Luno Global Customer Privacy Notice

Your basic details

Identity data

Business account data

Biometric data

Financial data

Transaction data

Correspondence data

Complaint data

Communication preferences

Transaction data

Technical data

Usage data

From cookies and other similar technologies

Information about your location

Referral details

Luno Group companies

Publicly available records

Public blockchain

Analytics providers

Intermediaries

Signing up with a social account

Market research providers

Other third party providers

In order to open and to maintain your Luno account

When you register with us and apply to open an account and to create and manage your account in accordance with our Terms of Use.

We may process all or some of the following categories of personal data:

• Basic data, Identity data, Financial data (which, depending on your location, may include bank account and/or masked payment card details), Transaction data, Communication preferences, Technical data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi)

In order to provide our services to you

When you process and execute transactions on the Luno platform, including using our instant buy, your Luno wallet to send and receive cryptocurrency, repeat-buy, bundles and staking products, fiat deposits and fiat/crypto conversions, and other products we may offer our customers in the future.

We may process all or some of the following categories of personal data:

• Basic data
• Financial data (which, depending on your location, may also include bank account and/or payment card details)
• Transaction data
• Technical data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi)

When you enable and use beta features in Luno Labs

You may choose to participate in testing and providing feedback on new features before they are widely released.

We may process all or some of the following categories of personal data:

• Basic data
• Technical data

In order to provide you with customer support

We use personal data to communicate with you, by email, our chatbot Toshi or phone call about your account, provide you with guidance and support, solve problems and issues you may encounter with your account, trouble shoot, and to resolve complaints and disputes, to contact you about your experience or to respond to a review you left on an app store or public website. We may also process personal data to authenticate you before responding to your request or as part of the account or password recovery processes.

We record and monitor our communications with you to make sure we have understood your instructions, to improve our service and to train our customer success team, with the aim of preventing mistakes from occurring.

We may process all or some of the following categories of personal data (only if and to the extent necessary to respond to your query):

• Basic data
• Identity data
• Correspondence data
• Financial and wallet information (usually limited to fiat and crypto balances)
• Transaction data
• Technical data
• Usage data

In order to send you important communications about your account and our services

We will notify you of service interruptions, important changes and security issues affecting your account.

We may process all or some of the following categories of personal data:

• Basic data
• Correspondence data
• Financial data
• Transaction data

To maintain the safety, integrity and security of our services

We need to understand our customers' circumstances and their use of our services to prevent, detect and investigate inappropriate, fraudulent, unlawful or unauthorised use of our services as set out in our Terms of Use, and to maintain the security of your account with us. Please see our security page for more information on how we keep your account secure.

We may process all or some of the following categories of personal data:

• Basic and identity data
• Transaction data
• Financial data
• Technical data
• Usage data

To help you make an informed decision about the right product for you.

We may ask you about your circumstances and goals so that you can find the product that is right for you. For example, you might be interested in buying crypto in the simplest possible way or you might be interested in more advanced trading and wish to use our exchange.

We may process all or some of the following categories of personal data:

• Basic data
• Identity data

To give you a better experience

We analyse usage and engagement with our products and services to personalise and improve your experience. This could also include the creation of anonymised aggregate demographic groups or “segments”.

We may process all or some of the following categories of personal data:

• Basic data
• Transaction data
• Technical data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi)
• Usage data
• Correspondence data

To improve our products and services and to research and innovate

We have an interest in improving our products and services to be competitive, innovative and to give our customers a first class experience. To do this we use data to prepare anonymous metrics about how our products and services are used for reporting purposes and to guide improvements.

We ask you about your experience and to give your opinion on a product or service. We do this by conducting customer and market research, for example through surveys and user testing, to better understand the needs of our customers, to get feedback on our products and services, to identify pain points and to improve our products and services.

This could also include the creation of anonymised aggregate demographic groups or “segments”.

We may process all or some of the following categories of personal data:

• Basic data
• Transaction data
• Technical data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi)
• Usage data
• Correspondence data

To offer promotions and provide rewards

We have an interest in rewarding our loyal customers. We do this by providing opportunities to benefit from promotions, prize draws and incentives.

