Privacy policy.

Who we are

IRemitify is a company registered in England with its registered office at London, United Kindgom.

For the purposes described in this policy, IRemitify Ltd is the data controller. We are registered with the Information Commissioner's Office.

You can contact us about privacy matters at info@iremitify.com, or on +44 161 8706883.

Scope of this policy

This policy applies to personal data we process in connection with:

• Your use of this website, including forms, demo bookings and support enquiries.
• Our commercial relationship with clients, prospective clients, suppliers and partners.
• The delivery of our products, professional services, hosting, support and maintenance.
• Recruitment enquiries and applications sent to us.

This policy does not govern how our clients handle personal data on the platforms we build for them. If you are a customer of a money-transfer business that uses our software, please read that business's own privacy notice — see the section on data held on client platforms below.

Whether we act as controller or processor

Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles personal data on a controller's instructions. Our role changes depending on the context, and it matters because it determines who you should contact about your data.

We act as controller for personal data relating to website visitors, enquiries, demo bookings, client and supplier contacts, marketing recipients, job applicants, and our own staff. This policy explains that processing in full.

We act as processor for personal data belonging to the end users of platforms we build, host or support for our clients. In that context our client — the regulated money-transfer business or financial institution — is the controller. We process that data only on their documented instructions, under a written data processing agreement.

Personal data we collect

Where we act as controller, we may collect and process the following categories of data:

• Identity and contact data — name, job title, employer, business email address, business telephone number and postal address.
• Enquiry data — the content of messages you send us through contact forms, demo bookings, email or telephone, including details about your business and requirements.
• Contractual data — records of proposals, agreements, statements of work, correspondence, project documentation and support tickets.
• Transactional and billing data — invoices, payment records and bank details of business contacts. We do not store full payment card numbers on our own systems.
• Due diligence data — information gathered when onboarding a client, supplier or partner, including company records, verification of authorised signatories, and sanctions and adverse-media screening results where required.
• Technical data — IP address, approximate location derived from it, browser type and version, operating system, device type, screen size, referring URL and time zone.
• Usage data — pages viewed, time spent, links clicked, scroll depth, documents downloaded and navigation paths through the site.
• Marketing data — your preferences for receiving communications from us, and your engagement with emails we send.
• Recruitment data — CV, employment history, qualifications and references, where you apply to work with us.

We collect this data directly from you, automatically as you use the site, and occasionally from public sources such as company registers, professional networks and industry directories where we are researching a prospective business relationship.

We do not seek to collect special category data — such as data revealing health, ethnicity, religious beliefs or biometric identifiers — through this website. Please do not send us such information unless we have specifically asked for it.

How we use your data

We use personal data to:

• Respond to enquiries, arrange demos and consultations, and prepare proposals and quotations.
• Enter into and perform contracts, deliver projects, and provide hosting, support and maintenance.
• Issue invoices, take payment, and manage our accounts and credit control.
• Carry out onboarding due diligence and meet our own anti-money-laundering, sanctions and know-your-supplier obligations.
• Operate, secure, monitor and improve this website and our products, including diagnosing faults and preventing fraud and abuse.
• Send you relevant information about our products and services, where you have agreed or where we are permitted to do so.
• Understand how the site is used so we can improve its content, structure and performance.
• Assess applications for employment and manage recruitment.
• Establish, exercise or defend legal claims, and comply with our legal, tax, accounting and regulatory obligations.

Our lawful bases for processing

We rely on one or more of the following lawful bases, depending on the purpose:

Performance of a contract — to deliver the products and services you have engaged us for, to take steps at your request before entering a contract, and to administer billing and support.

Legitimate interests — to run and grow our business, respond to business enquiries, market our services to business contacts, secure our systems, understand website usage, and protect our legal position. We balance these interests against your rights and freedoms, and you may object at any time.

Legal obligation — to comply with tax, accounting, company law, anti-money-laundering, sanctions and other statutory requirements, and to respond to lawful requests from regulators, courts or law enforcement.

Consent — for non-essential cookies and analytics, and for certain marketing communications. Where we rely on consent you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

Cookies and similar technologies

Cookies are small files placed on your device that allow a website to recognise it and remember information. We use the following categories:

• Strictly necessary — required for the site to function, including session management, form submission, load balancing and security. These cannot be switched off and do not require consent.
• Preference — remember choices such as your cookie settings so you are not asked repeatedly.
• Analytics — help us understand how visitors find and use the site, which pages perform well, and where people encounter difficulty. These are set only with your consent.
• Marketing — used to measure campaign performance and to show relevant content on other platforms. These are set only with your consent.

We also use a content delivery and security provider to serve this site, protect it against attack and obscure email addresses from automated harvesting. This involves processing your IP address and request data for security purposes.

You can manage your preferences at any time through our cookie settings, and you can block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the site from working.

Personal data held on client platforms

Our clients are regulated money-transfer businesses, financial institutions and fintechs who use our software to serve their own customers. Where we host, support or maintain such a platform, we may have access to personal data about that client's end users — for example sender and beneficiary details, transaction records, identity documents and screening results.

