This notice is also available in Malay, Bahasa Indonesia and French.

This privacy notice explains the ‘what’, the ‘why’ and the ‘how’ of our personal data processing when you visit our website or sign-up for and use our products and services. It also tells you how to exercise the rights available to you and who to contact if you have any questions about how we process personal data concerning you. Please read it carefully.

This notice is reviewed regularly and may be updated. We will ensure the most up to date version of this notice is published here.

Navigating this privacy notice

Click on one of these links to jump to the section explaining:

• What personal data we obtain
• Why we use personal data
• Who we share it with
• What your rights are and how to exercise them
• How to contact us

Our relationship with you

To check which Luno entity you are a customer of, refer to our Terms of Use page. The Luno entity that offers and provides our services is the company that is responsible for protecting personal data. Depending on where you are located, the company with that responsibility will typically be known as the “data controller” or the “responsible party.”

The personal data that we process

The personal data that we process will depend on our relationship with you: the information we collect about you as our customer will differ from the information we obtain about you if you are still being verified as a customer or are just visiting our website. You can find out more about the different account levels at Luno in our Help Centre.

The personal data that you provide us

We obtain personal data from you in various ways, including when you sign-up with us (for example, by filling in forms and submitting documents to open an account online or through the app), when you use your Luno account, when you contact us for any reason by email, chat or social media chat, when we contact you to confirm information or instructions (for example when we call you on your mobile number), when you respond to surveys or give us feedback and when you participate in a competition or engage with us on social media or participate in campaigns and promotions.

The personal data that is collected automatically

Certain information is collected automatically when you use our services, for example when you use our app or visit our website.

The personal data we may obtain from other parties

We also obtain personal data from other companies in the course of providing our products and services to you and for managing our business and operations.

Sensitive personal data

We may be required to collect personal data that is considered sensitive or is classed as “special category” personal data. Sensitive personal data usually requires added protections under local law. We will only process sensitive personal data for limited purposes and when permitted by local law.

We may process the following categories of sensitive or “special categories” of personal data:

• Biometric data (see the section “Biometric data” below)
• Personal data concerning criminal convictions and offences

Where we obtain sensitive personal data about you for carrying out KYC and AML screening we typically do so because it is necessary for reasons of substantial public interest under relevant regional and local anti-money laundering and anti-financial crime laws.

Biometric data

We need to verify your identity before you may open an account with Luno, update your security-related information (such as your email address, password, etc.) or recover your account or password. To verify your identity, we will ask you to take a photo or video selfie which we’ll compare with the photo on your chosen identity document (e.g., your passport or national ID book or card) to see if they match. The information collected from your selfie includes biometric data, which we process to comply with strict know your customer and anti-money laundering screening requirements. We do this because it is necessary for reasons of substantial public interest under relevant regional and local anti-money laundering and anti-financial crime laws and regulations. Where required by local law, we will also ask for your consent to collect and use biometric data.

For more information on the service providers we use please see the “Who we share personal data with and why” section below.

Biometric data is securely held by our third party service providers for a period of no longer than 1 year from the time you cease to be a customer of Luno unless special circumstances apply and we instruct them to hold it for longer where we are required by law to do so.

If you refuse, or fail, to provide personal data

You will not be able to access and use our services if you fail or refuse to provide personal data that we are obliged to collect by law or that is needed to enter into and perform under our Terms of Use.

Why we use personal data

This section explains why we use personal data and the legal bases we rely on to use it. In most cases we use personal data because we need it to enter into and perform under our Terms of Use, to pursue our legitimate interests or those of third parties and to comply with our legal obligations. We may also ask for your consent before using certain personal data, including if the law of your country of residence does not recognise one or more of these legal bases.

Personal data needed to enter into and perform our contract with you

It is necessary for us to process personal data to enter into and perform under contracts we have with you, in particular our Terms of Use. For example, we need to review your application for an account, open your account to enable you to transact on the Luno platform and provide support to you when you need it. We won’t be able to provide our services to you if we cannot process personal data on this basis.

Personal data needed to pursue our legitimate interests

We may process personal data for our legitimate interests, such as in running and growing our business and improving our products and services. If the law of your country does not recognise the legitimate interest ground then we process personal data for the reasons set out in the table below based on your acceptance of this Privacy Notice and your continued use of our services.

To comply with our legal obligations

All of the countries we operate in have laws and regulations that require us to process personal data in order to comply with them. For example, we have legal and regulatory obligations to detect, investigate and prevent financial crimes like fraud, money-laundering, terrorist financing, proliferation financing and circumvention of sanctions. If you fail to provide personal data that we need to meet our legal obligations we can’t provide products and services to you.

When we ask for your consent to process personal data

Depending on where you are located you may have the right to withdraw your consent to our processing of personal data for the reasons below. You always have control over your device permissions and in-app settings. If you do withdraw your consent we will stop processing personal data relating to you, however prior processing will not be affected. We may also ask you to consent to processing when local law does not recognise the legal bases above.

