Privacy Notice

This is the Privacy Notice for Zopa Bank Limited referred to as "Zopa", "we", "us" or "our" in this document.

This Privacy Notice provides details of what information we collect from you, what we do with it, who we share it with and your rights in relation to it.

Topics

1. The Information we collect about you
2. Using your information
3. Sharing your information
4. Overseas transfers
5. Retaining your information
6. Your rights
7. How to contact us or make a complaint
8. Consequences of not providing us with your personal data
9. Keeping your information safe
10. Cookies
11. About Zopa
12. Changes to this Privacy Notice

1. The information we collect about you

1. Please see below the types of personal data that we may collect and process about you.

This information may come from:

• The way you use our website.

• Your other interactions with us, including information you share with us.

2. Using your information

Data protection law requires us to have a legal ground to use your personal data. We rely on one or more of the following grounds to use your personal data:

• To comply with a law that we are subject to

• We have a legitimate interest in using your information which isn't outweighed by your interests, rights and freedoms

• You have given us your consent

We've set out in the table below how we use your personal data and the legal basis for using it.

Direct marketing

When you register with Zopa we'll give you the option to opt-out of receiving different categories of messages from us. These categories relate to letting you know about new products or launches, promoting our existing products, and asking for feedback.

We only send these messages if there is something worthwhile to tell you about. If you don't want to receive these messages you can log into your account and change your settings.

We'll still send your messages relating to Zopa products you have where this is necessary to provide you with a good service. There also may be some messages that we're required by law or regulation to send you even if you ask us not to.

Special category data

Data protection law requires us to treat special category data with more care. Special category data includes biometric data (physical, physiological or behavioural characteristics about you), health data, criminal convictions, and any religious or political data.

We'll only use special category data for the following purposes:

• detecting and preventing financial crime,

• verifying your identity through the use of biometric data; and

• making our services accessible to customers.

Also we'll only process special categories of information where we've obtained your explicit consent or where one of the limited grounds on which we can process special category data applies.

3. Sharing your information

We use and work with a range of third parties as part of running our business. This means that we may have to share your information with them and they may have to share your information with us. These third parties include:

• Other UK Fintechs and corporate partners of the 2025 Fintech Pledge

• Third party service providers that help us provide services to you including cloud based service providers, and third parties that help us communicate with you (SMS, live chat, email). Companies that help us understand, improve and market our products

4. Overseas transfers

We may transfer your personal data to countries outside either the UK or the European Economic Area (EEA), whose personal data protection laws are less strict than in the UK or the EEA.

Where we do so, we will make sure suitable safeguards are in place to protect your personal data, in line with data protection law. The safeguards we use will depend on the circumstances and the third party who we transfer data to, but include the EU Commission's standard contractual clauses.

Please contact privacy@zopa.com if you want to know more details about the above safeguards or obtain a copy of the standard contractual clauses we use to transfer data outside the UK and the EEA.

5. Retaining your information

We will hold your information for as long as you have a relationship with us. How long we’ll keep your information for will depend on the nature of our relationship, the type of information and the purposes for which we hold it.

We'll retain information that helps us to:

• comply with legal and regulatory requirements

• deal with any complaints regarding the services we've provided

• ensure we don't send marketing to people who have opted out

• maintain business records for analysis and audit purposes

6. Your rights

Right to be provided with certain information

We must provide you with certain information at the time we collect your personal information, including how we use it and the legal basis for doing so, who we share it with, how long we intend to keep it, where we got the information from and your rights in relation to it. You find this information in this Privacy Notice.

Right to withdraw your consent

Where we rely on your consent to use your personal data (for example for the use of biometric data for verifying your identity), you can withdraw that consent at any time and we’ll stop any further processing of the data linked to your consent (we may retain the same data on a different legal basis however).

Right to access your information

You can ask for a copy of the personal data we hold about you (and other information relating to it) unless providing some or all of it would adversely affect the rights and freedoms of others, or the law requires us not to comply with your request. You can make a request to access your personal data by contacting us using the methods available at zopa.com/contact. We aim to provide you with your data within 30 days.

Right to correction

You can ask us to correct any personal data we hold about you which you believe is inaccurate. We'll update your information as soon as we can. You may need to provide supporting evidence before we can deal with your request; e.g. a copy of your marriage certificate if you want to update your name.

Right to erasure ('right to be forgotten')

You can ask us to erase your personal data:

• if you think it's inaccurate

• if you think it's illegal for us to use it

• if you don't want us to destroy it because you need it for legal proceedings

• if you've told us we don't have a legitimate reason for using it and we're considering your request

Notification obligation

You can ask us to notify everyone to whom we've given your personal data whenever we amend, delete or agree to restrict our use of it.

Right to data portability

If we're using your information on the basis of your consent or because we need it to carry out our contractual obligations to you, you can ask us to give you your personal data in a structured, commonly used and machine-readable format or have it transmitted to another data controller.

Right to object

You have a right to object whenever we are using personal data on the basis of our legitimate interests (section 2 contains the ways in which we rely on legitimate interests to use your personal data). This includes where we use your personal data for direct marketing purposes, including profiling.

We may not always be able to comply with your requests

There may be occasions when you wish to exercise one of your rights and we're unable to agree to your request, e.g. because we have compelling grounds for using your information, or because we need to keep your information to comply with a legal obligation.

Making requests to exercise your rights

You can send us your request by contacting us using the methods available at zopa.com/contact

7. How to contact us or make a complaint

If you have any further questions about privacy at Zopa, or if you are unhappy with how we've handled your information you can contact us at:

The Data Protection Officer (DPO)

Zopa
Cottons Centre
47-49 Tooley St
London
SE1 2QG

Right to access your information

You can ask for a copy of the personal data we hold about you (and other information relating to it) unless providing some or all of it would adversely affect the rights and freedoms of others, or the law requires us not to comply with your request. You can make a request to access your personal data by contacting us using the methods available at zopa.com/contact. We aim to provide you with your data within 30 days.

Or by email at: privacy@zopa.com if you are still unsatisfied you can refer your concerns to the Information Commissioner's Office, the body that regulates the handling of personal data in the UK, at:

Information Commissioner's Office

Wycliffe House,
Water Lane,
Wimslow,
SK9 5AF

Tel: 0303 123 1113
Website: www.ico.org.uk

8. Consequences of not providing us with your personal data

You don't have to provide us with your personal data. If you don't provide your data we may not be able to respond to any enquiries you make through the site.

9. Keeping your information safe

We take your privacy seriously and take every reasonable measure to keep your information secure. We monitor our systems 24/7 and continually work to improve the security of your personal data and our systems.

10. Cookies

We use "cookies" and similar technologies, which store small amounts of information on your computer or device, for a number of different purposes. You can find more details about this in our Cookie Policy, which forms part of this Privacy Notice.

11. About Zopa

Zopa Bank Limited is a company incorporated in England & Wales under company registration number 10627575. Our registered office at 1st Floor, Cottons Centre, 47-49 Tooley Street, London SE1 2QG. We’re registered with the Information Commissioner with registration number Z879078. We’re also authorised and regulated by the Financial Conduct Authority and entered on the Financial Services Register under firm registration number 800542.

12. Changes to this Privacy Notice

We'll regularly review this Privacy Notice. If we make any changes, we'll post the updated policy on this page.