This Privacy Notice explains how GoHenry Limited (“GoHenry Limited”) and its subsidiary GoHenry Family Finance Limited (“GoHenry Family”) collect, use and disclose personal data online and offline in connection with the services we provide. The terms “GoHenry”, “we”, “our”, and “us” are used in this Privacy Notice to refer to GoHenry Limited and GoHenry Family collectively, and we have therefore specified where only one of them undertakes a specific activity. For the purpose of applicable data protection laws, each of GoHenry Limited and GoHenry Family is a separate data controller – GoHenry Limited is the data controller for most of our services, whereas GoHenry Family is the data controller for our Junior ISA services.

IDT Financial Services Limited ("IDT") is the issuer of the card associated with our Services. Accordingly, IDT is a joint controller of some of your Personal Data as it relates to, and is required for, the administration and operation of the card. A copy of IDT's privacy policy may be found at https://idtfinance.com/privacy-policy/

In this Privacy Notice we refer to the individuals whose personal data we process as “you”. Please read this Privacy Notice carefully therefore if any of the following applies to you:

• If you visit our website www.gohenry.com/uk (“Website”);
• If you apply to receive any of our services through any channel;
• If you use any of our services (whether as a child, parent or third party (such as a relative of a cardholder wishing to send money to someone via our services)); or
• If you otherwise use our app on your smart phone, tablet and/or other device.

In this Privacy Notice, we refer to all of the above as our “Services”. This Privacy Notice is not for any of our Services that expressly state that they are subject to a different Privacy Notice.

At GoHenry, our mission is to help every kid be smart with money in a safe and secure environment. This means that your and your family’s privacy is important to us. This Privacy Notice is an opportunity for us to be transparent with you about the personal data we collect, why we collect it, how we use it and how we protect it.

GoHenry Limited is a company established in the UK with its registered office at Stirley House, Ampress Lane, Ampress Park, Lymington, Hampshire SO41 8LW. This company is registered with the UK Information Commissioner’s Office under number Z2942623.

GoHenry Family Finance Limited is also a company established in the UK with its registered office at Stirley House, Ampress Lane, Ampress Park, Lymington, Hampshire SO41 8LW. This company is registered with the UK Information Commissioner’s Office, under number ZA801694.

Please read this Privacy Notice carefully so that you understand your rights in relation to your personal data. This Privacy Notice supplements any other privacy related notices and policies we may provide to you from time to time, and is not intended to override them. If you do not agree with this Privacy Notice in general or any part of it, you should not access the Website, use our Services or otherwise provide your information to us.

If after reading this Privacy Notice you still have questions, please don’t hesitate to contact us on [email protected], call us on 0330 100 7676 or write to our Data Protection Officer at GoHenry Limited, Stirley House, Ampress Lane, Ampress Park, Lymington, Hampshire SO41 8LW.

If you are a parent or guardian acting on behalf of a child, we have additionally drafted a short article to help you explain data privacy in a way that children may find more digestible. You can find it here. However, to be clear, the article is no substitution for the information set out in this Privacy Notice.

We will post any changes to this Privacy Notice on our Website, so please check it from time to time. And don’t worry, if we’re making major changes, we will notify you via email or in-app notifications.

Personal data means any information that can be used directly or indirectly to identify you.

The personal data we collect about you depends on whether you are a parent/guardian (and customer of GoHenry), a child who uses our Services, a gifter or relative (who gives money to a user of our Services) or a visitor to our Website or prospective customer. The types of personal data will also vary depending on the context of your interactions with our Services and the choices you make.

Parents/guardians (who are customers of GoHenry)

Information you give to us

You may provide some or all of the following personal data to us by registering with us, using our Services or contacting us:

