Optal privacy notice

1. About this Privacy Notice

1.1 This Privacy Notice applies to the Optal Group companies listed in Appendix 1 at the end of this Privacy Notice. It explains

(a) what kinds of Personal Information we process;

(b) how and when we collect Personal Information;

(d) when and with who we may share or transfer your Personal Information; and

(e) choices you have regarding our use of that Personal Information, and your ability toaccess or correct that Personal Information.

If you have any queries regarding this Privacy Notice, you should contact our Data Protection Manager in the way specified in paragraph 14.

1.2 Each entity is herein referred to as "Optal", "we", "us" or "our". Note that the main part of this Privacy Notice applies with respect to each and every Optal Group entity listed in Appendix 1. Any additional local law requirements or contact details which may apply to one particular entity due to its place of incorporation, place of business or area of activity are specified in Appendix 2 at the end of this Privacy Notice.

1.3 This Privacy Notice applies to data collected, submitted or processed:

(a) via the Optal website;

(b) when you subscribe or otherwise consent to receiving marketing materials or general information about Optal’s services; or

2. Personal Information

2.1 "Personal Information" is information which relates to a living individual who can be identified from that information or from that information and other information which is in our possession, or is likely to come into our possession and includes any expression of opinion about the individual and any indication of our intentions or the intentions of any other person in respect of the individual.

3. What Personal Information do we collect, use or process?

3.1 The types of Personal Information we may collect, use or process about an individual will depend upon the nature of our interaction with them. Personal Information that we collect, use or process may include (but is not limited to) the following (including copies of documents containing this information):

(a) full name;

(b) personal details such as your nationality, gender, age and/or date of birth;

(c) personal or business contact details including telephone numbers (landline, fax number and/or mobile), email addresses and public social media IDs;

(d) current residential address (including postal address);

(e) payment details, such as your credit card or bank account details;

(f) occupation and employment details including income details;

(g) information from your curriculum vitae, resume or job application if you apply for a job with us;

(h) identification documentation details (e.g. passport or national ID card number);

(i) National Insurance, Social Security Number (SSN) (or equivalent) number;

(j) criminal record check results;

(k) shareholding/proprietorship in relevant companies/businesses; and

(l) information about your usage of our website(s) and your interest in Optal’s products and services, through web tracking software; and/or when you report a problem with our website(s). This may include the full Uniform Resource Locators (URL) clickstream to, through and from our website(s) (including date and time); products or services you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number. Also technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform(s).

3.2 We collect, use or process Personal Information about individuals such as:

(a) our customers and their suppliers, potential customers and their representatives, employees, directors, partners, proprietors, shareholders, beneficial owners or individuals exercising control over the relevant counterparty;

(b) our customers' clients;

(c) our suppliers and potential suppliers and their representatives, directors, partners, proprietors, shareholders or other beneficial owners;

(d) contractors and potential contractors and their representatives providing goods and services to us; and

(e) any other person who comes into contact with Optal.

4. How and when do we collect Personal Information?

4.1 We collect your Personal Information to allow us to provide, market and sell our products and services and for the specified purposes set out in paragraph 6.2.

4.2 We may collect your Personal Information:

(a) in the course of providing you with our products or services;

(b) when you provide us, or you offer or apply to supply us, with goods or services;

(c) when you contact or provide information to us in any way (including by completing a form, disclosing information over the phone, fax or via email, SMS or social media, providing us with a business card or when you browse or fill in a form on our website(s));

(d) when you request information about us, our products or our services;

(e) when you provide feedback to us;

(f) when you visit premises from which we operate;

(g) in the course of conducting or administering our relationship with you, or when you are carrying out activities in connection with our operations;

(h) when you submit a job application to us;

(i) when we carry out background verification checks on you, if you are registering to use our service and we conduct customer due diligence;

(j) when you register or subscribe to use our services through our platform(s), website(s) or otherwise;

(k) when you place or accept an order on our website(s) or platform(s);

(l) when you report a problem with our service or our platform(s) or website(s);

(m) through us working closely with third parties (including, for example, business partners, suppliers and subcontractors in technical, payment and fulfilment services, advertising networks, analytics providers, search information providers, credit reference agencies and fraud prevention agencies or other similar organisations - who may check the information against any particulars on the Electoral Register and any other databases) and may receive information about you from them; or

(n) where we are otherwise required or authorised by law to do so.

