Company No. 13821747 · Vulnerability Disclosure Policy · Last updated 27 October 2026 · The applicable version is always the current one
Vulnerability Disclosure Policy
This policy explains how to report a suspected security vulnerability in the Group’s websites and online services, and how the Group will respond. The Group values the work of security researchers who report vulnerabilities responsibly.
1. How to report
Use the security and fraud report form and choose “security vulnerability”. Reports may be submitted anonymously; contact details are optional and are needed only if you wish to hear back.
2. What to include
the address (URL) affected and a description of the vulnerability;
step-by-step details of how to reproduce it, which must be benign and non-destructive;
where helpful: timestamps (UTC), the tools used and screenshots.
Do not include personal data other than your own contact details.
3. Rules of engagement
Do not access, change or delete data that is not yours, and do not disrupt the services. Stop as soon as you have enough to demonstrate the issue.
If, while verifying a vulnerability, you encounter personal or confidential data, stop testing immediately, do not copy or share the data, and tell the Group in your report.
Keep the details confidential until the Group has had a reasonable opportunity to resolve the issue.
4. The Group’s response
The Group aims to acknowledge a report within three business days and to triage it, with an indicative timetable for a fix, within ten business days. Timetables depend on severity and complexity; material changes will be communicated. The Group will not take legal action against good-faith research that follows this policy.
Out of scope
e-mail configuration suggestions (SPF, DKIM, DMARC) without a demonstrated attack;
public files such as robots.txt;
missing security headers without a demonstrated impact;
social engineering or phishing of the Group’s people.
If you obtain personal data while researching, do not keep it: delete it once you have reported the issue.
5. No rewards
The Group does not operate a bug bounty programme and does not offer monetary or other rewards for reported vulnerabilities. Do not disclose an issue publicly until the Group has confirmed that it is fixed.
We use strictly necessary technologies to operate this website. Analytical, functionality, and marketing cookies are disabled by default and will only be enabled after your affirmative choice. You can review each category in our Cookie Preference Centre.
The Neobankers Group Limited
Cookie and Similar Technologies Preference Centre
v.26/4 April 2026
Your Choices
1. Introduction and Scope
In accordance with the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) (“PECR”) as amended by the Data (Use and Access) Act 2025 (“DUA Act”), the UK General Data Protection Regulation (“UK GDPR”), as defined in section 3(10) of the Data Protection Act 2018 and as amended, and the Data Protection Act 2018 (“DPA 2018”), The Neobankers Group Limited (“the Company”) requires your affirmative consent before deploying any cookies or similar technologies that are not strictly necessary for the operation of this website or otherwise exempt under PECR Schedule A1.
For the purposes of this Preference Centre, “cookies and similar technologies” (referred to by the ICO as “storage and access technologies”) includes HTTP cookies, local storage objects (including localStorage and sessionStorage), tracking pixels (web beacons), browser fingerprinting, server-side tracking technologies, DNS-level domain delegation (CNAME cloaking), link decoration, scripts, tags, SDKs, and any other technology that stores information on, or accesses information from, your terminal equipment within the meaning of PECR Regulation 6. The Company accepts responsibility as “instigator” (within the meaning of the DUA Act, Section 112(2)) for any such technologies deployed on this website via tag management systems, embedded third-party content, or third-party integrations, and maintains contractual controls over third-party cookie behaviour with periodic compliance audits. The Company applies the principle of data minimisation (UK GDPR Article 5(1)(c)): only those technologies strictly necessary for the stated purposes are deployed. This Preference Centre, read in conjunction with the Company’s Privacy and Cookie Policy, constitutes the information notice required by UK GDPR Article 13 in respect of personal data collected through cookies and similar technologies.
2. Definitions
A “first-party cookie” (1P) is set by the domain you are visiting (theneobankers.group) and can only be read by that domain. A “third-party cookie” (3P) is set by a domain other than the one you are visiting and may be used to track your activity across multiple websites. A “session cookie” is temporary and deleted when you close your browser. A “persistent cookie” remains on your device for a set period or until manually deleted. For further information on how cookies work, please visit allaboutcookies.org.
