Business bank accounts

When you visit our website, we automatically collect certain information about your device and how you use the site, we also use cookies. 

Information We Collect

Technical Information

We automatically process the following types of technical information about your visit to our website:

Device information

• Type of device (e.g., desktop, tablet, mobile)
• Operating system and version
• Browser type and version
  

Network information

• IP address
• Internet Service Provider (ISP) information
• Connection type (e.g., Wi-Fi, mobile data)

Usage data

• Pages viewed and time spent on the website
• Clicks, scrolling, and other interactions with our website
• Referring and exit pages or URLs

Geolocation Data (if enabled)

• Approximate location derived from your IP address
• Precise geolocation if you provide explicit consent

Purpose and Lawful Basis

• We use this information to:
• Operate and improve the functionality of our website
• Diagnose and resolve technical issues
• Enhance user experience
• Ensure website security and prevent fraudulent activities

We process this data under our legitimate interests for providing our website to you. Most of this data is not associated directly with you but due to its nature it may be possible to identify you with it. 

Cookies

We use cookies and similar technologies on our website to provide essential functionality, improve user experience, and analyse how our site is used for Consumer Duty purposes. Some cookies are necessary for our site to function properly, while others are optional and help us personalise content and target advertisements more effectively.

You can manage your cookie preferences through your browser settings or by using the cookie consent tool on our website.

For further details on the types of cookies we use, why we use them, and how you can manage your cookie preference, please refer to our Cookies Policy.

For more information on your privacy rights and how we might process your personal data, you can contact us at [email protected].

Security

As a bank, we take the security of your data very seriously. We use the latest technical and organisational measures, in line with industry best practice, to safeguard the information we collect against unauthorised access, disclosure, or misuse.

For more detailed information on how we keep your data safe, and what steps you can take to do the same, please visit our security page.

When you apply for an account with us, we need certain information to progress your application, much of which is required by law.

Information and Purposes 

We collect the following information for the following reasons:

Online Interactions: information collected when you use our website or Zempler Bank app, participate in customer surveys or competitions, focus groups, feedback sessions, prize draws, or other promotions.

Application information: information such as your name, address, date of birth, contact details, financial information, and employment details when you apply for our products and services including you registering secondary adult or child (13+) user and information you provide when you register a secondary user of your account.

Identity Verification: copies of your identification documents, for example, your passport or driving license and any other information you provide to prove you are eligible to use our services.

Open Banking: access you give us to your other financial accounts.

Communication: details you provide when you communicate with us via phone (including recorded calls) email, letters, web chat, social media, or other channels.

Lawful Basis

We process this information in pursuit of contract between Zempler and you and so rely on the lawful basis of Contract.

We also use your personal data to fulfil our regulatory obligations and so process this information either under Legal Obligation or Legitimate Interest.

In some limited circumstances we use our legitimate interests in setting up an account for a service you have requested.

Third Parties

During your application we may also receive and share information about you with and from:

• Introducers: companies or individuals that introduce you to us. For example, we work with ClearScore Technology Limited to introduce customers to our credit card products. ClearScore may process personal data in accordance with its own privacy policy, available at https://www.clearscore.com/privacy-policy.
• Card Schemes or associations
• Credit Reference Agencies (CRAs): Equifax Limited for credit referencing and risk assessment purposes under a contractual agreement. Equifax processes this data in accordance with its own privacy policy, which can be found at https://www.equifax.co.uk/privacy.html.
• Service Partners: we partner with Wise Payments Limited to facilitate international payment services. Wise processes data independently under its own regulatory obligations. For details on Wise’s data handling practices, please visit https://wise.com/privacy-policy.
• Comparison Websites
• Social Networks
• Fraud Prevention Agencies: for example, CIFAS, whose fair processing notice can be found here: http://www.cifas.org.uk/fpn
• Public Information Sources: including Companies House and media outlets.
• Agents and Advisers: working on our behalf or yours.
• Market researchers
• Government and Law Enforcement Agencies
• Open Banking: when you ask us to, we’ll also collect personal data from accounts you hold with third party financial institutions (when you create a linked account by activating Open Banking in the Zempler Bank app).

