Privacy Policy

About us

Fena Labs Ltd. trading as fena, Commerce Toolkit and Commerce Toolkit by fena ("we" or "us"), is a company registered in England and Wales whose registered office is at 4 Thomas More Square, Thomas More Square, London, Greater London, England, E1W 1YW, and whose registered number is 12358683. We are committed to protecting and respecting your privacy and to providing clear information about the use of your data. We are the data controller for the purposes of the personal data we collect via our website and for the performance of the services listed under the usages of your personal data, below (together, the "Services"). We are registered with the Information Commissioner's Office (the ICO) with registration number: CSN7074873.

A summary of our data protection

Privacy and security is in our DNA

• We strongly protect and secure the personal data we hold about you.
• We will only use your personal data for your benefit and to deliver you our services.
• We do not sell your data to third parties.
• Where we track your use of the App, we do this to continuously improve and personalise your experience.
• Where we reuse your personal data, we do so to avoid asking you the same data twice.
• We may use suppliers to help us deliver our service, but we restrict their use of data to what you allow us to do and bind them to European data protection rules and to strict confidentiality.

You are in control

• You decide what bank account to connect to the app.
• You can disconnect a bank at any time to stop data exchange.
• You have the right to be forgotten: you can delete your fena account through the app.
• Any data that a partner has received based on your consent will still be held by that partner. You should request deletion of that data and your right to be forgotten directly with them. We will help you where we can.
• If you don't want us to personalise your App experience or use your data to improve our App or website, you can always disable this through the Cookie Settings on the website and in the future via the Privacy settings in the App.

Our community

We want to create a relevant experience for you, so the data we collect might be used anonymously in communications such as:

• Blog posts and infographics
• Emails such as weekly or monthly fena insights
• Social media posts
• Campaigns

Our public insights, posts and infographics are always anonymised and aggregated and can never be tracked down to you personally.

Europe

• Your data is stored in Europe.
• Your data is always protected by European rules.

What personal data do we use?

What is personal data?

Personal data is any data relating to a person who is identified or who can be identified (such as a name, an identification number, or an online identifier).

Personal data you give us: You may give us personal data about you by filling in forms on, or interacting with, the App, our website, or by corresponding with us by phone, email or otherwise. Examples of personal data include:

• Name, address, email address and phone number
• Information about your budgets
• Personal data about your financial circumstances
• Information we need to initiate and process the transfer of money on your behalf and send an instruction to your connected bank(s) (payment initiation services)
• Content you share with us in our community (Facebook, Twitter etc) or via our social media channels or via our Help Centre
• Copies of personal identification documents (such as your Passport, ID, Driver License)
• Personal information required to identify you and verify the information you give us
• Biometric data (such as fingerprint or facial recognition data) to grant access to our app on your device

Personal data from connected banks

If you connect one of your banks to our App or use our payment initiation services, we will collect data from your connected banks, such as:

• Bank account details, account numbers, information about your transactions
• Information identifying the account you have with your connected bank
• Information to initiate and process the transfer of money on your behalf

If you are referred or sign up to any of the Fena Labs services via one of our partners, we may share that personal data from connected banks with that partner. The data that might be shared with the 3rd party includes: Transaction History (deposits, purchases and refunds in your accounts) and Account Information (account numbers, balances, account types and other financial information tied to your accounts).

As part of your account information, we may collect sensitive personal data. For example, if you have a payment for a membership to a particular political party, this could reveal your political beliefs. We will not profile you on the basis of this data and we will not use this data for any other purposes than providing our services as detailed hereunder.

Personal data we collect from you

When you use the App or our website we may – ourselves or through our partners – collect information such as:

• IP address
• Device details
• Your login information
• Information about each visit you make to the App (such as page response times and length of visit)
• Location data
• Info about your use of the App or website through tracking tools
• Information we require to comply with our legal and regulatory obligations (such as "Know-Your-Customer" and "Customer Due Diligence")
• Information to verify the data you give us
• Information from your phone (like contact details from your address book) if you give us consent to use that data

We use well-known advertising platforms such as Facebook and Google to tell you about the App:

• If you click through such an advert and agree to the App Terms, an automated process will confirm to the advertising platform that you have signed up to the App and how much you use the App.
• If you don't use these platforms we will not collect or process this data.

