Privacy Policy

1. Who We Are

GCC Exchange UK Limited ("we", "us", "our") is authorised and regulated by the Financial Conduct Authority as an Authorised Payment Institution under Firm Reference Number 596446 and is registered with the Information Commissioner's Office (ICO) under registration number Z3149163.

GCC Remit is a trading name of GCC Exchange UK Limited.

Registered Office:
90 High Street
Southall
UB1 3DB

Email: ukmlro@gccexchange.com

This Privacy Policy applies to:

• www.gccexchange.co.uk
• GCC Exchange UK mobile application
• GCC Exchange UK branches
• Related services provided by GCC Exchange UK Limited

2. Information We Collect

Identity Information

• Full name
• Date of birth
• Nationality
• Photograph
• Government-issued identification documents
• Signature

Contact Information

• Home address
• Email address
• Telephone number

Financial Information

• Bank account details
• Debit card details
• Transaction history
• Source of funds
• Source of wealth where required

Beneficiary Information

• Recipient names
• Recipient bank account details
• Destination country
• Relationship information

Technical Information

• IP address
• Device identifiers
• Operating system
• Browser type
• Mobile application usage information
• Location data (where permitted)

Compliance Information

• KYC records
• Sanctions screening records
• Politically Exposed Person (PEP) checks
• Anti-money laundering verification records

3. How We Use Your Information

We use your information to:

• Open and manage customer accounts;
• Verify your identity;
• Process money transfers and payment transactions;
• Prevent fraud and financial crime;
• Conduct sanctions and AML screening;
• Meet legal and regulatory obligations;
• Provide customer support;
• Improve our products and services;
• Manage security and access controls;
• Send service-related communications;
• Send marketing communications where permitted.

4. Lawful Basis for Processing

Under UK GDPR, we process personal data on the following bases:

Contract

To provide money transfer and payment services.

Legal Obligation

To comply with:

• UK GDPR
• Data Protection Act 2018
• Money Laundering Regulations
• Payment Services Regulations
• FCA requirements
• Financial crime legislation

Legitimate Interests

To:

• Improve our services;
• Prevent fraud;
• Protect our business;
• Maintain network and information security.

Consent

Where consent is required, including certain marketing activities and optional cookies.

5. Sharing Your Information

We may share personal data with:

Regulatory Authorities

• FCA
• HM Revenue & Customs
• National Crime Agency
• Information Commissioner's Office
• Law enforcement authorities

Financial Institutions

• Banks
• Payment processors
• Correspondent banking partners
• Overseas payout institutions

Service Providers

• Cloud service providers
• IT providers
• Identity verification providers
• Fraud prevention providers
• Compliance screening providers

Group Companies

Where required for operational, compliance or administrative purposes.

6. International Transfers

Due to the international nature of remittance services, your personal data may be transferred outside the United Kingdom.

When this occurs, GCC Exchange UK Limited ensures appropriate safeguards are in place, including:

• UK International Data Transfer Agreements;
• Standard Contractual Clauses;
• Transfers to countries benefiting from adequacy regulations;
• Other safeguards permitted by law.

7. Data Retention

We retain personal data only for as long as necessary.

In most cases, customer and transaction records will be retained for a minimum of five years following the end of the business relationship, or longer where required by:

• Applicable law;
• Regulatory requirements;
• Court orders;
• Ongoing investigations;
• Legal proceedings.

8. Data Security

We maintain appropriate technical and organisational security controls, including:

• Encryption;
• Secure servers;
• Access controls;
• Multi-factor authentication;
• Monitoring and logging;
• Staff confidentiality obligations;
• Security testing and vulnerability management.

9. Your Rights

Subject to applicable law, you have the right to:

• Access your personal data;
• Correct inaccurate information;
• Request erasure;
• Restrict processing;
• Object to processing;
• Request data portability;
• Withdraw consent where consent is relied upon.

Requests may be submitted to: ukmlro@gccexchange.com

10. Complaints

If you are unhappy with how we process your personal data, please contact us first.

You also have the right to complain to the Information Commissioner's Office: www.ico.org.uk

11. Children's Privacy

Our services are not intended for individuals under the age of 18.

12. Changes to this Privacy Policy

We may update this Privacy Policy periodically.

The latest version will always be available on our website.