Privacy Policy

CUSTOMER PRIVACY POLICY

Effective date: April 14, 2023

Previous versions: Available here

Pulse aquí para leer la Política de privacidad en español.

We’re committed to protecting and respecting your privacy.

We will:

• always keep your personal data safe and private
• never sell your personal data
• allow you to manage and review your marketing choices at any time

1. About us

We are Revolut, a global financial super app. Our technology company, Revolut Technologies Inc., offers a platform through which customers may access a variety of financial products and services in the United States offered by our affiliates, licensed banks, and trust companies. Our broker-dealer company, Revolut Securities Inc., offers wealth and trading products available through the Revolut platform.

This Privacy Policy covers Revolut Technologies Inc., Revolut Securities Inc., and Revolut Wealth Inc.'s services in the United States.

2. Why do I need to read this policy?

We collect your personal data when you use:

• our website at www.revolut.com/en-US/
• the Revolut app
• any of the services available to you through the Revolut app or website

We may also collect your personal data from other people or companies. We explain how this can happen in more detail in the What personal data do you collect about me? section below.

When we say ‘personal data’, we mean information which:

• we know about you (for example, we know when you use your Revolut card to pay for things)
• can be used to personally identify you (for example, a combination of your name and postal address)

This policy explains what information we collect, how we use it, and your rights if you want to change how we use your personal data.

We may provide this policy in languages other than English. If there are any discrepancies between other language versions and the English language version, the English language version will prevail.

If you have concerns about how we use your personal data, you can contact dpo@revolut.com.

3. What personal data do you collect about me?

The table below explains what personal data we collect and use.

4. What is your legal basis for using my personal data?

We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:

We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:

Keeping to our contracts and agreements with you

We need certain personal data to provide our services and cannot provide them without this personal data.

Legal obligations

In some cases, we have a legal responsibility to collect and store your personal data (for example, under anti-money laundering laws we must hold certain information about our customers).

Legitimate interests

We sometimes collect and use your personal data because we have a legitimate reason to use it and this is reasonable when balanced against your human rights and freedoms.

Substantial public interest

Where we process your personal data, or your sensitive personal data (sometimes known as special category personal data), to adhere to government regulations or guidance, such as our obligation to support you if you are or become a vulnerable customer.

Consent

Where you've agreed to us collecting your personal data, or sensitive personal data, for example when you tick a box to indicate you’re happy for us to use your personal data in a certain way.

We explain more about how we use your personal data in the How do you use my personal data? section below.

5. How do you use my personal data?

Explore the ways in which we may use your personal data using this table:

Sometimes, we help you to provide services to customers. For example, we provide payment processing services to you if you use our Revolut Pro product. Where this happens, you’re responsible for deciding if we collect your customers’ personal data and how we should process it on your behalf.

6. Do you make automated decisions about me?

Depending on the Revolut products or services you use, we may make automated decisions about you.

This means that we may use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair, consistent and based on the right information.

Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. You can find out more about this in the What are my rights? section below.

For example, we may make automated decisions about you that relate to:

Approving credit applications:

• credit and affordability checks to see whether we can accept your credit application
• setting credit limits

Monitoring credit agreements:

• assessing how you’re repaying any credit product you hold with us
• amending your credit limit
• terminating your credit agreement

Opening accounts:

• KYC, anti-money laundering and sanctions checks
• identity and address checks

Detecting fraud:

• monitoring your account to detect fraud and financial crime

Our legal basis is one or more of the following:

• keeping to contracts and agreements between you and us
• legal obligations
• legitimate interests (to develop and improve how we deal with financial crime and meet our legal responsibilities)

7. Do you run credit checks on me?

We, and our lending partners, use credit reference agencies (or other providers of credit information in some countries) to run credit checks if you apply (or tell us you want to apply) for a credit product through Revolut.

If you give us access to other accounts you hold with other financial institutions, where you agree, we’ll use available information to carry out credit checks on you.

We’ll also share your personal data with credit reference agencies (or other providers of credit information) to:

• confirm details you have provided when you apply for products or services
• make an assessment about whether to accept your credit application
• determine an appropriate credit limit for you

When you enter into a credit agreement with us, we may continue sharing information with credit reference agencies or other providers of credit information (for example, information about your repayments and whether you repay in full or on time).

We’ll carry out additional credit checks on you from time to time to make sure that your financial wellbeing hasn’t changed over the course of the year.

The personal data we share with, and receive from, credit reference agencies (or other providers of credit information) when you apply for or use a Revolut credit product will vary depending on the country you live in. We’ll provide full details when you apply for a Revolut credit product.

For details of credit information providers we engage with in each country, please check out this page.

Our legal basis is one or more of the following:

• consent (where we are required to collect your consent by law)
• legal obligations
• keeping to contracts and agreements between you and us (where you take out a credit product with us)
• legitimate interests (to develop and, in the future, offer credit products to our customers).