3. Your Right to Refuse
You may continue to use this website with only strictly necessary cookies by selecting “Reject All Cookies”. No non-essential technologies will be deployed without your affirmative consent. Your refusal will not affect the availability or core functionality of this website, in accordance with UK GDPR Recital 42. The Company will not employ cookie walls or “consent or pay” models. The Company does not sell your personal data to any third party. This Preference Centre controls cookies set by this website only and cannot block cookies on third-party websites to which this website may link. The Preference Centre cannot be dismissed without making a choice, as this ensures no default consent state is assumed.
4. Granular Consent
When you first visit this website, this Preference Centre opens automatically and presents: (a) a concise statement that the website uses cookies and similar technologies; and (b) “Accept All Cookies” and “Reject All Cookies” controls of equal visual prominence, together with category-level controls for granular choice. No non-essential technologies are deployed until you have made an affirmative choice within this Preference Centre.
You may grant or withhold consent for each category independently by navigating the categories on the left. The “Reject All Cookies” and “Accept All Cookies” buttons have equal visual prominence — identical dimensions, font weight, and placement — in accordance with the ICO’s guidance prohibiting dark patterns in consent interfaces. No technologies are pre-selected. All non-essential categories default to “off”, in accordance with the CJEU’s ruling in Planet49 GmbH (C-673/17, 1 October 2019) and UK GDPR Recital 32, which together establish that consent must be given by a clear affirmative act, that pre-ticked boxes do not constitute valid consent, and that users must be informed of cookie duration and third-party access. Some cookies may collect data for more than one purpose; where this occurs, the Company will only use such cookies for essential purposes unless you have given consent for the relevant non-essential category.
5. Storage of Preferences, Consent Records, and Accountability
Your preferences will be stored in your browser (via a localStorage record named tnbg_cookie_consent) for thirteen (13) months, the same period as in the Data Retention Schedule, from the date of your most recent selection. This duration aligns with the browser-enforced maximum for first-party cookies in major browsers and is consistent with European regulatory best practice. After expiry, you will be asked to confirm your choices again.
To demonstrate consent under UK GDPR Article 7(1), your choice is stored in your browser together with (a) the date and time of the choice, (b) the version of this Preference Centre in effect at the time, and (c) the categories you accepted or refused. Withdrawing consent overwrites that record. The record expires after thirteen (13) months, when you are asked to choose again. The Company keeps no copy of it on its servers; if a server-side consent log is introduced, this notice will be updated first. The Company reviews the cookies and similar technologies used on this website whenever the website changes, to ensure ongoing accuracy of the inventory below.
6. Withdrawal of Consent
You may withdraw your consent at any time by reopening this Preference Centre via the “Cookie Preferences” link in the footer of every page of this website, adjusting the relevant toggles, and selecting “Save My Preferences”. Withdrawal of consent is as easy as giving it. Pursuant to UK GDPR Article 7(3), withdrawal shall not affect the lawfulness of processing carried out prior to its withdrawal. Upon withdrawal, any non-essential cookies previously set will be actively deleted from your browser, and the corresponding third-party scripts will cease to operate. The Company maintains the technical capability to identify and erase cookie-related personal data held on its servers in response to a data subject access or erasure request (UK GDPR Art. 17).
7. No Pre-Consent Loading and Technical Verification
The Company confirms that no non-essential cookies or similar technologies are deployed on this website until you have made an affirmative choice. All third-party scripts are gated via the consent management JavaScript: scripts are injected into the DOM only after the consent state for the relevant category has been verified. This approach is consistent with the ICO’s enforcement action against Sky Betting & Gaming (September 2024), in which pre-consent cookie deployment was found to breach UK GDPR Articles 5(1)(a), 6(1)(a), and 7(1), and with the ICO’s Top 1,000 Websites Programme (January 2025), under which the ICO reviewed the largest UK websites, communicated concerns to 134 of the top 200, and issued 17 Preliminary Enforcement Notices, achieving over 95% compliance by December 2025. The Company conducts periodic post-deployment verification by: (a) clearing all cookies and storage; (b) loading the website without interacting with the Preference Centre; (c) confirming via browser developer tools that no non-essential cookies or tracking scripts are present; and (d) logging the results. In accordance with UK GDPR Article 25 (Data Protection by Design and by Default), the consent management system operates on a fail-closed, privacy-by-default basis: all non-essential categories default to “off”; if the consent JavaScript fails to load, if localStorage is unavailable (as in certain private browsing modes), or if the tag management system experiences an outage, no non-essential cookies or scripts will be deployed.
