Privacy Policy

1. Who We Are

PrizeBNK Ltd ("PrizeBNK", "we", "us", "our") is the data controller for personal data collected through our website and business communications.

• Company Name: PrizeBNK Ltd
• Companies House Number: NI740985
• Registered Office: Ormeau Baths, 18 Ormeau Avenue, Belfast, Northern Ireland, BT2 8HS
• Incorporated: 28 May 2026
• Director: Sanil Xavier
• Website: https://prizebnk.com
• Email: sanil@prizebnk.com
• ICO Data Protection Registration: ZC179617 (registered 22 June 2026; expires 21 June 2027)

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

We collect information you provide to us directly, through our website lead form and business communications, and some information automatically when you browse our website, as described in Section 2.3.

2.1 Lead Form Data

When you submit the lead form on prizebnk.com, we collect:

• Full name
• Work email address
• Company size band (e.g. 51–250)
• Source page (which page on prizebnk.com you submitted from)
• Browser user-agent string (collected once at submission, used only to help us spot spam)

2.2 Communication Data

• Emails you send us, and notes from calls or demos
• LinkedIn messages exchanged with our team

We do not collect through the website:

• Employee personal data
• Financial account data or open banking data (collected only within the PrizeBNK mobile app with explicit consent)
• Sensitive personal data (health, religion, ethnicity, etc.)
• Payment card data
• IP addresses (we do not log or store visitor IPs)

2.3 Website Usage Data (collected automatically)

When you browse prizebnk.com, we collect:

• Page path and timestamp
• Referring URL
• Browser user-agent string
• UTM campaign parameters from the link you arrived through
• Only if you accept analytics cookies, the data described in Section 10

3. How We Collect Your Data

We collect personal data:

• Directly from you when you submit our lead form, reply to an email, or attend a demo
• Via LinkedIn when you engage with our team's content or direct messages

Some information is collected automatically when you browse the site, as described in Sections 2.3 and 10. Analytics cookies are set only if you accept them.

4. How We Use Your Data

We process your personal data on the following legal bases:

We do not use your data for automated decision-making or profiling.

We do not sell your personal data to any third party.

5. Who We Share Your Data With

We share data only where necessary and with appropriate safeguards in place. All service providers we use are bound by data processing agreements and may only process your data on our documented instructions. Finexer Ltd's role is different and is described in sections 5.3 and 6.

5.1 Service Providers

We use trusted third-party providers to host our website, deliver emails, and manage business communications. These providers process data on our behalf and are contractually bound to protect it. Where any provider is based outside the UK/EEA, we ensure appropriate transfer safeguards (such as standard contractual clauses) are in place.

Our current processors include Google LLC for Google Analytics, which receives site usage data only where consent is given; Calendly Inc for demo booking, which receives your name, email, timezone and the campaign parameters passed through from the link you arrived on; and Resend for lead notification email delivery.

5.2 Legal and Regulatory Bodies

We may disclose data to regulators or law enforcement where required by law.

5.3 Technology Partners

Account information services in the PrizeBNK mobile app are provided by Finexer Ltd, which is authorised by the Financial Conduct Authority under the Payment Services Regulations 2017 as an Authorised Payment Institution (FRN 925695). PrizeBNK Ltd acts as Finexer's agent for these services and is registered on the FCA Register (FRN 1061774). See the "Open Banking Data (via Finexer)" section for full details.

6. Open Banking Data (via Finexer)

If an employee chooses to connect a bank account in the PrizeBNK mobile app, account information services (AIS) are provided by Finexer Ltd, which is authorised by the Financial Conduct Authority as an Authorised Payment Institution (FRN 925695). PrizeBNK Ltd acts as Finexer's agent for these services and is registered on the FCA Register (FRN 1061774). Finexer is responsible for providing the regulated account information service and for obtaining and managing the employee's consent to access their account.

Finexer acts as a controller in its own right for the consent journey and for retrieving account information from the employee's bank. Once that information has been made available to PrizeBNK, PrizeBNK is the controller for how it is used in the app, as described below. Where Finexer stores that information or makes it available to us through its platform and APIs, it does so as our processor, on our documented instructions. You can read Finexer's privacy notice at finexer.com/legal/privacy.

Consent is given through Finexer and must be reconfirmed at least every 90 days for access to continue.

