Privacy Policy

1. Who We Are

PrizeBNK Ltd ("PrizeBNK", "we", "us", "our") is the data controller for personal data collected through our website and business communications.

• Company Name: PrizeBNK Ltd
• Companies House Number: NI740985
• Registered Office: Ormeau Baths, 18 Ormeau Avenue, Belfast, Northern Ireland, BT2 8HS
• Incorporated: 28 May 2026
• Director: Sanil Xavier
• Website: https://prizebnk.com
• Email: sanil@prizebnk.com
• ICO Data Protection Registration: ZC179617 (registered 22 June 2026; expires 21 June 2027)

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

We collect information you provide to us directly, through our website lead form and business communications, and some information automatically when you browse our website, as described in Section 2.3.

2.1 Lead Form Data

When you submit the lead form on prizebnk.com, we collect:

• Full name
• Work email address
• Company size band (e.g. 51–250)
• Source page (which page on prizebnk.com you submitted from)
• Browser user-agent string (collected once at submission, used only to help us spot spam)

2.2 Communication Data

• Emails you send us, and notes from calls or demos
• LinkedIn messages exchanged with our team

We do not collect through the website:

• Employee personal data
• Financial account data or open banking data (collected only within the PrizeBNK mobile app with explicit consent)
• Sensitive personal data (health, religion, ethnicity, etc.)
• Payment card data
• IP addresses in our own systems. Our hosting provider may process your IP address in short-term security logs, and Google processes it to estimate your approximate location if you accept analytics cookies.

2.3 Website Usage Data (collected automatically)

When you browse prizebnk.com, we collect:

• Page path and timestamp
• Referring URL
• Browser user-agent string
• UTM campaign parameters from the link you arrived through
• Only if you accept analytics cookies, the data described in Section 10

3. How We Collect Your Data

We collect personal data:

• Directly from you when you submit our lead form, reply to an email, or attend a demo
• Via LinkedIn when you engage with our team's content or direct messages

Some information is collected automatically when you browse the site, as described in Sections 2.3 and 10. Analytics cookies are set only if you accept them.

4. How We Use Your Data

We process your personal data on the following legal bases:

We do not use your data for automated decision-making or profiling.

We do not sell your personal data to any third party.

5. Who We Share Your Data With

We share data only where necessary and with appropriate safeguards in place. All service providers we use are bound by data processing agreements and may only process your data on our documented instructions. Finexer Ltd's role is different and is described in sections 5.3 and 6.

5.1 Service Providers

We use trusted third-party providers to host our website, deliver emails, and manage business communications. These providers process data on our behalf and are contractually bound to protect it. Where any provider is based outside the UK/EEA, we ensure appropriate transfer safeguards (such as standard contractual clauses) are in place.

Our current processors are: Lovable, our website hosting platform, delivered through Cloudflare's network; Supabase, the database for our first-party usage statistics, hosted in Frankfurt, Germany; Google LLC for Google Analytics, only where you consent; Calendly Inc for demo booking, which receives your name, email and timezone, plus the campaign parameters from the link you arrived on only if you accepted analytics; and Resend for lead notification emails.

5.2 Legal and Regulatory Bodies

We may disclose data to regulators or law enforcement where required by law.

5.3 Technology Partners

Account information services in the PrizeBNK mobile app are provided by Finexer Ltd, which is authorised by the Financial Conduct Authority under the Payment Services Regulations 2017 as an Authorised Payment Institution (FRN 925695). PrizeBNK Ltd acts as Finexer's agent for these services and is registered on the FCA Register (FRN 1061774). See the "Open Banking Data (via Finexer)" section for full details.

6. Open Banking Data (via Finexer)

If an employee chooses to connect a bank account in the PrizeBNK mobile app, account information services (AIS) are provided by Finexer Ltd, which is authorised by the Financial Conduct Authority as an Authorised Payment Institution (FRN 925695). PrizeBNK Ltd acts as Finexer's agent for these services and is registered on the FCA Register (FRN 1061774). Finexer is responsible for providing the regulated account information service and for obtaining and managing the employee's consent to access their account.

Finexer acts as a controller in its own right for the consent journey and for retrieving account information from the employee's bank. Once that information has been made available to PrizeBNK, PrizeBNK is the controller for how it is used in the app, as described below. Where Finexer stores that information or makes it available to us through its platform and APIs, it does so as our processor, on our documented instructions. You can read Finexer's privacy notice at finexer.com/legal/privacy.

Consent is given through Finexer and must be reconfirmed at least every 90 days for access to continue.

What we access

With the employee's explicit consent, the app accesses read-only account information from linked UK bank accounts. This may include account balance, transaction history, and account identifiers. We do not request or store online banking login credentials, and we cannot initiate payments, transfers, or other transactions.

Where we store it

Account information retrieved through Finexer is stored on PrizeBNK's servers in the UK (Google Cloud, London region), encrypted at rest, for as long as the connection is active.

Transactional emails from the app (invites and sign-in links) are sent through Resend's EU (Ireland) region, and push notifications and crash reports use Google Firebase, which may process limited device data (such as app installation IDs and crash reports) outside the UK under UK data-transfer safeguards. No bank data is sent to either.

How we use it

We use open banking data solely to:

• Power savings tracking and financial wellbeing insights within the app
• Work out prize draw entries from in-app habits (finishing daily spending reviews, keeping chosen spending cuts and keeping a bank account connected), never from balances or amounts saved
• Provide anonymised, aggregated engagement reporting to the employer

Retention

Open banking data is retained only while the employee maintains an active PrizeBNK account and the relevant bank account remains connected. On account closure or disconnection, data is deleted where permitted, subject to any statutory or legal retention period that applies. Where an account is deleted, its data is erased after the 90-day period described under “Deleting your account” below.

