Digital Capital Ltd
The notice distinguishes current website and enquiry processing from planned future product processing.
1.1 This Privacy Notice explains how Digital Capital Ltd uses personal information for this website, enquiries and business relationships, and describes the additional processing planned for its hospitality e-money, payment and optional savings services. We are currently pre-operational. Planned service processing applies only when that activity begins and has been explained to you.
1.2 Digital Capital Ltd is incorporated in England and Wales under company number 10222334 and has its registered office at 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.
1.3 Digital Capital Ltd is authorised by the Financial Conduct Authority as an Electronic Money Institution under Firm Reference Number 900710.
1.4 This Privacy Notice applies where we process personal data in connection with:
our website
onboarding and account opening
provision of payment and electronic money services
fraud prevention, risk management and compliance activities
communications with customers and prospective customers
relationships involving third-party platform partners through which our services may be accessed
1.5 We are committed to processing personal data fairly, lawfully, transparently and securely, and in accordance with applicable data protection laws, including the UK GDPR, the Data Protection Act 2018, and, where relevant, the EU GDPR.
1.6 Section 40 sets out our current processing. Before onboarding starts, we will update it to cover the activated product, providers and data flows. A description of a possible future purpose does not authorise collecting data now that is unnecessary for your current enquiry.
2.1 This notice covers website visitors, enquirers, prospective business contacts, directors, officers, shareholders, beneficial owners, employees, authorised users and administrators of actual or prospective business customers; people making complaints; and payers, payees and other people whose data we lawfully receive. The initial product is for UK businesses. Personal consumer customers, personal wallets and cardholders are conditional future categories only; we explain additional processing before a new product starts.
2.2 This Privacy Notice also applies where we process personal data about individuals associated with a business customer, including:
directors
beneficial owners
authorised signatories
controllers and representatives
employees or users given access to the account or services
3.1 Digital Capital is controller for its own website and enquiry handling and for the regulated-service purposes it determines when the relevant product is activated. A person’s company, a bank or another provider may separately be a controller for its own purposes. Roles depend on actual decisions and data flows, not only contractual labels.
3.2 In some circumstances, third-party Partners may collect information through their interface before or during onboarding. In those circumstances:
the Partner may act as a separate controller for its own purposes
the Partner may act as a processor acting on our behalf
the Partner may act as both, depending on the data flow and legal context
3.3 Where you access our regulated services through a Partner, Digital Capital remains the regulated provider of the account and payment services. That means we will ordinarily act as controller for the personal data we process for:
onboarding
account operation
payments
safeguarding-related operational administration
fraud prevention
AML/CTF compliance
sanctions screening
regulatory reporting
3.4 Where a Partner has its own customer relationship, website, platform, analytics, commercial communications or user environment, the Partner may separately determine how it processes data for those purposes. In those cases, the Partner’s own privacy notice will also apply.
3.5 If you are unsure whether Digital Capital or a Partner controls a particular processing activity, you may contact us using the details set out in this Privacy Notice.
3.6 There are no agents, distributors or introducers in the initial model. The conditional Partner provisions are retained for future arrangements. Any active processor, separate controller or joint controller must be identified by role in the completed processing schedule; we remain responsible for the obligations applicable to our role.
4.1 Digital Capital operates a regulated electronic money and payment services model in which:
Digital Capital provides the regulated service
customer onboarding and account servicing occur through systems controlled by or on behalf of Digital Capital
Partners may provide an interface or customer acquisition channel
Partners may have limited visibility or reporting access within controlled parameters
Partners do not provide the regulated service merely because their interface is used
4.2 Because of this model, personal data may move through more than one operational layer, including:
the customer-facing interface layer
account and onboarding systems
identity verification and compliance tooling
transaction monitoring systems
payment rails and settlement infrastructure
support, complaints and dispute handling systems
4.3 We design our privacy controls to reflect the sensitivity of regulated financial data and the fact that the same person’s data may be relevant across onboarding, ongoing service provision, fraud prevention, sanctions screening, risk management, customer support and legal compliance.
5.1 We collect and process different categories of personal data depending on the product, customer type, transaction profile, legal requirements and risk profile.
