GDPR & Your Rights

1. Your privacy matters

We want you to remain in control of your personal information. This page sets out the rights you have over your data and how to use them. If you have any questions, or would like to exercise any of your rights, email us at privacy@finstitch.com.

2. Who controls your data?

The data controller responsible for your personal information is:

• FinStitch Limited, registered in England & Wales.
• Company number 17242791.
• Registered with the UK Information Commissioner's Office (ICO) as a data controller, reference ZC168633.

3. Your rights

Depending on your location and applicable law, you may have the following rights.

Right of access

You can ask us to confirm whether we process your personal information, and request a copy of the information we hold about you.

Right to rectification

If any of your personal information is inaccurate or incomplete, you can ask us to correct or update it. Where possible, you can update your account information directly in FinStitch.

Right to erasure (“right to be forgotten”)

You can ask us to delete your personal information where:

• It is no longer necessary for the purposes for which it was collected.
• You withdraw your consent, where consent is the legal basis for processing.
• You object to processing and there are no overriding legitimate grounds to continue.
• The information has been processed unlawfully.
• Deletion is required by applicable law.

We may need to retain certain information to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

Right to restrict processing

You can ask us to temporarily restrict how we process your personal information in certain circumstances — for example, where you contest its accuracy, the processing is unlawful but you do not want the information deleted, you need it for legal claims, or you have objected to processing while your request is considered.

Right to data portability

Where technically feasible and required by law, you can request a copy of your personal information in a structured, commonly used, machine-readable format, and ask that it be transferred to another organisation where appropriate.

Right to object

You can object to certain types of processing, particularly where it is based on our legitimate interests. We will carefully consider all objections and stop processing where required by applicable law.

Right to withdraw consent

Where processing is based on your consent, you can withdraw it at any time. For example, you can:

• Disconnect connected financial institutions.
• Withdraw Open Banking permissions.
• Unsubscribe from marketing communications.
• Update your cookie preferences.

Withdrawing consent does not affect any processing carried out before you withdrew it.

Rights relating to automated decision-making

FinStitch does not make decisions that produce legal or similarly significant effects about you solely through automated processing. Where required by applicable law, you have the right to request human review of any such decision.

4. Managing connected financial accounts

When you connect financial accounts to FinStitch through regulated Open Banking providers or supported financial institutions, you stay in control:

• You decide which accounts to connect.
• You choose which permissions to grant.
• You can revoke access at any time through FinStitch or your financial institution, where supported.

Revoking access may affect the availability of certain features.

5. Requesting deletion of your account

You can request deletion of your FinStitch account at any time. When your account is deleted, we take reasonable steps to delete or anonymise your personal information, unless we are required to retain certain information for legal, regulatory, fraud-prevention, security or operational purposes. Some backup copies may remain for a limited period before being securely removed as part of our normal retention processes.

6. How to exercise your rights

To exercise any of your rights, email privacy@finstitch.com and tell us which right you want to use. To protect your information, we may ask you to verify your identity first. We handle requests free of charge and aim to respond within one month, although more complex requests may take longer where permitted by law.

7. Our lawful bases

We only process your data where we have a lawful basis — performance of a contract, consent, legitimate interests, or a legal obligation. Our Privacy Policy sets out which basis applies to each activity.

8. International transfers

Our primary infrastructure is hosted in the UK. Where a service provider processes data outside the UK, we only use providers that offer appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the Standard Contractual Clauses. See our Subprocessors page for who we work with.

9. Complaints

If you believe we have not handled your personal information appropriately, please contact us first so we have a chance to put things right. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk, or with your local data protection authority where applicable.

10. Our commitment to privacy

Protecting your personal information is a core part of our mission. We are committed to:

• Being transparent about how we use your information.
• Collecting only the information necessary to provide our Services.
• Processing financial information responsibly.
• Protecting your information with appropriate technical and organisational security measures.
• Carrying out Data Protection Impact Assessments for high-risk processing, so privacy risks are identified and mitigated before we build.
• Respecting your privacy rights.
• Continuously improving our privacy and security practices.

11. Contact

FinStitch Limited, registered in England & Wales (company number 17242791). For privacy enquiries, email privacy@finstitch.com; for general help, support@finstitch.com.