4.3 Generally, when providing our products and services, dealing with our personnel, or obtaining goods and services from our service providers, suppliers or contractors, we collect Personal Information directly from the relevant individual where reasonable and practicable.

4.4 Our website(s) may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy and security policies and procedures and that we do not accept any responsibility or liability for these policies and procedures or for your or your Personal Information’s security whilst you are visiting these websites. Please check these policies before you submit any Personal Information to these websites.

4.5 We may also collect Personal Information about you from your employer, if your employer has engaged us to provide services to them.

4.6 We may also collect Personal Information about you if you use any of the other websites or platforms we operate or the other services we provide. In this case, we will have informed you when we collected that data that it may be shared internally within the Optal Group of companies set out in Appendix 1 and combined with data collected on our websites. We work closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them for the purposes set out in paragraphs 4.1 and 6.2.

4.7 The Personal Information we collect may include sensitive Personal Information, including financial, criminal, health information and biometric information. We will ask for your consent to collect sensitive information, unless the law allows us to collect it without your consent.

4.8 It is voluntary for you to provide us with your Personal Information. However, in most cases, if you choose not to provide your Personal Information to us for the purposes set out in this Privacy Notice, or if we do not or are unable to collect the Personal Information we may not be able to provide you with access to Optal's services.

4.9 Where you provide Personal Information relating to others (e.g. beneficial owners’ details, business representatives’ details, supplier who is to be paid) you confirm that you have a lawful basis to do so and/or you will inform that person about us or are otherwise entitled to provide this information to us and for us to use it in accordance with this Privacy Notice.

5. Cookies

5.1 Please refer to our cookies notice for information about how we handle your Personal Information in relation to your activity on our website(s) and platform(s).

6. How do we use your Personal Information?

6.1 We use your Personal Information in order to operate our business efficiently and to market our products and services.

6.2 We may collect, hold and use your Personal Information

(a) to administer the relationship between you and us or your employer, and to administer our business, for example managing your customer account, collecting, making and processing payments, providing support, and keeping you informed about changes to our products and services;

(b) to carry out identity checks and customer due diligence, either in connection with the security of the products and services that we supply to you or you supply to us, or where we are required to do as part of our legal or regulatory obligations;

(c) to identify which products and services are likely to be of interest to you, promote and market our products and services, and to provide you with information that we believe may be of interest to you;

(d) to conduct research for the purposes of improving existing products or services, creating new products or services and marketing our products and services more effectively;

(e) to carry out statistical analysis, provided that the information is aggregated and de- identified such that no individual may be identified from that information even when combined with other information;

(f) to measure or understand the effectiveness of advertising we serve to you and others and to deliver relevant advertising to you

(g) for business support purposes including maintenance, backup and audit;

(h) to process any job application submitted by you;

(i) to respond to any queries or complaints you may have;

(j) to enhance the user experience of our website(s) by displaying more relevant information and options to customers;

(k) to allow you to participate in interactive features of our service;

(l) to administer our website(s) and other systems, including troubleshooting, data analysis, testing, research, statistical analysis and survey purposes;

(m) to assist with keeping our platform(s) and website(s) safe and secure;

(n) to comply with our statutory and legal obligations or requests from any court, authority or governmental body of any jurisdiction in which the Optal Group is subject to regulation; or (o) in order to establish, exercise, defend, protect, preserve or establish Optal’s legal or other rights, or those of our customers’ or others.

6.3 We may collect, use or disclose your Personal Information where the collection, use or disclosure is:

(a) in accordance with this Privacy Notice or any agreement you enter into with us; or

(b) required or authorised by applicable law.

7. When do we disclose your Personal Information?

7.1 Optal may disclose, transfer to, or provide access to, your Personal Information to third parties for the purposes described in paragraph 4.1 and 6.2.

7.2 We may share your Personal Information with other Optal Group entities as may be necessary to operate our business or provide you with services.

