Privacy Policy

Last updated: 8 July 2026

Italian Financial Services S.R.L. ("Italian Financial", "we", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you visit our website, use our platform and API, or otherwise interact with us, and describes your rights under Regulation (EU) 2016/679 (the "GDPR") and applicable Italian data-protection law.

1. Data controller & DPO contact

Italian Financial Services S.R.L., with registered office at Via Monte Napoleone 8, 20121 Milan, Italy, is the data controller responsible for personal data processed as described in this policy. Where we process personal data on behalf of our business customers in order to provide the Services, we act as a processor and the relevant customer is the controller; in that case, the customer's own privacy notice governs how the personal data of its End Users is handled.

You can contact our data-protection function, including our Data Protection Officer where appointed, at compliance@italianfinancial.com, or by post to the registered office above, marked for the attention of the Data Protection Officer.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and contact data — name, date of birth, nationality, residential and business address, email address, telephone number, and job title.
• Identity-verification (KYC) data — government-issued identity documents (passport, national identity card, driving licence), document images, document numbers, and information extracted from them, collected as part of onboarding and anti-money-laundering checks.
• Biometric data — a facial image or selfie and a facial template, together with liveness-detection signals, used to confirm that you are a real, present person and that you match your identity document (see section 4).
• Financial and transactional data — account identifiers, IBANs, card details, balances, and details of transactions processed through the Services.
• Business (KYB) data — company registration details, ownership and control structure, ultimate beneficial owners, and directors.
• Technical and usage data — IP address, device and browser information, log data, API request metadata and cookies (see section 10).
• Screening data — results of sanctions, politically-exposed-person (PEP) and adverse-media checks.
• Communications — correspondence with our support, sales and compliance teams.

3. Purposes & legal bases

We process personal data only where we have a lawful basis to do so under Article 6 GDPR (and, for special categories of data, Article 9 GDPR). Our principal purposes and legal bases are:

• To provide and operate the Services — performance of a contract with you, or steps taken at your request prior to entering into a contract (Article 6(1)(b)).
• To verify identity and comply with anti-money-laundering and counter-terrorist-financing obligations — compliance with a legal obligation to which we are subject (Article 6(1)(c)), including under Italian Legislative Decree No. 231/2007 and applicable EU anti-money-laundering law, and, where required, reasons of substantial public interest (Article 9(2)(g)) for special-category or biometric data.
• To carry out sanctions, PEP and adverse-media screening and to detect and prevent fraud and financial crime — legal obligation (Article 6(1)(c)) and our legitimate interests in protecting the Services and preventing crime (Article 6(1)(f)).
• To secure, maintain and improve the Services and communicate with you — our legitimate interests (Article 6(1)(f)) in running and developing our business securely, balanced against your interests and rights.
• For marketing communications where relevant — your consent (Article 6(1)(a)) or our legitimate interests, subject to your right to object at any time.
• To establish, exercise or defend legal claims and comply with legal requests — legal obligation and legitimate interests (Article 6(1)(c) and (f)).

Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Biometric & identity-verification data

To onboard you securely and to meet our regulatory obligations, our KYC/KYB module may process a facial image and derive a facial template (a mathematical representation of facial features) which is compared against the photograph on your identity document, together with active or passive liveness detection to confirm that a live person is present. This biometric data is used for the sole purpose of identity verification and fraud prevention and is not used for any incompatible purpose such as profiling or advertising.

Because biometric data used to uniquely identify a person is a special category of personal data under Article 9 GDPR, we process it only where an Article 9 condition applies — typically substantial public interest in the prevention of fraud and money laundering as reflected in EU and Italian law, or, where required, on the basis of your explicit consent. Biometric templates are protected with strong technical measures, access is strictly limited, and they are retained only for as long as necessary for verification and the applicable record-keeping period (see section 7). You may contact us to ask about the biometric processing applied to your verification.

5. How we share your data

We do not sell your personal data. We share personal data only where necessary and with appropriate safeguards, including with:

• Service providers and processors that host, support and secure our infrastructure, acting on our documented instructions under written data-processing agreements;
• Identity-verification, KYC and screening providers that help us verify documents, perform biometric checks and screen against sanctions, PEP and adverse-media lists;
• Card networks, banks and payment partners where necessary to process payments and card transactions;
• Our business customers, where you are their End User and we act as their processor;
• Competent authorities, regulators, courts and law-enforcement bodies, including the Unità di Informazione Finanziaria per l'Italia (UIF), where we are legally required to disclose information;
• Professional advisers and, in the context of a corporate transaction, prospective purchasers, subject to appropriate confidentiality obligations.

6. International transfers

We aim to store and process personal data within the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA that has not been recognised by the European Commission as providing an adequate level of protection, we implement appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (SCCs), supplemented where necessary by additional technical and organisational measures following a transfer risk assessment. You may request a copy of the relevant safeguards by contacting us at the address in section 12.

7. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, regulatory or reporting requirements. In particular, personal data collected for anti-money-laundering purposes — including identity-verification and transaction records — is retained for the period required by applicable anti-money-laundering law, generally a minimum of five (5) years and up to ten (10) years from the end of the business relationship or the completion of the relevant transaction, where the law so requires or permits. When personal data is no longer required, we securely delete or irreversibly anonymise it.

8. Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include encryption of data in transit and at rest, network segmentation, strict access controls on a need-to-know basis, multi-factor authentication, logging and monitoring, secure software-development practices, and regular testing and review of our controls. In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, in accordance with Articles 33 and 34 GDPR.

9. Your rights under the GDPR

Subject to the conditions and exceptions in the GDPR, you have the right to:

• Access — obtain confirmation of whether we process your personal data and a copy of it;
• Rectification — have inaccurate or incomplete personal data corrected;
• Erasure — request deletion of your personal data where one of the grounds in Article 17 applies (note that we may be legally required to retain certain data, for example for anti-money-laundering purposes);
• Restriction — request that we restrict processing in certain circumstances;
• Data portability — receive personal data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible;
• Object — object to processing based on our legitimate interests, and to object at any time to processing for direct-marketing purposes;
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at compliance@italianfinancial.com. We will respond within the timeframes required by law. If you are an End User of one of our business customers, you should generally direct your request to that customer, and we will assist them as their processor.

You also have the right to lodge a complaint with a supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (the Italian Data Protection Authority). We would, however, appreciate the opportunity to address your concerns before you approach the authority.

10. Cookies

We use cookies and similar technologies on our website. For details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or the Services. We will post the updated policy on this page and update the "Last updated" date, and, where changes are material, we will take reasonable steps to notify you. We encourage you to review this policy periodically.

12. Contact

For any question about this Privacy Policy or about how we handle your personal data, contact Italian Financial Services S.R.L., Via Monte Napoleone 8, 20121 Milan, Italy, or email our data-protection function at compliance@italianfinancial.com.