We may process all or some of the following categories of personal data:

• Referral details
• Basic data
• Technical data
• Usage data
• Limited transaction and wallet data
• Information about your location
• Any information you provide us when you participate

To market our products and services that might be of interest to you

It is in our interest to promote our products and services that you may be interested in. If you agree, we will send you messages about products, services and events of our trusted partners which we think may be of interest to you. We may send you messages about our products, features, promotions, news updates and events which may be sent by email, push notification or in-app notification. These messages may be personalised based on an analysis of your use of our products and your transactions to offer what we think may be of interest to you. You can ask us to stop personalising messages by sending us a message - please see ‘how to contact us’ at the end of this notice.

We also use personal data to measure the performance and effectiveness of our marketing campaigns (such as how many people engaged with or responded to an ad) and to make sure that our campaigns are effective and reach the right people.

We may process all or some of the following categories of personal data:

• Basic data
• Business account data
• Usage data
• Transaction data
• Information about your location
• Technical data

To maintain the quality, integrity and security of our services including our website and app

In addition to the steps we take to protect our services under the Terms of Use we also process personal data to keep the Luno app and website safe and secure through ongoing monitoring, testing and improvements and to conduct customer risk assessments. We do this to identify any usual behaviour which could be indicative of misuse, compromised accounts or accounts that may be abused for financial crime reasons.

We also screen against various databases, both internally and externally, to establish whether there may be a risk to Luno or our customers associated with providing our services to a customer, and to ensure that we are not involved in dealing with or assisting in criminal activities and the proceeds of crime.

We may process all or some of the categories of personal data listed in the “The personal data we collect” section above.

To record calls and chat conversations

When we chat with you or call you on your mobile phone, we record our conversation for quality assurance (for example, to make sure we have understood your instruction, query or concern) and for training purposes.

We may process some or all of the following categories of personal data:

• Basic data
• Usage data
• Transaction data
• Correspondence data

For organisational purposes

We may process personal data to manage our business (including collection and recovery of fees and payments) and in connection with corporate transactions such as mergers, acquisitions or divestitures.

We may process all or some of the categories of personal data listed in the “The personal data we collect” section above.

To verify your identity and decide whether to approve your application, as part of our "know your customer" procedure

We comply with anti-financial crime laws to prevent financial crimes like money-laundering and terror financing and to prevent us from establishing a business relationship with companies and countries appearing on sanctions lists issued by authorities such as the United Nations, European Union, UK Treasury and US Office of Foreign Assets Control (OFAC). If you would like to know more please visit our Help Centre.

It is also necessary to check your location to make sure you are verifying your account in the correct country and to ensure you are not in a sanctioned country. If you would like to know more about location sharing please see the “Luno asked me to share my location. Why?” article in our Help Centre.

We also use your biometric data to ascertain and verify your identity, typically by comparing a scan of your face taken from a photo or video selfie with the photograph on the copy of the identity document you provide.

You can find more information on Luno’s approach to combating money-laundering and financial crime in the Compliance Information page on our website.

Note, the exact categories of personal data we collect will depend on the account verification level. We may process all or some of the following categories of personal data:

• Basic data, Identity data, Financial data (which, depending on your location, may include bank account and/or payment card details)
• Technical data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi).
• Biometric data
• Publicly available data (typically information about you that might be obtained during KYC screening checks for example press reports or records from public databases and our KYC screening service providers)

To comply with other legal and regulatory obligations

We are also required to use and share personal data in response to civil and criminal legal claims, legitimate requests from law enforcement authorities investigating criminal activity, requests from tax and other supervisory authorities.

We also have obligations to:

• submit suspicious activity reports and suspicious transaction reports to designated local authorities
• comply with Financial Action Task Force (FATF) rules such as the "Travel Rule", which requires us to share certain information about each transfer. For more information about the Travel Rule please see this FAQ on the Travel Rule in our Help Centre.

We may process all or some of the following categories of personal data:

• Basic data
• Identity data
• Financial and wallet data
• Technical data
• Transaction data
• Usage data
• Information about your location (which could be based on IP address, GPS, GSM or WiFi).

For enabling device permissions for our app

We need your permission to collect information from your device to provide our products and services. Examples include requesting access to your camera, microphone, photos and location.