5.2 The categories of personal data we may process include the following.
5.2.1 Identity Data
Identity Data may include:
full name
previous names
date of birth
place of birth
nationality
gender, where required or provided
government-issued identification numbers
passport details
driving licence details
national ID card details
tax identification numbers, where relevant
company registration-linked identity details for business-associated individuals
5.2.2 Contact Data
Contact Data may include:
residential address
correspondence address
business address
email address
telephone number
5.2.3 Account and Relationship Data
Account and Relationship Data may include:
customer ID
account number or wallet identifier
onboarding status
customer type
account permissions
authorised user status
role within a business account
account preferences
service selections
linked product information
5.2.4 Financial Data
Financial Data may include:
account balances
payment details
payer and payee details
IBANs and sort code/account numbers where relevant
transaction history
merchant data
settlement-related information
fee data
reimbursement and chargeback-related data
information relating to the source and destination of funds
5.2.5 Verification and Due Diligence Data
Verification and Due Diligence Data may include:
copies of identification documents
selfies or liveness checks
biometric verification outputs, where applicable
proof of address
business incorporation documents
constitutional and ownership documents
beneficial ownership information
source of funds information
source of wealth information
employment and occupation data where relevant to AML risk assessment
politically exposed person (PEP) screening results
sanctions screening results
adverse media screening results
fraud flags and verification results
5.2.6 Transaction and Behavioural Data
Transaction and Behavioural Data may include:
date, time, amount and currency of transactions
payment initiation details
device or session-linked transaction indicators
transaction counterparties
payment purpose information
recurring transaction behaviour
payment frequency and pattern information
unusual activity indicators
behaviour used to assess fraud or compliance risk
5.2.7 Technical and Device Data
Technical and Device Data may include:
IP address
device identifiers
browser type
operating system
language settings
mobile device data
app usage data
login timestamps
session information
security event logs
authentication event data
5.2.8 Communications Data
Communications Data may include:
customer support messages
email correspondence
complaint submissions
dispute-related messages
call recordings, where applicable and lawfully used
internal notes created in connection with servicing, compliance or disputes
5.2.9 Website and Interaction Data
Website and Interaction Data may include:
pages visited
time spent on pages
referral sources
cookie-related information
engagement with forms or site tools
interaction with banners, disclosures and notices
5.2.10 Risk and Compliance Data
Risk and Compliance Data may include:
internal risk scores
transaction monitoring outputs
fraud model outputs
watchlist screening results
compliance review notes
restrictions or holds applied to an account
suspicious activity escalations
case management information
5.2.11 Corporate and Business Relationship Data
Where services are provided to a business customer, we may process:
company name
incorporation number
registered office
trading address
ownership structure
information about controllers, beneficial owners and management
business activity and sector information
website and commercial profile information
payment activity profile
partner or referral relationship identifiers
5.3 These are categories that may be needed for the stated purposes, not a requirement to provide every item. Website enquiries ordinarily require only contact, business and message details plus actual technical logs. We distinguish required from optional information at collection and do not request full payment credentials, identity documents or sensitive records through an ordinary enquiry form. The factual schedule identifies which categories are currently processed and which are planned.
6.1 We do not seek to process special category personal data unless this is necessary and lawful.
6.2 In limited cases, we may process special category data or data of a sensitive nature where:
this is required for identity verification
it is necessary to establish, exercise or defend legal claims
it is necessary for substantial public interest reasons, including anti-money laundering or fraud prevention compliance where permitted by law
it is provided by you in communications or complaints
it is incidentally contained in supporting documentation
6.3 Biometric verification technologies may be used by identity verification providers where applicable. In such circumstances, biometric outputs may be processed by us or by providers acting on our behalf, subject to applicable legal safeguards.
6.4 We will not use sensitive data for unrelated marketing purposes.
6.5 Special-category processing requires both an Article 6 lawful basis and an applicable Article 9 condition; a general reference to AML or “sensitive” information is insufficient. Where biometric data is used to uniquely identify a person, the condition, necessity, provider roles and safeguards must be documented and explained. Health-related support information is limited where possible to the adjustment needed. Criminal convictions and offence allegations require the separate Article 10 and Data Protection Act 2018 basis and safeguards. Any required appropriate policy document must be maintained.
7.1 The website and initial business product are not directed at children and there is no children’s account or card product. Any future product for minors requires a separate lawful design, age-appropriate information and applicable parental or other safeguards before launch.