8. Nature of This Website
This website is the corporate website of The NeoBankers Group Limited, a non-operating holding company that holds the Group’s intellectual property and directs the development of its projects. The Company does not conduct regulated financial services activity, process financial transactions, or hold client funds through this website. No banking, payment, or financial account data is collected, stored, or accessed by any cookie or similar technology deployed on this website. The cookies described herein serve solely informational and analytical purposes in relation to the corporate website. No cookie or similar technology deployed on this website is used for anti-money laundering, know-your-customer, customer due diligence, or any other regulatory compliance purpose.
9. Children
This website is not directed at persons under the age of 18. The Company does not knowingly collect personal data from children via cookies or similar technologies within the meaning of the UK GDPR or the Age Appropriate Design Code (ICO, 2021).
10. Cookie and Technology Inventory
Each category tab lists every cookie and similar technology currently deployed, including: technical name, vendor/provider, plain-English purpose, first-party or third-party classification, and precise expiry duration. This inventory was last verified on 11 April 2026 and is subject to periodic automated scanning conducted on a quarterly basis. For a current audit, or to exercise any data subject right, please use the Data protection request form. The Company will respond within one calendar month (UK GDPR Art. 12(3)), subject to the stop-the-clock provisions introduced by Section 111 of the DUA Act 2025 (in force 5 February 2026), free of charge for the first copy (Art. 12(5)).
11. Delegation of Authority
The data protection team, or such person as the Board may designate, is authorised to update the technical cookie and technology inventory without further Board approval, provided no new category of processing is introduced and no material change to the scope of data collection occurs. All changes to the cookie inventory shall be documented in an internal change log recording the date, nature of the change, and the person who authorised it. Ultimate accountability for data protection compliance, including cookie compliance, rests with the Board of Directors of The Neobankers Group Limited.
12. Data Protection Impact Assessment
Before any analytical or marketing technology described in this Preference Centre is enabled, a Data Protection Impact Assessment (“DPIA”) pursuant to UK GDPR Article 35 will be carried out in respect of it, addressing: (a) necessity and proportionality of processing; (b) risks to data subjects, including those arising from session replay functionality (which captures full user interactions) and cross-device tracking, both of which fall within the ICO’s Article 35(4) criteria for mandatory DPIAs (invisible processing, behaviour monitoring); (c) measures to mitigate identified risks, including pseudonymisation and data minimisation; and (d) cross-border transfer safeguards. A summary of each DPIA will be available on request from the data protection team.
12A. Recipients of Cookie-Related Data
In addition to the third-party technology providers identified in each category tab, cookie-related personal data may be disclosed to the following categories of recipients where required: (a) the Information Commissioner’s Office and other regulatory or supervisory authorities (including the FCA, FMA, and KNF) in response to lawful requests or investigations; (b) law enforcement agencies pursuant to a court order, statutory obligation, or the prevention or detection of crime; and (c) the Company’s professional advisers and auditors, subject to contractual confidentiality obligations.
13. Data Breach Notification
In the event of a personal data breach involving data collected through these technologies, the Company will comply with UK GDPR Articles 33 and 34, including notification to the ICO within 72 hours where required. The DUA Act’s Section 111 aligned PECR breach notification with the UK GDPR 72-hour timeline (in force since 20 August 2025).
14. Consent Mode Integration
If Google services are enabled in future, the Company will implement Google Consent Mode v2, which communicates your consent choices to Google services (including Google Analytics 4 and Google Ads) in real time via four consent parameters: analytics_storage, ad_storage, ad_user_data, and ad_personalization. These parameters ensure that Google services operate in accordance with your preferences and do not process data for purposes to which you have not consented. Google requires Consent Mode v2 implementation from all advertisers and publishers serving ads to UK and EEA audiences (mandatory from March 2024). Microsoft Clarity supports equivalent consent mode signals and has enforced consent signals for UK/EEA traffic since 31 October 2025; further details are set out in the Analytical and Performance category tab.
15. Legislative Developments (Data (Use and Access) Act 2025)
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its principal amendments to PECR came into force on 5 February 2026 via Commencement No. 6 Regulations (SI 2026/82).
The DUA Act expanded the existing strictly necessary exemption under PECR Regulation 6(4) by adding six illustrative examples of technologies that qualify: (i) ensuring terminal equipment security; (ii) preventing or detecting fraud; (iii) preventing or detecting technical faults; (iv) authenticating users; (v) recording user selections on an online service; and (vi) automatic authentication cookies.
