Privacy and Cookie Policy

Privacy is more than a promise. It is a practice. What we do not collect cannot leak.

Our privacy pledge. We collect only what we need. We do not sell or share your data for others’ marketing. We tell you how to use your rights — and act on them.

This policy answers:

• What personal data does the Group collect? — section 3
• On what basis does it use it? — section 4
• How long does it keep it? — section 5
• Who does it share it with? — section 6
• Where is it transferred? — section 7
• What are your rights? — section 8
• How is it protected? — section 9
• Are decisions made by automated means? — section 21

Our privacy principles.

• Your personal data belongs to you.
• We collect only what we need.
• We use it only for the purpose stated.
• We do not pass it on without a lawful reason.
• Everyone with access to it is bound by confidentiality.

Who you are — and what the Group processes

Where we get your data from. Most personal data comes from you, through the forms on this website. Some comes from others: from a partner, supplier or counterparty when you act for them or are involved in a matter with them; and from public sources such as Companies House and sanctions lists, when the Company carries out due diligence. Where data has not come from you, the Company tells you its source as required by Article 14 UK GDPR, unless an exemption applies.

How long each kind of data is kept is set out in the Data Retention Schedule.

How this website uses these technologies (24 October 2026). Without your consent this website uses only strictly necessary storage: your choice of country and your cookie choices. Google Analytics 4 and Microsoft Clarity (Analytical and Performance), and Google Ads conversion measurement, the Meta Pixel and the LinkedIn Insight Tag (Marketing), are built into the website but load only if you switch on the relevant category, and only once the Company has activated them. Google Consent Mode v2 is set to “denied” for every purpose by default, and a Global Privacy Control signal from your browser is honoured as an automatic opt-out. If you later withdraw consent, the tags stop and their cookies are deleted.

UK GDPR, Data Protection Act 2018, and PECR compliance

When this policy applies

• when you visit this website;
• when you submit a form or correspond with the Group;
• when the Group checks a prospective partner, supplier or other counterparty, including searches of public sources and sanctions screening;
• when you subscribe to the Group’s publications.

This policy does not apply to third-party websites linked from this site; their own policies apply. If you give the Group information about another person, please make sure they are aware of this policy.

Terms used in this policy

• Controller — the organisation that decides why and how personal data is used, and is responsible for it.
• Personal data — information about an identifiable individual.
• Processing — anything done with personal data, from collecting and storing it to sharing and deleting it.

PART A — PRIVACY POLICY

This website and its forms are not intended for persons under 18 years of age.

1. Data Controller

The data controller is The NeoBankers Group Limited, Company No.

13821747, registered at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. Data protection enquiries:

the Data protection request form.

2. Legal Framework

This Privacy Policy is issued in compliance with the UK General Data Protection Regulation (UK GDPR), as defined in section 3(10) of the Data Protection Act 2018, the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) (PECR), each as amended, including by the Data (Use and Access) Act 2025.

3. Data We Collect

We may collect and process the following categories of personal data:

• Identity data: name, title.
• Contact data: email address, telephone number, postal address.
• Technical data: IP address, browser type and version, operating system, platform, time zone setting, and other technology on the devices you use to access this website.
• Usage data: information about how you use this website, including referral source, length of visit, page views, and navigation paths.
• Due diligence data of counterparties: identity, ownership and authority of a partner, supplier or other counterparty, and the results of sanctions and adverse-media screening.

Some data is required by anti-money-laundering law; without it the Group cannot proceed with a counterparty.

If you do not provide data. If you do not provide data that a form or a legal obligation requires, the Group may be unable to reply or to proceed with a counterparty.

We collect this data when you: submit forms or correspond with us via email; browse our website (via cookies and similar technologies, as described in Part B); or engage with us in any business capacity.

4. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6(1):

• Consent (Art. 6(1)(a)): where you have given clear, affirmative consent for us to process your personal data for a specific purpose.

You may withdraw consent at any time by contacting us.

• Legitimate interests (Art. 6(1)(f)): where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. Our legitimate interests include: operating and improving this website, responding to enquiries, and protecting the Company's legal rights.
• Legal obligation (Art. 6(1)(c)): where processing is necessary for compliance with a legal obligation to which we are subject, including obligations under the Companies Act 2006, anti-money laundering legislation, and tax law.

5. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our specific retention periods are:

• Enquiry and correspondence data: 24 months from date of last correspondence, unless a longer retention period is required by law or legitimate business need.
• Website analytics data: 26 months, after which data is anonymised.
• Corporate and financial records: 6 years from end of financial year, as required by HMRC and the Companies Act 2006.
• Anti-money laundering records: 5 years from date of transaction or end of business relationship, whichever is later (MLR 2017).

6. Data Sharing

We may share personal data with the following categories of recipients:

• Our current and future subsidiaries, where necessary for corporate administration.
• Professional advisers (legal, tax, audit), acting as data processors or joint controllers.
• IT service providers acting as data processors, under contractual data processing agreements.
• Public authorities, where required by law (e.g., HMRC, NCA, ICO).

We do not sell personal data to third parties. We do not share personal data with third parties for their direct marketing purposes.

Requests from authorities. If an authority asks the Group about you, the Group tells you — unless the law forbids it.

7. Data Transfers

Where personal data is transferred outside the United Kingdom to a country that has not been deemed to provide an adequate level of data protection, we ensure that appropriate safeguards are in place in accordance with UK GDPR Article 46. These safeguards include the International Data Transfer Agreement (UK IDTA) or the EU standard contractual clauses with the UK Addendum, as approved by the Information Commissioner's Office.

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access (Art. 15): to obtain confirmation of whether we process your personal data and to receive a copy of that data.
• Right to rectification (Art. 16): to have inaccurate personal data corrected.
• Right to erasure (Art. 17): to have your personal data deleted in certain circumstances ('right to be forgotten').
• Right to restriction of processing (Art. 18): to restrict the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20): to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): to object to processing based on legitimate interests, including profiling.
• Rights related to automated decision-making (Art. 22): we do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects.

To exercise any of these rights, please contact:

the Data protection request form. We will respond to your request within one month. In exceptional circumstances, we may extend this period by a further two months, and we will inform you if this is necessary.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO can be contacted at: ico.org.uk, or by telephone on 0303 123 1113, or by post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include encryption of data in transit, access controls, and regular review of our security practices.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. The date of the most recent revision and the version number are indicated at the top of this document; the version published here is always the current one. We encourage you to review this policy periodically.

PART B — COOKIE POLICY

11. What Are Cookies

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work or work more efficiently, and to provide reporting information to the website operator.

12. Legal Basis

We use cookies in accordance with regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426)

(PECR) and the UK GDPR. We obtain your consent before placing any non-essential cookies on your device. Strictly necessary cookies do not require your consent.

13. Categories of Cookies We Use

Strictly necessary cookies: These are essential for the operation of our website. They enable core functionality such as security, network management, and account access. These cookies do not require your consent and cannot be disabled.

Analytics cookies: These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example by ensuring that users can find what they are looking for easily. These cookies require your consent before they are placed.

We do not use advertising, targeting, or social media cookies.

14. Specific Cookies

A detailed list of the cookies we use, their purpose, and their expiry period is available upon request by contacting: the Data protection request form.

Form drafts. Some forms offer “Save a draft on this device”. Only if you tick it, what you type is kept in your own browser (local storage, key tnbg-draft-…) so that you can finish later. It is not sent to the Group until you submit the form. This storage is strictly necessary for the service you have asked for, so no separate consent is requested (Regulation 6(4) PECR). The draft is deleted when you send the form, when you press “Clear draft”, or automatically after 7 days. Do not use it on a shared device.

E-mails. The Group does not use tracking pixels or analytics in its e-mails and does not track whether you open them.

15. Managing Cookies

You may manage your cookie preferences at any time through our Cookie Preference Centre or through your browser settings.

Most browsers allow you to refuse or delete cookies. The methods for doing so vary from browser to browser. You may also withdraw your consent at any time by clearing cookies from your browser.

Please note that if you disable or refuse cookies, some parts of this website may become inaccessible or not function properly.

16. Further Information

For further information about cookies, including how to see what cookies have been set and how to manage and delete them, visit: allaboutcookies.org.

PART C — PERSONAL DATA PROCESSING

17. Transparency Notice (UK GDPR Articles 13 and 14)

This section provides additional transparency regarding the processing of personal data by the Company, in fulfilment of the requirements of UK GDPR Articles 13 and 14.

