Privacy

This Privacy Notice serves to inform you about how Jigzo collects, uses, shares, and protects your personal data. Our goal is to be transparent about our data practices and to empower you with an understanding of your rights. We are committed to safeguarding your privacy in compliance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection laws.

Jigzo Limited is a company registered in England and Wales, company number 12014461. We are the controller of the personal data described in this notice. We are registered with the Information Commissioner's Office, registration number ZB293353. For any question about this notice, or to exercise a right, contact us.

This notice applies to the personal data of all individuals who interact with Jigzo, including the directors, beneficial owners and authorised representatives of our corporate clients, visitors to our website, and Approved Partners.

It covers all data processing activities related to our platform, services, and marketing communications, ensuring a consistent standard of protection for all personal information we handle.

We collect and process the following personal data belonging to customers and their representatives:

• For onboarding: Name, contact details, date of birth, nationality, identification documents, and compliance-related information (e.g., credit and background checks).

• During the relationship: Account activity, communications, and usage of online portals.

• Website visitors: IP addresses, browser types, and interaction data collected via cookies.

We process personal data to:

• Verify identities during onboarding and maintain compliance with AML/CTF regulations.

• Manage accounts, transactions, and communications.

• Improve our services and ensure secure access to our platform.

• Fulfill legal and regulatory obligations.

We process personal data based on:

• Legal obligations: Ensuring compliance with AML/CTF regulations.

• Contractual necessity: Providing and managing our services.

• Legitimate interests: Fraud prevention, platform security and service improvement. We have assessed our interests against your rights and recorded that assessment, which you can request.

• Consent: Marketing to prospective clients, where required. You may withdraw consent at any time.

We do not rely on your consent for our financial crime obligations. Consent can be withdrawn, and we cannot stop verifying, screening or monitoring because you ask us to. Those activities rest on our legal obligations.

• Identity verification, due diligence and screening records — 5 years after our relationship ends
• Transaction records — 5 years from the transaction
• Records relating to suspicious activity reports — 5 years from the report
• Complaints — 5 years from resolution
• Declined applications — 5 years, so a re-application can be identified
• Support correspondence — 5 years
• Marketing preferences — Until you object, or 2 years of inactivity
• Security and access logs — 12 months, or 5 years where required for a regulatory obligation

We keep data for up to 7 years where tax, company law or other obligations require it, and longer where an authority has asked us to or where it is relevant to legal proceedings. We do not keep data indefinitely, and we delete securely.

We implement robust measures, including encryption and access controls, to protect personal data. In the event of a data breach, we will notify affected individuals and relevant authorities, where required.

When you use Jigzo, personal data is also received by the institution that provides your account. That institution is an independent controller of the data it receives — it decides its own purposes and is subject to its own obligations. It is not processing data on our behalf, and we do not control what it does with it. The institution's own privacy notice applies to that processing.

Our other providers act as processors under written contracts requiring them to act only on our instructions and to protect your data. They include providers of identity verification and screening, corporate verification, data hosting and storage, document and correspondence systems, and email and messaging delivery.

The institution holding your account is identified in your account details, which you can see before you use the account. We will tell you if it changes.

We may share personal data with:

• Service providers assisting in our operations across different jurisdictions.

• Regulatory authorities or law enforcement, where legally required.

• Credit reference agencies for compliance checks.

We do not sell personal data to third parties.

Our platform and its backups are hosted in the United Kingdom, so no transfer arises in respect of platform data.

Some of our providers process personal data outside the United Kingdom. Where they do, the transfer is protected by one of the following:

• UK adequacy regulations, where the destination is covered by them
• An International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment
• For recipients in the United States, certification under the UK Extension to the EU–US Data Privacy Framework

We use automated tools for identity verification, sanctions screening and transaction monitoring. These can result in an application being paused or declined, or a payment being held.

A person always reviews before a final decision. No application is refused and no account closed by an automated process alone. If you think an automated check has produced the wrong result, tell us and we will look at it.

You have the right to:

• Access the personal data we hold about you
• Correct it where it is wrong
• Ask us to delete it — see below
• Restrict how we use it, in some circumstances
• Object to our using it where we rely on legitimate interests
• Receive it in a portable format, where we rely on contract or consent
• Object to marketing at any time, which we will action immediately
• Complain to the Information Commissioner's Office

On deletion, we need to be straight with you. We cannot delete records we are legally required to keep. Identity verification, transaction records and financial crime records must be retained for at least five years, and a request to delete them will be refused. We will explain why.

On access, one limitation applies. We cannot disclose anything that would prejudice the prevention or detection of crime. In particular, if we have made a report about suspicious activity we are prohibited by law from telling you, and we can neither confirm nor deny whether such a report exists.

We respond within one month, and will tell you if we need longer for a complex request. We may need to verify your identity first.

We use cookies to improve website functionality and user experience. For more details, refer to our Cookies policy.

We may update this Privacy Notice periodically. The latest version will always be available on our website.

If you have concerns about how we handle your personal data, contact us through the platform or via our website. If unresolved, you can escalate your complaint to the Information Commissioner’s Office (ICO) at (+44) 0303 123 1113 or via their website.