used;
• help our merchants better understand the uses of their platform and
• help our merchants to enhance your customer experience.

Managing cookies

1. the purposes of processing;
2. the categories of Personal Data concerned;
3. the recipients of your Personal Data;
4. the period for which your Personal Data will be stored;
5. the existence of your right to lodge a complaint with the Data Protection Commission; and
6. the source of your Personal Data

• your name,
• your address,
• the details of your Provider, and
• the period of data you would like access to.

1. where you contest the accuracy of your Personal Data;
2. where the processing is unlawful, and you do not want us to delete your Personal Data;
3. where we no longer need your Personal Data for the purposes of processing, but you require the data in relation to a legal claim; or
4. where you have objected to us processing your Personal Data pending verification as to whether or not our legitimate interests override your interests or in connection with legal proceedings.

1. we process your Personal Data with your consent or where it is necessary to perform our contract with you; and
2. the processing is carried out by automated means.

• Personal details: name, date of birth, full address(es), email address, phone number, gender;
• Bank account information:
  • Account type (e.g. current, saving, investment, credit card);
  • Account name;
  • IBAN/Account number/Sort code/SWIFT;
  • Currency;
• Account balance information:
  • Current balance;
  • Available balance (credit cards);
• Transactions;
  • Time;
  • Description;
  • Amount;
  • Meta-data (arbitrary data that banks associate with a transaction e.g. category); and/or
• Additional data which TrueLayer may collect in the future (as confirmed in writing from time to time):
  • Loans data when available;
  • Insurance data when available; and/or
  • Investments data when available;
  • Payment due date (credit cards) when available; and/or
  • Minimum payment due (credit cards) when available.