7.2 If we become aware that we have collected personal data from a child unlawfully or without the required basis, we will take appropriate steps to delete or otherwise remediate that data.
8.1 We collect personal data directly from you when you:
apply for an account
complete onboarding
submit documents
use our payment services
contact us
submit a complaint or dispute
use our website or app
respond to compliance enquiries
8.2 We may collect personal data indirectly through Partners where:
a Partner provides the interface through which you access our service
a Partner collects preliminary onboarding information
a Partner transmits data needed for customer setup, servicing or support
the Partner provides customer relationship or referral information relevant to the service
8.3 We may receive personal data from service providers and infrastructure providers, including:
identity verification providers
sanctions and PEP screening providers
fraud prevention providers
transaction monitoring providers
customer communication and ticketing providers
payment schemes
banking and safeguarding partners
payment rail participants
8.4 We may receive personal data from publicly available or official sources, including:
corporate registries
sanctions lists
court and insolvency records
regulatory records
adverse media sources
public company websites and databases
8.5 We may also generate personal data ourselves through our operation of the services, including:
internal account identifiers
transaction and risk history
fraud or compliance scores
audit logs
service usage records
internal case notes
8.6 For data received indirectly, we provide the required information about categories and sources within the applicable Article 14 period, generally within one month and, where applicable, earlier at first communication or disclosure. We apply any legal exception narrowly and record why it is justified. Asking a business customer to inform its staff does not remove our own transparency obligations.
9.1 If you provide personal data about another individual, including an authorised user, beneficial owner, director, employee, payee or representative, you must ensure that:
you are authorised to provide that data
the data is accurate
you have informed that person, where required, that their data may be provided to us and processed in accordance with this Privacy Notice
9.2 We may request evidence of authority where appropriate.
10.1 We take reasonable steps to ensure that the personal data we process is accurate, complete and up to date.
10.2 Because our services are regulated and may involve fraud prevention and financial crime controls, it is important that the information you provide is accurate and promptly updated if it changes.
10.3 If we believe that data is inaccurate, incomplete or inconsistent, we may:
request updated information
restrict account functionality
delay transactions
apply further review or due diligence measures
11.1 We seek to collect and process only the personal data that is reasonably necessary for the relevant purpose.
11.2 However, because we operate in a regulated financial services context, the data reasonably necessary for a particular purpose may be broader than in a non-regulated business, particularly where compliance, fraud prevention, sanctions, safeguarding administration, dispute handling or legal obligations are involved.
11.3 Where possible, we apply access controls, role restrictions and retention rules so that personal data is used only by those who need it for the relevant operational, legal or compliance purpose.
12.1 If you have questions about this Privacy Notice or how we process your personal data, you can contact us at:
Digital Capital Ltd
Email: info@digi-capital.co.uk
12.2 If a separate privacy or data protection contact channel is introduced, we may publish updated contact details in an updated version of this Privacy Notice.
12.3 Privacy questions and requests can be sent to info@digi-capital.co.uk, marked “Privacy”, or by post to Digital Capital Ltd, 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, England.
13.1 We process personal data for a range of purposes connected to the provision of regulated financial services, including operational, legal, risk management and compliance purposes.
13.2 These purposes are described in detail below.
14.1 We process personal data to:
open and manage accounts
verify identity and eligibility
provide access to payment services
process transactions
manage account permissions and authorised users
maintain transaction records
provide customer support
14.2 Article 6(1)(b) applies only where processing is objectively necessary for a contract with the individual, or requested pre-contract steps, such as a sole trader’s account. For a corporate customer’s directors, employees or representatives who are not contracting personally, the relevant basis is normally our legitimate interest in administering the business relationship, or a specific legal obligation where applicable. We identify the purpose and basis in section 22.
15.1 We process personal data to:
initiate, route and execute payments
communicate with payment schemes and financial institutions
validate payment instructions
provide transaction confirmations
investigate failed or delayed payments
15.2 The basis is contractual necessity where the individual is party to the relevant contract; for representatives, payees and other non-parties it is an identified legitimate interest in providing and securing the payment service, or a specific legal obligation. We use only data necessary for the relevant purpose and assess the impact on those individuals.