7.3 We may also disclose your Personal Information for the purposes described in paragraphs 4.1 and 6.2 to:

(a) organisations to whom you send payments or from whom you receive payments via our products or services;

(b) other organisations or individuals who assist us in providing our products or services to you (for example, our payment processing providers, financial service providers and outsourced service providers);

(d) professional service providers and advisors who perform functions on our behalf, suchas lawyers;

(e) representatives, agents or contractors who are appointed by us in the ordinaryoperation of our business to assist us in providing our products or services or administering our business (such as for data storage or processing, printing, mailing, marketing, planning and product or service development);

(f) analytics and search engine providers that assist us in the improvement and optimisation of our website(s); and

(g) government, regulatory authorities and other organisations as required or authorised by law, including in jurisdictions other than your own in which we operate.

7.4 We may also disclose your Personal Information to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets in circumstances which may require the use or transfer of such Personal Information. This may also include, without limitation, in connection with any bankruptcy or insolvency event. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Privacy Notice.

8. Overseas disclosures

8.1 Some of your Personal Information may be disclosed, transferred, stored, processed or used overseas by us, or by third party service providers for the purposes described in paragraphs 4.1 and 6.2. This may happen if:

(a) our offices or related entities are overseas;

(b) we outsource certain activities overseas;

(d) our computer systems including IT servers are located overseas.

8.2 In particular, your Personal Information may be disclosed as outlined in paragraph 8.1 to persons in Australia, Hong Kong, the European Economic Area, the United Kingdom, Singapore, Japan and the U.S.A and such other countries in which: (i) those parties or their, or our, computer systems may be located from time to time, or (ii) any member of the Optal Group becomes licensed or establishes a place of business, in each case where it may be used for the purposes described in this Privacy Notice.

8.3 Where we transfer data to other jurisdictions, we will do so in accordance with applicable privacy law.

9. Other uses and disclosures

9.1 We may collect, use and disclose your Personal Information for other purposes not listed in this Privacy Notice. If we do so, we will make it known to you at the time we collect, use or disclose your Personal Information.

10. Marketing

10.1 You may receive marketing communication from us if you have requested information from us or if you have provided us with your details when you requested our newsletter or other products on our website(s) and, in each case, you have not opted out of receiving marketing.

10.2 We will get your express opt-in consent before we use or share your personal data with any company outside of the Optal Group for marketing purposes.

10.3 You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by emailing us at any time at unsubscribe@optal.com

11. Storage and security of Personal Information held by us

11.1 We aim to keep your Personal Information secure. Any Personal Information that is collected via our website(s) or which is held on our computer systems is protected by safeguards including physical, technical (data encryption) and procedural methods. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of your information transmitted to our site; any transmission is at your own risk. Once we have received your information we will use strict procedures and security features to try to prevent unauthorised access.

11.2 We will store Personal Information only for as long as it is reasonably necessary taking into consideration the term of your relationship with Optal, Optal’s need to answer queries, resolve problems, provide improved and new services and comply with legal and regulatory requirements under applicable law(s) and regulatory requirements and those of our suppliers. This means that we may retain Personal Information for a reasonable period (in compliance with applicable law(s)) after you (or your employer) stop using Optal’s services. After this period or when the Personal Information is no longer necessary for the purposes described in this paragraph (including any directly related purposes), we will take reasonable steps to destroy or permanently anonymise the Personal Information.

12. Access and updating your Personal Information

12.1 You are generally entitled to access or correct Personal Information that we hold about you. If you request access to your Personal Information we will give you a description of it; tell you why we are holding it; tell you who it could be disclosed to; and let you have a copy of the information in an intelligible form. Optal may charge for providing access to this information, however such a charge will not be excessive and will be in accordance with applicable law.

12.2 With regards to paragraph 12.1 there may be some legal or administrative reasons to deny access. If we refuse your request to access your Personal Information, we will provide you with reasons for the refusal where we are required by law to give those reasons.

12.3 A request for access or correction can be made by contacting our Data Protection Manager in the way specified in paragraph 14.

12.4 We take all reasonable and such practical steps as may be required to ensure that any Personal Information we collect and use is accurate, complete and up-to-date. To assist us in this, you need to provide true, accurate, current and complete information about yourself as requested, and properly update the information provided to us to keep it true, accurate, current and complete.

12.5 Please contact us in the way specified in paragraph 14 if you believe that the Personal Information is inaccurate, incomplete or out of date, and we will use all reasonable efforts and take such practical steps as may be required to correct the information.

12.6 It would assist us to ensure we properly understand your request, and allow us to respond more promptly, if requests are made in writing and include as much detail as possible.

