1. Who we are
Cremello Currency Management Limited (“Cremello”) is a company incorporated in England and Wales with company number 10911678 and head office and registered address at Fora, One Canada Square, London, United Kingdom, E14 5AA. We are authorised by the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017 (register reference 1024672) for the provision of payment services.
We provide foreign exchange and payment services to personal and business clients. This Privacy Policy explains what personal data we collect about you, why we collect it, how we use it, who we share it with, and your rights in relation to it.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Cremello is the data controller of your personal data.
2. Personal data we collect
We collect personal data from you when you enquire about or use our services, when you correspond with us, and when you use our website. The types of personal data we collect include:
Information you give us:
- identity information: your name, date of birth, nationality and copies of identification documents such as your passport or driving licence;
- contact details: your address, email address and telephone number;
- financial information: your bank account details, transaction history and payment information;
- business information: where you are a business client, information about your organisation, its structure, directors, beneficial owners and authorised persons;
- source of funds and wealth information, as required for our anti-money laundering compliance;
- tax information: tax identification numbers and tax residency information, where required;
- vulnerability information: where you are a personal client, information about your personal circumstances that may indicate you are vulnerable or require additional support, for example in connection with health, life events or financial resilience. We will only collect this information where you choose to share it with us, and will handle it with appropriate sensitivity solely for the purpose of ensuring you receive fair treatment; and
- correspondence records: records of your communications with us, including telephone calls, emails and written correspondence.
Information we collect automatically:
- technical data: IP address, browser type and version, operating system, and other technical information when you use our website. Please see our Cookie Policy https://www.cremellocurrency.co.uk/cookie-policy/ for more information; and
- usage data: information about how you navigate and use our website, including pages visited and time spent on each page.
Information we receive from third parties:
- identity verification and fraud prevention agencies;
- credit reference agencies;
- sanctions screening databases and other publicly available sources;
- regulatory and law enforcement authorities, where required;
- business introducers or partners who refer you to us; and
- where you instruct us to make a payment to a third party, we will receive details about that third party from you. By providing us with this information, you confirm that you are entitled to do so and that the third party is aware that their information will be processed by us in order to execute the payment.
3. How we use your personal data
We only use your personal data where we have a lawful basis to do so. The table below sets out the purposes for which we use your personal data and the legal basis we rely on for each.
| Purpose | Examples | Legal basis | Data Category | Retention Period |
|---|---|---|---|---|
| Providing our services | Processing FX and payment transactions; managing your account; executing your instructions; issuing contract notes. | Performance of a contract | Identity; contact; financial; transaction | Duration of relationship + 6 years |
| Identity verification and onboarding | Carrying out KYC checks; verifying identity documents; screening against sanctions lists. | Legal obligation; legitimate interests | Identity; contact; documentation | Duration of relationship + 6 years |
| Anti-money laundering and fraud prevention | Monitoring transactions for suspicious activity; reporting to the National Crime Agency; sharing data with fraud prevention agencies. | Legal obligation; legitimate interests | Identity; contact; transaction; financial | 5 years from end of relationship (extendable to 10 years with supervisory authority consent under the MLRs) |
| Regulatory compliance | Complying with FCA requirements; responding to regulatory enquiries; maintaining records as required by law. | Legal obligation | Identity; contact; transaction; financial; correspondence | Duration of relationship + 6 years, or such longer period as required by applicable regulation |
| Communicating with you | Responding to your enquiries; sending account notifications; notifying you of changes to our terms or services. | Performance of a contract; legitimate interests | Identity; contact; correspondence | Duration of relationship + 6 years |
| Improving our services | Analysing how our website and services are used; developing new products and services. | Legitimate interests | Technical; usage | 26 months (in line with analytics data standard) |
| Marketing to individual clients | Sending you information about our services and products where you have consented or where we have a legitimate interest to do so. | Consent; or where the soft opt-in exception under PECR applies | Identity; contact; marketing preferences | Until consent is withdrawn or you opt out, and in any event no longer than 2 years from last interaction |
| Marketing to corporate clients | Sending information about our FX and payment services to corporate clients by email or other electronic means. | Legitimate interests | Identity; contact; marketing preferences | Until you opt out, and in any event no longer than 2 years from last interaction |
| Legal claims and dispute resolution | Enforcing our contractual rights; defending legal claims; complying with court orders. | Legitimate interests; legal obligation | Identity; contact; financial; transaction; correspondence | Duration of any claim or proceedings + 1 year, or 6 years from the relevant event if no claim arises |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
4. Who we share your personal data with
We do not sell your personal data. We share your personal data only in the following circumstances:
Service providers
We share your personal data with third-party service providers who assist us in operating our business, including IT and systems providers, payment processing partners, identity verification providers, and compliance and regulatory technology providers. All such providers are required to process your data only on our instructions and in accordance with appropriate contractual safeguards.
Regulatory and law enforcement authorities
We are required by law to share certain information with regulatory and law enforcement authorities, including the Financial Conduct Authority, HM Revenue and Customs, the National Crime Agency, and other bodies where required.
