Legal

Privacy Notice

Last updated: 11 June 2026

The Nummus website (nummuswallet.com) and the Nummus mobile application are operated by Jaikul CMC Ltd (with registered office at Artemidos, 5 Artemidos Tower, 8th floor, 6020, Larnaca, Cyprus), referred to in this notice as "NUMMUS", "we", "us" or "our". NUMMUS is the controller of your personal data.

Nummus operates as a technology and connectivity platform. The financial accounts, payment cards and related services accessible through the platform are operated by independent regulated third-party service providers and remain subject to their applicable regulatory, jurisdictional and operational frameworks.

Most of the financial data associated with your services (such as account balances, full payment card details and transaction information) is held directly by the relevant service providers and accessed by you through secure, user-authenticated channels. NUMMUS does not have direct access to this data and cannot view, retrieve or modify it on your behalf.

What is this document about?

We're committed to protecting and respecting your privacy.

We will:

always keep your personal data safe and private
never sell your personal data
allow you to manage and review your marketing choices at any time

1. About us

NUMMUS is the controller of your personal data for all Nummus products and services. References to "Nummus" in this notice refer to the Nummus platform (nummuswallet.com and the Nummus mobile application) operated by NUMMUS.

2. Why do I need to read this notice?

We collect your personal data when you use:

our website at nummuswallet.com
the Nummus app
any of the services available to you through the Nummus app or website

When we say 'personal data', we mean information which we know about you (for example, your registration details and how you interact with the Nummus app and its features) and which can be used to personally identify you (for example, a combination of your name and postal address).

This notice explains what information we collect, how we use it, and your rights over your personal data.

Sometimes, we may also provide you with 'just in time' privacy explanations in the Nummus app. When you use a new Nummus product or service for the first time, these explanations will help you to understand what specific personal data Nummus collects, uses or shares about you for that product or service. Where relevant, you will be prompted to review your in-app privacy preferences.

We may provide privacy notices and explanations in languages other than English. If there are any discrepancies between other language versions and the English language version, the English language version is authoritative.

If you have concerns about how we use your personal data, you can contact support@nummuswallet.com.

3. What personal data do you collect about me?

The table below explains what personal data we collect and use.

Information you give us

We collect information you provide when you: fill in any forms; correspond with us; respond to any of our surveys; register to use the Nummus app; open an account or use any of our services; take part in online discussions or promotions; speak with a member of our social media or customer support teams; enter a competition or share information with us on social media; contact us for other reasons. We will collect the following information:

your name, address, and date of birth;
your email address, phone number and details of the device you use;
your Nummus username (your 'UserID');
your registration information;
basic details of your Nummus cards (such as the card type, masked card number and activation status). Full card details (full card number, CVC, expiry date) are provided directly by the card issuing service provider through secure channels and are not stored by or accessible to Nummus;
copies of your identification documents and any other information you provide to prove you are eligible to use our services;
your country of residence, tax residency information, and tax identification number;
records of our discussions, if you contact us or we contact you (including records of phone calls);
your image in photo or video form, and facial scan data extracted from your photo or video ('biometric data'), to verify your identity during onboarding as part of our Know-Your-Customer (KYC) checks, to authenticate you as an authorised user of our services, or to detect and prevent fraud;
information about other people (such as your spouse or family) when we are required to collect this information to comply with KYC, anti-money laundering and other laws applicable to the service providers operating the services you have applied for. If you give us personal data about other people, or you ask us to share their personal data with third parties, you confirm that you have brought this notice to their attention beforehand.

Information collected from your use of our products and services

Whenever you use our website or the Nummus app, we collect the following information:

technical information, including the IP address used to connect your computer to the internet, your login information, the browser type and version, the time zone setting, device language, the operating system and platform, the type of device you use, whether your device uses a VPN, a unique device identifier, mobile network information, your mobile operating system and the type of mobile browser you use;
information about your visit, including the links you've clicked on, through and from our website or app (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks), and methods used to browse away from the page;
service activity metadata associated with the actions you initiate through the Nummus app (such as event timestamps, action type, and the service provider invoked). The detailed financial information associated with these actions (amounts, balances, beneficiary details, merchant data and full card details) is held directly by the relevant service providers and is not stored by or accessible to Nummus;
information stored on your device, including if you give us access to contact information from your contacts list (only if you have given us permission). We also use Google Analytics 4 (GA4) to collect anonymised usage and behavioural data about how visitors interact with our website and app. This may include page views, session duration, device type and approximate location derived from IP address.