16.1 We process personal data to comply with legal obligations relating to:
anti-money laundering (AML)
counter-terrorist financing (CTF)
sanctions screening
fraud prevention
16.2 This may include:
identity verification
enhanced due diligence
transaction monitoring
screening against sanctions and PEP lists
adverse media screening
16.3 This processing is necessary to comply with legal obligations and, where applicable, for reasons of substantial public interest.
16.4 We distinguish statutory customer due diligence and record keeping under the Money Laundering Regulations 2017 and other binding duties from additional fraud-prevention activity based on legitimate interests. A PEP or sanctions screening result is assessed for accuracy and relevance; it is not automatically proof of wrongdoing. Additional Article 9 or 10 conditions are applied where relevant.
17.1 We process personal data to:
detect and prevent fraud
assess transaction risk
identify suspicious behaviour
protect customers and the financial system
17.2 This may include:
analysing transaction patterns
behavioural analysis
device and session monitoring
fraud scoring
17.3 This processing is based on our legitimate interests in preventing fraud and protecting our services, as well as legal obligations where applicable.
18.1 We process personal data to:
comply with regulatory reporting obligations
respond to requests from regulators or authorities
maintain required records
support audits and investigations
18.2 This processing is necessary to comply with legal obligations.
19.1 We process personal data to:
communicate with you regarding your account
provide service updates
respond to enquiries
handle complaints and disputes
19.2 Service and complaint communications use the contractual, legitimate-interest or legal-obligation basis relevant to the individual and purpose. Direct marketing is separate: we apply PECR and data protection rules, request consent where required, explain any lawful business-contact approach and provide an easy opt-out. You may object to direct marketing at any time.
20.1 We process personal data to:
analyse usage of our services
improve functionality and performance
identify operational issues
20.2 We identify the actual analytics used and its lawful basis. Our website currently uses Framer’s built-in website statistics, which show us aggregate figures such as visitor numbers, page views, popular pages and referring websites; we rely on our legitimate interests in understanding and improving how our website is used. Device access is governed separately by PECR, including any applicable specific exception; a legitimate-interest assessment alone does not authorise non-exempt tracking. We would ask for your consent before using optional analytics or marketing technologies that use cookies or store information on your device, as explained in the Cookie Policy.
21.1 We process personal data to:
establish, exercise or defend legal claims
investigate disputes
enforce contractual rights
21.2 This processing is based on our legitimate interests and, where applicable, legal obligations.
22.1 The table below summarises how we rely on different legal bases.
Purpose and data
Article 6 basis and relevant interest
Enquiries and business contact details
Legitimate interests in responding and developing legitimate business relationships; requested pre-contract steps where the individual would be the contracting party
Account administration and payment execution
Contract for a contracting individual where necessary; legitimate interests in administering the corporate customer service for representatives and counterparties; specific legal obligation where applicable
Identity checks, AML and sanctions records
Legal obligation for applicable statutory duties; identify any additional legitimate-interest checks separately; Article 9 or 10 condition if relevant
Fraud monitoring, security and risk assessment
Legitimate interests in protecting customers, systems and preventing fraud, with an assessment of necessity and impact; legal obligation for specific mandatory controls
Safeguarding, regulatory reporting and audit
Legal obligation for required records and disclosures; data minimisation and access restrictions apply
Customer service, complaints and disputes
Legal obligation where a statutory complaint or redress duty applies; otherwise relevant contract or legitimate interests in resolving the matter
Website statistics and optional analytics or marketing tracking
Legitimate interests in understanding and improving use of our website, for Framer’s cookieless website statistics; consent under the selected website approach for any optional analytics or marketing tracking that uses cookies or device storage (none at present). PECR device-access conditions are assessed separately
Direct marketing communications
Consent where legally required; otherwise an identified lawful legitimate-interest basis with PECR conditions and an unconditional direct-marketing objection route
Legal claims and business transfers
Legitimate interests in establishing, exercising or defending claims or managing a legitimate transaction; legal obligation where applicable; additional sensitive-data condition if needed
23.1 We use automated systems and profiling to support:
fraud detection
transaction monitoring
risk assessment
compliance screening
23.2 These systems may:
assign risk scores
flag transactions or accounts
trigger restrictions or additional checks
23.3 We distinguish automated support for a decision from a solely automated decision producing a legal or similarly significant effect. For any significant solely automated decision, we identify whether there is meaningful human involvement, explain relevant information about the decision, assess the applicable statutory restrictions, especially for special-category data, and implement the required safeguards. A routine reference to fraud prevention does not remove these duties.
