Welcome to TrueLayer!

Thanks for using TrueLayer!

If you are located in the UK, we're TrueLayer Limited, registered in England and Wales (company number 10278251) with our office at Part Ground Floor (East), Floors 6 and 7, The Gilbert, 40 Finsbury Square, London, EC2A 1PX.

If you are located in the EEA, we’re TrueLayer (Ireland) Limited, registered in Ireland (company number 671615) with our registered office at 6th Floor, 2 Grand Canal Square, Dublin 2, D02 A342, Ireland.

We refer to ourselves as “we” or “us” throughout these Terms.

These simple rules ("Terms") apply whenever you use our Services. You will likely be accessing the Services through one of our Merchant customer’s (“Merchant”) apps or websites.

Each time you use our Services, you're agreeing to the latest version of these Terms. If you don't agree with them, unfortunately, you won't be able to use our Services.

You can find out more about how we look after your information in our Privacy Notice and how we use cookies in our Cookie Policy – both are included in these Terms.

Who we are

We are not authorised to give you any financial or investment advice. Our Services do not amount to financial or investment advice.

Restrictions on our Services

Our Services are provided to you only, so please don't share your bank login details with anyone else.

By using our Services, you agree that:

• You won't use our Services to do anything fraudulent, illegal, or harmful.

• The bank login details you use are yours, and you have the okay to connect your bank accounts to our Services.

• You live in the EEA (that's the European Economic Area).

If we think that these rules aren't being followed, or if it's against the law for us to provide a Service to you, we might have to say no. If that happens, we'll let you know through the app or website, unless the law stops us from doing so.

Authentication

Once you select your bank and Payment Account, we will redirect you to your bank (either on a web browser, or your banking mobile app) where you will need to log in using your credentials (e.g. a password and biometric credential such as a fingerprint).

Neither TrueLayer nor the Merchant will be able to see or access your bank login credentials at any time.

Alternatively, some banks support what is called an ‘embedded flow’ for authenticating with your bank. This flow will in some instances require you to provide your login credentials to us so we can securely transfer them to your bank. This transfer is encrypted. We will only use your credentials to complete the Services you have explicitly consented to us providing.

Revocation of consent

We will only provide our Services to you if you provide us with explicit consent to do so. You can revoke your consent at any time, either through your mobile banking app, by contacting your bank or in some instances with your Merchant.

Data Services

Account Information Services (AIS)

Our Account Information Service (AIS) means you can:

• access and view Account Information stored in your Payment Accounts; and

• with your explicit consent, share that Account Information with a chosen Merchant or other third party.

We do this for you in a few ways, depending on what you request:

• We can consolidate your Account Information from different banks and show it to you through the app or website you're using.

• We can securely share your Account Information with a Merchant (like a credit checker) so they can provide a Service you've asked for.

• We can use the Account Information ourselves, to help you choose a bank account from which to make a payment when using our Payment Services.

You explicitly consent to us accessing your payment account, retrieving your Account Information, processing your personal data to do so and storing your name, bank account number and provider to facilitate any future payment services you receive from us. We will not store any Account Information you share.

How this works

On our Merchant’s app or website, you will be directed to a page where you will be asked to:

• provide us with explicit consent to provide the AIS

• select the bank and Payment Account you want us to connect to

• choose the Account Information you want to share

Once you authenticate yourself to your bank, we will be able to access the Account Information and share it as per your instructions. We will do this as soon as you complete the steps above so there is no opportunity to cancel your consent for this initial sharing of Account Information.

Account Information can include any, some or all of the following:

• Your name

• Transaction history (including transaction amounts and descriptions)

• Account name, number and sort code

• Account currency

• Account balance (including overdraft balances)

• Payment due dates

We will only request the Account Information you ask us to and we will only use it as explicitly requested by you. If a bank sends us additional information, we will delete it immediately.

The Account Information we share will be a snapshot as of the date and time at which we accessed the account.