We use tools to improve the user experience of our website and to personalise your App experience. Therefore, we perform statistical analyses about the way you use the services of fena (such as information on how you navigate, how much time you spend, how long you visit, and from where you came to our service):

• For our website: fena uses Google Analytics on our website. We don't use Google Analytics on our app or on your transaction data.

What do we use your personal data for?

Contractual performance: If you sign up for or download our apps and want us to deliver you our services, we can only perform these services if we can process your personal data for this purpose.

Your consent: We rely on your consent to process and use your personal data for the following purposes:

• Provide information on your accounts, such as transaction monitoring
• Initiate payments on your behalf
• (Re)Using personal information we have collected to identify you and to verify your identity to validate the data we hold about you and enrich your data. This excludes ID copies.
• Use your bank account details (such as sort code, account number or IBAN) to fulfil our KYC and due diligence requirements and speed up your registration and onboarding.
• If you wish to share the copy of the ID document we hold about you for other purposes (e.g. because a Partner would need it to enrol you in its products or services) you choose to do so upon your further specific consent at that point in time.

Legitimate interest: We use your personal data on the basis of our legitimate interest and to your benefit so that we can:

• Create a persona about you, so we can suggest relevant actions and deliver you the benefit of our app and connect you to our services and the services and products of our partners.
• Provide you with updates about the App.
• Improve your experience of our service: assess the use of the App; help us identify people like you that might enjoy the App; make a secure connection between your device and the App.
• Take action if we need to defend our rights under the App Terms if you would misbehave or act in deviation of laws or regulations or our App Terms.
• Track and examine the use of the App and the website to prepare reports on its activities and analyse that data.
• Attract new partners and get you the best deals available from our partners.
• Perform research and trend analysis to optimise your experience.
• Create content using some personal data to engage with you in a relevant and human way.
• Use and present content based on data to talk to you about the benefits of fena and its features in an engaging and relatable way and link you back to the benefit of the product.
• Engage and activate our users by learning from beta services, re-engaging our users on social media and via email, and providing more detailed information on your spending data (e.g. a weekly or monthly email on personalised insights).
• Optimise your experience in the Business Portal.
• Reuse and prefill data you have provided us with before when you connect a new partner or new product or service in the Partner Portal. We do so to avoid asking you the same data twice and you can always validate and update this data.

We could use your personal data in an anonymised and aggregated form to enrich content in:

• Blog posts and infographics
• Emails, such as a weekly or monthly fena account insights update
• Social media posts
• Campaigns

This will never contain data or insights or information that can be tracked down to you personally. We will always use the minimum data required and will process to the minimum extent required.

Legal obligations: We will also process your personal data where we are under a legal obligation to do so to:

• Identify you and verify your identity to comply with our Customer Due Diligence and Know-Your-Customer obligations.
• Prevent and detect fraud, money laundering, other crime, and security issues, and to reduce fena's risks.
• Comply with laws and regulations, as well as any sector-specific guidelines and regulations.

Please be aware that if you do not want us to process the data for the purposes set out above, we cannot deliver you our services.

Your key rights

Your primary right is the right to stop processing your data (right to object). The App is designed to put you in control and enables you to withdraw your consent by:

• Deleting your account or deleting a connected bank.
• Disabling tracking your use of the App in the Privacy Settings of the App.
• Sending us an email with the request to be forgotten if any of the above does not work or if you cannot connect to the App.

You have the right to ask us not to process your personal data for marketing purposes:

• You can always unsubscribe to our emails and campaigns.
• You have the right to object to us processing information about you where we do so on the basis of a legitimate interest. If we cannot make that work, it could mean that we may not be able to provide you with the App at all.

This would not invalidate any processing of the personal data prior to your withdrawal of consent.