Information about your location

If you turn location services on in the Nummus app, we track your location using GPS technology.

Information from others

We collect personal data from third parties or other people, such as official registers and databases, fraud prevention agencies and partners who help us to provide our services. This includes information to help us check your identity and any other information that may be required for KYC, anti-money laundering or sanctions screening obligations applicable to us or to the service providers operating the services you have applied for. Sometimes other Nummus customers may give us information about you.

Information from social media

Occasionally, we'll use publicly available information about you from selected social media websites or apps to carry out enhanced due diligence checks. Publicly available information from social media websites or apps may also be provided to us when we conduct general searches on you (for example, to comply with our anti-money laundering or sanctions screening obligations).

Information from publicly available sources

We collect information and contact details from publicly available sources, such as media stories, online registers or directories, and websites for enhanced due diligence checks, security searches, and KYC purposes.

4. What is your legal basis for using my personal data?

We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:

Keeping to our contracts and agreements with you — We need certain personal data to provide our services and cannot provide them without this personal data.
Legal obligations — In some cases, we have a legal responsibility to collect and store your personal data (for example, under anti-money laundering laws we must hold certain information about our customers).
Legitimate interests — We sometimes collect and use your personal data because we have a legitimate reason to use it and this is reasonable when balanced against your rights and freedoms.
Substantial public interest — Where we process your personal data, or your sensitive personal data, to adhere to government regulations or guidance, such as our obligation to prevent fraud or support you if you are or become a vulnerable customer.
Consent — Where you've agreed to us collecting your personal data, or sensitive personal data, for example when you tick a box to indicate you're happy for us to use your personal data in a certain way.

5. How do you use my personal data?

Checking your identity

Whenever you sign up with Nummus, we'll use your personal data to check your identity (as part of our KYC process). This may include facial scan data extracted from any photo or video you submit ('biometric data').

Legal basis: Legal obligations; Substantial public interest; Consent (where required by law).

Providing our services

Whenever you apply for or use a Nummus product or service, we'll use your personal data to:

decide whether or not to approve your application;
meet our contractual and legal obligations relating to any products or services you use;
help you understand your spending behaviour and how you use Nummus products and services;
recover debt and exercise other rights we have under any agreement with you;
provide you with customer support services (we may record and monitor any communications between you and us, including phone calls).

Legal basis: Keeping to contracts and agreements between you and us; Legitimate interests; Legal obligations.

Protecting against fraud

We use your personal data to check your address and identity, protect against fraud, keep to financial crime laws and to confirm that you're eligible to use our services. We also use it to help us better understand your financial circumstances and manage fraud risks related to your Nummus account.

Legal basis: Legitimate interests; Substantial public interest; Consent (where required by law); Legal obligations.

Marketing and providing products and services that might interest you

We use your personal data to:

personalise your in-app experience and marketing messages about our products and services so they're more relevant and interesting to you (where allowed by law);
if you agree, provide you with information about our partners' promotions or offers;
if you agree, allow our partners and other organisations to provide you with information about their products or services;
ask your opinion about our products or services.

Legal basis: Legitimate interests; Consent (where required by law).

To keep our services up and running

We use your personal data to manage our website and the Nummus app (including troubleshooting, data analysis, testing, research, statistical and survey purposes), and to make sure that content is presented in the most effective way for you and your device. We use HubSpot as our customer relationship management (CRM) platform to store basic contact information — specifically your first name, last name and email address — to manage communications and support interactions. We use Google Analytics 4 (GA4) to analyse website and app usage in order to improve our services.

Legal basis: Keeping to contracts and agreements between you and us; Legitimate interests; Consent (where required by law).