If you want us to continue sharing Account Information over an extended period of time, you will need to re-authenticate with us every 90 days (for a UK bank) or 180 days (for an EU bank).

Verification Services

Our Verification Service is a type of AIS, therefore the existing AIS Terms also apply to it.

It allows you to verify your identity against Account Information obtained through AIS.

How this works

You will be asked to verify your identity by a Merchant. They will then give you the option to use our AIS to share certain Account Information with us solely for the purposes of verifying you. Once we obtain your Account Information, we will compare it to the data given to us by your Merchant. (e.g. we compare the name held on your bank account with the name you provided to your Merchant).

Once this process is complete, we will let your Merchant know if the details match or not.

Payment Services

Payment Initiation Services (PIS)

Our PIS enables you to initiate a payment, or payments, from your Payment Account to a Merchant. We will instruct your bank to make the payment on your request.

You explicitly consent to us initiating your payment, processing your personal data to do so, sharing this personal data with the person you are paying and storing/using your name, bank account number and provider to facilitate any future payment services you receive from us.

How this works

When you checkout or go to the payment page on your Merchant’s website or app, you will see the option to Pay by Bank. If you choose this option, you will then be asked to

• provide us with explicit consent to perform the PIS

• select the bank and Payment Account you want to make your payment from

• instruct us to initiate a payment of your chosen amount to the Merchant

Once you authenticate yourself to your bank (see Authentication) we will initiate the payment which will then be completed by your bank.

The money will leave your account right away, or at the very latest, within two hours. We'll send you a confirmation (or your Merchant will) with a unique code and the payment amount for your records.

If you choose to make a single payment, our payment Service is over once we have instructed your bank to initiate the payment.

If you want to set up your bank account so you can make future payments to your Merchant without being redirected to your bank each time, you can establish a ‘mandate’. This mandate works by setting the limits within which your payment can be made (e.g. how often, how much). A payment can then be initiated on your behalf automatically when you buy something from that Merchant and choose this payment method. Instead of providing explicit consent for a single payment you are consenting to multiple payments provided that they fall within the limits agreed in the mandate.

For any payment the amount or mandate will be clearly displayed to you before we instruct your bank.

When you make a payment (single or recurring) into one of our Merchants’ accounts, we will identify the bank account and bank you used and may preselect these for you when you make a future payment through our Services.

Just so you know, your bank handles the actual payment, not us. We don't charge you anything for our Service, but your bank might have their own fees. Check their terms and conditions for details.

If you think that your payment may have been incorrect, unauthorised, or not properly executed, then you need to contact us or your bank as soon as possible (and no later than 13 months after the date executed) so that we can investigate.

MyBank (Italy Only)

If your Payment Account is located in Italy, we may use a Service called MyBank to facilitate your payment. This will be clearly highlighted as part of your bank selection process.

More information on MyBank can be found at www.mybankpayments.eu

Direct Debits

We can help you to securely establish a Direct Debit mandate with your Merchant so that future payments can be taken without the need to reauthenticate yourself with your bank.

How this works

When you checkout or go to the payment page on your Merchant’s website or app, you'll see an option to use Direct Debit for future orders.

If you choose this, we'll start by initiating your initial payment to the Merchant from your bank account via PIS. We'll then use your bank details (name, account number, sort code) from that payment to create a Direct Debit mandate for the Merchant. If you approve it, that Merchant can then take payments directly from your account for future purchases.

Save my details / Remember me

When you use our Services, we will keep a record of that use and may use limited information from it to improve your future checkout experience. This could be by pre-selecting a bank provider or Payment Account you have used before.

In addition, you may want us to store additional information about you to speed up and simplify future payments. You can do this by opting in where indicated.

How this works

As part of your payment checkout process you may be shown an ‘opt in’ tickbox where you can indicate your request to save your details. When you ‘opt in’, you agree to these Terms.

