1. ABOUT US
1.1This Privacy Notice is issued by Keystones Partners Limited (company number 13790130), trading as KEYSPX, with its registered office at 154 Bishopsgate, Fourth Floor, London EC2M 4LN, United Kingdom ("Keystones", "we", "us" or "our").
1.2We are a cross-border payment facilitation and foreign exchange services provider. We act as controller in respect of the personal data described in this Notice, meaning we determine how and why your personal data is processed.
1.3We operate as part of the Keystones group, which includes entities in the United Kingdom, the United States and other jurisdictions. Where we refer to the Keystones group in this Notice, we mean Keystones Partners Limited and its affiliated entities. Keystones Partners Limited is registered with HM Revenue & Customs for supervision under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (registration number 13790130). The group’s U.S. money services business is registered with the Financial Crimes Enforcement Network ("FinCEN") (registration number 31000279438382) and with the Financial Transactions and Reports Analysis Centre of Canada ("FINTRAC") (registration number N300000412).
2. WHAT THIS NOTICE COVERS
2.1This Notice explains how we collect, use, share, store and protect the personal data of: our clients and prospective clients; the directors, beneficial owners, authorised users and representatives of our client organisations; the beneficiaries of payments we facilitate; and visitors to our website and Platform.
2.2This Notice applies to personal data we collect directly from you, personal data we receive from your organisation, and personal data we obtain from third-party sources such as identity verification providers, screening databases, sanctions lists and publicly available registers.
2.3This Notice should be read alongside our Terms of Business and, where applicable, the Data Processing Agreement between us and your organisation.
3. INFORMATION WE COLLECT
We collect and process the following categories of personal data, depending on your relationship with us:
3.1Identity and verification data. Full name, date of birth, nationality, photograph, copies of government-issued identification documents (passport, national identity card, driving licence), proof of address, and any additional documentation required for identity verification or enhanced due diligence.
3.2Contact data. Email address, telephone number, postal address, and business address.
3.3Corporate and ownership data. Your role within the client organisation, directorship details, beneficial ownership information, shareholder structure, corporate registration documents, and any information relating to politically exposed person status.
3.4Financial and transaction data. Bank account details, payment instructions, transaction history, source of funds information, source of wealth documentation, currency and amounts, beneficiary details, and settlement records.
3.5Compliance and screening data. Results of sanctions screening, PEP screening, adverse media screening, and identity verification checks; risk assessments; due diligence records; and any information obtained in connection with ongoing monitoring or transaction review.
3.6Platform and technical data. Login credentials (excluding passwords, which are stored in hashed form only), IP address, browser type, device information, access timestamps, and activity logs when you use our Platform.
3.7Communication data. Records of correspondence between us, including emails, messages, telephone call recordings (where applicable), and notes of meetings or conversations.
4. HOW AND WHY WE USE YOUR INFORMATION
We process your personal data only where we have a lawful basis under the UK General Data Protection Regulation (UK GDPR). The paragraphs below set out our processing purposes and the legal basis for each.
4.1Client onboarding and due diligence. We use your identity, contact, corporate and financial data to carry out customer due diligence, verify your identity, assess risk, and determine whether we can provide services to you. Legal basis: Legal obligation (anti-money laundering and counter-terrorist financing regulations); legitimate interest (assessing business risk).
4.2Providing our services. We use your financial and transaction data, contact data and Platform data to execute and settle Transactions, issue Quotations and Confirmations, manage your account, and communicate with you about your Transactions. Legal basis: Performance of our contract with you (the Terms of Business).
4.3Sanctions screening and ongoing monitoring. We use your identity, corporate and transaction data to screen against sanctions lists, PEP databases and adverse media sources, and to carry out ongoing monitoring of your transactions for suspicious activity. Legal basis: Legal obligation (UK MLR 2017, U.S. Bank Secrecy Act, OFAC sanctions requirements, and the Canadian Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA)).
4.4Regulatory reporting. We may be required to disclose your personal data to regulatory authorities, law enforcement agencies or financial intelligence units in connection with suspicious activity reports or other mandatory filings. Legal basis: Legal obligation.
4.5Fraud prevention and security. We use your Platform data, communication data and transaction data to detect, prevent and investigate fraud, unauthorised access and security incidents. Legal basis: Legitimate interest (protecting our business, our clients and the integrity of the financial system).
4.6Record keeping. We retain your personal data for the periods required by law and for our legitimate business purposes, as set out in Section 7. Legal basis: Legal obligation; legitimate interest (maintaining records for regulatory inspection, audit and dispute resolution).
4.7Communication and relationship management. We use your contact data to communicate with you about our services, provide updates, respond to enquiries and manage our business relationship. Legal basis: Legitimate interest (maintaining client relationships); performance of contract.
4.8Legal claims. We may process your personal data in connection with the establishment, exercise or defence of legal claims. Legal basis: Legitimate interest (protecting our legal rights).
5. WHO WE SHARE YOUR INFORMATION WITH
We do not sell your personal data. We share your personal data only with the following categories of recipients, and only to the extent necessary for the purposes set out in this Notice:
5.1Keystones group entities. We share personal data with other entities within the Keystones group where necessary for the provision of services, compliance, treasury operations and internal administration.
5.2Banking and payment partners. We share transaction and beneficiary data with our correspondent banks, intermediary banks and payment service providers to execute and settle Transactions.
