Privacy Policy

Scope of this policy

This Privacy Policy applies when you visit or use The Bank of New York Mellon Corporation, register or manage an account, submit verification documents, perform banking activities, communicate with support or otherwise interact with our services.

By using the platform, you acknowledge that personal information will be processed as described in this policy and as required to deliver secure banking services.

Information we collect

The information collected depends on the services you use and the information required to operate, secure and administer your account.

Identity and contact information

• Your name, date of birth, residential address, email address and telephone number.
• Government-issued identification details and other information required for identity verification.
• Identity-document images, photographs or selfies submitted during KYC verification.

Account and security information

• Account numbers, usernames, authentication records and account-status information.
• Login activity, security events and information used to identify suspicious or unauthorized access.
• Device, browser, network or IP information where collected for security, diagnostics or fraud prevention.

Financial and transaction information

• Account balances, deposits, withdrawals, transfers and card-related records.
• Beneficiary, recipient and transaction-reference information.
• Transaction dates, values, statuses and records needed for reconciliation, reporting and dispute resolution.

Communication information

• Support enquiries, complaints, instructions and other communications sent to us.
• Delivery records for account, security and transaction notifications.

How we use personal information

We use personal information only for legitimate operational, security, customer-service and regulatory purposes, including to:

• Create, verify, administer and support accounts.
• Conduct identity, KYC, compliance and fraud-risk checks.
• Authorize, process, record and reconcile banking activities.
• Protect accounts and investigate suspicious, unauthorized or unlawful activity.
• Deliver verification codes, security alerts, transaction notices and service communications.
• Respond to enquiries, complaints and support requests.
• Maintain financial, compliance, security and audit records.
• Meet applicable legal, regulatory, reporting and law-enforcement obligations.
• Improve system reliability, accessibility, security and customer experience.

When information may be shared

We do not sell personal information. Information may be disclosed only where reasonably necessary, authorized or legally required.

Recipients may include:

• Financial institutions, payment networks and transaction-processing partners.
• Identity-verification, communication, hosting, security and professional-service providers.
• Regulators, courts, auditors, law-enforcement authorities and other authorized public bodies.
• Fraud-prevention or risk-management services where permitted by applicable law.
• A successor organization during a lawful merger, restructuring, acquisition or transfer of business.

Service providers are expected to process information only for approved purposes and to apply appropriate confidentiality and security protections.

Security safeguards

We use administrative, organizational and technical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure.

• Authentication, authorization and role-based access controls.
• Restricted administrative access to sensitive customer information.
• Secure handling of passwords, verification codes and other authentication information.
• Monitoring, audit records and investigation of suspicious activity.
• Controlled backups, system maintenance and security updates.

Identity documents and KYC photographs are stored outside publicly accessible web storage and are made available through authenticated, role-restricted administrative access.

How long information is retained

Personal information is retained for as long as it is reasonably required to provide services, secure the platform, resolve disputes, maintain accurate financial records and meet legal or regulatory obligations.

Retention periods may differ according to the type of information and the reason it was collected. Financial, transaction, KYC, fraud-prevention, compliance and audit records may need to be retained after an account has been restricted or closed.

Cookies, sessions and device information

The website may use cookies or similar technologies needed to maintain secure sessions, remember permitted preferences, protect against malicious requests and support reliable operation.

Some cookies are necessary for authentication and security and cannot be disabled without affecting core account functionality. Optional analytics or preference technologies should be used only where enabled and permitted.

You may control cookies through your browser, although blocking essential cookies can prevent login or other protected features from working correctly.

Your privacy rights

Subject to applicable law, verification of identity and any permitted limitations, you may have the right to:

• Ask whether we hold personal information about you.
• Request access to personal information associated with your account.
• Request correction of inaccurate, incomplete or outdated information.
• Object to certain processing or withdraw consent where processing depends on consent.
• Request deletion or restriction where legally available.
• Submit a complaint to the relevant privacy or data protection authority.

We may ask for proof of identity before processing a request. This protects customers against unauthorized access or fraudulent changes.

Some requests may be limited where fulfilling them would conflict with legal obligations, another person's rights, fraud prevention, security controls or required financial and compliance recordkeeping.

International processing and transfers

Some approved service providers or technology systems may process information in another country. Where this occurs, appropriate contractual, organizational or legal safeguards should be applied as required by applicable data-protection law.

Children's personal information

Our banking services are not intended to be opened or operated independently by children unless the service expressly permits this and all required guardian, identity and legal requirements have been satisfied.

Contact us when you believe a child's information has been submitted without proper authority.

Changes to this policy

We may update this Privacy Policy when services, security practices, legal requirements or information handling procedures change.

The updated version will display a revised “Last updated” date. Material changes may also be communicated through the platform or another appropriate channel.