18. Categories of Data Subjects

We process personal data relating to: website visitors; enquirers and correspondents; business contacts and partners; directors and officers of the Company and its current and future subsidiaries; and suppliers and service providers.

19. Purposes and Legal Bases

The purposes for which we process personal data, and the corresponding legal bases, are set out in sections 4 and 5 of Part A above. In summary: website operation and analytics (legitimate interest); responding to enquiries (consent or legitimate interest); corporate administration and governance (legal obligation and legitimate interest); and compliance with legal and regulatory obligations (legal obligation).

20. Recipients

The categories of recipients with whom we may share personal data are set out in section 6 of Part A above.

21. Automated Decision-Making

We do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects concerning individuals.

22. Publications by Email

If you subscribe to the Company’s publications by email, the Company processes your email address and, if you provide them, your name, organisation, country, the type of reader you select, and the topics and kinds of publication you choose.

• Purpose: to send you, by email, each kind of publication to which you have consented, on the topics you choose, and to keep a record of your consent. Optional details (name, organisation, country and reader type) are used only to address you by name and to understand, in aggregate, who reads the Company’s publications; they are not used to tailor emails to individual recipients.
• Legal basis: your consent (UK GDPR and EU GDPR Article 6(1)(a); regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003).
• Confirmation: you are subscribed only after you confirm your address through the link the Company sends you (double opt-in).
• Withdrawal: you may withdraw consent to any kind of publication at any time through the unsubscribe link in every email or through the Data protection request form; withdrawal does not affect processing before it.
• Retention: your email address and optional details until you unsubscribe; the record of consent and withdrawal for two years afterwards, to demonstrate compliance (UK GDPR Article 7(1)).
• Recipients: the email service provider that sends the e-mails on the Company’s behalf, under a data processing agreement; the provider will be named in this section before subscriptions open.
• No profiling: the Company does not use subscription data for profiling or automated decision-making, and does not sell or share it for others’ marketing. The list is not used to communicate financial promotions.

Subscriptions are not yet open; no subscription data is collected until they are.

23. Verification through LinkedIn

Some enquiry forms ask you to confirm who you are through LinkedIn before your message is sent. This applies to the forms for partnership and project enquiries, suppliers, press and media, general enquiries and messages to a project lead. On the Careers form, verification through LinkedIn is optional; it helps the Company confirm your details and reply sooner. Forms for data protection requests, reports of fraud, scams or security issues, regulatory and compliance matters and concerns about wrongdoing never require LinkedIn, and you may use them without an account.

• What the Company receives: when you choose to verify, you are taken to LinkedIn and sign in there. LinkedIn tells the Company your name, your email address and whether LinkedIn has verified it, your profile photo and a unique identifier for your LinkedIn account (scopes “openid”, “profile” and “email”). The Company does not receive your password, contacts, posts or messages, and does not post anything on your behalf.
• Purpose: to confirm that an enquiry comes from a real person, to reduce spam and impersonation, and to direct the enquiry to the right person. The verified name and email are attached to your enquiry.
• Legal basis: the Company’s legitimate interest in knowing who it corresponds with and in protecting its channels from misuse (UK GDPR and EU GDPR Article 6(1)(f)). For the Careers form, steps taken at your request before entering into a contract (Article 6(1)(b)).
• If you cannot use LinkedIn: you may write to the Company by post at its registered office, 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom. On the Careers form you may simply send the form without verifying.
• Retention: the verification result is kept with your enquiry and for as long as the enquiry is kept under the Data Retention Schedule. The Company keeps no LinkedIn access token after verification is complete.
• Recipients and transfers: LinkedIn Ireland Unlimited Company processes your sign-in under its own privacy policy, as an independent controller. The Company does not share the verification result with anyone else.
• Cookies: the Company does not place LinkedIn cookies on this website. Any cookies are set by LinkedIn on its own site when you sign in there.
• Your rights: you may object to this processing, or ask for access to or erasure of the verification result, through the Data protection request form, which never requires LinkedIn. You may also remove the Company’s access in your LinkedIn settings.

LinkedIn verification is being introduced. Until it is switched on, the forms can be sent without it.

— END OF DOCUMENT —