Revolut

Revolut is a British financial technology company that offers banking services.

4.2/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes, but you may opt-out

4/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.

Score

Yes, by contacting someone

60%

Yes, using an automated mechanism

100%

N/A

The service doesn't collect any personal information.

100%

Citation

You can ask us to delete your personal information if:
✓ there's no good reason for us to continue using it;
✓ you gave us consent (permission) to use the information and you have now withdrawn that consent;
✓ you have objected to us using the information;
✓ we have used the information unlawfully; or
✓ the law requires us to delete the information.
Just to let you know, we may not be able to agree to your request. As a firm authorised by the Financial Conduct Authority, we must keep certain customer information for at least six years (we've explained this in more detail below). If you've closed your Revolut account, we may not be able to delete your entire file because these regulatory responsibilities take priority. We will always let you know if we can't delete your information.

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

We share your personal information within the Revolut group of companies in order to provide you with the best service.

For example, we may share your information with Revolut Travel Ltd, in order to provide you with insurance mediation services (for example when we offer overseas medical insurance as part of a Premium or Metal plan).

Suppliers who provide us with IT, payment and delivery services: To help us provide our services to you

Our banking and financial-services partners and payments networks, including Visa and Mastercard: To help us provide our services to you this includes banking and lending partners, banking intermediaries and international payment-service providers

Card manufacturing, personalisation and delivery companies: To create and deliver your personalised Revolut Card

Advertisers: To promote our services. (We provide anonymous information only for example, ‘500 men under 30 clicked on their advert’.)

Analytics providers and search information providers: To help us improve our website or app

Customer-service providers, survey providers and developers: To help us to provide our services to you

Communications services providers: To help us send you emails, push notifications and text messages

Credit-reference and fraud-prevention agencies: To help us develop and offer credit products to you, and to check your identity and your eligibility for credit products.

To help us develop and offer credit products to you, and to check your identity and your eligibility for credit products.

We will only share your personal information in this way if you have asked for the relevant service. You can withdraw your permission at any time by contacting us through the Revolut app. However, this may affect your ability to continue to use those services.

From time to time we may work with other partners to offer you co-branded services or promotional offers, and we will share some of your personal information with those partners. We will always get your consent before sharing your information for these purposes. You can withdraw your consent at any time by contacting us through the Revolut app.

Our partners will have their own privacy notice explaining how they use your personal information. It's important that you read those privacy notices as well.

If you apply for a credit product, we'll share your personal information with credit-reference agencies to check whether you are likely to make repayments when due.

We also share your personal information with fraud-prevention agencies to check your identity, protect against fraud, keep to anti-money-laundering laws and confirm that you are eligible to use our products and services.

If fraud is detected, you could be refused certain services, finance or employment. You can contact us through the Revolut app to ask for more details of how your information will be used by us and these fraud-prevention agencies.

We may also need to share your personal information with other third-party organisations:

if we have to do so under any law or regulation;
if we sell our business;
in connection with criminal or fraud investigations;
to enforce our rights (and those of customers or others); or
in connection with legal claims.

When we use social media for marketing purposes, your information may be shared with the social-media platforms so that they can check if you also hold an account with them. If you do, we may ask the advertising partner or social-media provider to:

use your information to send our adverts to you, because we think that you might be interested in a new Revolut product or service;
not send you our adverts, because the marketing relates to a service that you already use; or
send our adverts to people who have a similar profile to you (for example, if one of our services is particularly useful to people with similar interests to the ones on your social-media profile, we may ask our advertising partner or social-media partner to send our adverts for that service to those people).
An example of how we may use social media for marketing purposes is through Facebook’s ‘Custom Audience’ tool, the terms of which are available here.

The legal basis would be the following.

Legitimate interests
You can contact us as at any time, either through the Revolut app or by emailing dpo@revolut.com, if you do not want us to share your personal information for marketing purposes. Remember you can also manage your marketing preferences directly with any social-media provider that you have an account with.

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

We may also need to share your personal information with other third-party organisations:

Transparency

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We store your information on our secure servers.

Any payment transactions carried out by us or our payment-processing providers will be encrypted using Secured Sockets Layer technology or a secure virtual private network.

If you use a password for the Revolut app or our website, you will need to keep this password confidential. Please do not share it with anyone.

Unfortunately, providing information online is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee that all information you provide through the Revolut app or our website will be secure. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

When you use our services, which include social networking, chat room or forum features, do not share any personal information that you don't want to be seen, collected or used by other users, as this information will become publicly available.

Notes

A slightly more in-depth security whitepaper is found at https://www.revolut.com/security

Is the policy's history made available? No

0/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? No

0/5

Collection

Does the service collect personal data from third parties? Yes, but for critical data only

7/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, but only for some non-critical data/uses

3/10

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

We collect different types of information from you and others
The table below explains what personal information we collect and use.

We collect information you provide when you:
✓ fill in any forms;
✓ correspond with us;
✓ register to use the Revolut app;
✓ open an account or use any of our services;
✓ take part in online discussions, surveys or promotions;
✓ speak with a member of our customer support team (either on the phone or through the Revolut app);
✓ enter a competition; or
✓ contact us for other reasons.
We will collect the following information.
✓ Your name, address, and date of birth.
✓ Your email address, phone number and details of the device you use (for example, your phone, computer or tablet).
✓ Your username, password and other registration information.
✓ Details of your bank account, including the account number, sort code and IBAN.
✓ Details of your debit cards and credit cards, including the card number, expiry date and CVC (the last three digits of the number on the back of the card).
✓ Identification documents (for example, your passport or driving licence number), copies of any documents you have provided for identification purposes, a personal description (if you provide one), and any other information you provide to prove you are eligible to use our services.
✓ Records of our discussions, if you contact us or we contact you.
✓ Your photo (only if you upload one).

Whenever you use our website or the Revolut app, we collect the following information:
✓ Technical information, including the internet protocol (IP) address used to connect your computer to the internet, your log-in information, the browser type and version, the time-zone setting, the operating system and platform, the type of device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your mobile operating system, the type of mobile browser you use and so on.
✓ Information about your visit, including the links you have clicked on, through and from our site (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page.
✓ Information on transactions (for example, payments into and out of your account), including the date, time, amount, currencies, exchange rate, beneficiary details, details of the merchant or ATMs associated with the transaction, IP address of sender and receiver, sender's and receiver's name and registration information, messages sent or received with the payment, details of device used to arrange the payment and the payment method used.
✓ Information stored on your device, including if you give us access to contact information from your address book, log-in information, photos, videos or other digital content, check-ins (sometimes, we call this content information). The Revolut app will regularly collect this information in order to stay up to date.

If you have location services in the Revolut app switched on, we track your location using GPS technology and your IP address.

We collect information from third parties, such as credit-reference agencies, fraud-prevention agencies and partners who help us to provide our services.
This includes your credit record, information to help us check your identity, and information relating to your transactions.

If you allow us to, we will collect information such as friends lists from Facebook or similar information from other online accounts. If you've asked us to, we'll use your Facebook profile to confirm your identity as part of our know-your-client (KYC) process (the process of how we check who you are).

Last Updated

December 7, 2020

Sources

Source #1 ↗

Contributors

doamatto, milesmcc