We may process all or some of the following categories of personal data:

• Device preferences
• Technical data

To preserve and share personal data with law enforcement or others

In rare situations, we might have to preserve or share personal data in an emergency or where there is a risk to a person’s safety.

The actual categories of personal data we collect will depend on the situation requiring disclosure to protect the vital interests of individuals.

Luno Group Companies

As we are a global business, personal data may be shared with other Luno Group companies to facilitate our operations.

Identity verification, KYC and sanctions screening services

We use service providers who support our identity verification, sanctions screening and general KYC processes and help us to comply with legal and regulatory requirements, including:

• The following providers assist us in verifying your identity when you apply for an account:
  • Onfido Limited. You can view their privacy notice here.
  • Daon Limited. You can view their privacy notice here.
  • Smile ID. You can view their privacy notice here.
  • PT Asli RI (Indonesia only). You can view their privacy notice here.
• Daon assists us in verifying your identity. You can read Daon’s privacy policy here.
• Government population registers which we use for KYC and AML screening, such as Home Affairs in South Africa, Dukcapil in Indonesia and SmileID in Nigeria
• GeoComply Solutions Inc. (Geocomply) assists us in complying with our legal obligations and provides location-based services
• Refinitiv (World-Check) assists us in conducting screening of customer information to comply with our legal obligations to identify sanctioned individuals, politically exposed persons and individuals with adverse media. You can find out more about how World Check uses data here.

We may also share information with government departments to screen your details against the local population register, for example Home Affairs in South Africa and Dukcapil in Indonesia.

Fraud detection and transaction monitoring

We use service providers who provide fraud detection and transaction monitoring solutions that help us comply with legal and regulatory requirements and to safeguard our services. These recipients include:

• GeoComply Solutions Inc. (Geocomply) provides location-based services.

• Chainalysis Inc assists us with monitoring on-chain (crypto) transactions.

• ComplyAdvantage assists us with monitoring off-chain (fiat) transactions.

• Maxmind Inc provides location-based services based on your IP address.

• Notabene Inc assists us with providing sender and beneficiary information to enable Travel Rule compliance.

• OpSec Security Inc assists us in identifying false or fictitious websites, social media profiles and to take down phishing websites.

• Sift Science assists us with fraud prevention to protect you and/or us against fraud or other financial crime, and to take action we reasonably deem necessary based on the results of such enquiries.

• Solidus assists us in conducting market surveillance in order to identify market abuse.

• Twilio assists us in sending customers SMS’ for security purposes.

Payments processors

We use the services of third party payments processors to facilitate deposits to and withdrawals from your Luno account. The exact service provider depends on the country you are in and the method you choose to fund your account.

If LunoPay is available in your country and you choose to use it, we will share personal data with payment processors to facilitate your payment.

When you link your account to a third party service provider

For example if you link your Luno account to your bank account or to other websites and services. These third parties should process personal data in accordance with their own privacy notices.

Law enforcement, government agencies, regulators, banks, payments processors and other financial institutions and our professional advisors

We share personal data to:

• Respond to court orders, requests for information from law enforcement, regulatory or other governmental authorities;
• Comply with our reporting and information sharing obligations;
• Detect and investigate financial crime and other illegal activity;
• Detect and investigate technical and security issues;
• To protect the property and safety of our employees, customers, the Luno Group or others.

In the context of corporate transactions and restructuring

Personal data may be shared or transferred if Luno is acquired, merged or otherwise restructured, or if a change of control occurs or we become insolvent. It might be necessary for us to share personal data when evaluating and entering into transactions involving the purchase or sale of assets.

Other services providers

We use service providers who help us to operate our platform and provide our services to you including in relation to technical infrastructure, marketing and analytics, and web and app development:

• Marketing service providers, typically to manage campaigns and send marketing communications and to organise and manage promotions.
• Communications service providers to send service and marketing communications.
• Cloud data hosting service providers.
• Security service providers to help safeguard our platform, customer accounts, property, etc.
• Analytics providers which help us understand how people use and engage with our services.
• Payments processors.
• Outsourced customer service.

When you ask us to share your personal data with a third party

For example when you authorise us to share your account information with your financial adviser or wealth manager or you may authorise third parties to act on your behalf.