Privacy Policy

Last Updated: [ October 15, 2026]

Introduction

Welcome to M&M Fintech Ltd ("we", "us", or "our"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, process, and protect your personal data when you use our website (http://www.mmfintech.io ), our proprietary financial technology services (including Open Banking, Payment Processing, Compliance, Blockchain, and AI tools), or interact with us in any way.

M&M Fintech Ltd is the data controller for your personal data. We are registered in England and Wales (Company Number: 12495944) and registered with the Financial Conduct Authority (FCA) under reference number 903084.

Our registered office is: 110 Bishopsgate, London, England, EC2N 4AY.

Personal Data We Collect

To provide our AI-powered fintech solutions, open banking, and regulatory compliance services, we may collect, use, store, and transfer different kinds of personal data, which we have grouped together as follows:

  • Identity Data: First name, last name, date of birth, biometric data (for identity verification), and identification documents (e.g., passport, driving licence) required for Know Your Customer (KYC) and Anti-Money Laundering (AML) checks.
  • Contact Data: Billing address, operational address, email address, and telephone numbers.
  • Financial Data: Bank account details, payment card details, open banking account information, and digital wallet addresses.
  • Transaction Data: Details about payments to and from you, account-to-account (A2A) transfer histories, and details of services you have used through us (such as Banky).
  • Technical Data: Internet protocol (IP) address, login data, browser type and version, time zone setting and location, operating system, and platform technology on the devices you use to access our services.
  • Usage Data: Information about how you use our website, APIs, and fintech products.
  • AI and Analytics Data: Behavioural patterns, fraud risk scores, and routing preferences processed by our AI-native infrastructure.

How We Collect Your Data

We use different methods to collect data from and about you, including through:

  • Direct interactions: You may give us your Identity, Contact, and Financial Data by filling in forms, integrating with our APIs, or corresponding with us by post, phone, email, or otherwise.
  • Automated technologies or interactions: As you interact with our website or services, we automatically collect Technical Data and Usage Data using cookies, server logs, and our AI monitoring systems.
  • Third parties or publicly available sources: We may receive personal data about you from various third parties, including credit reference agencies, fraud prevention agencies, open banking networks, and identity verification partners.

How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • To perform a contract: Where we need to deliver our fintech services, process transactions, or manage our relationship with you.
  • To comply with legal obligations: Where we need to comply with FCA regulations, PSD2 guidelines, AML directives, and other statutory requirements.
  • For our legitimate interests: To operate our business securely, improve our AI-powered fraud detection systems, ensure 99.99% uptime of our infrastructure, and grow our business (provided your interests and fundamental rights do not override these interests).

Artificial Intelligence & Automated Decision-Making

Because AI is embedded in our services, we use automated processing for fraud detection, risk scoring (e.g., generating AI Risk scores), and automated compliance monitoring. If an automated decision produces a legal or similarly significant effect on you, you have the right to request human intervention, express your point of view, and contest the decision.

Data Security

We have put in place appropriate, enterprise-grade security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This includes PCI-DSS compliant environments, encrypted blockchain infrastructure, and continuous automated AI security monitoring. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

Typically, to comply with FCA and UK anti-money laundering regulations, we are required to retain basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for a minimum of five years after they cease being customers.

Sharing Your Data

We may share your personal data with the following parties:

  • Service Providers: Acting as processors who provide IT, cloud storage (e.g., AWS), blockchain infrastructure (e.g., Fireblocks), and system administration services.
  • Financial Partners: Banking partners (e.g., The Kingdom Bank, Financial House), payment networks (e.g., Mastercard), and open banking ecosystems required to execute transactions.
  • Regulators and Authorities: HM Revenue & Customs, the FCA, the NCA, and other authorities acting as processors or joint controllers based in the UK who require reporting of processing activities.

International Transfers

If we transfer your personal data out of the UK or the European Economic Area (EEA), we ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards are implemented (such as standard contractual clauses approved by the Information Commissioner's Office).

Your Rights

Under the UK GDPR, you have rights under data protection laws in relation to your personal data, including the right to:

  • Request access to your personal data (a "data subject access request").
  • Request correction of the personal data that we hold about you.
  • Request erasure of your personal data.
  • Object to processing of your personal data where we are relying on a legitimate interest.
  • Request restriction of processing of your personal data.
  • Request the transfer of your personal data to you or to a third party (data portability).
  • Withdraw consent at any time where we are relying on consent to process your personal data.

To exercise any of these rights, please contact us using the details below.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact our Data Protection Officer (DPO) at:

  • Company: M&M Fintech Ltd
  • Email Address: [Insert Privacy/DPO Email Address, e.g., privacy@mmfintech.io]
  • Postal Address: 110 Bishopsgate, London, England, EC2N 4AY

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (http://www.ico.org.uk ). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.