The DUA Act also introduced three new exceptions to PECR’s consent requirement through a new Schedule A1:
Statistical purposes (Schedule A1, Paragraph 5): first-party analytics cookies are exempt from consent provided all four cumulative conditions are met: (i) the sole purpose is collecting aggregate statistical information about website usage to improve the service; (ii) the user receives clear and comprehensive information about this purpose; (iii) the user is provided a simple, free means of objecting (opt-out); and (iv) no secondary purpose (advertising, profiling, or third-party sharing beyond processors) is served by the data.
Appearance and functionality: cookies adapting language, screen size, or display preferences, with information and opt-out.
Emergency assistance: location-determination cookies for emergency services, exempt from both consent and information requirements.
The DUA Act also expanded PECR’s scope to cover organisations that “instigate” the setting of cookies or similar technologies via third parties (Section 112(2)). The maximum penalty under PECR has increased to £17.5 million or 4% of total annual worldwide turnover, whichever is greater, aligning with the UK GDPR penalty regime. The ICO also gained enhanced investigatory powers including compulsory interviews and technical assessments.
16. International Visitors
For visitors from the European Economic Area: the ePrivacy Directive (2002/58/EC) applies; the DUA Act Schedule A1 analytics exemption does not apply; full opt-in consent remains mandatory for all non-essential technologies. The European Commission renewed UK adequacy on 19 December 2025, valid until 27 December 2031, permitting personal data to flow from the EEA to the UK without additional safeguards. For visitors from the Principality of Liechtenstein: the Liechtenstein Data Protection Act (DSG) applies. For visitors from the Republic of Poland: the Polish rules on the storage of, and access to, information in terminal equipment apply. For visitors from Canada: PIPEDA applies to the extent relevant. For visitors from the United States: this website is not directed at persons in the United States, and the Company does not do business in California or in any other US state. The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and comparable state laws (including those of Colorado, Connecticut and New Jersey) therefore do not apply to the Company, and the Company does not display the “Your Privacy Choices” link or icon. The Company does not sell personal data and does not share it for cross-context behavioural advertising. As a matter of good practice, and for all visitors wherever they are: non-essential technologies stay off until you consent; “Reject All Cookies” refuses them; and if your browser sends a Global Privacy Control (GPC) signal, the website treats it as a refusal of marketing technologies, which stay off even if that category was previously accepted.
17. Regulatory Context
The Company is a non-operating holding company and is not itself authorised or regulated by the Financial Conduct Authority or any other financial services regulator. Nothing on this website states or implies that any company of the Group holds a financial services authorisation. This Preference Centre has been designed in accordance with the ICO’s guidance on storage and access technologies: (a) language is clear, fair, and not misleading; (b) the preference management link is accessible from the footer of every page; (c) no dark patterns are employed — Reject All and Accept All buttons have identical visual weight.
18. Accessibility
This Preference Centre is designed to conform to WCAG 2.2 Level AA (W3C, 5 October 2023; ISO/IEC 40500:2025) having regard to the Equality Act 2010. Specific measures include: role=“dialog” and aria-modal=“true” on the modal container; role=“tablist”, role=“tab”, and role=“tabpanel” for tab navigation; aria-checked on toggle switches; aria-live=“polite” on status messages; keyboard operability (Tab, Enter, Space, Escape, arrow keys) with visible focus indicators; compliance with WCAG 2.2 Success Criterion 2.4.11 (Focus Not Obscured) ensuring the cookie interface does not hide focused elements on the underlying page; compliance with Success Criterion 2.5.8 (Target Size — Minimum) with all interactive targets meeting the 24×24 CSS pixel minimum; colour contrast ratios of at least 4.5:1 for text and 3:1 for interactive components (WCAG 1.4.3/1.4.11). An independent accessibility audit will be commissioned prior to production deployment.
19. Browser Cookie Management
In addition to using this Preference Centre, you may manage cookies through your browser settings. Most browsers allow you to block or delete cookies, although this may affect site functionality. For browser-specific instructions, please consult your browser’s help documentation. To opt out of Google Analytics across all websites, you may install the Google Analytics opt-out browser add-on. For industry-wide advertising opt-out: Your Online Choices (EDAA) · DAA Opt-Out.