Personal Data	How we use it and the Legal Basis for doing so
Contact and identification information such as your name, phone number, email address, postal address, date of birth, photograph.	We each use this information to: establish your identity as part of your account application, process your account application, authorize your access to our respective Services, investigate account activities, and communicate with you. We each do this in order to fulfil our legal obligations regarding Anti-Money Laundering and sanctions checks and to perform our respective contracts with you to provide our Services once you are a customer. We use your photographs with your consent to give you the ability to add a personal touch when engaging with our Services. We also each use aggregated demographic data derived from your date of birth and postal address to conduct research for the further development and improvement of our respective Services, in which we have a legitimate interest.
Identification document numbers and copies of identification documents (for example passport, driving licence and utility bills)	We each use this information to establish your identity as part of your account application, to fulfil our obligations regarding Anti-Money Laundering and sanctions checks.
Financial information such as the last four digits and expiry date of your debit card number, bank account information, bank sort code, IBAN and other similar financial information.	We each use this information to process your payments in connection with our respective Services. This is necessary to perform our respective contracts with you to provide the Services.
Security information such as passwords, password hints, security questions and answers and other similar security information	We each use this information to process your account application and authorize your access to our respective Services. This is necessary to perform our respective contracts with you to provide the Services.
Phone Contact Information such as the names, email addresses and phone numbers stored in your phone’s contact list	We each use this information to provide you with our respective Services, so that you can make and receive payments to your contacts.This is necessary for the purposes of our respective legitimate interests in providing our Services to you.
Any other information you directly provide to us when filling out forms, corresponding with us (e.g. via email or conversations with our customer services team (“Member Services”) by phone or chat sessions), filling out surveys, providing us with feedback and product reviews and other similar information.	We each use this information to provide you with our respective Services at your request, to communicate with you, to help you investigate and resolve complaints and services issues. This is necessary to perform our respective contracts with you to provide the Services. We each use this information to offer regular emails including newsletters to let you know about our Services. From time to time we may also contact you to ask your views on our Services, or to fill out a survey. We each do this for the purposes of our legitimate interests in improving our respective Services and as a provider of customer support. We also use this information to conduct research into the use of our respective Services, also for the purposes of our legitimate interests in improving our Services.

Information we collect automatically

When you use our Services, we automatically collect certain information that is sent to us by your computer, mobile phone or other device.

Personal Data	How we use it and the Legal Basis for doing so
Device and technical information such as IP address, iOS IDFA, iOS IDFV, Android GPS ADID, device user agent functionality (browser type and version, operating system and platform, hardware used) and other similar device and technical information.	We each use this information for the purposes of our legitimate interests in providing and improving our respective Services and the security of them. The IDFA and ADID are used for analytics and advertising purposes. You have the choice to disable these on your device and, where legally required, we would only use these with your consent.
Usage information such as the full uniform resource locators (URLs), information about page response times, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouseovers), error reports and performance data (i.e. details of the software or hardware related to an error, content of files you were using when an error occurred), troubleshooting and help data plus other similar usage information.	We each use this information for the purposes of our respective legitimate interests in providing and improving our Services and the security of them.

Information we collect from third parties

Personal Data	How we use it and the Legal Basis for doing so
Payments data We each receive information in connection with your payment from your third party bank, including the name of your issuing bank, part (but not all) of your Primary Account Number, the cardholder name, card expiry date, country of issue and card payment method (Visa/Mastercard, Debit/Credit etc.).	We each use this information for the purposes of our legitimate interests in providing and improving our respective Services and the security of them. We each use this information for the purposes of our respective legitimate interests in providing and improving the applicable Services and the security of them.

Children who use our Services

Information you or your parent/guardian give to us

You or your parent/guardian may provide either or both of us with some or all of the following personal data relating to you by registering with either or both of us, using our Services or contacting us:

