1. Introduction

Muniy Ltd (Company number 11191944) (Muniy, we, us or our) provides the products and services offered on the Muniy website and/or mobile application www.muniy.com (Platform). We are registered with the Information Commissioner (No. ZA522292).

For the purposes of the Data Protection Act 2018 and General Data Protection Regulation (EU) 2016/679 as amended from time to time (“DPA”), we are the data controller of any data we hold that may be used to identify you ("personal data”).

We have adopted this policy to ensure that we have standards in place to protect the data that we collect about you that is necessary and incidental to:

  • providing the products and services that we offer; and
  • the normal day-to-day operations of our business.

Together with the Muniy Terms & Conditions and the Muniy Customer Agreement (Service Terms), this Privacy Policy it forms part of our agreement with you and determine our responsibilities under the DPA.

Capitalised terms not otherwise defined in this Privacy Policy shall have the meaning given to them where they first appear, or in the Service Terms of which this Privacy Policy forms part, or the DPA.

If, at any time, you provide data or other information about someone other than yourself, you warrant that you have that person’s consent to provide such information for the purpose specified.

Muniy is not available to children (persons under the age of 18 years).

2. Collection, Purpose and Legal Basis for Processing

We may collect and process the personal data specified in Annex A to this Privacy Policy, for the purpose and on the legal basis specified in that Annex.

We only collect personal data relevant to your use of the Platform and the administration and enforcement of the Service Terms.

3. How Personal Data is Stored

The personal data that we hold will be stored in the European Economic Area (EEA), but may be transferred to, and stored at, a destination outside the EEA, with and by third parties.

Data may also be processed by third parties and/or staff operating outside the EEA who work for us or for one of our third party partners. Such staff may be engaged in, among other things, the fulfillment of your order, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing.

Your personal data will be stored for the duration of the Service Terms and for such time thereafter as required by Applicable Law or the limitation period for bringing contractual claims under or in relation to the Service Terms.

4. When Data is Disclosed

We only disclose personal data to Third Party Service Providers for the purposes explained in Annex A to this Policy.  Third Party Service Providers will only use your information to help provide the Platform, they will not market to you.

In order to access the Platform, you may be required to accept additional privacy policies which are specific to third parties whose services you uses (such as an internet service providers).

We may share your information with third-party service providers in connection with the provision of the Platform (Third Party Service Providers) and related services to you, and otherwise operating our business, marketing and promoting our products and services. We may link your account with a Third Party Service Provider to the Platform to enable certain functionality, which allows us to obtain information from those accounts.

You may choose to access the Platform third parties (such as your accountant) (Third Party Systems). In order to engage with such Third Party Systems, you may be required to accept additional privacy policies which are specific to those Third Party Systems. If you sign-up to Muniy through a Third Party System we may share such information and for such purposes as explained in Annex A to this Policy. We may also share anonymous aggregate information about you with Third Party Systems to allow them to provide targeted information to you through the Platform.

The Platform may contain links to other websites and third party services. When linking your account with third parties, you must read the privacy policies of such providers, so that you can understand the manner in which they will handle your personal data. The information we may obtain from those services often depends on their privacy policies or account settings. Please be aware that we shall not be held responsible for the privacy policies of such other sites and services. Please read the privacy policies or statements of each and every site or service that collects your personal data.

These service providers may be located or have facilities that are located a different jurisdiction (including outside the EEA), in which case your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

5. Processing of Personal Data Provided to Us by Others

We will process your personal data provided to us by PPS concerning your account and transactions involving their services (see Section 11 below).

As required by Applicable Law, we will also check your identity and other personal details with a fraud prevention agency/agencies and credit reference agencies. If you give false or inaccurate information and we identify fraud, this will be recorded and may be shared by those agencies with other organisations, so that we and those other organisations, including law enforcement agencies and debt collection agencies, may access, use and search these records to:

  • help make decisions about credit and credit related services, for you and members of your household;
  • help make decisions on motor, household, credit, life and other insurance proposals and insurance claims, for you and members of your household;
  • trace debtors, recover debt, prevent fraud, and to manage your accounts or insurance policies;
  • prevent fraud and money laundering, for example, when:
  • Checking details on applications for credit and credit related or other facilities;
  • Managing credit and credit related accounts or facilities;
  • Checking details on proposals and claims for all types of insurance; and
  • Checking details of job applicants and employees.

6. The Safety & Security of Your Personal Data

We will take all reasonable precautions to protect your personal data from unauthorised and unlawful access and processing, as well as accidental loss, destruction or damage. This includes appropriately securing our physical facilities and electronic networks.

The security of online transactions and the security of communications sent by electronic means or by post cannot be guaranteed. When you provide information to us via the internet or by post, you do so at your own risk. We cannot accept responsibility for misuse or loss of, or unauthorised access to, data, where the security of information is not within our control.