20. Relationship with Privacy Policy and ROPA
This Preference Centre should be read in conjunction with the Company’s Privacy and Cookie Policy. In the event of inconsistency, the Privacy and Cookie Policy shall prevail. This Preference Centre forms part of the Company’s data protection programme maintained pursuant to UK GDPR Article 30 (Records of Processing Activities). Prior versions of this Preference Centre are available upon request from the data protection team. The ICO’s finalised guidance on storage and access technologies, incorporating the DUA Act 2025 amendments, is expected to be published in Spring 2026; the Company will review and, where necessary, update this Preference Centre promptly upon publication.
21. Severability
If any provision of this Preference Centre is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Version 26/4 · Effective 07 April 2026 · Last amended 11 April 2026 · Adopted by the Board · Board minutes No. 26.17-0803.1 of 3 August 2026 · Next review: April 2027 or sooner upon material change in applicable legislation, ICO guidance, or processing activities.
These cookies and similar technologies are essential for the provision of this website and cannot be disabled. They are deployed in response to actions you have taken which amount to a request for services. This corporate website does not process financial transactions or store financial account data; accordingly, no banking, payment, or credential data is collected by any technology on this website.
Sub-Categories
The Company classifies strictly necessary technologies on this corporate website into the following sub-categories: (a) session management cookies, maintaining your navigation state as you move between pages; (b) security cookies, which detect and prevent malicious activity directed at this website; and (c) consent record-keeping technologies, which store your privacy preferences (the tnbg_cookie_consent localStorage record, which records your consent state, and the tnbg-location localStorage record, which records the country and language you selected in the welcome window).
Legal Basis
PECR Regulation 6(4) — strictly necessary exemption, as expanded by the DUA Act 2025 with six illustrative examples (terminal equipment security, fraud prevention, technical fault detection, user authentication, recording user selections, and automatic authentication). No consent is required for the placement of these cookies. The UK GDPR lawful basis for processing the personal data collected by strictly necessary cookies is Article 6(1)(f) (legitimate interests); the Company documents its Legitimate Interests Assessment, a summary of which is available from the data protection team on request. The Company classifies only the minimum necessary technologies in this category; certain functionality and appearance cookies that may qualify for DUA Act Schedule A1 exemption are conservatively placed in the Functionality category with consent requested.
Tag Management
If enabled, Google Tag Manager (“GTM”) would serve as this website’s tag management system. GTM itself does not set cookies or collect personal data; it is a container through which third-party scripts are conditionally loaded. The Company acknowledges instigator liability (DUA Act, Section 112(2)) for all technologies deployed via GTM. No third-party scripts are injected until the relevant consent category has been confirmed. Where Cloudflare, Inc. is used for content delivery and security, it is certified under the EU-US Data Privacy Framework.
Technologies in This Category
Name
Type
Vendor / Purpose
Duration
tnbg_cookie_consent
1P
The NeoBankers Group — localStorage record storing your consent choices, timestamp, and Preference Centre version (consent proof)
13 months (persistent)
tnbg-location
1P
The NeoBankers Group — localStorage record of the country and language you selected in the welcome window and your answer to the US-person question, so that the window is not shown again and information appropriate to your jurisdiction is presented (strictly necessary). The country is pre-selected from the country associated with your IP address, as reported by the website’s hosting provider, or, where that is not available, from your device’s time zone; where the two differ (for example when a VPN or proxy is in use), no country is pre-selected and you are asked to choose it, and the record notes that they differed; your IP address is not stored in this record or passed to any other party for this purpose
13 months (persistent)
__cf_bm
1P
Cloudflare, Inc. — only if the website is served through Cloudflare: bot management, distinguishes humans from automated traffic (security)
30 minutes
cf_clearance
1P
Cloudflare, Inc. — only if the website is served through Cloudflare: records successful completion of a security challenge (security)
Up to 12 months
Analytical and Performance Cookies
Purpose
These cookies enable the Company to measure and analyse website traffic, user behaviour patterns, and page performance. The data collected is aggregated and pseudonymised (not anonymised, as device identifiers and truncated IP addresses may constitute personal data). No automated decision-making or profiling within the meaning of UK GDPR Article 22 is carried out. Analytics data supports the Company’s ability to monitor the effectiveness and accessibility of its corporate website. Microsoft Clarity additionally provides session replay and heatmap functionality, which captures full user interactions including page scrolling, click patterns, and form field interactions (but not keystrokes). If Clarity is enabled, it will be configured to mask sensitive input fields. Session replay recordings are stored on Microsoft Azure infrastructure in the United States for a default retention period of 30 days, after which they are automatically deleted.