Location-based services and analytics

If you turn location services on in the Nummus app, we use your personal data to:

protect against fraud and detect anomalies in account activity;
provide relevant advertising to you (for example, information about nearby merchants);
perform analytics on aggregate location and usage patterns to improve our services.

Legal basis: Keeping to contracts and agreements between you and us; Legitimate interests; Consent (to track you when you have location services switched on).

Preparing anonymous statistical datasets

We prepare anonymous statistical datasets about our customers' spending patterns for forecasting purposes, to understand how customers use Nummus, and to comply with governmental requirements and requests. The information used and shared in this way is never personal data and you will never be identifiable from it.

Legal basis: Legitimate interests; Legal obligations.

Improving our products and services

We use your personal data to help us develop and improve our current products and services.

Legal basis: Legitimate interests.

Meeting our legal obligations, enforcing our rights, protecting our business and other legal uses

We use your personal data:

to share it with other organisations (for example, government authorities, law enforcement authorities, tax authorities, fraud prevention agencies);
to recover debts from you;
if this is necessary to meet our legal or regulatory obligations;
to identify and support vulnerable customers;
to protect ourselves, including our rights, property, personnel or products;
to help prevent and fight harmful or unlawful behaviour and spam communications;
in connection with legal claims;
to help detect or prevent crime.

Legal basis: Legitimate interests; Substantial public interest; Legal obligations.

6. Do you make automated decisions about me?

Depending on the Nummus products or services you use, we may make automated decisions about you. This means that we may use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair, consistent and based on the right information.

Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. We may make automated decisions about you that relate to:

Onboarding and identity verification: KYC, anti-money laundering and sanctions screening checks; identity and address verification; eligibility assessment for the services you have requested.
Routing to service providers: matching your application to the appropriate service provider based on your jurisdiction, service type and other relevant criteria.
Detecting fraud and anomalies: monitoring your account activity to detect fraud, financial crime and unusual behaviour.

Our legal basis is one or more of the following: keeping to contracts and agreements between you and us; legal obligations; legitimate interests.

7. How do you use my personal data for marketing?

If you sign up to our services, and where national laws allow, we'll assume you want to be contacted by post, push notification, email and text message with information about Nummus products, services, offers and promotions. Where national laws require us to get your consent to send marketing messages, we'll do so in advance.

We use your personal data to personalise marketing messages about our products and services so they are more relevant and interesting to you (where allowed by law). This may include analysing how you use our services and your transactions. You can object to profiling for direct marketing purposes. You can also adjust your preferences or tell us you don't want to receive direct marketing at any time. Just use the privacy settings in the Nummus app or tap the unsubscribe links in any marketing message we send you.

We won't pass your details on to any organisations outside Nummus for their marketing purposes without your permission.

Our legal basis is: consent (where required by law); legitimate interests.

8. What are my rights?

You have the right to be told how we use your personal data

We provide this privacy notice to explain how we use your personal data.

You have the right to ask us for a copy of your personal data

If you ask, we'll provide a copy of the personal data we hold about you. We can't give you any personal data about other people, personal data which is linked to an ongoing criminal or fraud investigation, or personal data which is linked to settlement negotiations with you.

You can ask us to correct your personal data if you think it's wrong

You can have incomplete or inaccurate personal data corrected. Before we update your file, we may need to check the accuracy of the new personal data you have provided.

You can ask us to delete your personal data

You can ask us to delete your personal data if: there's no good reason for us to continue using it; you gave us consent and you have now withdrawn it; you have objected to us using your personal data; we have used your personal data unlawfully; the law requires us to delete your personal data. We may not always be able to agree to your request. We must keep certain customer personal data even when you ask us to delete it (for example, to comply with anti-money laundering and KYC regulations).

You can object to us processing your personal data for marketing purposes

You can tell us to stop using your personal data, including profiling you, for marketing.

You can object to us processing other personal data (if we're using it for legitimate interests)

If our legal basis is 'legitimate interests' and you disagree, you can object. If there is an overriding reason why we need to use your personal data, we will not accept your request.

You can ask us to restrict how we use your personal data

You can ask us to suspend using your personal data while we investigate accuracy, if our use is unlawful but you don't want it deleted, or if we no longer need it but you want us to hold it for a legal claim.