Privacy or security practices of any third party (including third parties that we are permitted to disclose your data to in accordance with this policy or any applicable laws) may be subject to separate privacy and security policies than that of Muniy's.

If you suspect any misuse or loss of, or unauthorised access to, your data, you should let us know immediately.

We are not liable for any loss, damage or claim arising out of another person’s use of the data where we were authorised to provide that person with the data.

7, Your Rights

The table in Annex B to this Privacy Policy explains your rights under the DPA and how to exercise them. This Privacy Policy provides confirmation of the details required in relation to your right of access.

8. Complaints and Disputes

You have the right to object to:

  • processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
  • direct marketing; and
  • processing for purposes of scientific/historical research and statistics
  • unless we hold compelling legitimate grounds for processing or the processing is for the establishment, exercise or defence of legal claims.

You have the right to lodge a complaint with the Information Commissioner or other competent supervisory authority if you consider that the processing of your data infringes the DPA.

If you lodge a dispute regarding your data, we both must first attempt to resolve the issue directly between us.

If we become aware of any unauthorised access to your data which is likely to result in a high risk for the rights and freedoms of the data subjects, we will inform you without undue delay after becoming aware of it, once we have established what was accessed and how it was accessed.

9. Additions to This Policy

We reserve the right to modify this policy at any time on the same conditions as we may vary our Service Terms. If we decide to change this policy, we will post the changes on our Platform at www.muniy.com/privacy. It is your responsibility to refer back to this policy to review any amendments. Changes and clarifications will take effect immediately upon their posting on the Platform. If we make material changes to this policy, we will notify you here that it has been updated.

Annex A

Personal Data Collected
Purpose
Basis for Processing

(a) Information that you provide by filling in forms on the Platform. This includes information provided at the time of registering to use the Platform, posting material or requesting further services. We may also ask you for information when you report a problem with the Platform;

(b) Your contact details, including residential and business address(es), your e-mail address, home address, mobile and/or landline telephone numbers;

(c) Records of any correspondence between you and Muniy;

(d) Details of transactions you carry out through the Platform, information about payments you make and receive such as the date, amount, currency and details of payer/payee;

(e) Details of your visits to the Platform and the resources that you access;

(f) Pixel tags and web beacons;

(g) information you post about us, or communicate to us, on a social media service;

To manage and administer the Platform;·      

To enable you to use the Platform;

To communicate with you about the Platform, your relationship with us

To investigate complaints, deal with enquiries, complaints and feedback from you;

To give you any notices under the Service Terms;

To keep you informed about payments you initiate or information that you allow access to via the Platform;

To update Muniy's records;

To identify, prevent, detect or tackle fraud, money laundering and other crime;

To carry out checks required by applicable regulation or regulatory guidance;

To carry out our obligations arising from and exercise our rights under, any agreements between you and us, including tracing and recovering payments and debts;

To enable us to send email messages in a format customers can read and to show if email has been read;

To check any instructions given to us, for training purposes, for crime prevention and to improve the quality of our customer service.

To disclose to third parties:

In the course of using cloud services (Amazon Web Services);

Information that may be required to communicate with you (such as Gmail from Google, Inc);

In relation to the provision of a cross-border payment solution.

When entering into such contracts with third parties, we take all reasonable precautions to ensure that their privacy policy abides by the same principles held in this policy.

When you click on links to third-party websites, we may link your account with a third party to our services to enable certain functionality, which allows us to obtain information from those accounts.

If it is under a duty to disclose or share your personal data in order to comply with any legal obligation;

To enforce this Privacy Policy or the Service Terms;

To a credit reference agency to check your identity and to prevent fraud, (it will also keep a record of your request and use it whenever anyone applies to be authenticated in your name);

To Third Party Service Providers, agents and subcontractors, acting for us, to use for the purpose of operating the Platform;

To anti-fraud agencies, for the purpose of preventing and detecting fraud;

To debt collectors and other third parties to trace you and recover any debt;

In the event that Muniy sells any business or assets, in which case it may disclose your personal data to the prospective seller or buyer of such business or assets;

To protect the rights, property, or safety of it, its customers, or others (which includes exchanging information with other companies and organisations for the purposes of fraud protection);

To investigate, prevent or detect fraud or carry out checks against money laundering;

For audit purposes and to meet obligations to any relevant regulatory authority or taxing authority.