Automated Decision Making

We may use automated processes to make decisions about your application; we do this to process your request quickly and fairly. We may use automated decision making in the following circumstances:

• Assessing your creditworthiness for credit application or other products
• Fraud and anti-money laundering detection
• Personalising services or product recommendations based on your preferences of financial history.

International Transfers

We primarily store and process your personal data within the United Kingdom (UK) or the European Economic Area (EEA). However, in certain circumstances, we may need to transfer your personal data to countries outside of the UK or EEA, for example, if:

• Our Service Providers or business partners have operations in third countries
• Cloud hosting or IT support services are provided from international data centres

Where we transfer your personal data to a country outside of the UK (meaning its data protection laws may not be equivalent to those in the UK), we put appropriate safeguards in place to ensure your rights and freedoms remain protected. These may include:

1. International data transfer agreements (IDTAs) or Standard Contractual Clauses (SCCs) approved by the UK (or, where applicable, the European commission) that contractually bind the recipient to protect your personal data.
2. Additional technical and organisational measures, such as encryption, restricted access protocols, or data minimisation.
3. Reliance on a country specific adequacy decision, if applicable, which recognises that the country provides a sufficient level of data protection.

Retention

Unsuccessful Applications

If your application is unsuccessful then we are obliged by law to keep information about your application for up to 6 years after the application is made

Successful Applications

If your application is successful, we will retain your information in order to service your account. Please see below for more information on how long we will retain your data. 

Your Rights

If you successfully open an account with us, you can go to the ‘when you are a customer’ section of this notice to read your full rights. If you apply for an account with us, but the application is not successful, you still have certain rights. While these rights may not always be absolute, they include: 

Right to be informed

You have the right to be informed about how your personal data is collected, used, shared and stored. This includes clear, accessible information about:

• The types of data we collect
• How long it is stored
• Why we collect it
• How we use it
• Who we may share it with
• Your rights under data protection law

We are committed to transparency and will provide this information at the time we collect your data or as soon as possible thereafter.

Right to access (commonly referred to as a Data Subject Access Request, or DSAR)

You have the right to ask us whether we are processing your personal data, and if so, to request a copy of the data, along with relevant details about how and why we use it. 

Right to Rectification

If the personal data we hold about you is inaccurate or incomplete, you are entitled to ask us to correct or complete it. 

Right to be Forgotten (commonly referred to as an Erasure or Deletion request)

In certain circumstances, you can request that we erase your personal data. This might apply if the data is no longer necessary for the purpose for which it was collected, or if you withdraw your consent (where our processing relies on your consent). 

Right to Restrict Processing 

You can ask us to limit the use of your personal data in certain situations – for example if you believe the data we hold is incorrect or if you have objected to our processing. 

Right to Object

You have the right to object to the processing of your personal data, for example, when our lawful basis for processing your personal data is our Legitimate Interests, or if you have previously consented to direct marketing. 

Right to Data Portability

You have the right to receive your personal data in a way that is accessible and machine-readable, for example as a csv file if our lawful basis for processing that data is based on your consent, or contractual obligation.

This right only applies if the data:

• is held electronically, and
• you have provided it to us, such as your registration details.

Rights related to automated decision-making including profiling

In certain circumstances, you have the right not to be subject to a decision based solely on automated processing (including profiling) if it produces legal or similarly significant effects, you can request human intervention or challenge any automated decision that affects you in such a way.

If you have any concerns or have any questions about your rights and how we handle your personal data, please contact us first using the details in the ‘contact’ section of this notice so that we can address your concerns. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights. For more information, visit: https://ico.org.uk/make-a-complaint/

 

Fees for Access Requests

You have the right to request access to your personal data. In most cases, we will provide this information free of charge. However, in accordance with the Data Use and Access Act 2025, we may charge a reasonable fee if your request is manifestly unfounded, excessive, or repetitive, or if it involves significant administrative effort. Any applicable fees will be clearly communicated in advance and will reflect the actual cost of processing your request. You will have the opportunity to revise or narrow your request to avoid incurring a fee.