DUA Act Schedule A1 Exemption Assessment
The Company notes that certain first-party analytics cookies may qualify for the statistical-purposes exemption under PECR Schedule A1, Paragraph 5 (inserted by the DUA Act 2025). This exemption requires all four cumulative conditions to be met: (i) sole purpose is aggregate statistical information for service improvement; (ii) clear and comprehensive information provided to users; (iii) simple, free opt-out mechanism provided; (iv) no secondary use for advertising, profiling, or third-party sharing. The Company has elected to continue seeking your consent for all analytical cookies as a conservative compliance measure, and to maintain consistent treatment across UK and EU/EEA jurisdictions where the exemption does not apply.
Data Elements Collected
Truncated IP address, browser type, operating system, device type, screen resolution, referral source, pages visited, duration, click interactions, and scroll depth. No directly identifying information (name, email) is collected.
Legal Basis
Consent, UK GDPR Article 6(1)(a). Withdrawal: Article 7(3). Cookies deleted and scripts cease upon withdrawal.
Third-Party Providers and International Transfers
Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework and its UK Extension (UK-US Data Bridge, SI 2023/1028, in force 12 October 2023). Standard data processing terms accepted per UK GDPR Article 28. Transfer safeguards: UK International Data Transfer Agreement (IDTA) under Section 119A DPA 2018 and/or UK Addendum to EU SCCs (Art. 46(2)(c)), supplemented by adequacy decisions (Art. 45). Transfer Risk Assessment conducted. Sub-processor lists are maintained and published by Google and Microsoft respectively.
Google Analytics Data Sharing Configuration
The Company has disabled Google’s optional data sharing settings for benchmarking, technical support, account specialists, and Google products & services improvement, ensuring that analytics data collected on this website is not used by Google LLC for its own purposes. This configuration is necessary to maintain the Company’s position that Google acts as a data processor (UK GDPR Art. 28) rather than a joint controller.
Server-Side Data Retention
Beyond client-side cookie duration, the following server-side retention periods would apply if the relevant technology were enabled: Google Analytics 4 — user-level and event-level data retained for 2 months (the shortest setting available), after which it is automatically deleted from Google’s servers; aggregated reporting data may persist indefinitely. Microsoft Clarity — session replay and heatmap data retained for 30 days.
Cookies in This Category
Name
Type
Vendor / Purpose
Duration
_ga
1P
Google LLC — GA4, pseudonymous client identifier (persistent)
2 years (vendor default; ~13 months browser-enforced in Chrome)
_ga_*
1P
Google LLC — GA4, session state and engagement metrics; GS2 format since May 2025 (persistent)
2 years (vendor default; ~13 months browser-enforced)
_gid
1P
Google LLC — GA4, distinguishes users for 24-hour analytics aggregation
24 hours
_gat
1P
Google LLC — GA4, request rate limiting (throttle)
1 minute
_clck
1P
Microsoft Corporation — Clarity, pseudonymous user ID for heatmaps and session replay (persistent)
12 months
_clsk
1P
Microsoft Corporation — Clarity, session-level page view aggregation (session)
Session
MUID
3P
Microsoft Corporation — Clarity/Bing, cross-site user identification (bing.com)
12 months
CLID
3P
Microsoft Corporation — Clarity, cross-site session linking (c.bing.com)
12 months
ANONCHK
3P
Microsoft Corporation — Clarity, session integrity check (c.bing.com)
These cookies enable enhanced functionality and personalisation, such as remembering your language preferences, region, display settings, accessibility preferences (large font, high contrast), and other choices you have made during previous visits.
DUA Act Schedule A1 Note
Appearance and functionality cookies may qualify for the new exemption under PECR Schedule A1. This exemption does not apply in EU/EEA jurisdictions. The Company requests consent across all jurisdictions per ICO conservative guidance.
Legal Basis
Consent, UK GDPR Article 6(1)(a). Withdrawal: Art. 7(3). Cookies deleted upon withdrawal. Refusing these cookies may require you to re-select preferences on each visit; core operation and security are not affected.