23.4 Where the significant automated-decision rules apply, you can make representations, obtain human intervention and contest the decision. Contact the privacy contact in section 12. We explain meaningful information about the logic, significance and expected consequences where required, without disclosing information that lawfully must remain confidential. The factual schedule must state whether such decisions actually occur, in which process and with what safeguards.
23.5 In the initial customer acceptance model, automated verification, screening and risk tools support review by Digital Capital. They do not replace Digital Capital's final acceptance or refusal decision. Griffin separately decides whether to open an elected savings account. Payment-monitoring tools may generate alerts or temporary restrictions; where a decision is solely automated and has legal or similarly significant effects, we will provide the information and safeguards required by law.
24.1 As a result of processing your personal data, we may:
approve or decline account applications
restrict or suspend accounts
delay or refuse transactions
apply transaction limits
escalate activity for further review
24.2 These actions may be required to:
comply with law
manage risk
prevent fraud
25.1 Where you access services via a Partner:
the Partner may collect certain personal data through its interface
that data may be shared with Digital Capital for onboarding and service provision
25.2 In relation to regulated services:
Digital Capital acts as the primary data controller
Partners do not provide regulated financial services
25.3 Partners may process personal data for their own purposes, including:
platform functionality
analytics
customer relationship management
25.4 In such cases, the Partner acts as an independent controller.
25.5 The allocation of responsibilities between Digital Capital and a Partner depends on:
the specific data flow
contractual arrangements
applicable law
25.6 Any future Partner processing must be documented before it begins, including purposes, recipients, access, role allocation and notices. Initial direct distribution does not support a claim that unnamed introducers routinely collect customer data.
26.1 Certain personal data must be provided to us in order for us to:
comply with legal obligations
provide services
26.2 Failure to provide required information may result in:
inability to open an account
restrictions on services
termination of the relationship
27.1 We may process personal data in additional scenarios including:
safeguarding administration
reconciliation processes
transaction dispute resolution
chargeback handling
27.2 These activities are carried out in accordance with applicable legal and contractual requirements.
28.1 We may share personal data where necessary to provide services, comply with legal obligations, or protect our legitimate interests.
28.2 Personal data may be shared with the following categories of recipients.
28.3 SERVICE PROVIDERS
We may share data with service providers who support our operations, including:
identity verification providers
fraud prevention providers
sanctions screening providers
technology and infrastructure providers
customer support systems
communications platforms
28.4 Providers acting as processors are subject to appropriate Article 28 contracts, instructions, confidentiality, security and oversight. Some verification, fraud-prevention, banking or payment providers may be independent controllers for their own statutory or service purposes; the factual schedule must identify the actual role and relevant privacy information. We do not describe every provider as a processor by default.
28.5 FINANCIAL INSTITUTIONS AND PAYMENT INFRASTRUCTURE
We may share data with:
safeguarding banks
payment schemes (including Faster Payments and SEPA systems)
intermediary and correspondent banks
28.6 This sharing is necessary to execute payments and operate services.
28.7 REGULATORS AND AUTHORITIES
We may disclose personal data to:
the Financial Conduct Authority
law enforcement agencies
tax authorities
courts and dispute resolution bodies
28.8 Such disclosure may occur where required by law or regulatory obligation.
28.9 PARTNERS
28.9.1 Where services are accessed via a Partner:
personal data may be shared between the Partner and Digital Capital
such sharing is limited to what is necessary for onboarding, service provision, and support
28.9.2 Partners may also process personal data independently for their own purposes.
28.9.3 An independent controller is responsible for its own processing, but this does not remove Digital Capital’s responsibilities for any disclosure it makes, its selection and oversight of processors, or any processing for which it acts as controller or joint controller. We explain the relevant roles before an active Partner arrangement begins.
28.10 OTHER DISCLOSURES
We may disclose personal data:
in connection with a business transfer
to enforce contractual rights
to prevent fraud or financial crime
28.11 Current website hosting, form handling and communications recipients, and future banking, identity-checking and transaction providers, must be recorded with their actual legal names, roles, data categories, purposes, locations and relevant onward transfers. Planned use of a provider is not evidence of a signed data-processing or banking agreement. SEPA and card recipients are conditional future categories only.
