This notice explains how Revolut, including its affiliates, (“we, us, our”) collects and uses personal data during our Third-Party Risk Management (TPRM) due diligence process.
1. The Personal Data We Collect
When you populate our Due Diligence form, we collect the following information:
- Directly from you: Business contact details of the vendor representative filling out the form (name, surname, business email address, and phone number).
- Indirectly from your organization: Names and surnames of key controllers, ultimate beneficial owners (UBOs), and individual details contained within your internal policies, licenses, or external reports.
2. Why We Use This Information (Purposes & Lawful Bases)
We process this personal data to evaluate and manage third-party risk, ensure financial crime compliance (including Anti-Money Laundering requirements), and verify business capabilities.
Our legal bases for processing this data are:
- Legal Obligation: To comply with regulatory mandates governing financial services, vendor risk assessments, and financial crime prevention.
- Legitimate Interests: To protect Revolut’s business infrastructure, assets, and reputation by verifying the integrity and compliance of our business partners.
3. How We Share Your Data
Your information is shared internally with Revolut’s Third Party Risk Management (TPRM) , Legal, Compliance and audit teams. We also share this data with trusted third-party risk assessment platforms and software providers that host our due diligence systems. When legally required, data will be shared with regulatory bodies or law enforcement.
Because Revolut operates globally, your data will be accessed or transferred outside of the UK and EEA.
In these cases, we protect your data using standard data protection clauses approved by the European Commission and the UK Information Commissioner's Office (ICO).
4. How Long We Keep Your Data
We retain due diligence data for the duration of our relationship with the vendor, plus an additional 7 years following the termination of the contract to fulfill our legal holding and regulatory compliance obligations. If a vendor contract is not awarded, we hold this data for 7 years.
5. Your Rights and How to Contact Us
You have the right to access your data, request rectification of inaccuracies, ask for erasure, or restrict and object to our processing under certain conditions.
- To exercise your rights: Contact our Data Protection Officer at dpo@revolut.com.
- To file a complaint: You have the right to log a complaint with the UK Information Commissioner’s Office (ICO) or your local data protection supervisory authority.