Where we hold personal data about you as a result of providing you with a Service, we will use it to pre-populate certain information in a checkout once we are certain it is you checking out. This could include your name, email address, date of birth, account number/sort code/IBAN and/or billing/shipping address. The data we have will be determined by the Services you have used previously.

You will always be given the chance to amend the data or input it manually.

If, at any time, you wish to opt out of this Service, you can do so as part of a future payment or via the following link. For more information about the personal data we process, please see our Privacy Notice below.

Signup+

Our Signup+ Service allows you to make a payment and verify yourself to a Merchant at the same time (e.g. for registration purposes).

How this works

Some Merchants will require you to identify yourself prior to using their Services. You may be directed to our Signup+ option where data will be obtained about you in one of two ways:

• AIS Option

  • You will be asked to use our AIS to share certain Account Information with us and your Merchant.

• PIS Option

  • When you make the PIS payment, you agree that we can use the data we collect as part of that payment to identify you.

Once we have the complete set of information about you, we will provide it to your Merchant or verify it against data they have provided to us for that purpose. If the details match, your account ID will be completed.

If the Account Information you initially share through AIS or PIS is not sufficient to satisfy your Merchant’s ID requirements, we will also share it with our third party data provider, Equifax Limited, who will return the information required to register you on that Merchant website. We will then share that information with the Merchant.

Equifax is a credit reference agency and will use your Account Information solely for the purposes of enabling our Signup+ Service. This search will have no impact on your credit rating. For more information about Equifax, please read their Credit Reference Agency Information Notice.

Protecting You

We will contact you via email if necessary where we identify any actual or suspected fraud or security threats.

We understand that sometimes things go wrong, and an unauthorised payment might happen from your bank account, even when you're using our Service to initiate it. Here's how your liability works in those situations:

When You're Not Liable (No Cost to You): You can claim back from your bank any losses from an unauthorised payment if:

• You couldn't have known that your personalised security credentials (like details you use to authenticate with your bank through) were lost, stolen, or misused before the payment was initiated.

• The unauthorised payment happened because your bank failed to apply the required strong security checks when you initiated the payment through our Service.

• The payment was initiated after you told us or your bank that your personalised security credentials used for initiating payments through our Service were lost, stolen, or compromised.

When You Might Be Partially Liable (Up to £35): If an unauthorised payment occurs because your personalised security credentials were misused, or if you didn't keep them safe, you might be responsible for losses up to a maximum of £35.

When You're Fully Liable (All Losses): You will be responsible for all losses if:

• You acted fraudulently (e.g., you deliberately initiated the unauthorised payment or helped someone else do it).

• You intentionally, or with significant carelessness (gross negligence), failed to keep your personalised security details safe.

Other relevant terms and conditions

Remember, your use of a Merchant’s services and your bank account is covered by their own terms and conditions. We aren’t responsible for your bank or the Merchant from whose website or app you access our Services. You should contact them in the event of any issues with their Services.

We don't charge you to use any of our Services, but the Merchant might have fees for using their website or app.

Each Merchant pays us for providing our Service to them. Any issues with a Merchant's products or Services are handled by them, not us.

Intellectual Property

We own everything related to our Services, website, and technology. If you give us feedback or ideas, we can use them to improve things without any restrictions.

Disclaimers

We provide our Services as they are, when they're available. While we work hard to provide a great Service, we can't guarantee that everything will always work perfectly for you. This doesn't change your legal rights as a consumer.

As much as the law allows, we can't offer additional warranties beyond what we've stated in these Terms.

If you break these Terms and it causes us a loss, you'll be responsible for those costs.

Who is responsible if things go wrong?

We’ll always follow the law but we're only responsible for problems we could reasonably predict. If we breach these Terms and it causes you loss or damage, we'll take responsibility for that, but we’re not responsible for the following:

• unexpected or consequential losses (i.e. we could not predict the issue or resulting loss)

• your loss or damages if you breach these Terms

• things out of our control like power outages, pandemics, or natural disasters

• if your account is hacked or accessed without our control.

If you think someone is using your bank details to access our Service, email us right away at [email protected].