13. How do we deal with complaints?

13.1 If you feel that we have not respected your privacy or that we have conducted ourselves inconsistently with this Privacy Notice, please contact our Data Protection Manager in the way specified in paragraph 14 and advise us as soon as possible. We will investigate your queries and complaints within a reasonable period of time and in accordance with applicable law and regulation depending on the complexity of the complaint.

13.2 We will notify you of the outcome of our investigation.

14. What to do if you have a question, problem or want to contact us about our use of your Personal Information or this Privacy Notice?

14.1 If you:

(a) have a query or concern about this Privacy Notice or our Personal Information handling processes;

(b) wish to make a complaint in relation to a breach of your privacy;

(d) would like to update or correct your Personal Information held by us,

please contact our Data Protection Manager who can be reached by email at compliance@optal.com

This Privacy Notice was last updated on 13 December 2021. Any changes we may make to this Privacy Notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our Privacy Notice.

Appendix 1

Optal Group Companies

This is the Privacy Notice of the following Optal Group companies:

Company Name	Company number	Registered Address
Optal Limited	5531282	27-28 Eastcastle Street London W1W 8DH United Kingdom
Optal Financial Limited	8364883	27-28 Eastcastle Street London W1W 8DH United Kingdom
Optal Asia Limited	2189337	31/F Tower Two Times Square 1 Mathesons St Causeway Bay Hong Kong
Optal Australia Pty Ltd	614 774 248	Level 23 367 Collins Street Melbourne Victoria 3000 Australia
Optal Financial Europe Limited	612228	3rd Floor Fleming Court Fleming’s Place Dublin 4 Ireland
Optal Singapore Pte. Ltd	201717379M	30 Cecil Street #19-08 Prudential Tower Singapore 049712
Optal Japan Kabushiki Kaisha	0100-01-205301	No. 806 Ark Hills Front Tower RoP 2-23-1 Akasaka Minato-ku Tokyo Japan

Appendix 2

Local Law Addenda

England & Wales

(Relevant where references in this Privacy Notice to “Optal” mean Optal Limited and/or Optal Financial Limited)

With regards to what constitutes Personal Information in paragraph 2.1, pursuant to the General Data Protection Regulation (EU Regulation 2016/679) as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018, it includes any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

For the purposes of UK data protection law, each of Optal Financial Limited and Optal Limited are data controllers. Under UK data protection law, we may only process your information if we have a legal basis for doing so. Typically we will process your data on the basis that we have a legitimate interest in operating our business, to comply with our legal obligations, to establish or defend our legal rights, or you have given us your consent.

We only collect sensitive personal information about you if we have your consent or if we have a legal or regulatory obligation. For example the regulated financial services entities in the Optal Group may have to do background checks on individuals as part of our obligations to do customer due diligence.

With regard to your right to obtain a copy of the Personal Information we hold about you stated in paragraph 12.1, you may obtain a copy of such Personal Information for free.

In addition to the rights stated in paragraph 14, you have the right to:

request certain information about how Optal processes your Personal Information;
request a transfer of certain Personal Information from us to another data controller; and
ask us to delete Personal Information we hold about you.

Any request to exercise one of these rights will be assessed by us on a case by case basis. There may be circumstances in which we are not legally required to comply with your request, for example because of relevant legal exemptions provided for in applicable data protection legislation.

With regards to the contact information stated in paragraph 14, should you wish to write to us, please do so at Optal Financial Limited, c/o WEX, Fourth Floor, East Building, 1 London Bridge, London SE1 9BG, for the attention of: Risk and Compliance.

In addition, you have the right to lodge a complaint to the UK’s Information Commissioner’s Office in respect of your data protection rights.

Ireland

(Relevant where references in this Privacy Notice to “Optal” mean Optal Financial Europe Limited)

With regards to what constitutes Personal Information in paragraph 2.1, pursuant to the General Data Protection Regulation (EU Regulation 2016/679), it includes any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

For the purposes of Irish data protection law, Optal Financial Europe Limited is the data controller.

Under Irish data protection law, we may only process your information if we have a legal basis for doing so. Typically we will process your data on the basis that we have a legitimate interest in operating our business, to comply with our legal obligations, to establish or defend our legal rights, or you have given us your consent.

With regard to your right to obtain a copy of the Personal Information we hold about you stated in paragraph 12.1, you may obtain a copy of such Personal Information for free.