Your other rights are:

• Right of access and data portability: All data that you have provided us is accessible in the App. You can request a copy of all personal data you have provided us through the App or via the email address you have provided us at registration. If technically possible, we will help you to automatically export this data to other platforms or users. We can only give you the data we hold ourselves. Any data that a partner holds about you is with that partner — you should request deletion of that data and your right to be forgotten directly with them. We will help you where we can.
• Right to rectification: You can control your data through the App. Where you cannot change this data through the App, you have the right to ask us to rectify inaccurate or incomplete personal data which we have about you.
• Right to erasure: You have the right to ask us to erase your personal data. You can delete your fena account through the app. This will automatically delete all information we have about you. Be aware that the partners you have activated may still have data about you. You will need to contact them directly in order for them to delete this data.
• Right to object to automatic processing: You don't need to object because we don't subject you to decisions based solely on automated processing which significantly affect you.

Where do we store your personal data?

Your data is stored in Europe: the personal data we collect from you is stored on secure information technology systems located in Europe, namely the United Kingdom.

For the provision of customer support, or as necessary to troubleshoot the App, we may give access to our systems to suppliers outside of Europe:

• This will only be incidental access.
• If we give access, we will only do so under European data protection rules, and our suppliers are bound to abide by this.

Partners are bound by the same European data protection rules as we are, but partners could decide to store your data in other countries or parts of the world than we do. That is not in our control and between you and the partners you connect. We recommend you carefully read their privacy policies. Upon connection to a partner, the App will give you easy access to these privacy policies.

Protecting your personal data

Security is in our DNA

• We are committed to ensuring that your personal data (including your Account Information and financial details, described in the Terms and Conditions) is secure.
• In order to prevent unauthorised access to or disclosure of it, we have put in place suitable physical, electronic and operational procedures to safeguard and secure the personal data we collect about you.
• In particular, we protect your personal data by deploying SSL and high standard encryption algorithms.
• We also ensure that we meet security standards imposed by law that are applicable to the operation of fena.
• We will never ask your PIN or other security credentials.

Help us protect you

• To help us protect your personal data, you agree to comply with our security policies and procedures that we notify you from time to time.
• You also agree to take all reasonable steps to prevent the unauthorised or fraudulent use of your User Login or PIN code, or other security credentials.
• If you find out or suspect that your App's User Login, PIN code, or recovery code has been lost, stolen, or someone has used it without your permission, you must tell us as soon as possible.

Providers, regulators and law enforcement

We will only share your personal data in a very limited way. This will happen either where we need to use services we cannot build ourselves or have a duty or legal obligations to disclose it:

• Our service providers (including their sub-contractors). This may happen where they help us to run our service or the technology systems that are needed to operate our App and services. This includes:
  • Data storage providers to safely and securely store your data.
  • Aggregation service providers, where necessary in order to retrieve Account Information for use in the App on your behalf.
  • Identification and verification service providers, to help us adhere to our legal obligations to verify your identity and the information you give us. These may include: Sumsub (United Kingdom).
  • Social Media Platforms via anonymised campaign-IDs so that we can provide relevant content to you on Social Media.
  • Email services e.g. to send you regular updates or communication.
  • Customer relation management to provide you with customer care services.
  • Website and app analytics to provide you with the best experience.
• Regulators in connection with their duties, such as crime prevention or carrying out regulatory oversight of what we do.
• Fraud prevention agencies and law enforcement agencies, to prevent and detect fraud, money laundering or other crimes.

How long do we keep your data

We are only allowed to keep your personal data for as long as it's still necessary for the purpose we initially required it. But as we are in financial services and bound by strict regulations, this means that we need to retain the data we hold about you for a minimum of 7 years after termination of your fena account. If (local) regulations require us to retain it longer or delete it sooner, we will follow these retention periods.

If you delete your fena account or invoke your right to be forgotten, we will use feasible solutions to make it no longer directly available in our systems, like archiving it. This means that in such a case we will no longer process your data.

Using computers to make decisions about you

We do not use automatic processing or profiling to make automated decisions about you that could significantly impact you (like refusing you financial products).

Our contact details

Fena Labs Ltd is the data controller for the personal data collected via this website and the services described in this Privacy Policy. We are authorised and regulated by the Financial Conduct Authority.

Complaints to the privacy regulator

You have the right to complain to the privacy regulator in the country in which you reside, where you work, or anywhere where you believe we might have broken data protection rules.

In the UK, the privacy regulator is the Information Commissioner's Office (the "ICO"). The ICO can be contacted at: