プライバシーポリシー

Last updated:  07/28/2026

‍

1. Overview

In order for Millbank FX Limited to provide you with payment services we need to collect certain information about you and/or your company. We will endeavour not to be intrusive and refrain from asking any unnecessary questions. When we collect and use this information we are regulated under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Millbank FX Limited is the 'controller' of your personal information for the purposes of those laws. We are registered with the UK Information Commissioner's Office under registration number ZA272741.
‍

We have appointed a Data Protection Officer who is responsible for overseeing how we handle your personal information and for answering any questions you have about this policy. If you have a query, wish to exercise any of your rights, or want to make a complaint about how we use your information, you can contact our Data Protection Officer at:
‍

Mr Matheu Crisp

Data Protection Officer

Millbank FX Limited

Floor 4, 20 King Street

London EC2V 8EG

matheu.crisp@millbankfx.com
‍

Please read this notice carefully along with our terms and conditions and any other document referred to in it.


2. What information do we collect?

During the course of our interactions by telephone, email or our online portal and your visits to our website we will collect information on you that includes:

- Contact information including your name, address, email address, telephone number, nationality, date of birth and signature.

- Identity information may include a copy of your driving licence, passport, and/or a recent utility bill, or other information verifying your identity and address, or to answer additional questions to help verify your information.

- Interaction with our website. We collect information about the device you are using, such as the type of device, operating system and platform, the type and version of browser, browser plug-in types and versions, the times you access our website/app and the time zone setting, mobile network information and unique device identifier, which may include your Device’s IMEI number and/or MAC address, or the mobile phone number used by the Device. We do not capture GPS information about you.

- Contact and Call History. Information on when, how and why dialogue has taken place between Millbank FX Limited and you as a client. We may monitor communications such as emails and telephone calls for quality assurance, training, fraud prevention and compliance.

- Transactional Information. This includes the amount, currency and type of the transaction, source of funds, exchange rate, recipient name and bank details, recipient address for some jurisdictions and, optionally, the recipient’s email address and phone number. Some of the information we ask for is required by law. Where information is required, we will tell you at the point we collect it. If you are unable to provide it, we may be unable to open your account or process your transaction.

• Information from third parties and public sources. We also obtain information about you from sources other than you directly. These include credit reference and fraud prevention agencies, identity verification providers, sanctions, politically exposed person and adverse media databases, Companies House and other corporate registries, and publicly available sources including internet and media searches. We use this information to verify your identity, meet our legal obligations, and assess financial crime risk.

‍

3. How do we use your personal information?

Our primary purpose in collecting your information is to provide you with a smooth, safe and seamless service. We use your information as follows:

- We will use your information in order to furnish you with critical service updates, respond to customer service requests, resolving customer complaints, conducting customer surveys, enabling the provision of services, confirm opening of a Millbank FX Limited account, send notices and other disclosures as required by law, sending you notices of money transfers carried out through Millbank FX Limited.

- Marketing. We would like to send you information about our products and services, and about currency market events and news, that may be of interest to you. Where you are not an existing client, we will only send you marketing by email or text message if you have given us your consent, which we will ask for at the point you provide your details. Where you are an existing client, we may send you information about services similar to those we already provide to you unless you tell us you would prefer not to receive it. You can opt out of marketing at any time, at no cost, by using the unsubscribe link in any marketing message we send you, by emailing privacy@millbankfx.com, or by telling your account manager. Opting out of marketing will not stop us sending you service messages relating to your account or transactions.

- Compliance and risk management. As an authorised financial institution we are duty bound to carry out background checks on individuals, companies, our counterparties and also to monitor ongoing transactions. This is to prevent money laundering and fraud and includes helping Millbank FX Limited to protect clients from fraudulent activity on their accounts. We carry out checks to ensure we do not deal with countries, entities or individuals that are subject to sanctions, to comply with counter-terrorist financing and anti-money laundering regulations and to identify high-risk individuals where we need to add additional controls. We also conduct investigations into actual or suspected violations of our terms and conditions.
‍

- Automated decision-making and profiling. We may use automated systems to assess transactions and account activity. Where a decision is based solely on automated processing and produces a legal or similarly significant effect, we will provide the safeguards required by law. These include providing information about the decision, allowing you to make representations, enabling you to request human intervention and allowing you to contest the outcome. Some decisions may also be required by sanctions, anti-money laundering or other legal obligations. In those circumstances, our ability to change the decision or disclose particular information may be restricted by law.

4. Our lawful bases for processing

We only process your personal information where the law allows us to do so. Under the UK GDPR we must have a valid "lawful basis" for each purpose for which we use your information. The bases we rely on are set out below.

‍

Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests do not override your rights and freedoms. You can request further information about any of these assessments by contacting us at privacy@millbankfx.com.

‍

Special category and criminal offence data

Some of the information we process is subject to additional protection under data protection law. This includes:

• biometric data, where we use facial matching or liveness detection as part of a photographic identity check;
• information about actual or suspected criminal offences, which may arise from sanctions screening, adverse media checks, fraud investigations or the handling of suspicious activity;
• information revealing political exposure, where screening identifies you or an associate as a politically exposed person.

Where we process this information, we do so in reliance on Article 9(2)(g) and Article 10 of the UK GDPR, together with the conditions in Part 2 of Schedule 1 to the Data Protection Act 2018 — specifically the conditions relating to the prevention or detection of unlawful acts, regulatory requirements relating to unlawful acts and dishonesty, and preventing fraud. This processing is carried out in the substantial public interest. Where we use biometric data for identity verification, we will obtain your explicit consent under Article 9(2)(a) and will offer you an alternative method of verification if you prefer not to provide it.

We maintain an Appropriate Policy Document, as required by Schedule 1 to the Data Protection Act 2018, which explains how we comply with the data protection principles when carrying out this processing and our retention and erasure policies for it. A copy is available on request from privacy@millbankfx.com.

5. Cookies and similar technologies

We use cookies and similar technologies on our website. Cookies fall into the following categories:

• Strictly necessary — required for the website and secure client portal to function, including session management, load balancing and security. These do not require your consent.
• Functional — remember your preferences, such as language and display settings.
• Analytics — help us understand how visitors use our website so we can improve it.
• Marketing — used by us and by third parties to deliver and measure advertising.
  ‍

We will only place functional, analytics and marketing cookies with your consent, which we obtain through the banner shown when you first visit our website. You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of every page. Withdrawing consent is as easy as giving it.

Full details of each cookie we use, its purpose and its duration are set out in our Cookie Policy at www.millbankfx.com/cookies

6. Who we share your information with

We share personal information with the following categories of recipient:

• Banking and payment partners — correspondent banks, liquidity providers, payment schemes and beneficiary banks, in order to execute your transactions. Payment messages necessarily include payer and payee details under the Funds Transfer Regulation.
• Identity verification and screening providers— to carry out electronic identity checks, sanctions, PEP and adverse media screening.
•  Technology and infrastructure providers — cloud hosting, our client portal, CRM and communications recording providers.
• Professional advisers — auditors, lawyers, insurers and compliance consultants.
• Credit reference and fraud prevention agencies — including where we and they may keep a record of the search.
• Regulators and authorities — including the Financial Conduct Authority, HM Revenue & Customs, the National Crime Agency, the Information Commissioner's Office, law enforcement and the courts, where we are required or permitted to disclose.
• Corporate transactions — a prospective buyer, investor or successor in the event of a sale, merger or reorganisation of our business.

‍

Where a third party acts as our processor, we have a written contract in place requiring them to process your information only on our instructions and to keep it secure.

‍

7. International transfers

Millbank FX Limited will never sell, lease, rent or give away your personal information.

Some of our suppliers and correspondent banking partners are based outside the United Kingdom, and your information may be transferred to, stored in, or accessed from countries outside the UK. Where we make such a transfer, we ensure one of the following safeguards is in place:

• the country has been assessed by the UK Government as providing an adequate level of protection under UK adequacy regulations; or
• the transfer is made under the ICO's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment; or
• a limited exception under Article 49 UK GDPR applies — most commonly where the transfer is necessary for the performance of a contract with you, such as executing a payment to a beneficiary overseas

You can obtain a copy of the safeguards we use by contacting us at privacy@millbankfx.com.


8. Security and data breaches

Millbank FX Limited is committed to keeping your personal information secure. We have technical and organisational measures in place designed to prevent data loss, misuse of data, and unauthorised or unlawful access or disclosure. These include encryption of data in transit and at rest, access controls limiting personal data to staff who need it, secure disposal of physical records, anti-malware and firewall protection, and secure communications software. All Millbank FX Limited employees with access to client personal data are required to comply with this policy and receive regular data protection training. Our systems are subject to periodic testing by independent security specialists.

We have procedures in place to detect, investigate and report personal data breaches. We will notify the Information Commissioner's Office within 72 hours where a breach is likely to result in a risk to your rights and freedoms, and we will inform you directly and without undue delay where a breach is likely to result in a high risk to you.

9. How long we keep your information

We keep your personal information only for as long as we need it for the purposes set out in this policy, or for as long as we are required to keep it by law. As an authorised payment institution we are subject to statutory record-keeping obligations which, in many cases, require us to retain information for a fixed period even after you have closed your account or asked us to delete it.

The periods we apply are:

‍

‍

‍

‍

In limited circumstances we may retain information for longer than the periods above. This will happen where:

• a competent authority, such as the Financial Conduct Authority, the National Crime Agency or a law enforcement body, directs us to retain it, in which case the Money Laundering Regulations permit retention for up to ten years;
• the information is relevant to ongoing or reasonably anticipated legal proceedings, a regulatory investigation, or a complaint; or
• we are otherwise required to do so by law or by court order.

Where a retention period has expired and we have no other lawful reason to keep your information, we will securely delete it or irreversibly anonymise it so that it can no longer be associated with you. Anonymised information may be retained indefinitely for statistical and business analysis purposes.

If you ask us to delete your information before a statutory retention period has expired, we will restrict our use of it so that it is held only for the purpose of meeting that obligation, and we will delete it once the period ends. We will explain this to you at the time you make your request.

10. Your Rights

Under UK data protection law you have the following rights, which are normally free of charge:

• Access — to receive a copy of the personal information we hold about you.
• Rectification — to have inaccurate or incomplete information corrected.
• Erasure — to ask us to delete your information where we no longer have a lawful reason to hold it.
• Restriction — to ask us to limit how we use your information while a query about it is resolved.
• Portability — to receive information you gave us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and is automated.
• Objection — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• Withdrawal of consent — where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
• Automated decision-making — where a decision is based solely on automated processing and produces legal or similarly significant effects, to receive the safeguards required by law, including the ability to make representations, request human intervention and contest the decision.

Important limits. As an authorised payment institution we are required by law to collect, verify and retain certain information. Where we hold your information to comply with the Money Laundering Regulations 2017, the Payment Services Regulations 2017 or sanctions legislation, we will usually be unable to erase it, stop processing it, or act on an objection until our statutory retention period has expired. We are also prohibited by law from telling you if we have made a suspicious activity report about you, and we may be unable to disclose certain information in response to an access request for that reason.

To exercise any of these rights, email privacy@millbankfx.com or write to us at the address in section 11. We will respond within one month. We may extend this by up to two further months for complex requests, and will tell you if we do. We may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive.

11. Contacting us

Millbank FX Limited is the controller of your personal information. You can contact us at any time by email to privacy@millbankfx.com or in writing to Millbank FX Limited, 20 King Street, London, EC2V 8EG.

Requests to exercise your rights, and any questions or complaints about how we handle your personal information, are received at this address and are handled by, or escalated to, our Data Protection Officer, whose details are set out in section 1. You may also contact the Data Protection Officer directly if you prefer.

You also have the right to lodge a complaint with the Information Commissioner's Office if you believe we have not handled your request or complaint properly. The ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concerns before you approach the ICO, so please consider contacting us first.

Privacy Complaints. You may submit a complaint about our processing of your personal information by emailing privacy@millbankfx.com. We will acknowledge your complaint within 30 days. We will investigate it without undue delay, keep you informed of its progress where appropriate, and tell you the outcome once our investigation is complete. You may complain to the Information Commissioner’s Office at any time.

12. Children's Policy

Our accounts and services are not offered to persons under 18. We may nevertheless process limited information about a person under 18 where they are connected with a customer or transaction, for example as a beneficiary, dependant or beneficial owner. Where this occurs, we process the information only where we have an appropriate lawful basis and apply suitable safeguards. We will delete information collected without a valid purpose unless the law requires or permits us to retain it.


13. Changes to this policy

We keep this policy under review and may update it from time to time. The version in force is always available at https://www.millbankfx.com/privacy-policy and shows the date it was last updated. Where changes are material, we will notify you directly by email before they take effect. If a change requires your consent, we will ask for it separately.