8. How do you use my personal data for marketing?

If you sign up to our services, and where national laws allow, we’ll assume you want us to contact you by mail, push notification, email and text message with information about Revolut products, services, offers and promotions. Where national laws require us to get your consent to send marketing messages, we’ll do so in advance.

We use your personal data to personalize marketing messages about our products and services so they are more relevant and interesting to you (where allowed by law). This may include analyzing how you use our services and your transactions.

You can object to profiling for direct marketing purposes. You can also adjust your preferences or tell us you don't want to hear from us at any time. Just use the privacy settings in the Revolut app or tap the unsubscribe links in any marketing message we send you.

If you do not want to receive personalized marketing messages, and opt out from receiving them, you will not receive any marketing communications. However, you may still receive generic information about our products and services in the Revolut app.

We won't pass your details on to any organizations outside the Revolut group of companies for their marketing purposes without your permission. You can find out more in the Do you share my personal data with anyone else? section below.

Our legal basis is:

• consent (where we are required by law to collect your consent); or
• legitimate interests (to send you marketing and to provide information relevant to your interests).

9. What are my rights?

Your ability to exercise these rights will depend on a number of factors. Sometimes, we won’t be able to agree to your request (for example, if we have a legitimate reason for not doing so or the right does not apply to the particular information we hold about you).

10. How do I exercise my rights?

To exercise any of your rights set out in the previous section, you can contact us through the Revolut app or send us an email at dpo@revolut.com.

For security reasons, we can't deal with your request if we’re not sure of your identity, so we may ask you for proof of ID.

If a third party exercises one of these rights on your behalf, we may need to ask for proof that they’ve been authorized to act on your behalf.

When you exercise one of your rights, or update your privacy settings in the Revolut app, it may take us up to one month to respond or implement your changes.

Revolut will usually not charge you a fee when you exercise your rights. However, we’re allowed by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded or excessive.

Revolut will not discriminate against you in any way because you exercise any rights conferred by this Privacy Policy.

If you are unhappy with how we have handled your personal information you can file a formal complaint by sending us an email to complaints.us@revolut.com.

11. Do you share my personal data with anyone else?

Revolut group companies

We share your personal data within the Revolut group of companies to:

• provide you with the best service
• send you information about Revolut products and services we think you’ll be interested in hearing about.

Other Revolut customers

We’ll ask you to let us sync your mobile phone contacts. This will help you to identify which of your trusted mobile phone contacts are Revolut customers. Your ‘trusted contacts’ will also be able to see if you’re a Revolut customer through our ‘Payments with Friends’ functionality.

‘Payments with Friends’ gives you access to Revolut features like requesting money from your friends, splitting bills, group Vaults, paying other Revolut customers or chatting to your ‘trusted contacts’.

We use technological safeguards to ensure a ‘trusted contact’ is somebody you already know and who knows you (for example, you have each other saved in each other’s mobile phone contacts lists or have already received or given money through a peer-to-peer payment with them).

Both you and your trusted contact must have synced your mobile phone contacts lists with Revolut to be viewable to each other in the Revolut app.

We only show your basic contact details in the Revolut app to your trusted contacts who are also Revolut customers (for example, your name (as saved in your friend’s contacts list), mobile phone number, Revolut username, and Revolut profile photo (if you have one)).

You can, of course, choose not to sync your contacts list with Revolut. This means that you won’t be able to identify which of your mobile phone contacts are Revolut customers.

You can also turn off ‘Payments with Friends’ through the privacy settings in the Revolut app.

People or companies that you transfer money to

Where you make a payment from your Revolut account, we’ll provide the recipient with your details alongside your payment (for example, your name and IBAN). This is because, like all payment institutions, we’re required by law to include certain information with payments.

People or companies that transfer money to you

When you receive a payment to your Revolut account, we’ll provide the payer with your details (for example, your name and IBAN). This is necessary to confirm that the payment has been made to the correct account.

Suppliers

The table below explains which suppliers we normally share your personal data with:

Partners who help to provide our services

We may share your personal data with our partners to provide certain services you’ve asked us for.

We’ll only share your personal data in this way if you’ve asked for the relevant service or if it’s provided as part of our membership plans.

From time to time, we may work with other partners to offer you co-branded services or promotional offers, and we’ll share some of your personal data with those partners. We will always make sure you understand how we and our partners process your personal data for these purposes.

Credit reporting agencies

As set out in the Do you run credit checks on me? section above, if you apply for a credit product, we'll share your personal data with credit reference agencies to check whether you are likely to make repayments when due.

Other financial institutions and Revolut customers

We may share your personal data with other financial institutions, or Revolut customers, if you ask us to.

We may also share your personal data with other financial institutions, or Revolut customers, where you do not ask us to.