In addition to the rights stated in paragraph 14, you have the right to:

request certain information about how Optal processes your Personal Information;
request a transfer of certain Personal Information from us to another data controller; and
ask us to delete Personal Information we hold about you.

With regards to the contact information stated in paragraph 14, should you wish to write to us, please do so at 28 Fitzwilliam Place, Dublin 2, D02 T292, Ireland, for the attention of: Risk and Compliance.

In addition, you have the right to lodge a complaint to Ireland’s Data Protection Commissioner in respect of your data protection rights.

Hong Kong

(Relevant where references in this Privacy Notice to “Optal” mean Optal Asia Limited)

With regards to paragraph 4.9, replace paragraph 4.9 with the following:

"Where you provide Personal Information relating to others (e.g. beneficial owners’ details, business representatives’ details, supplier who is to be paid) you confirm that, on or before the collection of such Personal Information by you, you have informed that person about us and the purposes, and/or before providing such Personal Information to us, you have obtained their voluntary and express consent if such provision of Personal Information to us and/or our proposed purposes constitute a new purposes beyond the purpose(s) notified to them at the time of collection, or you are otherwise entitled to provide this information to us and for us to use it in accordance with this Privacy Notice."

With regard to paragraphs 6.2(c), 6.2(d) and 6.2(f) and 10, we will only use your Personal Information (your name and contact details (email address, correspondence address and telephone number)) for direct marketing (in respect of financial services and payment services of the Optal Group) if you provide your voluntary and express consent or non-objection and have not subsequently withdrawn this. We will not provide your Personal Information to others for their use in directing marketing.

With regards to paragraph 8.2, the countries to which it may be transferred includes countries where your Personal Information may be subject to a lower standard of protection including to jurisdictions whose applicable law does not provide a comparable standard as the Personal Data (Privacy) Ordinance.

With regards to paragraph 9, your Personal Information collected will be used for the purpose for which the data is collected or for a directly related purpose. Otherwise, we will request you to provide a voluntary and express consent for a new purpose to us on or before your collected Personal Information is used.

With regards to paragraph 12.2, the reference to "administrative reasons" does not apply.

With regards to paragraph 12.5 the information to be corrected includes any of your Personal Information that has been disclosed by us to a third party as contemplated under this Privacy Notice if, at the time of such disclosure, the Personal Information concerned is materially inaccurate having regard to the purpose for which it is to be used. Optal shall take all praticable steps to correct information held by us and the third party.

Australia

(Relevant where references in this Privacy Notice to “Optal” mean Optal Australia Pty Limited)

With regards to paragraph 8.2, note that this is without us being responsible under the Privacy Act 1988 (Cth) for such use (or for any breach). Where such parties are located overseas, you may have rights to enforce such parties' compliance with applicable data protection laws, but you may not have recourse against those parties under the Australian Privacy Act in relation to how those parties treat your Personal Information. However, we will take all steps reasonably necessary to ensure that your Personal Information disclosed to third parties in the countries referenced above (outside of Australia) is treated securely and in accordance with this Privacy Notice.

Singapore

(Relevant where references in this Privacy Notice to “Optal” mean Optal Singapore Pte Ltd)

Accessing your Personal Information

With regard to paragraph 12.2, Singapore law permits Optal to refuse your request to access your Personal Information in certain instances, including where:

your Personal Information is subject to legal privilege;
your Personal Information would, if disclosed, reveal confidential commercial information that could, in the opinion of a reasonable person, harm the competitive position of an Optal entity;
your Personal Information is contained in any document related to a prosecution if all proceedings related to the prosecution have not been completed;
your request(s) unreasonably interfere with our operations because of the repetitious or systematic nature of the requests;
the burden or expense of providing access would be unreasonable to Optal or disproportionate to your interests;
your request is for information that does not exist or cannot be found, or that is trivial; or
your request is otherwise frivolous or vexatious.

Please see the Fifth Schedule to the Personal Data Protection Act 2012 for the full list of situations where Optal would not be obliged under Singapore law to grant you access to your Personal Information.

With regards to the contact information stated in paragraph 14, should you wish to contact us, please write to us at: 38 Beach Road, Level 30, South Beach Tower, Singapore 189767, for the attention of: Data Protection Manager or call us on: +65 6909 9299.