29.1 Personal data may be transferred outside the United Kingdom or European Economic Area.
29.2 For a restricted UK transfer we rely on an applicable UK adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to approved EU standard contractual clauses where appropriate, with the required transfer assessment and supplementary safeguards. A bare reference to EU clauses is not sufficient for every UK transfer. For processing independently subject to EU GDPR, the relevant EU transfer requirements also apply. Any statutory derogation is used only where its specific conditions are met.
29.3 Transfers may occur where:
service providers are located overseas
payment infrastructure requires cross-border processing
regulatory obligations require it
29.4 The completed schedule identifies destination countries and the mechanism used for each restricted transfer, including overseas support access and sub-processors. You may request information and a copy or description of the relevant safeguards using the privacy contact, subject to lawful redactions.
30.1 We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Notice.
30.2 Customer due-diligence and supporting transaction records covered by MLR regulation 40 are ordinarily kept for five years from the end of the business relationship or completion of the occasional transaction, as applicable. Personal data is deleted at the end of that period unless a specific lawful exception applies; the regulation’s limits on longer retention must be observed. This is not a blanket five-year minimum for every website visitor, message or data category. Safeguarding records have their own CASS retention triggers.
30.3 Retention periods depend on:
legal obligations
regulatory requirements
risk management needs
dispute resolution requirements
Record category
Retention trigger and period
Unconverted enquiries and business contacts
24 months from our last meaningful contact, after which the enquiry is deleted
Website, security and authentication logs
The website has no accounts or logins, so there are no authentication logs. Framer, our website host, keeps server and security logs under its own retention policy; we do not keep separate website logs.
Consent, objections and marketing preferences
The website does not collect marketing consent. If you object to marketing or ask us not to contact you, we keep only your contact detail and the date, for as long as needed to respect your request.
AML customer due diligence and supporting transactions
Ordinarily five years from relationship end or occasional-transaction completion under MLR 40, subject to its specific exceptions and limits
CASS safeguarding records
Ordinarily five years from creation or last modification; acknowledgement letters until five years after the last covered account closes; apply any more specific rule
Financial complaints and redress
At least the applicable DISP record period
Privacy complaints, rights requests and legal claims
Six years after the matter is closed, or longer while a related legal claim or regulatory enquiry remains open
Identity images, biometrics and vulnerability information
Not collected at present; separate periods will be set before onboarding starts
31.1 We apply the following principles:
data is retained only as long as necessary
access is restricted based on need
data is securely deleted or anonymised when no longer required
31.2 In regulated financial services, extended retention may be required.
32.1 You have rights under applicable data protection laws, including:
right of access
right to rectification
right to erasure (in certain circumstances)
right to restrict processing
right to object
right to data portability
32.2 You may withdraw consent at any time without affecting earlier lawful processing, object to direct marketing unconditionally and exercise the applicable safeguards for significant solely automated decisions. Rights depend on the relevant processing and lawful basis; we explain an applicable limit instead of relying on a general financial-services exemption.
33.1 A right is restricted only where a specific legal exemption or condition actually applies and only to the necessary extent. An AML, fraud or legal-claims label does not create a blanket exemption from access, transparency or other rights.
33.2 In such cases, we will explain the restriction where possible.
34.1 You may exercise your rights by contacting us.
34.2 We may:
request identity verification
refuse requests where permitted by law
34.3 We normally respond without undue delay and within one month. Where the law allows an extension because of complexity or the number of requests, we notify you within the initial month, explain the reason and the permitted extension, normally up to two further months. Any identity or clarification request and any lawful pause must be necessary and handled under the applicable rules. Requests are normally free; a refusal or charge requires a specific lawful basis and an explanation of complaint and court remedies.
35.1 If you are dissatisfied with how your data is handled, you may contact us at:
35.2 You may also lodge a complaint with the Information Commissioner’s Office (ICO).
35.3 You can complain by email or post and through the published website contact form; no special wording is required. We acknowledge a data protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed as needed and communicate the outcome without undue delay. The acknowledgement period is not a deadline to delay starting the investigation. These duties apply from 19 June 2026.