Fraud prevention agencies
We share information with fraud prevention agencies to help detect and prevent fraud and money laundering. Records held by these agencies may be used by other organisations in their own fraud prevention checks.
Payment counterparties
Where you instruct us to make a payment, we will share the necessary details about you and your instruction with the receiving financial institution and any intermediary banks involved in the payment chain, as required by law and payment scheme rules.
Business partners and introducers
Where you have been introduced to us by a business partner, we may share limited information about your relationship with us with that partner as part of our ongoing arrangement with them.
Professional advisers
We may share your personal data with our lawyers, auditors, insurers and other professional advisers where necessary for the conduct of our business.
Business transfers
If we sell or transfer all or part of our business, your personal data may be transferred to the acquirer as part of that transaction.
5. International transfers of personal data
In the course of providing our services, we may transfer your personal data to countries outside the United Kingdom. This may occur, for example, where we use service providers or payment intermediaries based outside the UK, or where we are required to report information to overseas regulatory authorities.
Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect it, in accordance with UK data protection law. These safeguards may include:
- transfers to countries that the UK government has recognised as providing an adequate level of data protection by way of adequacy regulations;
- an International Data Transfer Agreement (IDTA), approved by the UK Information Commissioner for international transfers of personal data; or
- where a transfer involves both UK and EU data protection considerations, the International Data Transfer Addendum to the European Commission's standard contractual clauses, which adapts those clauses for UK purposes.
You may contact us using the details in section 10 if you would like further information about the safeguards we have in place for international transfers, including to request a copy of the relevant transfer mechanism.
6. How long we keep your personal data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law.
As a regulated payment institution, we are required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and associated legislation to retain records relating to our clients and their transactions for a minimum of five years from the end of the business relationship, and in certain circumstances for up to ten years.
We will generally retain your personal data for a minimum of six years from the end of our relationship with you, unless a longer retention period is required by law or is necessary to protect our legitimate interests (for example, in connection with an ongoing legal claim).
When your personal data is no longer required, we will delete or anonymise it in accordance with our internal data retention policy.
7. How we protect your personal data
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure or destruction.
These measures include:
- restricting access to personal data to authorised personnel only;
- using encryption for the transmission of personal data over the internet;
- maintaining appropriate information security policies and procedures; and
- regularly reviewing and testing our security measures.
Whilst we take all reasonable steps to protect your personal data, the transmission of data over the internet is not completely secure and any transmission is at your own risk. Once we have received your personal data, we use strict procedures and security measures to try to prevent unauthorised access.
We have procedures in place to deal with any suspected personal data breach and will notify you, the Information Commissioner's Office (ICO) and the FCA of a breach where we are legally required to do so.
8. Your rights
Under UK data protection law, you have the following rights in relation to the personal data we hold about you:
- right of access - you have the right to request a copy of the personal data we hold about you (known as a subject access request);
- right to rectification - you have the right to ask us to correct any inaccurate or incomplete personal data we hold about you;
- right to erasure - you have the right to ask us to delete your personal data in certain circumstances. Please note that we may not always be able to comply with your request, for example where we are required by law to retain your data;
- right to restriction - you have the right to ask us to restrict our processing of your personal data in certain circumstances, for example if you contest the accuracy of the data we hold;
- right to object - you have the right to object to our processing of your personal data where we are relying on legitimate interests as our legal basis, and also to object to processing for direct marketing purposes;
- right to data portability - in certain circumstances, you have the right to receive your personal data in a structured, machine-readable format and to have it transferred to another organisation;
- right to withdraw consent - where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal; and
- right to lodge a complaint - if you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), which is the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by telephone on 0303 123 1113.
To exercise any of your rights, please contact us using the details in section 10 below. We will respond to your request within one month of receipt. We may need to verify your identity before processing your request. In some cases, for example where your request is particularly complex or you have made a number of requests, we may take up to three months to respond. If this is the case, we will notify you within one month of receiving your request and keep you updated.
9. Automated decision-making
We may use automated processes as part of our identity verification, sanctions screening and fraud prevention procedures. These processes may result in an automated decision being made about you, for example a decision to decline to provide services to you based on a sanctions screening match.
Where we make a decision that has a significant effect on you using solely automated means, you have the right to request that the decision is reviewed by a member of our team. To request a review, please contact us using the details in section 10 below.
10. Contact us
If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have a complaint about how we handle your personal data, please contact us:
- by email: clientsupport@cremellocurrency.co.uk
- by post: Cremello Currency Management Ltd, Fora, One Canada Square, London E14 5AA
We will acknowledge your complaint within a reasonable period and investigate it without undue delay. If you remain dissatisfied after receiving our response, you have the right to refer your complaint to the Information Commissioner’s Office (ICO).
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by notifying you directly. We recommend that you check this page periodically for any updates.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the course of your relationship with us.
This policy was last updated on 30 October 2026.