Personal Data	How we use it and the Legal Basis for doing so
Contact and identification information such as your name, phone number, email address, postal address, date of birth, photograph.	We use this information to process the application for you and authorize your access to our Services, to communicate with you. This is necessary for the purposes of our respective legitimate interests in providing our Services to you. We use your photographs with you or your Parent/Guardians consent to give you the ability to add a personal touch when engaging with our Services. We each also use aggregated demographic data derived from your date of birth and postal address to conduct research for the further development and improvement of our respective Services, in which we have a legitimate interest.
Identification document numbers and copies of identification documents (for example passport, driving licence)	We use this information in relation to teen accounts to fulfil our legal obligation to establish your identity and fulfil our obligations regarding Anti-Money Laundering and sanction checks.
Financial information such as the last four digits and expiry date of your GoHenry card number (this is collected by GoHenry Limited but not by GoHenry Family).	Necessary for the purposes of GoHenry’s legitimate interests in processing your payments.
Security information such as passwords, password hints and other similar security information.	We each use this information to process your account application and authorize your access to our respective Services. This is necessary for the purposes of our respective legitimate interests in providing our Services to you.
Phone Contact Information such as the names, email addresses and phone numbers stored in your phone’s contact list	We each use this information to provide you with our respective Services, so that you can make and receive payments to your contacts.This is necessary for the purposes of our respective legitimate interests in providing our Services to you.
Any other information you or your parent/guardian directly provide to either or both of us when filling out forms, corresponding with us (e.g. via email or conversations with Member Services by phone or chat sessions), filling out surveys, providing either or both of us with feedback and product reviews and other similar information.	We each use this information to provide you with our respective Services at your request, to communicate with you, to help you and to investigate and resolve complaints and services issues. We each use this information to offer regular emails including newsletters to let you know about our respective Services. From time to time we each may also contact you to ask your views on our respective Services, or to fill out a survey. We each do this for the purposes of our respective legitimate interests in improving our Services and as a provider of customer support. We each also use this information to conduct research into the use of our respective Services, also for the purposes of our legitimate interests in improving our Services

Information we collect automatically

When you use GoHenry’s Services, GoHenry automatically collects certain information that is sent by your computer, mobile phone or other device.

Personal Data	How we use it and the Legal Basis for doing so
Transaction information such as sender’s and receiver’s names and registration information, as well as other similar transaction information.	We each use this information to process your payments, for the purposes of our legitimate interests in providing and improving our respective Services and the security of them.
Device and technical information such as IP address, device user agent functionality (browser type and version, operating system and platform, hardware used) and other similar device and technical information.	We each use this information for the purposes of our legitimate interests in providing and improving our respective Services and the security of them.
Usage information such as the full uniform resource locators (URLs), information about page response times, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouseovers), error reports and performance data (i.e. details of the software or hardware related to an error, content of files you were using when an error occurred), troubleshooting and help data plus other similar usage information	We each use this information for the purposes of our legitimate interests in providing and improving our respective Services and the security of them.

Information we collect from third parties

Personal Data	How we use it and the Legal Basis for doing so
Payments data GoHenry receives information about the transactions you make using your GoHenry card, including the name and location of the merchant.	GoHenry Limited uses this information for the purposes of its legitimate interests in providing its Services to you and in preventing fraud.

Gifters and Relatives (who give money to a user of our Services)

Information you give to us

You may provide some or all of the following personal data to us when you wish to send money to a user of our respective Services:

Personal Data	How we use it and the Legal Basis for doing so
Contact and identification information such as your name, email address, postal address and date of birth.	GoHenry Limited (on behalf of itself or GoHenry Family as applicable) uses this information to process your payments and to communicate with you. This is necessary for the purposes of our legitimate interests in processing your payment to the users of our respective Services.
Financial information such as your payment details (e.g. bank account).	GoHenry Limited (on behalf of itself or GoHenry Family as applicable) uses this information to process your payments. This is necessary for the purposes of our legitimate interests in processing your payment to the users of our respective Services.

Information we collect automatically

When you use our Services, GoHenry Limited automatically collects certain information that is sent to it by your computer, mobile phone or other device.

Personal Data	How we use it and the Legal Basis for doing so
Device and technical information such as IP address, device user agent functionality (browser type and version, operating system and platform, hardware used) and other similar device and technical information	GoHenry Limited uses this information for the purposes of its legitimate interests in providing and improving its Services and the security of them.

Information we collect from third parties

Personal Data	How we use it and the Legal Basis for doing so
Payments data that either or both of us receive in connection with your payment from your third party bank, including the name of your issuing bank, part (but not all) of your Primary Account Number, the cardholder name, card expiry date, country of issue and card payment method (Visa/Mastercard, Debit/Credit etc.)	GoHenry Limited or GoHenry Family (as applicable) will use this information for the purposes of its legitimate interests in providing and improving its Services and the security of them.