In relation to that data:

• Our client is the controller and decides why and how the data is used. We are the processor.
• We process it only on the client's documented instructions, under a written data processing agreement, and never for our own purposes.
• Access is restricted to named personnel who need it to deliver support or maintenance, is logged, and is bound by confidentiality obligations.
• We do not sell, rent, share or reuse client end-user data, and we do not use it to train models or build our own products.
• We assist our clients in responding to requests from their end users, but we cannot action such requests directly.

If you are a customer of a money-transfer service and want to exercise your data rights, please contact that operator directly — they hold the relationship with you and the authority to act. If you contact us instead, we will forward your request to the relevant client where we can identify them, and tell you that we have done so.

Who we share data with

We share personal data only where necessary, and only with recipients bound by appropriate confidentiality and data protection obligations. These may include:

• Cloud hosting and infrastructure providers who host our website, systems and client environments.
• Content delivery and security providers who protect the site against attack and improve performance.
• Business software providers supplying our email, calendar, document storage, CRM, ticketing, accounting and communication tools.
• Analytics and marketing platforms, where you have consented to their use.
• Identity verification and screening providers, where due diligence is required on a client, supplier or partner.
• Professional advisers including lawyers, accountants, auditors and insurers, where they need the information to advise us.
• Regulators, courts and law enforcement, where we are legally required or permitted to disclose.
• An acquirer or successor, if we sell, restructure or transfer part of our business, subject to equivalent protections.

We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes. A current list of our sub-processors is available to clients on request.

International transfers

We operate internationally and work with clients and providers in over thirty countries. As a result, personal data may be transferred to, or accessed from, countries outside the United Kingdom and the European Economic Area.

Where that happens, we ensure an appropriate safeguard is in place — such as a transfer to a country covered by a UK adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another mechanism recognised under applicable law. We also carry out a transfer risk assessment where required.

You may request a copy of the safeguards we rely on by contacting us at privacy@iremitify.com.

How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected, and to meet our legal, accounting and regulatory obligations. As a general guide:

• Enquiries that do not lead to an engagement — up to 24 months from last contact.
• Client contract, project and correspondence records — for the duration of the relationship and six years afterwards, reflecting the statutory limitation period.
• Invoices, payment and accounting records — at least six years, as required by UK tax law.
• Onboarding and due diligence records — at least five years from the end of the relationship.
• Marketing records — until you unsubscribe or object, plus a suppression record kept indefinitely so we can honour your objection.
• Unsuccessful job applications — up to 12 months, unless you ask us to keep them longer.
• Website analytics and server logs — typically up to 14 months.

Retention of data on client platforms is determined by the client as controller, and is set out in the applicable data processing agreement. At the end of an engagement we return or delete that data in accordance with the client's instructions, subject to any legal retention requirement.

How we protect your data

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, network segregation, audit logging, vulnerability management, secure development practices, monitoring, and regular backups.

Access to personal data is restricted to personnel who need it to perform their role. All staff and contractors are bound by confidentiality obligations and receive data protection and security training.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where required, and inform affected individuals without undue delay where the risk is high. Where we act as processor, we notify the relevant client controller without undue delay so they can meet their own obligations.

Your rights

Where we act as controller, you have the following rights under UK data protection law:

• Access — to be told whether we hold data about you and to receive a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have data deleted where there is no continuing lawful reason for us to hold it.
• Restriction — to limit how we use your data while a concern is being resolved.
• Portability — to receive certain data in a structured, commonly used, machine-readable format, or have it sent to another controller.
• Objection — to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Withdrawal of consent — where our processing relies on consent, you may withdraw it at any time.

To exercise any of these rights, email privacy@iremitify.com. We will respond within one month. That period may be extended by a further two months for complex or numerous requests, in which case we will tell you within the first month and explain why. There is no fee, unless a request is manifestly unfounded or excessive. We may ask you for information to verify your identity before we act.

Marketing preferences

We may send business contacts information about our products, services and events where you have asked to hear from us, or where you represent a business with a relevant interest and we are permitted to contact you on the basis of our legitimate interests.

Every marketing email contains an unsubscribe link, and you can opt out at any time by writing to privacy@iremitify.com. Opting out of marketing does not stop service messages such as invoices, support responses, security notices or contractual notifications, which we need to send you.

Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling of that kind in relation to our own website visitors or business contacts.

Our compliance products include automated screening and monitoring features. Where those features are used on a client's platform, the client determines how they are configured and applied, and remains responsible for ensuring meaningful human review of the resulting decisions.

Children's data

This website and our products are intended for business use. We do not knowingly collect personal data from anyone under the age of 18 through this site. If you believe a child has provided us with personal data, please contact us and we will delete it.

Third-party links and embedded content

This site contains links to third-party websites, including the sites of our clients and partners, and may embed content such as videos and images hosted elsewhere. Following a link or loading embedded content may allow that third party to collect data about you.

We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy notice of any site you visit through a link from ours.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our products, or the law. The current version is always published on this page with a revised "last updated" date.

Where a change materially affects how we use your personal data, we will take reasonable steps to notify you directly. We recommend reviewing this page periodically.