The processing is necessary for:·

the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;

compliance with a legal obligation to which we are subject;

the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

Information about the device(s) you use to access the Platform and your visits to and use of the Platform (including your Internet Protocol address, location, browser/platform type and version, internet service provider, hardware model, advertising identifier, unique device identifiers, language, wireless network, mobile network (including mobile number), operating system, referral source, exit pages, length of visit, page views, website navigation and search terms used)

To improve your browsing experience by personalising the Platform;

To develop and improve the Platform;

To ensure that content on the Platform is presented in the most effective manner for you and for your computer;

To disclose to third parties:

To comply with a current judicial proceeding, a court order or legal process served on us, any request by the FCA or any other regulator who may have jurisdiction over us from time to time or for audit purposes and to meet obligations to any relevant regulatory authority or taxing authority;

To enforce this Privacy Policy or the Service Terms;

The processing is necessary for:

the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;

the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

Copies of passports, name, location, date of birth, location, photograph, driver’s licence or other identification evidence that you provide for anti-money laundering and anti-fraud purposes;

To identify you and verify your identity;

To identify, prevent, detect or tackle fraud, money laundering and other crime;·

To carry out checks required by applicable regulation or regulatory guidance;

To disclose to third parties for:·       authentication of identity, passport and driver’s license (third parties such as HooYu, TruNarrative, AU10TIX, Onfido, Jumio);

To comply with a current judicial proceeding, a court order or legal process served on us, any request by the FCA or any other regulator who may have jurisdiction over us from time to time or for audit purposes and to meet obligations to any relevant regulatory authority or taxing authority;

To enforce this Privacy Policy or the Service Terms;

To a credit reference agency to check your identity and to prevent fraud, (it will also keep a record of your request and use it whenever anyone applies to be authenticated in your name);

To anti-fraud agencies, for the purpose of preventing and detecting fraud;

The processing is necessary for:

the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;

compliance with a legal obligation to which we are subject;

the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.

(a)   Records of any surveys that you may be asked to complete about, for example, online and offline preferences, habits, movements, trends, decisions, associations, memberships and finances;

(b)   Your e-mail address, mobile and/or landline number;

(c)   Information you wish us to provide to your accountants, lawyers or other professional advisers;

(d)   We may collect your name and address from publicly available sources such as Companies House.

To provide you with information, products or services that you request or which Muniy decides may interest you;

For statistical analysis;

To identify which elements of the Platform or other products might interest you.

To disclose to third parties: ·       to assist marketing and promotions to  customers and prospects on social media (such as Facebook or via post – please see the “Direct Mail Marketing” section below);

With your consent


Annex B: Your Rights

Your Rights and How to Excercise Them
Exception

Right of Access:

To obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from you, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) of the GDPR and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

How to Exercise:

This Privacy Policy provides confirmation of the details required in relation to your right of access.

Under the DPA, you have a right to access certain personal records that Muniy holds about you. Any access request may be subject to a fee to meet Muniy's costs in providing you with details of the information they hold about you if the request is unfounded or excessive.

Right to rectification:

to obtain from us without undue delay the rectification of inaccurate personal data concerning you.

We must communicate to each recipient to whom the rectified personal data have been disclosed, unless this proves impossible or involves disproportionate effort.We shall inform you about those recipients if you request it.

Right to erasure:

to obtain from us the erasure of personal data concerning you without undue delay where:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) you object to the processing based on legitimate interest where there are no overriding legitimate grounds for the processing;

(c) the personal data have been unlawfully processed;

(d) the personal data have to be erased for compliance with a legal obligation to which we are subject.

We must communicate to each recipient to whom the erased personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

We shall inform you about those recipients if you request it.

Processing is necessary for

(b) compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us; or

(d) the establishment, exercise or defence of legal claims.

Right to request the restriction of processing concerning you:

to obtain from us restriction of processing where:

(a) the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;

(b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

(c) we no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims;

(d) you object to the processing based on legitimate interest pending the verification whether our legitimate grounds override yours.

We must communicate to each recipient to whom the restricted personal data have been disclosed, unless this proves impossible or involves disproportionate effort.We shall inform you about those recipients if you request it.

Where processing has been restricted under this right, such personal data shall, with the exception of storage, only be processed:

(a)   with your consent; or

(b)   for the establishment, exercise or defence of legal claims; or

(c)   for the protection of the rights of another natural or legal person; or

(d)   for reasons of important public interest of the Union or of a Member State.

The right to data portability:

to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where:

(a) the processing is based on consent or is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract; and

(b) the processing is carried out by automated means.

You have the right to have the personal data transmitted directly from us to another controller, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to the right to erasure.

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

The right to object to processing:

to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on processing necessary for the purposes of the legitimate interests pursued by us or a third party (except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data), including profiling.

Where:

(a)   we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject; or

(b)   for the establishment, exercise or defence of legal claims.

The right to ask us not to process your personal data for direct marketing purposes:

to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

You have the right to ask Muniy not to process your personal data for marketing purposes. Muniy will usually inform you (before collecting your data) if it intends to use your data for such purposes or if it intends to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms used to collect your data.

The right not to be subject to automated individual decision-making, including profiling:

to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

If the decision:

(a) is necessary for entering into, or performance of, a contract between you and us;

(b) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

(c) is based on the data subject’s explicit consent.

In the cases referred to in points (a) and (c) we shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express his or her point of view and to contest the decision.