Other third parties

We may share your personal data with other third parties where necessary to facilitate you receiving payments to your Revolut account.

For legal reasons

We also share your personal data with other financial institutions, government authorities, law enforcement authorities, tax authorities, companies and fraud prevention agencies to check your identity, protect against fraud, keep to tax laws, anti-money laundering laws, or any other laws and confirm that you’re eligible to use our products and services.

If fraud is detected, you could be refused certain services by Revolut or other companies.

We may also need to share your personal data with other third party organizations or authorities:

• if we have to do so under any law or regulation
• if we sell our business or credit portfolio
• in connection with criminal or fraud investigations
• to enforce our rights (and those of customers or others)
• in connection with legal claims.

Social media and advertising companies

When we use social media for marketing purposes, your personal data (limited to only your name, email address and app events) may be shared with the social media platforms so that they can check if you also hold an account with them. If you do, we may ask the advertising partner or social media provider to:

• use your personal data to send our adverts to you, because we think that you might be interested in a new Revolut product or service
• not send you our adverts, because the marketing relates to a service that you already use
• send our adverts to people who have a similar profile to you (for example, if one of our services is particularly useful to people with similar interests to the ones on your social media profile, we may ask our advertising partner or social media partner to send our adverts for that service to those people)

An example of how we may use social media for marketing purposes is through Facebook’s ‘Custom Audience’ tool. Read more about these terms.

We may share your personal data with our advertising partners in the ways described above, but the personal data is hashed before we send it, and the social media platform we share it with is only allowed to use that hashed personal data in the ways described above.

Our legal basis is:

• legitimate interests (to ensure Revolut’s advertising is as effective as possible)

You can contact us at any time, either through the Revolut app or by emailing dpo@revolut.com, if you don’t want us to share your personal data for advertising purposes. You can also use the privacy settings in the Revolut app to opt out from having your personal data shared in this way.

Remember you can also manage your marketing preferences directly with any social media provider that you have an account with.

Where you ask us to share your personal data

Where you direct us to share your personal data with a third party, we may do so. For example, you may authorize third parties to act on your behalf (such as a lawyer, accountant or family member or guardian under a power of attorney). We may need to ask for proof that a third party has been validly authorized to act on your behalf.

CONSUMER PRIVACY NOTICE

The Consumer Privacy Notice details our privacy and security practices regarding our relationship with you and provides instructions on how to limit the sharing of non-public personal information.

12. Will my personal data go outside the United States?

We may transfer your personal information outside the US to provide our services. We may store your personal information outside of the United States or use affiliates or service providers located outside of the United States to offer you our products and services.

For example, if you ask to make an international payment, we will send funds to banks overseas. We might also send your information overseas to keep to global legal and regulatory requirements, and to provide ongoing support services.

We may share your personal information with credit reporting agencies and fraud-prevention agencies outside the US.

We will take all reasonable steps to make sure that your personal information is handled securely and in line with this privacy policy and data protection laws.

If you would like more information, please contact us through the Revolut app or by sending an email to dpo@revolut.com.

13. How do you protect my personal data?

We recognize the importance of protecting and managing your personal data. Any personal data we process will be treated with the utmost care and security. This section sets out some of the security measures we have in place.

We use a variety of physical and technical measures to:

• keep your personal data safe
• prevent unauthorized access to your personal data
• make sure your personal data is not improperly used or disclosed

Electronic data and databases are stored on secure computer systems with control over access to information using both physical and electronic means. Our staff receives data protection and information security training. We have detailed security and data protection policies which staff are required to follow when they handle your personal data.

While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorized access, we cannot guarantee it will be secure during transmission by you to our app, a website or other services. We use HTTPS (HTTP Secure), where the communication protocol is encrypted through Transport Layer Security for secure communication over networks, for all our app, web and payment-processing services.

If you use a password for the Revolut app or our website, you will need to keep this password confidential. Please do not share it with anyone.

When you use our public services, which includes our social network accounts and the Revolut Community forum, do not share any personal data that you don't want to be seen, collected or used by other customers, as this personal data will become publicly available.

14. How long will you keep my personal data for?

We’ll generally keep your personal data for six years after our business relationship with you ends, or such period as may be required by applicable local laws.

We’re required to keep your personal data for this long by anti-money laundering laws. We may keep your personal data for longer because of a potential or ongoing court claim, or for another legal reason.

15. How will you keep me updated about how you use my personal data?

If we change the way we use your personal data, we’ll update this policy and, if appropriate, let you know by email, through the Revolut app or through our website.

16. Do you use cookies?

We use cookies to analize how you use our website. Please read our Cookies Policy for more information about cookies.