Cookies in This Category
Name
Type
Vendor / Purpose
Duration
lang
1P
The Neobankers Group — stores selected language preference (persistent)
12 months
region
1P
The Neobankers Group — stores selected regional settings (persistent)
12 months
Last verified: 11 April 2026
Marketing and Advertising Cookies
Purpose
These cookies may be set by third-party advertising partners to build a profile of your interests and display relevant advertisements on other platforms. They do not directly store personal data in the traditional sense, but are based on the unique identification of your browser and device. The Company does not sell your personal data.
Profiling
No automated decision-making or profiling producing legal or similarly significant effects (UK GDPR Art. 22) is carried out by the Company.
Joint Controllership
The Company may act as joint controller with certain providers in respect of initial data collection (UK GDPR Art. 26). Standard DPA terms and joint controller terms accepted (Art. 26/28). The essence of each arrangement is available from the data protection team upon request.
International Transfers
Google LLC, Meta Platforms Inc., and LinkedIn Corporation are certified under EU-US DPF and UK Extension (UK-US Data Bridge, SI 2023/1028). Transfer safeguards: UK IDTA under Section 119A DPA 2018 and/or UK Addendum to EU SCCs (Art. 46(2)(c)), supplemented by adequacy decisions (Art. 45). Transfer Risk Assessment conducted. Data is processed primarily in the United States. Sub-processor lists are maintained by each provider: Google, Meta, LinkedIn.
Legal Basis
Consent, UK GDPR Art. 6(1)(a). Withdrawal: Art. 7(3). Cookies deleted, scripts cease. Refusing these cookies means you will not receive targeted advertising from this website; it does not reduce the overall number of advertisements you see. The Company does not deploy server-side tracking via Meta Conversions API (CAPI) or equivalent server-to-server data transmission mechanisms that would bypass client-side consent controls.
Cookies in This Category
Name
Type
Vendor / Purpose
Duration
li_sugr
3P
LinkedIn Corporation — Insight Tag, member identification for ad targeting and conversion analytics (persistent). Note: not set for users in EEA/Designated Countries.
3 months
li_fat_id
1P
LinkedIn Corporation — Insight Tag, first-party member identification for environments blocking third-party cookies (persistent)
30 days
_fbp
1P
Meta Platforms, Inc. — Pixel, tracks user activity for advertising campaign measurement (persistent)
3 months
_fbc
1P
Meta Platforms, Inc. — Pixel, click attribution linking ad interactions to website activity (persistent)
3 months
fr
3P
Meta Platforms, Inc. — advertising targeting and measurement (facebook.com; blocked by Safari ITP and Firefox ETP)
3 months
_gcl_au
1P
Google LLC — Ads, links website interaction to conversion events for attribution (persistent)
3 months
_gcl_aw
1P
Google LLC — Ads, stores Google Ads click identifier for conversion tracking (persistent)
3 months
_gcl_dc
1P
Google LLC — Ads, stores DoubleClick/Display click identifier (persistent)
3 months
IDE
3P
Google LLC — DoubleClick, advertising targeting across Google ad network (doubleclick.net)
26/4 · Effective 7 April 2026 · Last amended 11 April 2026 · Adopted by the Board · Board minutes No. 26.17-0803.1 of 3 August 2026 · Next review: April 2027 or sooner upon material change in applicable legislation, ICO guidance, or processing activities.
Data Controller
The NeoBankers Group Limited, Co. 13821747, 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Registered in England and Wales.
Access (Art. 15), rectification (16), erasure (17), restriction (18), notification (19), portability (20), objection (21). Response within one calendar month (Art. 12(3)), subject to stop-the-clock provisions (DUA Act 2025, s.111), free of charge (Art. 12(5)).
Welcome to The NeoBankers Group
Please confirm your country of residence so that we can present information appropriate to your jurisdiction.
We could not reliably determine your location, for example because a VPN or proxy is in use. Please select your country of residence to continue.
The Group does not provide services to persons resident in this jurisdiction.
Please confirm the statement above to continue.
This website is not intended for residents of the United States or US Persons (as defined in Regulation S under the US Securities Act of 1933). If you are such a person, you are not authorised to proceed and must leave the website.
This is the corporate website of The NeoBankers Group Limited, a holding company incorporated in England and Wales. It is provided for information only and does not constitute an offer, a solicitation or a financial promotion in any jurisdiction. The Group does not provide regulated services through this website. Any such service would be provided only by an entity holding the required authorisation, under its own terms, and may not be available in your jurisdiction.
Oleg Pinchuk · Without Unnecessary Words, 2002 · bronze, h 14 in, 9 castings