Privacy Policy

1. Who we are

This policy explains how Multibanx Ltd (“Multibanx”, “we”, “us”), company number 15744236, registered in England and Wales, collects and uses personal data. It applies to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), as amended, including by the Data (Use and Access) Act 2025.

Multibanx is a UK-based advisory and sourcing business. We help businesses and financial institutions identify and assess banking, payment, FX and settlement providers. We are not a bank, electronic money institution or payment institution, and we do not hold client funds. The banking, payment and settlement services we refer to are provided by third-party institutions, each of which is responsible for its own obligations.

Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom.

Data protection contact: info@multibanx.com.

2. Who this policy covers

This policy covers:

• visitors to this website;
• people who contact us through the website, by email, by telephone or in person;
• professional contacts at prospective and existing clients, providers, introducers and advisers;
• prospective and existing clients, and their representatives; and
• individuals connected to a client’s organisation, such as directors or owners, where we receive information about them in the course of an engagement.

3. Website visitors and routine enquiries

Website visitors. When you visit this website, our hosting platform processes basic technical information needed to deliver the pages, such as your IP address, browser type, the pages you request and the date and time of each request. We do not require you to create an account, and we do not carry out identity checks on visitors. Our approach to cookies and similar technologies is described in our Cookie Policy.

Enquiries. If you complete the enquiry form, we collect the details requested on it: your name, business email address, organisation, role (if you choose to give it), organisation type, area of interest, jurisdictions or currencies (if you choose to give them), and a brief outline of your requirements.

Please do not include passwords, account login details, bank account details or identity documents in an enquiry. We do not intentionally collect special category data, such as health, religious or political information. Please do not include it.

Professional contact details. When we speak or correspond with you in a business capacity, we keep your name, job title, organisation, business email address and telephone number, together with a record of the conversation.

4. Correspondence and client engagements

We keep records of correspondence with prospective and existing clients, including emails, meeting notes and call notes, so that we can respond properly and manage the engagement.

Where we agree to work with you or your organisation on a particular requirement, we may need further information to assess and progress that engagement. This may include information about the business, its ownership and management, the currencies and jurisdictions involved, and the requirements of the providers you are considering. Where it is genuinely necessary, it may also include identity information about the individuals involved.

We collect such information only for the specific engagement, and we will explain what we need and why before we ask for it. We do not request it through the website.

We do not routinely collect passports, National Insurance numbers or bank account details from website visitors or from people who make an enquiry. Where a provider’s onboarding process requires such information, it is usually collected by that provider directly. Where we handle any such information ourselves, we limit it to what is necessary for the purpose and handle it in line with this policy.

5. Due diligence and verification

In some engagements, we may receive or carry out checks to understand the parties involved and to manage risk, for example to confirm identity, ownership or the suitability of a proposed arrangement. This information may come from clients, from counterparties, from introducers, or from third-party verification sources.

We carry out such checks only where they are relevant to a specific engagement, and we will tell you when a check is being made about you or your organisation. We do not carry out checks on every visitor or every enquiry. This policy does not assume that any particular legal obligation applies to our activities. Where a check is made, it is made for risk management in connection with the engagement, on the lawful basis set out in section 10.

6. Information from professional networks and public sources

To identify relevant contacts, understand an organisation, and prepare for a conversation, we may use information from public sources such as company registers, professional networking sites, and published news and business material. We use such information only where it is relevant to a business purpose, and we do not use it for any unrelated purpose.

7. Business development and communications

We may contact business contacts about services and insights that may be relevant to their organisation. We send electronic marketing messages only in line with PECR and UK GDPR. Every marketing message will identify us as the sender and explain how to stop receiving further messages.

If you object to marketing, we will stop, and we will keep a record of your objection so that we do not contact you again in error.

8. Institutional introductions and sharing information

Introducing clients to relevant banks, payment institutions, e-money issuers, FX providers and settlement providers is central to our work. We will not introduce you or your organisation to a provider without first discussing it with you. Before any introduction, we will explain what personal data would be shared, with whom, and why. We share only what is needed for that introduction.