We also use pixels or web beacons in the direct marketing emails that we send to you. These pixels track whether our email was delivered and opened, and whether links within the email were clicked. They also allow us to collect information such as your IP address, browser, email client type and other similar details. We use this information to measure the performance of our email campaigns, and for analytics. You can control whether you receive direct marketing emails through the privacy settings in the Revolut app.

17. Children’s privacy

About Revolut <18

Revolut <18 is a sub-account of your Revolut personal account for your child(ren). Revolut <18 is a great way for your child(ren) to pay for things and learn how to use money.

How do we protect the privacy of children’s data?

In order to protect the privacy of data for both the parent(s) and child(ren), we adopted and followed the guidelines and rules laid down by the Children’s Online Privacy Protection Act (‘COPPA’). COPPA requires us to notify parents or legal guardians and get their verifiable parental consent before we collect, use, or disclose personal information of children under the age of 13.

We do not knowingly collect “personal information,” as defined below under COPPA, directly from users under the age of 13, except as described below. If the primary account holder creates a sub-account for a child under the age of 13, only the primary account holder (i.e., the parent or legal guardian), provides information to us necessary to establish the sub-account for the child. Revolut will not collect, use, or disclose any personal information from the child if the parent does not provide consent.

PERSONAL INFORMATION UNDER COPPA

Personal information means individually identifiable information about an individual collected online, including— (A) a first and last name; (B) a home or other physical address including street name and name of a city or town; (C) an e-mail address; (D) a telephone number; (E) a Social Security number; (F) any other identifier that the Federal Trade Commission determines permits the physical or online contacting of a specific individual; or (G) information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph.

What information are we collecting from you about your child(ren)?

We may collect the following information:

• the child's name, address and date of birth;
• email address, phone number and details of the device they use (for example, the child's phone number);
• your username, password and other registration information;
• identification documents (for example, the child's passport or driving license number (if applicable)), copies of any documents you have provided for identification purposes, a personal description and photograph of the child, and any other information you provide to prove they are eligible to use our services; and
• records of our discussions if you contact us or we contact you.

What information are we collecting directly from your child(ren) if they are age 13+?

If your child is age 13+, we may collect the following information:

• the child's name, address and date of birth;
• email address, phone number and details of the device they use (for example, the child's phone number);
• username and PIN/Passcode;
• synced phone contacts;
• geolocation and IP address; and
• photo (if a profile photo is uploaded)

How do we use the collected information of your child(ren)?

We may use your child(ren)’s data so we can do the following:

• send them a welcome pack and information like tips on how to use their account to save money;
• make sure it is the child using the account;
• make sure we give them important news and other information they need to know about the account;
• provide them with our full set of features, subject to applicable laws and Revolut’s age-based restrictions;
• protect their account by making sure they are at the same place as their card is being used;
• reply to the parent, legal guardian, or child when they contact us, or answer any questions they may ask us;
• find out what the child likes and doesn’t like about Revolut <18 so we can make it better for them; and
• make sure we don’t break the law. To do this, we’ll share information with the police or other important people when we need to. They will investigate when something has gone wrong and make sure we’re doing everything right to protect them.

Are there any exceptions to collecting information from my child(ren) without verifiable parental consent?

There are some limited exceptions that allow us to collect information without verifiable parental consent, such as:

• collecting a child’s contact information solely to directly respond to the child’s request on a one-time basis. We will not use that information to re-contact the child for any other purpose;
• collecting a child’s contact information and the contact information of their parent or legal guardian to directly respond more than once to a specific request from the child. We will not use the child’s personal information to re-contact the child for any other purpose;
• to protect the security and integrity of our app;
• to respond to judicial process or provide information to law enforcement;
• when providing support for the internal operations of our app which include: maintaining and analyzing the functioning of our app; performing network communications; authenticating users; personalizing content on the app; serving contextual advertising or capping the frequency of advertising; protecting the security or integrity of the user;
• to ensure legal and regulatory compliance.

How do I exercise my right to review the information provided by my child(ren)?

Upon written request, COPPA requires us to provide you with a description of the specific types of personal information collected from your child(ren) such as name, address, telephone number, email address, hobbies, and extracurricular activities. To make sure you (i.e., the parent or legal guardian) are actually making this request, we may ask for additional information before disclosing the personal information collected from your child(ren).

You also have the right to stop us from future use or future collection of personal information from your child(ren). You may ask us to delete the child’s personal information. See section on How long we will keep your child(ren)’s personal information.

How long will we keep your child(ren)’s personal information?

We need to keep your child(ren)’s data while their Revolut <18 account is active.

We may need to keep your data for longer if the law says we must. So even if you ask us to destroy your data, we may not be able to do that right away.

If you close your account, we’ll keep your data for up to six years. We may need to keep it even longer, for example, if it is needed for regulatory or legal reasons.

What to do if you have any questions or want to know more?

Get in touch! If you have any questions about your child(ren)’s data, email us at dpo-revolut_u18@revolut.com.