If you see any suspicious activity on your bank account after using our Service, contact your bank immediately. They'll investigate and handle refunds. Check their complaints policy.

About these Terms

Each time you use our Services, you agree to the latest Terms. These Terms apply for as long as you use our Services and you can't use our Services if you don't agree to the latest Terms.

We can terminate the Terms or stop you from using our Services if you break the rules or if we are required to by law. Termination will be effective on 2 months notice. You can also end the agreement by contacting our Client Care team.

We can change these Terms at any time. The change will become effective 2 months after we have posted the changes on this page, unless we need them to be effective sooner to comply with the law. If you don't like the changes, you will have to stop using our Services.

You can download these Terms or contact our Client Care team and ask for a copy.

Accessibility of our Services

We're committed to making our Service accessible for everyone, in line with the EU Accessibility Act. It's designed to be perceivable, operable, understandable, and robust. For more details, please contact our Client Care team.

Complaints

We want to make things right if you're not happy. If you have a complaint, the quickest way to get help is to contact our Client Care team and select “New Ticket” > “Make a Complaint”.

You can also email us at [email protected] or write to us at:

• UK: TrueLayer, Client Care, Part Ground Floor (East), Floors 6 and 7, The Gilbert, 40 Finsbury Square, London, EC2A 1PX.

• EEA: TrueLayer, 25-28 North Wall Quay, Dublin 1, D01 H104, Ireland.

We'll get back to you within 3 working days and aim to resolve your issue within 15 days. We might need to contact the Merchant or your bank to help, and we might need your help too. We'll send you updates by email.

If you are a consumer, micro-enterprise or other eligible complainant and you are not happy with our response, you have the right to refer your case to:

• UK: the Financial Ombudsman Service by calling them on 0800 023 4567, via their website or by post at The Financial Ombudsman Service, Exchange Tower, London, E14 9SR

• EEA: the Financial Services and Pensions Ombudsman by calling (01) 567 7000, via their website, or by post (Financial Services and Pensions Ombudsman, Lincoln House, Lincoln Place, Dublin 2, D02 VH29, Ireland)

Governing Law and Jurisdiction

• UK: These Terms are covered by English law. You can take legal action in English courts. If you live in Scotland or Northern Ireland, you can also take legal action in your local courts. All disputes are handled under English law.

• EEA: These Terms are covered by Irish law. You can take legal action in Irish courts. All disputes are handled under Irish law.

If you're a consumer, you have the legal rights that your home country gives you. These Terms don't take away those rights.

You can also use the European Commission's online dispute resolution platform to help settle any problems from online transactions, including those related to our Services.

Entire Agreement

These Terms are the entire agreement between you and us in relation to the Services and replaces any other agreement we may have entered into previously.

Transfer of Your Rights

You can’t transfer your rights under these Terms to any third party without our written consent.

Modification and Severance

If any part of these Terms isn't valid, we'll either change it to make it valid or remove it. This won't affect the rest of the Terms.

Waiver of Rights

If either of us doesn't use a right or solution we have under these Terms or the law right away, it doesn't mean we lose that right. We can still use it later. And if we do agree to give up a right, it only counts if it’s in writing.

Communication, Translation and Language

Any and all communication between us in relation to these Terms will be conducted by email. This includes where we need to provide you with information or notifications in relation to our Services that are required by law.

While we provide translations of our Terms, the English language version takes precedence. If you contact us, we will always try our best to communicate with you in a language you understand.

Contact Us

For specific issues (e.g. a complaint or to opt out of a Service) please see the relevant sections above. If you have any general queries our Client Care team will be happy to help. Just raise a ticket via this link.

Consumer Privacy Notice

Dated: 25 September 2025

Overview

This Privacy Notice explains how we collect, store, process and protect your personal data when providing you with our Services. Please read it carefully before using our website, console or other web applications (collectively the "Site") or any of our Services.

Any questions? Email us at [email protected].