You can ask us to transfer personal data to you or another company

Where allowed under regulatory requirements, we'll provide your personal data in a structured, commonly used, machine-readable format.

You can withdraw your permission

If you've given us consent to use your personal data, you can withdraw it at any time by changing your privacy settings in the Nummus app or sending an email to support@nummuswallet.com.

You can ask us to carry out a human review of an automated decision

If we make an automated decision that significantly affects you, you can ask us to carry out a manual review of this decision.

Your ability to exercise these rights will depend on the legal basis used to justify the processing of your personal data. Sometimes, we won't be able to agree to your request.

9. How do I exercise my rights?

To exercise any of your rights set out in the previous section, you can contact us through the Nummus app or send us an email at support@nummuswallet.com.

For security reasons, we can't deal with your request if we're not sure of your identity, so we may ask you for proof of ID.

If a third party exercises one of these rights on your behalf, we may need to ask for proof that they've been authorised to act on your behalf.

When you exercise one of your rights, or update your privacy settings in the Nummus app, it may take us up to one month to respond or implement your changes.

Nummus will usually not charge you a fee when you exercise your rights. However, we're allowed by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded or excessive.

10. Do you share my personal data with anyone else?

Services provided by third-party service providers

When you apply for or use a financial service through Nummus (for example, opening a bank account or activating a payment card), your application and ongoing service data is shared with the regulated third-party service provider that operates that service.

When this happens:

The service provider becomes a separate data controller for the personal data they receive and process in connection with the service you have applied for.
The service provider processes your personal data under its own privacy policy and in accordance with the applicable laws and regulations of its country of operation.
The service provider may share your personal data with its own regulators, banking partners, payment networks, fraud prevention agencies, government authorities and other entities, as required by the laws applicable to it.
The service provider may retain your personal data for the periods required by its applicable banking, anti-money laundering, KYC and tax laws, which may differ from the retention periods set out in this notice.

Your personal data may be transferred to and processed in jurisdictions other than your country of residence, including the jurisdictions where the relevant third-party service providers operate. Data protection laws in these jurisdictions may differ from those that apply in your country. By applying for a service operated by a third-party service provider through Nummus, you acknowledge and consent to this cross-border transfer of your personal data.

You should review the privacy policy of the relevant service provider when you apply for a service operated by them. A current list of our regulated banking and financial services partners and their privacy policies is available upon request via support@nummuswallet.com.

Internal use

We use your personal data internally within NUMMUS to:

provide you with the best service
protect you, other customers and our systems from fraud or harmful behaviour
facilitate you quickly signing up to use other Nummus products or services
improve existing, or develop new, products or services
send you information about Nummus products and services we think you'll be interested in hearing about

Other Nummus customers

We'll ask you to let us sync your mobile phone contacts. This will help you to identify which of your trusted mobile phone contacts are Nummus customers. Your 'trusted contacts' will also be able to see if you're a Nummus customer through our in-app discoverability settings.

If you have synced your mobile phone contacts, we show basic details about you in the Nummus app to your trusted contacts who are also Nummus customers (for example, your name as saved in your friend's contacts list, mobile phone number, UserID, Nummus profile photo if you have one).

You can choose not to sync your contacts list with Nummus, and you can also change your discoverability preferences through the privacy settings in the Nummus app.

People or companies that you transfer money to or from

Where you make a payment from your Nummus account, we'll provide the recipient with your details alongside your payment (for example, your name and account identifier). Where you receive a payment to your Nummus account, we'll provide the payer with your details. This is necessary to confirm that the payment has been made to the correct account.