Visitors to our Website or Prospective Customers

Information you give to us

You may provide some or all of the following personal data to GoHenry when you visit our Website:

Personal Data

How we use it and the Legal Basis for doing so

Any information you directly provide to GoHenry Limited when filling out forms, corresponding with it (e.g. via email or conversations with Member Services by phone or chat sessions), filling out surveys, providing us with feedback and product reviews and other similar information.

GoHenry Limited uses this information for the purposes of its legitimate interests in communicating with you, helping you investigate and resolve complaints and services issues and conducting research into the use of our Services. We offer regular emails including newsletters to let you know about our Services. From time to time we may also contact you to ask your views on our Services, or to fill out a survey. Depending on the nature of such emails or surveys, we may ask for your consent.

We use cookies and other similar technologies to collect information about your browsing activities over time and across different websites following your use of our Services. Cookies allow us to recognize and count the number of users and to see how users move around our Website when they are using it. This helps us to improve our Services and the way our Website works. You can find more information about cookies and how to manage them here.

For more information, please refer to our Cookies Policy here.

We do not use or share your personal data with others except as described in this Privacy Notice. However, in certain circumstances, we will share your information with third parties. Specifically, we share your personal data:

• When the disclosure is requested by you, with consent or to perform a contract with you.
• With our business partners (e.g., banking partners, card processor, issuing bank, investment services providers, payment services provider, risk and security system providers); our suppliers (e.g., maintenance, analysis, audit, payments, fraud detection, marketing and development); and/or our sub-contractors, for the performance of any contract with you or for our legitimate interests or legal obligation. For example, companies we have hired to assist in protecting and securing our system and services may need access to personal data to provide those functions. Note that such business partners, suppliers and subcontractors will only have access to your personal data as reasonably necessary to perform these tasks on our behalf and will be obligated to not disclose or use it for other purposes.
• With advertising and analytics providers, in our legitimate interests. If we decide to engage advertisers to promote our Services, the advertisers and their advertising networks may require certain identifiers (which are, strictly speaking, personal data) to serve relevant adverts to you and others, and we may provide them with aggregate information about our users. We may also use such aggregate information to help our advertising partners provide a tailored and targeted campaign, relevant for a subsection of our users. In some instances, we may use your personal data we have collected to enable our advertising partners to display their advertisement to their target audience.
• With professional advisors, in our legitimate interests or as required by law. As necessary, we will share your personal data with professional advisors functioning as service providers such as auditors, law firms, or accounting firms.
• For legal and security reasons and to protect our services and business, in our legitimate interests or as required by law. We will share your personal data with regulators, law enforcement agencies, public authorities, or any other relevant organisations: (i) in response to a legal obligation; (ii) if we have determined that it is necessary to share your personal data to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries, such as to investigate or prevent illegal activities; (iii) to protect the interests of, and ensure the safety and security, of us, our users, a third party or the public; (iv) to exercise or defend legal claims; and (v) to enforce our terms and conditions, other applicable terms of service, or other agreements.
• With our affiliates, in our legitimate interests. We may share your personal data with companies within our corporate family.
• In connection with an asset sale or purchase, a share sale, purchase or merger, bankruptcy, or other business transaction or re-organisation, in our legitimate interests. We will share your personal data with a prospective buyer, seller, new owner, or other relevant third party as necessary while negotiating or in relation to a change of corporate control such as a restructuring, merger, or sale of our assets.

The personal data that we collect from you will be stored in the United Kingdom (“UK”), but will also be transferred to and processed in countries outside the UK. Your personal data is also processed by staff operating outside the UK who work for us or one of our third party service providers or partners. Such staff may, for example, be engaged in the fulfilment of your payment order, the processing of your payment details and the provision of support services. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice.

For any transfers of data outside the UK, the data transfer will be under the European Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses), or any equivalent contracts issued by the relevant competent authority of the UK (the “Model Clauses”) unless the data transfer is to a country that has been determined by the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals’ rights and freedoms for their personal data. Please contact us via [email protected], call us on 0330 100 7676 or write to our Data Protection Officer at GoHenry Limited, Stirley House, Ampress Lane, Ampress Park, Lymington, Hampshire SO41 8LW should you wish to examine a copy of the Model Clauses.