35.4 ICO information and complaint route: https://ico.org.uk/make-a-complaint/. A complaint that also concerns a regulated payment service may have a separate FCA timetable and FOS route; we explain the parallel processes and do not use one to postpone the other.
36.1 We implement appropriate technical and organisational measures to protect personal data.
36.2 These measures include:
encryption
access controls
monitoring and logging
incident response procedures
36.3 Despite these measures, no system can be guaranteed to be completely secure.
37.1 In the event of a data breach, we will:
investigate the incident
take appropriate remedial action
notify authorities and affected individuals where required
37.2 Where a personal-data breach is notifiable, we notify the ICO without undue delay and, where feasible, within 72 hours of awareness, explaining any delay. Where the breach is likely to result in a high risk to individuals, we notify affected people without undue delay unless a specific exception applies. We record the facts, effects and remedial action.
38.1 Our website or services may include links to third-party sites.
38.2 We are not responsible for their privacy practices.
39.1 We may update this Privacy Notice periodically.
39.2 Updates may reflect:
changes in law
changes in our services
operational updates
39.3 We explain material new uses before processing where required and obtain new consent where that is the relevant basis. A website update does not itself create consent or permit an incompatible new purpose.
Digital Capital Ltd
Email: info@digi-capital.co.uk
Item
Current position
Privacy contact
Privacy questions and requests can be sent to info@digi-capital.co.uk, marked “Privacy”, or by post to Digital Capital Ltd, 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, England.
Current website processing
Hosting and delivery: Framer B.V. (Netherlands), our processor, hosts the website on Amazon Web Services and receives your IP address and browser details when you visit. Website statistics: Framer’s built-in analytics records page visits so that we can see aggregate figures such as visitor numbers, page views, popular pages and referring websites; Framer states that it uses no cookies or persistent identifiers and does not store your IP address. Contact form: Framer’s built-in form collects your name, email address, optional business name and message, and Framer emails them to our contact@digi-capital.co.uk inbox. Email: our digi-capital.co.uk mailboxes, including info@digi-capital.co.uk, run on Microsoft 365 (Microsoft). Fonts are loaded from Google Fonts and map data for the homepage graphic from GitHub, so Google and GitHub receive your IP address and browser details. No advertising, tracking pixels or social media embeds are used, and no cookies are set.
Planned account and identity providers
Digital Capital plans to use Sumsub for identity and business verification, screening and transaction monitoring, and Griffin for the applicable banking, payment and optional savings arrangements. These are planned service providers, not a statement that customer services or data sharing are already live. Before the relevant processing starts, we will provide the actual provider identities, roles, data categories, purposes, transfer safeguards and retention information applicable to your service.
Banking and safeguarding data flows
No live customer banking or safeguarding service is currently provided. For the planned service, information needed for the relevant banking, payment, compliance and savings purposes will be shared through the agreed arrangements. Digital Capital retains responsibility for its own due diligence and processing. Griffin has its own responsibilities and makes the savings account-opening decision under the applicable terms. We will explain the operative data flows before processing begins.
Sensitive data and biometrics
Our current enquiry form does not request identity documents, biometric data, health information or criminal-offence information. Please do not include such information in your message. If you provide sensitive information voluntarily, we restrict access and assess whether it is necessary and lawful to retain it; unnecessary information is deleted or redacted. Any necessary processing is subject to the additional legal conditions described in section 6. Planned identity and biometric processing will be explained before onboarding begins.
Automated significant decisions
None. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
International transfers
Framer B.V. is based in the Netherlands, and UK law treats the EEA as adequate. Framer hosts on Amazon Web Services and may use sub-processors outside the UK and EEA, including in the United States. For a restricted transfer from the UK to the United States, reliance on the Data Privacy Framework requires the recipient to have an active certification under the UK Extension covering the relevant data. EU–US certification alone is not sufficient for that UK transfer. Where adequacy does not apply, the relevant UK International Data Transfer Agreement or UK Addendum and required transfer assessment and safeguards must support the transfer. You can request information about the applicable safeguards through our privacy contact, subject to lawful redactions. Framer lists its sub-processors in its Trust Center. Google, GitHub and Microsoft may process your IP address or emails outside the UK under their own terms.
Retention and marketing
Retention periods are set out in section 30. The website does not collect marketing sign-ups; any marketing follows section 19.2, and every marketing message will include an easy way to opt out.