To protect your vital interests or the vital interests of others

We might have to use and share personal data where strictly necessary to respond to emergencies.

Automated Decisions

Our onboarding procedure is partially automated and we may make decisions regarding your eligibility as a customer by automated means. This means that we use technology to decide whether to accept you or refuse to onboard you as a customer. If we do not have enough information for the technology to make a decision on your eligibility, we will ask you to re-upload your documentation or a member of our Customer Success team will be in touch with you. If the automated procedure determines that you are underage, do not meet our acceptance criteria or are found to be violating our Terms of Use, your application will be automatically denied.

You always have the option to start the sign-up process again if you are rejected, or can reach out to our Customer Success team if you have any questions.

Marketing

We may send you information about our products, services, news and promotions, or otherwise communicate with you, by email, push or in-app notifications, text message or other means for marketing purposes. When we communicate with you for marketing purposes we will do so only in accordance with applicable laws relating to consent and opt-outs.

You may opt out of receiving marketing communications at any time by clicking on the “Unsubscribe” option included in every marketing communication sent to you. You can also manage your communications preferences in your account communications settings in our app or on our website. Please note that unsubscribing from marketing content will not stop you from receiving important communications in relation to the security or operation of your account or the Luno product (for example when we need to inform you of upcoming maintenance, changes to our Terms of Use, in the event of a security incident, etc.).

Cookies and similar technologies

You can adjust your cookie preferences online when you visit our website or by adjusting the settings on your browser. Please see our cookie policy for more information about the cookies we use.

Who we share personal data with and why

Luno engages third party service providers and works with partners and other third parties to provide our products and services to you. This requires us to share or give access to personal data to these parties for certain reasons.

How long we keep personal data for

We will typically retain personal data for the duration of your relationship with us, and afterwards for such period as may be necessary for our legitimate business purposes (including compliance with our legal obligations, preventing fraud, resolving disputes and enforcing agreements), to protect the integrity of our services, to protect the safety and security of our customers and to comply with the law.

International transfers of personal data

Luno is a global organisation and, in the course of providing our products and services to you, personal data may be transferred to, and processed in, countries other than the country in which you are located. Those countries may have data protection laws that provide a level of protection which is lower than that available in your country. For example, personal data will be processed by Luno companies in various jurisdictions and by our third parties who operate around the world. We will only transfer personal data where permitted by local law and with appropriate safeguards such as standard contractual clauses.

Keeping personal data secure

Luno places great importance on ensuring the security of our systems and personal data. We maintain an ISO 27001 certification, which requires us to implement and regularly review appropriate and reasonable technical and organisational security measures to keep personal data safe. Our employees are trained to handle personal data securely and with the utmost respect, failing which they may be subject to disciplinary action. For more information on Luno’s security processes please visit the security page on our website.

Your rights

Depending on the applicable law and the reason for the processing, you may be entitled to exercise the following rights:

• Ask us to give you access to personal data.

  This right entitles you to receive confirmation that we process personal data relating to you and you may sometimes also be able to request a copy of the personal data.

• Ask to have personal data erased.

  This right entitles you to ask us to delete or remove personal data concerning you. Please note that we may not be able to comply with your request either in whole or in part because of certain legal reasons. To the extent that we can’t comply with your request we will get in touch with you to give you the reasons for our decision.

• Object to our processing of personal data.

  Where we process personal data based on our legitimate interests but you believe there are circumstances that mean we shouldn’t, you may submit an objection; however there may be times when we can demonstrate legitimate grounds that override your objection. If we believe we have legitimate grounds to override your objection we will be in touch with you to give you the reasons for our decision. You may also object to our processing for the purpose of sending you direct marketing communications.

• Ask for processing to be restricted.

  If you are unsure about the accuracy of the personal data we are processing relating to you or you think we shouldn’t be processing it or our reason for processing is unclear, you may ask us to restrict the processing.

• Ask for personal data to be corrected or updated.

  You may ask us to update any inaccurate or out of date record. Remember that you can always update your details on your Luno profile online or in the app, or by contacting us by email or chat.

• Ask us to transfer (or “port”) personal data to you or to a third party.

  In limited circumstances, you may ask us to transmit to you or to another company personal data that you have provided to us in a structured, commonly used and machine readable format.

• Make a complaint to a supervisory authority.

  You may have the right under local law to complain to the local supervisory authority in your country.

Luno will honour these rights to the extent required by law. You may exercise your rights by submitting a request or by emailing us at privacy@luno.com.

Personal data of children

You must be 18 years or older to open a Luno account. Our products and services are directed at adults aged 18 years and over, and are not intended for individuals under 18 years old. Luno will not knowingly request to collect personal data from individuals under the age of 18 and we make all efforts to comply with applicable local legal requirements regarding children’s personal data.

How to contact us

Should you have a query in relation to this Privacy Notice or about how we handle personal data, please submit a support ticket or send an email to privacy@12do.net