Your personal data will not be retained by us for longer than necessary in relation to the purposes for which it was originally collected, or for which it was further processed. We will retain your personal data as follows:

• If you choose to close your account, your personal data will generally stop being visible on our Services within 24 hours. Your personal data may continue to be displayed in the Services of others until they refresh their cache.
• We retain your personal data after you have closed your account for the purposes for which it was originally collected, or for which it was further processed, but we will not retain any of your personal data for more than to six years after the termination of our business relationship. We have chosen this as a benchmark for all personal data that we receive from you because as a company providing financial services, we have legal obligations to retain some of your personal data for substantial periods of time. For example, we are required to retain it for up to five years to comply with our legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (SI 2017/692), and under the E-Money Regulation 2011(SI 2011/99) you have the right to redeem your e-money for up to six years after termination of your account.

We know that security is a major concern for you and your family. To give you peace of mind we have advanced security systems in place. Please know however that although we do our best to protect your personal data, we cannot guarantee the security of your data during transmission of information via the internet, as any such transmission is at your own risk.

To protect your and your family’s personal data, we make an effort to:

• Use secure server software to store your personal data;
• Encrypt your payment transactions;
• Implement security safeguards designed to protect your data such as HTTPS;
• Use full login and security question controls on our systems;
• Restrict access of your personal data to those of our employees who need to know your personal data to do their job, and ensure that all our employees sign a confidentiality clause as part of their terms of employment;
• Maintain physical, electronic and procedural safeguards to protect your personal data from unauthorised access;
• Continuously educate and train our employees about the importance of confidentiality and privacy of customer information;
• Continuously monitor our systems for possible vulnerabilities and attacks; and
• Regularly review and update our privacy controls and policy.

Your personal data is yours and you therefore have certain rights in relation to it:

1. Access: You have the right to access personal data we hold about you, how we use it, and who we share it with.
2. Portability: You have the right to receive a copy of the personal data we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
3. Correction: You have the right to correct any of your personal data we hold that is inaccurate.
4. Erasure: In certain circumstance, you have the right to delete the personal data we hold about you.
5. Restriction of processing to storage only: You have the right to require us to stop processing the personal data we hold about you, other than for storage purposes, in certain circumstances.
6. Objection: You have the right to object to our processing of your personal data.
7. Objection to marketing: You can object to marketing at any time by opting-out using the unsubscribe/ opt-out function displayed in our communications to you. We usually like to send our customers special promotional communications such as newsletters, offers and updates that we think will be of interest to them. If you are a user of our Services, you (including if you are a child over 13) can always update your preferences by either logging into your account or by contacting us at:
   (a) If you want to opt in: [email protected]
   (b) If you want to opt-out: [email protected]
   Please remember that we will always continue to send important Service information to you (as a user of our Services).
8. Withdrawal of consent: Where we rely on consent to process your personal data, you have the right to withdraw this consent at any time.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. For example, where fulfilling your request would adversely affect other individuals, where there are overriding public interests or where we are required by law to retain your personal data.

If you wish to exercise any of your rights please contact either or both of us via [email protected] or call our Member Services Team on 0330 100 7676. No administration fee will be charged for considering and/or complying with such a request unless the request is deemed to be excessive in nature. We will respond to requests to exercise these rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances).

You can also contact us by writing us via [email protected] or call our Member Services Team on 0330 100 7676 if you would like to close your account.

Our Website and Services may contain links to other online platforms, plug-ins or other applications operated by third parties. We do not control such other sites or applications, and are not responsible for their content, their privacy policies, or their use of your information. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms, may also be viewable by other users of the Website/Services and/or users of those third-party online platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators except as disclosed on the Website/Services. We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of personal data by third parties. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.

If you have a complaint about how we use your personal data please don’t hesitate to contact us via [email protected] or write to our Data Protection Officer at GoHenry Limited, Stirley House, Ampress Lane, Ampress Park, Lymington, Hampshire SO41 8LW and we will respond to your request as soon as possible.

If you are unhappy with the way that we have dealt with your complaint, you can refer your complaint to the UK’s Information Commissioner’s Office, the ICO. For more information you can visit their website at www.ico.org.uk.

We welcome your questions, comments, and concerns about this Privacy Notice or your personal data.
Please send us any feedback to [email protected].