If you are located in the UK, we're TrueLayer Limited, registered in England and Wales (company number 10278251) with our office at Part Ground Floor (East), Floors 6 and 7, The Gilbert, 40 Finsbury Square, London, EC2A 1PX. We are registered as a data controller with the Information Commissioner's Office ("ICO") under number ZA797592.

If you are located in the EEA, we’re TrueLayer (Ireland) Limited, registered in Ireland (company number 671615) with our registered office at 6th Floor, 2 Grand Canal Square, Dublin 2, D02 A342, Ireland.

In this Privacy Notice, TrueLayer will be referred to as "we", "us", or "our".

When referring to you, we simply use the word “you”.

What personal data do we collect?

The table below sets out the personal data that we collect, process and in some instances store when you use our Services. We don’t always process the full extent of this data, but it sets out the maximum amount we will process for each specific Service.

We respect your privacy. Before using your information, we always make sure it's truly necessary and that it doesn't negatively impact your rights. We only use your information for the reasons we collected it (which we've explained). If we need to use it for something different, we'll let you know why and what legal reasons allow us to do so.

The TrueLayer Network

When you use our Services, we will create a user profile for you. The user profile will keep a record of each Service that we have provided to you and contain the information set out in the table above. We use your user profile to provide you with the best possible experience when using our Services as well as enabling us to manage our regulatory compliance obligations.

How long we keep your personal data

We don't keep your information forever! We’ll generally keep it for 7 years after the last time you used one of our Services. We do this in case we need to respond to a legal claim.

In some circumstances, like cases of anti-money laundering or fraud, we may keep data longer if we need to (that’s in our legitimate interest) and/or the law says we have to.

We decide how long based on:

• Our contract with you (the Terms)

• Legal requirements to keep or delete data

• Your consent: if you gave us permission to use your data, but revoke it

• Our business needs (legitimate interests)

• Fraud risk

• Potential disputes and following data protection rules

Sharing of your personal data

We share as little of your personal data as we can and where we do, we encrypt it and/or make it impossible for the person we share it with to identify you where possible. We always make sure the recipients keep your information safe and only use it for the specific reason we shared it with them.

The reasons why we may have to share personal data include:

• to comply with and fulfil any legal obligation

• to enforce or apply the Terms we entered into with you

• to protect the rights, property, or safety of TrueLayer, your Merchant or others

• to effect our Services where we use partners or suppliers who process personal data on our behalf (but they can only use it as we instruct them to)

• if we sell, transfer or merge parts of our business or assets with another entity

• to effect our Services by using another company in our group.

Our key partners who process data on our behalf can be found below.

In some cases, we may share limited data from your user profile with the Merchant whose website/app you are using our Services on. The Merchant will only be permitted to use that personal data to help us deliver our Service to you (for example, by personalising your checkout experience).

International transfers of your personal data

We primarily store your data within Europe (the EEA) and the UK. We'll always take steps to keep it secure and in line with this privacy policy.

However, sometimes, to give you the best possible Service, we might need to share your information with companies located outside the UK and the European Economic Area (EEA).

For instance, if we use a global customer support system, your inquiries might be handled by a team in another country.

When this happens, we take extra steps to make sure your data is protected to the same high standards as it is here. This might involve using specific legal agreements that ensure your information is kept safe and secure, no matter where it's being processed.

We ensure our international data transfers comply with applicable law by using:

• Transfers to countries with recognized adequate data protection.

• EU Standard Contractual Clauses and the UK's International Data Transfer Addendum.

• Other legally permitted methods.

You can always ask us for more details about these safeguards if you're curious!

Automated Decision Making

Sometimes, we use automated decision making to help us make quick decisions to keep things safe and offer you the right stuff. For example, if we spot unusual activity on your account that looks like fraud, we might automatically freeze a transaction to protect your money. We may also use automated decision making to figure out which of our Services or offers might be a good fit for you, so we can show you things you might actually like.

