- which Luno entity controls your data;
- how we collect, process and share your personal data;
- the important security measures we maintain to secure your personal data;
- what rights you have in respect of the personal data we hold on you; and
- why and how we retain your personal data.
Our relationship with you
Depending on which country or region you have verified your Luno account in, you may be a customer of a specific Luno entity. References in this Policy to “Luno”, “we”, “us”, “our” or any similar term is to the relevant Luno entity you are a customer of. Here is a table which provides the information on which Luno entity who have contracted with:
|Country/region||The Luno entity you are a customer of||Registered address|
|Singapore All EU countries United Kingdom||Luno Pte Ltd (2012 0954 5R), incorporated in Singapore||5 Shenton Way, #10-01 UIC Building, Singapore (068808)|
|Australia||Luno Australia (Pty) Ltd (631 915 476), incorporated in Australia||Level 12, 225 George Street, Sydney, New South Wales, Australia, 2000|
|Indonesia||PT Luno Indonesia Ltd (4014111731102609), incorporated in Indonesia||Gedung Chubb Square, Thamrin Nine Podium, Go Work Lantai 8, Jl M.H Thamrin No. 10 RT/RW. 000/000 Kel. Kebon Melati Kec Tanah Abang Kota Administrasi Jakarta Pusat|
|Malaysia||Luno Malaysia Sdn Bhd (201501011592 (1136927-A)), incorporated in Malaysia||Unit 3.3, 3rd Floor, Surian Tower No.1 Jalan PJU 7/3 Petaling Jaya Selangor Malaysia 47810|
|Nigeria||Luno Fintech Nigeria Ltd (RC 1216337), incorporated in Nigeria||Venia Business Hub, 8 The Providence Street, Lekki Phase 1, Lagos, Nigeria|
|South Africa||Luno (Pty) Ltd (2013/075107/07), incorporated in South Africa||30 Chiappini Street, De Waterkant, Green Point, Cape Town, Western Cape, South Africa, 8001|
|Uganda||Luno Technology Uganda Ltd (80020001421135), incorporated in Uganda||Plot 24 Henlon Close, Luthuli Avenue, Bugolobi, Kampala, Uganda|
|Zambia||Luno Technology Zambia Ltd (120180009295), incorporated in Zambia||Stand 4015A, The Gallery Office Park, Frost Building, Rhodes Park, Lagos Road Lusaka, Zambia|
Collecting your personal data
In order to open and operate an account for you, provide you with our products and services, or communicate with you, we may need to collect your personal data.
We may collect the following types of personal data:
- personal identification information such as your full name, date of birth, nationality, cellphone or mobile number, email address, place of residence (and/or proof of residence), employment status, industry of employment and/or national identification number or social security number;
- information for purposes of biometric identification such as the selfie you provide to us when creating your Luno account, video/audio recording, or other evidence of yourself with your identification documentation;
- national identity documentation such as a copy of national identity document, drivers’ license or passport (including any relevant visa information) and/or any other information deemed necessary to comply with our legal obligations under financial or anti-money laundering laws;
- financial information such as your source of funds, bank account information, credit and/or debit card information, transaction history, tax documents, or other proof of income or net worth;
- transaction information such as your transaction data on your Luno account and information on the recipient of any transaction(s);
- correspondence such as information provided to us when engaging with our customer support and/or responses to surveys;
- information lawfully obtained from third parties such as credit information, online identifiers relating to fraud prevention, suspected criminal activity, sanction information or other personal information about you provided by a service provider appointed to help us provide our services;
- usage, device and location information such as cookies, geolocation information, browser name and version information, IP address information, device fingerprint data, authentication data and/or click-stream data.
Personal data is collected in various ways, including:
- when you provide it to us such as when you sign up for a Luno account, use our products and services, or take part in customer surveys, competitions and promotions;
- when you communicate with us by email, chat, telephone or any other means, we collect the communication and any personal data provided in it;
- when you use the Luno platform we collect information on your transactions and usage of your Luno account;
- when we obtain information from third parties such as identity verification services, credit reference agencies, regulatory and enforcement agencies and public sources.
You must be 18 years or older to open a Luno account and, as such, Luno will not intentionally or knowingly collect personal data directly from individuals under the age of 18 years.
Processing your personal data
We will only process your personal data where it is necessary for us to carry out our lawful business activities. In doing so, we rely on one or more of the following lawful grounds for processing your personal data:
Consent: In some cases, we will only process your personal data where you provide us with your express consent for such processing.
Legal obligation: In some cases, we may need to process your personal data in order to comply with an obligation imposed by law.
strong>Legitimate interest: In some cases, we may need to process your personal data where it is in our legitimate legal interests to do so.