Suppliers and service partners

Type of supplier	Why we share your personal data
Suppliers who provide us with IT, payment and delivery services	To help us provide our services to you.
Regulated banking and financial services partners (including bank account providers, card issuers, banking intermediaries, payment networks such as Visa and Mastercard, and international payment service providers)	To operate the financial accounts, payment cards and related services accessible through the platform.
Identity verification and KYC service providers	To help us verify your identity so we can provide our services to you.
Card manufacturing, personalisation and delivery companies	To create and deliver your personalised Nummus card.
CRM and marketing platform providers (including HubSpot)	We store basic contact information — specifically your first name, last name and email address — in HubSpot, our customer relationship management platform, to manage communications and support interactions with you.
Analytics providers (including Google Analytics 4)	To help us understand how users interact with our website and app, and to improve our services. Data collected via GA4 is anonymised and aggregated where possible.
Customer-service providers, survey providers and developers	To help us provide our services to you.
Communications services providers	To help us send you emails, push notifications and text messages.
Partners who help to provide our services	We may share your personal data with our partners to provide certain services you've asked us for, or to ensure you receive any reward we have promised you. We'll only share your personal data in this way if you've made a qualifying purchase, asked for the relevant service or if it's provided as part of your membership plan.
Other financial institutions	We may share your personal data with other financial institutions where this is necessary to facilitate a transaction. For example, if a payment is made to your account by mistake, we can share your information with the financial institution the payment came from to help return the payment.

For legal reasons

We also share your personal data with other financial institutions, financial services companies, insurance providers, government authorities, law enforcement authorities, tax authorities, and fraud prevention agencies to check your identity, investigate or protect against suspected fraud, keep to tax laws, anti-money laundering laws, or any other laws, and confirm that you're eligible to use our products and services.

We may also need to share your personal data with other third party organisations or authorities:

if we have to do so under any law or regulation
if we sell our business
in connection with criminal or fraud investigations
to enforce our rights (and those of customers or others)
in connection with legal claims

Social media and advertising companies

When we use social media for marketing purposes, your personal data (limited to your name, email address and app events) may be shared with the social media platforms so that they can check if you also hold an account with them. The personal data is hashed before we send it, and the advertising partner we share it with is only allowed to use that hashed personal data in the ways described in this notice.

Our legal basis is legitimate interests (to ensure Nummus's advertising is as effective as possible).

You can contact us at any time through the Nummus app or by emailing support@nummuswallet.com if you don't want us to share your personal data for advertising purposes.

Where you ask us to share your personal data

Where you direct us to share your personal data with a third party, we may do so. For example, you may authorise third parties to act on your behalf (such as a lawyer, accountant or family member). We may need to ask for proof that a third party has been validly authorised to act on your behalf.

11. How do you protect my personal data?

We recognise the importance of protecting and managing your personal data. Any personal data we process will be treated with the utmost care and security.

We use a variety of organisational and technical measures to maintain the confidentiality, availability and integrity of your personal data and make sure your personal data is not improperly used or disclosed.

We have detailed information security and data protection policies which our employees are required to follow when they handle your personal data. Our employees receive data protection and information security training. Personal data is stored on secure computer systems with access management controls in place to limit physical, system and information access to only authorised employees.

Nummus has strict policies in place that control how we share your personal data with other companies. Before sharing personal data with any company, we thoroughly vet the company in advance and assess the security controls the company has in place to protect your personal data.

While we take all reasonable steps to ensure that your personal data will be kept secure from unauthorised access, we cannot guarantee it will be secure during transmission by you to our app, our website or other services. We use HTTPS, encrypted through Transport Layer Security, for all our app, web and payment-processing services.

If you use a password, PIN or generated authorisation code or prompt to use the Nummus app, our website or other services, you will need to keep it confidential. Please do not share it with anyone. Nummus will never ask you for this credential.

When you use our public services, which include our social media accounts and the Nummus community channels, do not share any personal data that you don't want to be seen, collected or used by other customers, as this personal data will become publicly available.

12. How long will you keep my personal data for?

We will keep your personal data:

for as long as necessary to achieve the original purpose we collected it for
in line with relevant laws

We are required to keep certain personal data for specified time periods by KYC, anti-money laundering and other applicable laws. These time periods vary from country to country, and may also be set by the regulatory frameworks of the service providers operating the services you have applied for.

We may keep your personal data for a longer time period because of a potential or ongoing court claim, or for another legal reason.

13. How will you keep me updated about how you use my personal data?

If we change the way we use your personal data, we'll update this notice and, if appropriate, let you know by email, through the Nummus app or through our website.