If we make an automated decision about you, you have the right to ask a real person to take a look. You can also tell us your side of the story and challenge the decision. Just get in touch with us, and we'll make sure a human reviews it.

AI

We might use AI, including generative AI, to help with things like customer Service, fraud detection, business decisions, and marketing. We may also use your data to improve our AI models.

Cookies

What are cookies?

Cookies are small text files stored in browsers that help website providers understand site usage, remember logins, and store preferences. We use cookies and similar technologies (like URL tracking, device fingerprinting and local storage), all referred to as ‘cookies’ in this policy.

Think of them as little helpers that remember things about your visit, like your language preference for example.

What cookies does TrueLayer use?

When you browse our website or use our Services, we automatically receive your computer's IP address. This is a unique number that identifies your computer on the internet.

Our website uses cookies to make things work better for you. We use them to distinguish you from other users, remember your preferences and make your experiences with our Services better tailored to you.

Types of cookies used

Some cookies are essential for our website to run smoothly – you can't really turn these off if you want to use the site. Others help us understand how you use our website so we can make improvements and show you things we think you'll be interested in. For these extra helpers, we'll usually ask for your permission.

You're always in control. You can manage your cookie preferences at any time through our cookie settings link (usually found at the bottom of the page). You can choose which of the optional cookies you're happy for us to use.

Cookies collect anonymous identifiers, not your personal information. They track things like your device, browser, and how you use our site. We never use cookies to store your banking details.

Cookies can be "first party" which are cookies set by us, or "third-party" which are cookies that are placed on your computer/device by a third party when you visit our Site or use our Services.

We will only deploy non-necessary Cookies on your computer/device when we have obtained your prior consent to do so. If you choose to consent to our use of non-necessary Cookies, you may withdraw your consent to these Cookies at any time.

We use the following types of cookies:

• Essential Cookies (Always On): These make our site work. You can block them in your browser, but the Site might not work properly. They don't collect personal info. This also includes cookies that we use to monitor for and detect potentially harmful or illegal use of our Services

• Functional Cookies (Personalisation): These make your experience better (remember settings, etc.). Some features might not work without them.

• Ad Cookies (Targeted Ads): These show you ads based on your interests. They don't store personal info, just your browser/device info.

• Performance Cookies (Site Improvement): These help us see how people use our site so we can make it better. They collect anonymous data.

Managing cookies

You have full control over the non-essential cookies we use. When you first visit our site, we'll ask for your consent to use these.

If you change your mind later, no problem! You can always adjust your cookie settings. Look for a "Cookie Settings" or similar link, usually at the bottom of our website. Clicking this will allow you to choose which categories of optional cookies you want to enable or disable.

Please remember that some cookies are necessary for our Services to function properly, so you won't be able to turn those off.

Your Rights

You have rights when it comes to your personal data.

You have the right to ask us what information we hold about you, and you can ask us to correct anything that's wrong. You can also ask us to delete your data in certain situations, or to limit how we use it.

If you've given us permission to use your data, you can change your mind at any time. And sometimes, you can even ask us to give your data to someone else. If you want to exercise any of these rights, just get in touch with us – we're here to help!

Email us at [email protected] including your personal details (name and address) along with your request.

Changes to this Privacy Notice

Future Privacy Notice changes will be posted here and emailed to you when appropriate.

The "Last updated" date shows when the most important changes were made. Any changes become effective when we post the new notice or tell you about them, whichever is later as required by law.

Please check this page regularly for updates.

Questions and Contact Information

To access, correct, amend, or delete your personal information held by us, or for more information on our data processing practices, please contact [email protected].

Making a complaint to a supervisory authority

Should you be dissatisfied with the Service we provide, you have the right to register a complaint with us at [email protected].

If you are in the UK, you have the right to file a formal complaint to the Information Commissioner's Office at www.ico.org.uk.

If you are in Ireland, you can do the same with the Irish Data Protection Commission.

If you are located anywhere else, you can contact the relevant data protection supervisory authority in your country of residence.