This notice explains what personal data Fidorox collects, why, who we share it with, how long we keep it and the rights you have over it. It applies to fidorox.com, the Fidorox app and our communications with you, wherever you live, and it meets the standard of the EU and UK General Data Protection Regulations.
1. Who is responsible for your data
[Legal entity name] (to be confirmed), a company registered in [Country of incorporation] (to be confirmed) under number [Company registration number] (to be confirmed), whose registered address is [Registered address] (to be confirmed) is the controller of your personal data. Our data protection contact is [Data protection officer, or the contact who acts for one] (to be confirmed), at privacy@fidorox.com.
When accounts, cards, payments and crypto-asset services open, our licensed partners are controllers of the data they need to provide them under their licences, and their own privacy notices apply to it; we will name them here.
2. What we collect
- Who you are and how to reach you
- Your email address, your country of residence, whether your account is personal or business, and, if you give them, your given and family names, the name you would like us to call you by, and your phone number (which we keep but do not verify or use to contact you).
- A business you open or join
- Its legal name and country of incorporation, and, if you give them, its trading name, registration number, registered address, website, industry and size; the people on its team with their roles and their positions in the business (such as director); and the invitations sent to join it: the address invited, the role offered and who sent it.
- Your account’s state
- Whether your identity has been verified, whether your account is active or limited, and, if you ask us to close it, when you asked and the reason you chose, if any.
- Your preferences
- The language, number and date formats, time zone and theme you choose, and which of your personal account and your businesses you are working in.
- Your sign-in and its security
- Your password’s hash (never the password), your passkeys’ public keys, your authenticator app’s secret (sealed), your recovery codes’ hashes, your sessions, the devices you sign in from (a short description such as “Chrome on macOS”, never the full browser string), and the IP addresses of your sign-ins.
- A record of security events
- Every sign-in, every change to your security settings and every action our staff take on your account, in a record that cannot be altered.
- Your choices
- The versions of our terms and of this notice you accepted and when, and whether you agreed to hear from us about new products, with each change to that choice.
- When accounts open
- Identity documents and checks, your account details, balances and transactions, and the information the law requires us to collect to prevent money laundering and fraud.
- When you write to us
- Your messages and our answers.
Our website does not use analytics, advertising or tracking of any kind, and sets no cookies. Our web servers keep a short technical record of requests (address, time, page) to keep the service secure.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Opening and running your Fidorox account and, when they open, your money accounts | Performing our contract with you |
| Verifying your identity, preventing money laundering, terrorist financing and fraud, and applying sanctions | Our legal obligations |
| Protecting your account and our service: detecting unusual sign-ins, refusing breached passwords, keeping security records | Our legitimate interest in a secure service, and our legal obligations |
| Telling you about changes to the service and to these terms | Performing our contract, and our legal obligations |
| Telling you about new products | Your consent, which you can withdraw at any time |
| Answering your questions and complaints | Performing our contract, and our legitimate interest in helping you |
4. Decisions made by machine
To protect you and to meet our legal duties, some checks are automated, such as refusing a sign-up from a country under sanctions or flagging an unusual sign-in. Where such a decision has a significant effect on you, you can ask a person to review it, explain your view and contest it.
5. Who we share it with
- Our licensed partners, when the services they provide open, as section 1 explains.
- Service providers who process data for us under contract and our instructions: cloud hosting in the European Union, sending email, and identity verification when it opens.
- A breached-password service: when you choose a password, we send only the first five characters of its SHA-1 fingerprint, never the password, and check the answer ourselves.
- Authorities, courts and regulators, when the law requires it.
We never sell your data, and we never share it for advertising.
6. International transfers
We store your data in the European Union. Where a provider handles it outside the European Economic Area, we protect it with the European Commission’s standard contractual clauses or an adequacy decision, and you can ask us for a copy of the safeguards.
7. How long we keep it
- Your Fidorox account and profile: while you use Fidorox, then as the rows below require.
- Identity checks and transaction records: five years after our relationship ends, or longer where the law requires.
- Security records: as long as your Fidorox account exists and for the period the law requires after.
- Your marketing choice: until you change it.
8. Your rights
You have the right to:
- access the personal data we hold about you, and receive a copy;
- have it corrected if it is wrong or incomplete;
- have it erased, where we no longer need it and the law does not require us to keep it;
- restrict or object to its use, including for direct marketing at any time;
- receive the data you gave us in a portable form;
- withdraw a consent at any time, without affecting what was done before.
Write to privacy@fidorox.com. We answer within one month. You may also complain to a data protection authority, in particular in the country where you live or work; our lead authority is [Lead supervisory authority] (to be confirmed).
9. Security
We encrypt your data in transit and at rest, seal the most sensitive values again inside our database, give our staff access only to what their role needs, and record every access. Our security page explains more.
10. Children
Fidorox is not for anyone under 18, and we do not knowingly collect their data.
11. Changes to this notice
We publish every version of this notice with its date and keep earlier versions readable, and we tell you before a change that affects you applies.