What we access

With the employee's explicit consent, the app accesses read-only account information from linked UK bank accounts. This may include account balance, transaction history, and account identifiers. We do not request or store online banking login credentials, and we cannot initiate payments, transfers, or other transactions.

How we use it

We use open banking data solely to:

• Power savings tracking and financial wellbeing insights within the app
• Determine prize-eligibility based on qualifying savings activity
• Provide anonymised, aggregated engagement reporting to the employer

Retention

Open banking data is retained only while the employee maintains an active PrizeBNK account and the relevant bank account remains connected. On account closure or disconnection, data is deleted where permitted, subject to any statutory or legal retention period that applies.

Withdrawing consent

Employees can disconnect linked accounts or withdraw open banking consent at any time within the PrizeBNK app. Withdrawing consent stops further collection and use of account information, although we may retain certain records where required by law.

7. Data Storage and Residency

We do not currently persist lead enquiries in any database. Submissions from prizebnk.com are sent directly to our business email inbox, which is the sole system of record for lead data. Our email and document systems are configured to keep data within the UK and EEA.

The prizebnk.com website is hosted on a global edge network. UK visitors are served from UK points of presence, and the hosting layer does not store personal data at rest.

8. Data Retention

We retain your data for the following periods:

When we no longer need your data, we will securely delete or anonymise it.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access - request a copy of the data we hold about you (Subject Access Request)
• Right to rectification - ask us to correct inaccurate or incomplete data
• Right to erasure - request deletion of your data where we have no legal basis to retain it
• Right to restrict processing - ask us to limit how we use your data
• Right to data portability - receive your data in a portable, machine-readable format
• Right to object - object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent - where processing is based on consent, you may withdraw at any time

To exercise any of these rights, please email: sanil@prizebnk.com

We will respond within one month of receiving your request, as required by UK GDPR. This period may be extended by up to two further months where the request is complex or where we have received a number of requests from you; we will tell you within one month if an extension applies and why. There is no charge for most requests.

10. Cookies and Tracking

Nothing non-essential is set until you make a choice in the consent banner. Accept and Reject are equally available. Google Consent Mode keeps all storage denied by default.

These are first-party cookies and are set only after you consent.

We have turned off Google signals and user-provided data collection. Advertising storage and personalisation remain denied, so your data is not used for advertising or remarketing.

We record page path, timestamp, referring URL, browser user-agent string and UTM campaign parameters on our own backend for internal product analytics. This sets no cookies and runs whether or not you accept analytics cookies.

We use sessionStorage to remember the campaign parameters you arrived with for the duration of your visit, and localStorage to remember your cookie choice. Neither is a cookie and neither is shared with third parties.

You can withdraw or change your consent at any time using the Cookie settings link in the footer.

Our hosting provider may log basic request metadata (request time, response status, requested URL) for security and abuse prevention. These logs are not used to build profiles of visitors.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS / TLS encryption for all data in transit
• 2-step verification on company email accounts
• Access controls limiting who can read the lead inbox
• Data processing agreements with all third-party processors
• Server-side input validation on the lead form to prevent injection

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.

12. International Data Transfers

Your personal data is stored in the UK and EEA (Google Workspace tenant pinned to "Europe" data region). The EEA benefits from a UK adequacy decision, so transfers between the UK and EEA do not require additional safeguards.

Personal data may be transferred to the USA through Resend for lead notification email delivery, Google LLC for Google Analytics data where consent is given, and Calendly Inc for demo booking details. Each transfer is covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses in line with UK GDPR.

13. Third-Party Links

Our website may contain links to third-party sites (e.g. LinkedIn). We are not responsible for their privacy practices. Please review their policies independently.

14. Children's Privacy

Our website and Services are directed at UK employers and HR professionals only. We do not knowingly collect data from individuals under 18. If you believe we have inadvertently done so, please contact us immediately.

15. Changes to This Privacy Policy

We will update this Privacy Policy as our business and product develop - including when we change our app or open banking features. We will notify registered business contacts of material changes via email. The "Last updated" date at the top of this page will always reflect the most recent version.

16. How to Complain

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always appreciate the chance to address your concerns first - please email us at complaints@prizebnk.com before escalating to the ICO.

17. Contact Us

PrizeBNK Ltd - Data Controller
Ormeau Baths, 18 Ormeau Avenue, Belfast, Northern Ireland, BT2 8HS
Companies House No: NI740985
Email: sanil@prizebnk.com
Complaints: complaints@prizebnk.com
Website: https://prizebnk.com