5.3Identity verification and screening providers. We share identity data with third-party KYC, identity verification, sanctions screening and adverse media screening providers.
5.4Regulators and authorities. We disclose personal data to regulatory authorities, law enforcement agencies, financial intelligence units, tax authorities and courts where required by law or in response to a lawful request.
5.5Professional advisers. We share personal data with our legal, accounting and compliance advisers where necessary for the provision of professional advice.
5.6Technology providers. We use cloud-based platforms and technology services to store and process data. Our primary platform is Google Workspace. All technology providers used for the storage or processing of personal data are subject to appropriate contractual protections.
5.7Business transfers. In the event of a merger, acquisition, reorganisation or sale of all or part of our business or assets, your personal data may be transferred to the successor entity as part of that transaction. We will notify you of any such transfer and of any changes to the controller of your data.
5.8We require all third parties who receive personal data from us to process it only in accordance with our instructions and applicable data protection law, and to implement appropriate security measures.
6. INTERNATIONAL TRANSFERS
6.1The nature of our business means that your personal data may be transferred to, stored in, or accessed from countries outside the United Kingdom, including the United States, Cameroon, Côte d’Ivoire and other jurisdictions in which Keystones group entities, banking partners or service providers operate.
6.2Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including: transfers to countries recognised by the UK Secretary of State as providing an adequate level of protection; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as issued by the UK Information Commissioner’s Office; or other appropriate safeguards recognised under UK data protection law.
6.3Where we rely on standard contractual clauses, we carry out a transfer impact assessment where required and implement supplementary measures where necessary to ensure the transferred data receives a level of protection substantially equivalent to that provided under UK law.
6.4You may request further information about the safeguards we apply to international transfers by contacting us using the details in Section 12.
7. HOW LONG WE KEEP YOUR INFORMATION
7.1We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to establish, exercise or defend legal claims.
7.2As a money services group subject to anti-money laundering regulation in the United Kingdom (HMRC supervision under the MLR 2017), the United States (FinCEN) and Canada (FINTRAC), we are required by law to retain certain records for minimum periods. In general: client identity and due diligence records are retained for at least five years from the end of the client relationship; transaction records are retained for at least five years from the date of the transaction; and regulatory correspondence and filing records are retained for the periods required by the applicable authority.
7.3At the end of the applicable retention period, personal data is securely deleted or anonymised, unless a legal hold or other legal obligation requires further retention.
7.4We do not retain personal data indefinitely as a default. Retention beyond the applicable period requires documented justification.
8. HOW WE PROTECT YOUR INFORMATION
8.1We take the security of your personal data seriously and apply technical and organisational measures appropriate to the sensitivity of the data and the risks involved. These include: access controls limiting access to personal data to authorised personnel with a business need; multi-factor authentication on all systems holding personal data; encryption of personal data in transit; secure cloud-based storage with access logging; and regular review of access permissions and security settings.
8.2We operate an information security framework that is reviewed annually. Our staff receive security awareness training at induction and on an ongoing basis.
8.3In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UK Information Commissioner’s Office within 72 hours of becoming aware of the breach, and will notify you directly where required by law.
9. YOUR RIGHTS
Under UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to legal exceptions, particularly where we are required by law to retain or process your data for regulatory compliance purposes.
9.1Access. You have the right to request a copy of the personal data we hold about you and information about how we process it.
9.2Rectification. You have the right to ask us to correct personal data that is inaccurate or incomplete.
9.3Erasure. You have the right to ask us to delete your personal data in certain circumstances. This right is limited where we are required by law to retain data, for example under anti-money laundering regulations.
9.4Restriction. You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged.
9.5Portability. Where we process your personal data on the basis of consent or performance of a contract, and by automated means, you have the right to receive your data in a structured, commonly used and machine-readable format.
9.6Objection. You have the right to object to processing based on our legitimate interests. Where you object, we will assess whether our interests override your rights.
9.7Withdrawal of consent. Where we process your personal data on the basis of consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
9.8Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Our compliance screening processes involve automated tools, but all results are reviewed by a member of our team before any decision is made.
9.9To exercise any of these rights, contact us using the details in Section 12. We will respond to your request within one month. Where a request is complex or we receive a high volume of requests, we may extend this period by up to two additional months, and will inform you of any extension.
9.10If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk.
10. COOKIES AND THE PLATFORM
10.1Our Platform uses cookies and similar technologies to maintain your session, authenticate your identity, remember your preferences and ensure the security of your access. These cookies are strictly necessary for the operation of the Platform and do not require your consent.
10.2We do not use advertising cookies, tracking cookies or analytics cookies that profile your behaviour across other websites.
10.3If we introduce non-essential cookies in the future, we will update this Notice and obtain your consent before placing them.
11. CHANGES TO THIS NOTICE
11.1We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal requirements or business operations. Where we make material changes, we will notify you by email or through the Platform.
11.2The current version of this Notice is always available on our website and through the Platform.
12. CONTACT US
12.1If you have any questions about this Privacy Notice, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us: Keystones Partners Limited 154 Bishopsgate, Fourth Floor London EC2M 4LN United Kingdom Email: compliance@keystones-partners.com
12.2We aim to resolve any concern you raise promptly and fairly. If you are not satisfied with our response, you have the right to complain to the ICO.