Privacy Notice

1. About this notice

This Privacy Notice explains how eXgine Limited (“eXgine”, “we”, “us” or “our”) collects and uses personal information.

eXgine Limited is registered in England and Wales under company number 11640652 and has its registered office at Trevenson House, Church Road, Pool, Redruth, England, TR15 3PT.

For personal information processed by eXgine for its own purposes, eXgine is the data controller.

eXgine Limited is registered with the Information Commissioner’s Office as a data controller under registration reference ZB237457.

2. Our relationship with QashPay

eXgine is part of QashPay.

QashPay provides the merchant-facing platform through which eXgine services may be made available. Marketing, initial commercial enquiries and QashPay platform activities are handled by QashPay and are subject to the QashPay privacy notice.

eXgine receives personal and business information from QashPay where this is necessary to onboard a customer, meet legal or regulatory requirements, provide foreign exchange services, administer transactions or operate the relationship between eXgine and the customer.

Where eXgine and QashPay separately determine how and why they process personal information, each organisation acts as a separate data controller for those activities.

3. Information we may collect

Depending on your relationship with us, we may process:

Business and contact information, including your name, business name, position, email address, telephone number and business address.

Identity and verification information, including information about company directors, beneficial owners, authorised representatives and other relevant individuals, together with identity documents and verification results where required.

Corporate and ownership information, including company registration information, ownership and control information and information relating to the nature of the business.

Compliance information, including information required for anti-money laundering, sanctions, politically exposed person, adverse media and other compliance checks.

Transaction information, including currencies, amounts, transaction identifiers, foreign exchange rates, timestamps and information needed to associate an FX transaction with the relevant underlying payment.

Settlement and account information, including information required to identify the relevant settlement accounts, currencies and value dates.

Technical and security information, including IP address, browser or device information, logs and information used to secure our systems.

Communications, including correspondence and records of enquiries or support requests.

4. Where we obtain information

We may obtain personal information:

• directly from you;
• from QashPay;
• from acquiring banks, payment service providers and other payment partners;
• from banking and foreign exchange counterparties;
• from identity, business verification and compliance providers;
• from Companies House and other official or public registers;
• from publicly available sources; and
• from professional advisers, regulators or authorities where appropriate.

5. How we use personal information

We use personal information where necessary to:

• assess and onboard customers;
• verify businesses, directors, beneficial owners and authorised representatives;
• meet our anti-money laundering and other legal obligations;
• provide and administer foreign exchange services;
• book, record, reconcile and settle FX transactions;
• associate FX transactions with relevant payment and settlement information;
• manage our contractual relationships;
• protect our systems and prevent fraud or misuse;
• maintain accounting, audit and compliance records;
• respond to enquiries and provide support;
• establish, exercise or defend legal claims; and
• comply with requests or obligations imposed by regulators, law enforcement agencies, courts or other authorities.

6. Lawful bases

Depending on the activity, we rely on one or more of the following lawful bases under UK data protection law:

Contract — where processing is necessary to enter into or perform a contract with an individual.

Legal obligation — where processing is necessary to comply with laws applying to eXgine, including anti-money laundering requirements.

Legitimate interests — where processing is necessary for legitimate business purposes such as operating and securing our services, maintaining business records, preventing misuse and managing customer relationships, provided those interests are not overridden by an individual’s rights.

Consent — where consent is required, including for certain non-essential cookies or similar technologies.

7. Anti-money laundering and compliance

eXgine is registered with HM Revenue & Customs for anti-money laundering supervision.

We are required to carry out appropriate customer due diligence, maintain records and monitor relevant relationships and transactions.

This may require us to verify identities and ownership information, screen individuals and businesses against relevant databases and obtain additional information about a customer, transaction or source of funds.

We may be legally restricted from telling an individual about certain compliance checks, reports or disclosures.

8. Marketing

Commercial marketing and merchant acquisition for eXgine services are undertaken through QashPay.

eXgine.net is primarily an informational website and is not intended to operate as a separate marketing database.

Where you choose to visit QashPay or submit information directly to QashPay, QashPay’s privacy notice applies to the information collected for those purposes.

9. Who we may share information with

Where necessary and lawful, we may share information with:

• QashPay and relevant group companies;
• acquiring banks and payment service providers;
• banks, foreign exchange counterparties and liquidity providers;
• identity verification, compliance and fraud prevention providers;
• technology, hosting, cybersecurity and other operational service providers;
• accountants, auditors, lawyers and other professional advisers;
• insurers;
• regulators, government departments, tax authorities, courts and law enforcement agencies; and
• other parties where disclosure is required by law or necessary in connection with a corporate transaction.

We only share information where there is an appropriate reason and legal basis to do so.

10. International transfers

Some service providers or counterparties may process personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we use an appropriate mechanism such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally permitted safeguard.

11. How long we keep information

We keep personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, accounting and contractual requirements.

Anti-money laundering records are retained for the period required by applicable law, which will ordinarily include a period of at least five years from the end of the relevant business relationship or transaction where the Money Laundering Regulations require this.

Other retention periods depend on the nature of the information and the purpose for which it is held.

12. Your rights

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to erase information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exemptions.

We may need to verify your identity before responding to a request.

13. Cookies

Information about cookies and similar technologies used on eXgine.net is available in our Cookie Policy.

Non-essential cookies or similar technologies requiring consent will not be used unless the appropriate consent has been obtained.

14. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or misuse.

Access to personal information is limited according to business need and appropriate security controls are applied to systems handling customer and transaction information.

15. Complaints

If you have questions or concerns about how eXgine uses personal information, please contact us first so that we can investigate.

You also have the right to make a complaint to the Information Commissioner’s Office, the UK supervisory authority for data protection.

16. Changes to this notice

We may update this Privacy Notice to reflect changes to our business, services or legal obligations.

The latest version will be published on this website with the date it was last updated.

17. Contact

For privacy enquiries or to exercise your data protection rights, contact:

eXgine Limited
Trevenson House
Church Road
Pool
Redruth
England
TR15 3PT

contact@exgine.net