Your right to complain

Under the Data Use and Access Act 2025, you have a statutory right to complain if you believe your personal data has been mishandled or your rights under UK data protection law have been infringed. We are committed to handling complaints fairly, transparently and promptly. If you wish to raise a concern about how we process your personal data, please follow the steps below.

You can submit a complaint to us using any of the following methods:

• Email: [email protected]
• Post: Cottons Centre, Cottons Lane, London, SE1 2QG
• Telephone: Zempler - Contact us 

We will acknowledge your complaint within 30 days of receipt, and:

• Take appropriate steps to investigate your complaint without undue delay
• Keep you informed of the progress of the investigation
• Notify you of the outcome once the investigation is complete

If you are not satisfied with our response, you may escalate your complaint to the information commissioner's office: https://ico.org.uk

Security

As a bank, we take the security of your data extremely seriously. We use the latest technical and organisational measures, in line with industry best practice, to safeguard the information we collect against unauthorised access, disclosure, or misuse.

For more detailed information on how we keep your data safe, and what steps you can take to do the same, please visit our security page.

To service your account, we process the following information. 

Account Set-up and Management

Account

• Your Zempler Bank username known as your ‘customer number’ (this is random and is automatically assigned to you when a new account is opened with us).
• Details of your bank account, including the account number, sort code and IBAN.
• Details of your Zempler Bank pre-paid card and credit cards, including the card number, expiry date and CVC (the last three digits of the number on the back of the card)
• Information on transactions and your use of Zempler Bank products (for example, payments into and out of your account), including the date, time, amount, currencies, exchange rate, beneficiary details, details of the merchant or ATMs associated with the transaction (including merchants’ and ATMs’ locations), IP address of sender and receiver, sender's and receiver's name and registration information, messages sent or received, details of device used to arrange the payment and the payment method used.

App Usage: when you use our app we use the following information:

• Technical Data: Your IP (Internet Protocol) address, geographical location, login and browser details, operating system, device information, pages visited, time spent, and other technical details gathered during your interaction with our online services.
• Usage Data: Information on how you use and operate your account, including transaction details and account activity.

Additional Purposes

Service Delivery: to provide you with our products and services, process transactions, and respond to your inquiries.

Customer support: to communicate with you and handle any issues or queries related to your account.

Communication: details you provide when you communicate with us via phone (including recorded calls) email, letters, web chat, social media, or other channels.

Online Interactions: information collected when you use our website or Zempler Bank app, participate in customer surveys or competitions, focus groups, feedback sessions, prize draws, or other promotions.

Legal and Regulatory compliance

• Identity Verification: to verify your identity and prevent fraud and money laundering activities.
• Regulatory Obligations: to comply with applicable laws, regulations, and guidelines from regulatory authorities.
• Fraud and Crime Prevention: to detect, investigate, and prevent fraud, financial crimes, and other illegal activities.

Business Interests and Service Improvements

• Performance analysis: to monitor and analyse the usage and effectiveness of our services, website, app, and communications.
• Product Development: To develop and test new products and services, ensuring they meet your needs.
• Marketing: with your consent, to provide you with information about products and services that may interest you. You can update your marketing preferences at any time through our online banking portal or by contacting Customer Service.

Automated Decision Making

We may use automated processes to make decisions about your application and account, such as credit scoring and fraud detection.

Legal Basis for processing - Summary

We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:

• Performance of a contract: processing is necessary to enter into and fulfil our contract with you.
• Legal Obligations: Compliance with legal and regulatory requirements, including fraud and money laundering prevention.
• Legitimate Interest: To pursue our legitimate business interests such as improving services and ensuring security, provided these do not override your rights and freedoms.
• Consent: For specific purposes like marketing communications and eligibility checks, where you have given explicit consent. You can withdraw your consent at any time.
• Substantial Public Interest: Where we process your personal data, or your sensitive personal data (sometimes known as special category personal data), to adhere to government regulations or guidance, such as our obligation to prevent fraud or support you if you are or become a vulnerable customer