More specifically, we may process your personal data for one or more of the following purposes:
- to verify your identity in accordance with Know Your Customer (KYC), Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) requirements;
- to perform sanctions screening on you in compliance with all required sanctions screening processes imposed by, for example, the United Nations, European Union, UK Treasury and US Office of Foreign Assets Control (OFAC) and to take measures to prevent transacting with individuals, companies and countries appearing on these sanctions lists;
- to manage and maintain your account with us;
- to detect and prevent fraudulent or unauthorised use of our products and services;
- to better manage our business and your relationship with us, including for purposes of quality control and staff training to make sure we continue to provide you with accurate information, products and services;
- to improve our products and services, and to develop new products and services;
- to notify you about benefits and changes to the features of our products and services;
- to provide you with personalised advertising and marketing;
- to respond to your enquiries and to resolve disputes;
- in relation to legal claims, compliance, audit, risk management, law enforcement processes and regulatory functions; in connection with the acquisition, merger or sale of a business.
Where we are required to process criminal history information, biometric information or any other type of special personal data about you in connection with any of the purposes listed above, you expressly consent to the collection, use and storage of this personal data about you. If you choose to withdraw your consent, we refer you to the section below titled “Your right to access, update, or remove your personal data”. Please note that, should you withdraw your consent, you will no longer be able to use the Luno products and services.
Sharing your personal data
We may share your personal data with:
- any person that works for us or for one of our group companies;
- any entity that forms part of the Luno group of companies, including where relevant the Luno operating entity in the country or region in which you live;
- financial and other institutions we partner with to provide our products and services;
- with third party cryptocurrency (or virtual or digital asset) service providers when you send cryptocurrency over the blockchain. The third party service provider may also use this information to screen and process the relevant transaction;
- companies and organisations that provide services to us, including in relation to technical infrastructure, marketing and analytics, and web and app development;
- companies and organisations that assist us with identity verification, background screening, due diligence, processing or otherwise fulfilling transactions that you have requested and fraud prevention services. In particular, we may use Onfido Limited (Onfido) to assist us in verifying your identity by determining whether the selfie you take when creating your Luno account matches the photo of you in your accepted identity document. The information collected from your photo may include biometric data;
- certain services, including those provided by GeoComply Solutions Inc. (Geocomply), will make use of your location data. You consent to us and GeoComply transmitting, collecting, maintaining, processing and using your location data in order to provide and improve location-based services. You may withdraw this consent at any time by turning off the location settings or by notifying us in writing that you would like to withdraw such consent (which may result in you no longer being able to use Luno’s products and services);
- our professional advisers, consultants and other similar services.
We will otherwise treat your personal data as private and confidential and will not share it with other parties except:
- where you have given us permission to do so;
- where we may transfer rights and obligations pursuant to our agreement with you.
Security of your personal data
Luno places great importance on ensuring the security of your personal data. We regularly review and implement appropriate and reasonable technical and organisational security measures to keep your personal data safe. Employees of Luno are trained to handle personal data securely and with the utmost respect, failing which they may be subject to disciplinary action.
International transfers of your personal data
Luno is a global organisation and, in the course of providing our products and services to you, your personal data may be transferred to, stored and processed outside of the jurisdiction in which you reside, and the laws of those countries may differ from the laws applicable in your own country. For example, data collected in the European Economic Area (EEA) may be transferred to, stored and processed at a destination(s) outside of the EEA (including the United States of America).
Where you have opted-in to receive marketing communications and news, we may share information about our products, services, news and promotions with you. If you have opted-in to receive marketing communications, you may always opt out at a later stage by clicking on the “Unsubscribe” option included in every marketing communication sent to you.
Please note that unsubscribing from marketing content will not stop you from receiving important communications in relation to the security or operation of your account or the Luno product.
Additional matters relating to personal data
Retention of personal data
Your biometric data is held by our third party service providers for a period of no longer than 1 year from the time when you cease to be a customer of Luno.
Incomplete personal data
Where indicated (for example in application forms or account opening forms), it is obligatory to provide your personal data to us to enable us to process your application for our products or services. Should you decline to provide such personal data, we may not be able to process your application/request or provide you with our products or services.
Your right to access, update, or remove your personal data
Most of the data Luno collects, and the ways in which we use it, are necessary for us to provide and improve the services we provide to you, or to comply with our obligations. In certain situations, we give you the ability to choose how we use your data.
Depending on the country in which you live, you may have certain rights under data protection law, including the right to object to the processing of your personal data or to request that we:
- provide you with a copy of your personal data (including in a format that can be shared with a new provider); or
- correct, delete, or restrict the processing of your personal data.
Please submit a support ticket if you would like to exercise any of the above rights. These rights are limited in some situations, such as where we are legally required to process your data, and may limit your ability to use our products and services.
We will notify you and the relevant supervisory authority as soon as we become aware of any data breach that is likely to result in a risk to your rights and freedoms.
Credit and debit card data
We do not store your full credit and debit card data. This data is securely transferred and stored off-site by an authorised payment vendor in compliance with Payment Card Industry Data Security Standards (PCI DSS). This information is not accessible to Luno or Luno’s employees or any agent acting for or on behalf of Luno.
Contacting Luno in relation to personal data