9. Who we share personal data with

We may share personal data with:

• banks, payment institutions, e-money issuers, FX and settlement providers, but only for a specific introduction or onboarding process that you have discussed with us;
• professional advisers, such as lawyers and accountants, where needed;
• service providers, including website hosting and technology providers, that process personal data on our behalf under written contracts;
• regulators, courts, law enforcement or other public authorities, where we are required to do so by law; and
• a prospective buyer or seller of all or part of our business, under appropriate confidentiality obligations.

We do not sell personal data.

10. Purposes and lawful bases

We rely on the following lawful bases under UK GDPR. Where a purpose is listed more than once, the bases apply together as described.

• Responding to enquiries and recording professional contact details. Legitimate interests in responding to people who contact us and in managing our business. Steps at your request before entering into an engagement (Article 6(1)(b)).
• Correspondence and engagement administration. Steps at your request before, and performance of, any agreement with you (Article 6(1)(b)). Legitimate interests in managing our relationship with you and our business.
• Assessing and progressing an engagement. Legitimate interests in assessing whether we can help and in progressing the engagement. Legal obligation, where a law requires the information.
• Due diligence and verification. Legitimate interests in managing risk in a specific engagement. Legal obligation, where a law applies.
• Public sources and professional networks. Legitimate interests in business development and in preparing for relevant conversations.
• Business development and marketing. Legitimate interests, or consent where PECR requires it. You can object at any time (see section 13).
• Institutional introductions. Legitimate interests in connecting clients with relevant providers. Your agreement, which we obtain before any personal data is shared for an introduction. Where that agreement is needed as consent, we rely on it as consent.
• Website operation and security. Legitimate interests in running and protecting the website.
• Legal obligations, regulatory requirements and legal claims. Legal obligation, and legitimate interests in establishing, exercising or defending legal claims.

11. International transfers

Some recipients of personal data may be located outside the United Kingdom, for example where an introduction is to a provider based overseas. Where we transfer personal data internationally, we will use a transfer mechanism permitted by UK GDPR. Depending on the transfer, this may be an adequacy regulation, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Submitting an enquiry, or agreeing to be contacted, does not on its own mean that you consent to any international transfer. Where a transfer depends on your consent, we will ask you separately and explain what it involves. On request, we will tell you which recipients are outside the United Kingdom and which safeguards apply to them.

12. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected, including to meet any legal, regulatory or accounting requirement. In general:

• Enquiries that do not lead to an engagement: for the time needed to respond and follow up, and then no longer than is necessary.
• Client engagements: for the duration of the engagement, and for a further period needed to deal with queries, complaints or legal claims, or to meet a legal requirement.
• Due diligence and verification records: only for as long as they are needed for the engagement and any legal requirement that applies.
• Marketing contacts: until you unsubscribe or object. We keep a minimal suppression record so that we do not contact you again.
• Website server logs: for the period set by our hosting platform, which we will confirm before launch.

When personal data is no longer needed, we delete it or anonymise it.

13. Information security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse, proportionate to the nature of the information. No transmission over the internet is completely secure, so we cannot guarantee the security of information sent to us online.

14. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict or object to processing in certain circumstances, including processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent where we rely on consent, without affecting processing carried out before withdrawal; and
• receive certain data in a portable format, where it applies.

To exercise any of these rights, email info@multibanx.com with the subject line “Data rights request”. We may need to verify your identity before we act. We will normally respond within one month, and if we need longer, we will tell you.

15. Complaints and contact

If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it:

1. Write to us at info@multibanx.com with the subject line “Data protection complaint”. Please describe your concern and what you would like us to do. We will acknowledge your complaint and respond within a reasonable time.
2. Contact the Information Commissioner’s Office (ICO) if you are not satisfied with our response, or if you prefer to complain directly. The ICO is the UK supervisory authority for data protection. You can contact the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or online at ico.org.uk/make-a-complaint.

16. Changes to this policy

We may update this policy as our services or the law change. The date of the latest version is shown at the top of this page.