Privacy notice

1. Who we are

olaMac Security & Logistics, company number (not yet published), with its registered office at (not yet published), is the controller of the personal data described in this notice under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For data protection matters, contact us at (not yet published).

2. What we collect

• Identification and contact data: name, date of birth, nationality, address, email and telephone number, and identity document details (passport, national identity card or driving licence).
• Documents you upload to verify your identity and address and, for organisations, company registration documents and the identity of directors and beneficial owners.
• Account and custody data: your metal holdings, deposits, withdrawals, transfers of ownership, delivery addresses, documents you request, invoices and payment references. If you transfer metal to another client, or receive it, the other party sees your name and account number.
• Communications: secure mailbox messages, chat transcripts and support tickets.
• Security data: sign-in times, IP addresses, device information and an audit record of actions taken on your account.

We do not collect or store payment card numbers.

3. Why we use it and our lawful bases (UK GDPR, article 6)

• To perform our contract with you: custody, storage, verification, transport, transfers and billing (article 6(1)(b)).
• To comply with legal obligations, including customer due diligence and record keeping under the Money Laundering Regulations 2017, reporting under the Proceeds of Crime Act 2002, sanctions law and tax law (article 6(1)(c)).
• For our legitimate interests in securing your account and our premises, preventing fraud and defending legal claims, balanced against your rights (article 6(1)(f)).
• With your consent, for optional notifications such as SMS alerts, which you can withdraw at any time in your profile (article 6(1)(a)).

Where we process information about criminal convictions or offences, for example in sanctions and fraud checks, we do so as permitted by Schedule 1 to the Data Protection Act 2018.

4. Who we share it with

We share personal data only with: carriers and insurers needed to transport and protect your metal; banks and payment institutions that process your payments; auditors, legal advisers and technology providers bound by confidentiality; and public authorities where the law requires, such as the National Crime Agency, HM Revenue & Customs, the Office of Financial Sanctions Implementation and the courts. We do not sell personal data.

5. International transfers

Where personal data is transferred outside the United Kingdom, we do so only to countries covered by UK adequacy regulations or under the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

6. How we protect it

Identity documents and records are encrypted and kept in write-once storage with integrity checks. Access is restricted to authorised staff for their duties, and every access is logged. Sessions expire automatically and can be revoked from your profile.

7. How long we keep it

We keep personal data for as long as your account is active and afterwards for 5 years after the end of the relationship for customer due diligence and transaction records, as required by regulation 40 of the Money Laundering Regulations 2017, and for up to 6 years for contract and tax records. Signed documents and certificates may be kept for up to 10 years to establish, exercise or defend legal claims.

8. Your rights

You have the right to access your personal data, to have it corrected, to have it erased or its use restricted in certain circumstances, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time. To exercise these rights, contact our Data Protection Officer at (not yet published). We respond within one month.

You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. We would appreciate the chance to deal with your concerns first.

9. Cookies

We use only the cookies needed to keep you signed in and secure. See our Cookie notice.

10. Changes

We will publish any update to this notice on this page and, for material changes, notify you through the portal.