Withdrawing consent

Employees can disconnect linked accounts or withdraw open banking consent at any time within the PrizeBNK app. Withdrawing consent stops further collection and use of account information, although we may retain certain records where required by law.

Deleting your account

You can delete your PrizeBNK account and its data at any time, from inside the app (Profile → Account management → Delete my account) or by emailing sanil@prizebnk.com from the email address on your account.

When you delete your account, your sign-in is closed straight away, we stop reading your bank data and nothing more is collected about you, and you are removed from future prize draws. After 90 days everything is permanently erased, including:

• your profile and sign-in details
• your connected bank accounts, balances and transactions
• your savings goals, streaks, daily reviews and prize draw entries
• your notifications and app settings
• the data held by our open banking provider, Finexer, for your connections

We keep your account for 90 days before erasing it so that a deletion made by mistake can be recovered (contact us within that time), and so that prize draws that have already taken place can still be verified. During this period your data is not used and you cannot sign in. After erasure we keep only the records we are required to keep by law, such as prize payout records, and a record that an account was deleted, which does not identify you.

If your employer removes you from PrizeBNK, your account and its data are deleted immediately, including the data held by Finexer.

7. Data Storage and Residency

We do not currently persist lead enquiries in any database. Submissions from prizebnk.com are sent directly to our business email inbox, which is the sole system of record for lead data. Our email and document systems are configured to keep data within the UK and EEA.

The prizebnk.com website is hosted on Lovable and delivered through Cloudflare's global network. UK visitors are served from UK points of presence, and the hosting layer does not store personal data at rest.

8. Data Retention

We retain your data for the following periods:

When we no longer need your data, we will securely delete or anonymise it.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access - request a copy of the data we hold about you (Subject Access Request)
• Right to rectification - ask us to correct inaccurate or incomplete data
• Right to erasure - request deletion of your data where we have no legal basis to retain it
• Right to restrict processing - ask us to limit how we use your data
• Right to data portability - receive your data in a portable, machine-readable format
• Right to object - object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent - where processing is based on consent, you may withdraw at any time

To exercise any of these rights, please email: sanil@prizebnk.com

We will respond within one month of receiving your request, as required by UK GDPR. This period may be extended by up to two further months where the request is complex or where we have received a number of requests from you; we will tell you within one month if an extension applies and why. There is no charge for most requests.

10. Cookies and Tracking

Nothing non-essential is set until you make a choice in the consent banner. Accept and Reject are equally available. Google Consent Mode keeps all storage denied by default.

These are first-party cookies and are set only after you consent.

We have turned off Google signals and user-provided data collection. Advertising storage and personalisation remain denied, so your data is not used for advertising or remarketing.

We record page path, timestamp, referring URL, browser user-agent string and UTM campaign parameters on our own systems to produce statistics about how the site is used, so we can improve it. This sets no cookies and is not used to identify you. Under the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, this statistical use does not require your prior consent, but you can switch it off at any time: choosing Reject in the cookie banner, or in Cookie settings in the footer, stops it along with Google Analytics.

We use sessionStorage to remember the campaign parameters you arrived with for the duration of your visit (cleared if you choose Reject), and localStorage to remember your cookie choice. We pass campaign parameters to Calendly with your booking only if you have accepted analytics. None of this is a cookie.

You can withdraw or change your consent at any time using the Cookie settings link in the footer.

Our hosting provider (Lovable, delivered through Cloudflare) may log basic request metadata, such as request time, response status, requested URL and IP address, for security and abuse prevention. These logs are not used to build profiles of visitors.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS / TLS encryption for all data in transit
• 2-step verification on company email accounts
• Access controls limiting who can read the lead inbox
• Data processing agreements with all third-party processors
• Server-side input validation on the lead form to prevent injection

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.

12. International Data Transfers

Your personal data is stored in the UK and EEA (Google Workspace tenant pinned to "Europe" data region). The EEA benefits from a UK adequacy decision, so transfers between the UK and EEA do not require additional safeguards.

Personal data may be transferred to the USA through Resend for lead notification email delivery, Google LLC for Google Analytics data where consent is given, and Calendly Inc for demo booking details. Each transfer is covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses in line with UK GDPR.

13. Third-Party Links

Our website may contain links to third-party sites (e.g. LinkedIn). We are not responsible for their privacy practices. Please review their policies independently.

14. Children's Privacy

Our website and Services are directed at UK employers and HR professionals only. We do not knowingly collect data from individuals under 18. If you believe we have inadvertently done so, please contact us immediately.

15. Changes to This Privacy Policy

We will update this Privacy Policy as our business and product develop - including when we change our app or open banking features. We will notify registered business contacts of material changes via email. The "Last updated" date at the top of this page will always reflect the most recent version.

16. How to Complain

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always appreciate the chance to address your concerns first - please email us at complaints@prizebnk.com before escalating to the ICO.

Complaints about Open Banking services

If you have a complaint relating to our Open Banking services, including bank connections or account information, please contact us at complaints@prizebnk.com. Complaints relating to Account Information Services will be referred to Finexer Ltd, the FCA-authorised provider, for investigation and handling in accordance with applicable regulatory requirements. If you remain dissatisfied with the final response, you may be eligible to refer your complaint to the Financial Ombudsman Service at www.financial-ombudsman.org.uk.

17. Contact Us

PrizeBNK Ltd - Data Controller
Ormeau Baths, 18 Ormeau Avenue, Belfast, Northern Ireland, BT2 8HS
Companies House No: NI740985
Email: sanil@prizebnk.com
Complaints: complaints@prizebnk.com
Website: https://prizebnk.com