Global Privacy Policy

Privacy and security are very important to us at Nium. This Global Privacy Policy (“Privacy Policy” or “Policy”) is intended to help you understand how we collect, use, and share your personal information when you use our products or services.

Nium refers to Nium Pte. Ltd. and its affiliates and subsidiaries worldwide, including entities operating under the Nium Travel, Instarem brands identified here (collectively “Nium Group”, “Nium”, “we”, or “us”). This Global Privacy Policy applies to the Nium Group and describes and applies to personal information that we collect, use, and disclose about you when you access or use the Nium websites, mobile application, or other online or mobile service that links to or otherwise presents this Privacy Policy to you (“Site”), including our products and services, as well as your related interactions with us (collectively referred to herein as the “Services”).

You should read this Privacy Policy carefully as it contains important information about your privacy rights and choices. If you do not agree to this Privacy Policy, please do not use the Services. 

Nium obtains information about you from various sources. “You” may be a visitor on the Site, a user of our Services, including as a customer of Nium (“Nium Client”) or an end user of a Nium Client (“End Customer”), or a recipient/beneficiary of one of our Services. If you are an End Customer, your use of the Services will also be subject to the applicable agreement between us and the applicable Nium Customer.

If you are located in Brazil or California, please see the ‘Brazil Privacy Notice’ and ‘California Privacy Notice’ sections below for information specific to those regions.

If you have obtained a financial product or service in the United States with Nium, Inc., to be used primarily for personal, family, or household purposes, we will use and share personal information that we collect from or about you in accordance with our U.S. Consumer Privacy Notice.

Information We Collect

The personal information that we collect about you depends in relation to your use of the Services, the choices that you make, your location, and applicable law.

Information You Provide to Us Directly 

We collect the information directly from you when you use our Site and/or Services.

• Identifiers, including name, address, email address, phone number, age, date of birth, gender, citizenship, account credentials; geolocation, unique device identified, network information or internet protocol (IP) address
• Government identifier Information, including national identification card information; driver’s license, state identification, passport, visa, Social Security number, tax identification, etc.
• Employment Information, including occupation, employer, or salary range
• Company Information, including information about your company, company name, location
• Payment Information, including your payment transactions and transaction history regarding the Services
• Financial Information, including your financial and bank name, account number, and routing number and card details
• Verification Information, including your image in photo or video form, and facial scan data extracted from your photo or video (known as ‘biometric data’), to verify your identity during onboarding as part of our Know-Your-Customer (KYC) and Know-Your-Business (KYB) checks to authenticate you as an authorised user of our services, or to detect and prevent fraud. Where such data constitutes biometric data or sensitive personal data under applicable laws, we only use it when we have a lawful basis. There are three situations where this applies:
  • You give your permission. Where applicable law requires it, we will ask for your explicit, freely given, specific and informed consent before processing biometric data.
  • We are required by law. If applicable law requires us to process this data, we will only use it to the minimum extent necessary.
  • Fraud and financial crime prevention. Where permitted by appliable law, we may use biometric data to detect and prevent fraud or financial crime.
• Sensitive Personal Information: Social Security number, driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
• Other information that you voluntarily provide to us related to the Services or otherwise or that we may collect as permitted by law and with your consent where required by law

If you do not provide us with the information below, we may not be able to provide the Services to you, or your use of the Services may be restricted.

In addition to information you provided us in connection with your use of the Services, you may also choose to submit information to us via other methods, including but not limited to in response to marketing or other communications; through social media or online forums; through participation in an offer, program, or promotion; in connection with an actual or potential business relationship with us; or by connecting with us at industry events or conferences.

Information We Collect Automatically Based on Your Activity on Our Services

We may collect certain information automatically when you use our Site or Services. For example, we collect information about your device you use to access the and use the Sites and Services, such as your IP address, general geographical location, browser or device information, operating system version, and Internet service provider. We may also automatically collect information regarding your use of our Site, such as pages that you visit before, during and after using our Site, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Site.

We may use third parties to engage in such collection activities on our behalf.

We also partner with third parties to manage our advertising on other websites and evaluate the overall performance of our Services.

In accordance with applicable law (which may include obtaining your consent depending on your jurisdiction of residence, such as in the EU or UK), we and our advertising partners and service providers use technologies such as cookies, beacons, tags, scripts, and similar technologies to analyze trends, administer our Services, track use of the Services, and gather demographic information about our user base as a whole. We may receive reports on this activity on an individual and aggregated basis.

Our third-party partners may also use cookies and pixels to gather information about your activities on our Services and other sites in order to provide you advertising based upon your browsing activities and interests or help us track the success of our advertising efforts. Cookies are also used to gather statistical data, such as which pages are frequently visited, what is downloaded, and the address of sites visited immediately before or after coming to our Services.

For more information about our use of cookies and how to opt-out of certain cookies, please see our Cookies Notice. If you disable certain cookies, your ability to use some features or parts of the Services may not be accessible to you and/or the performance, features, or Services may not function as intended.

Information We Collect from Third Parties

In addition to the information we collect directly and automatically from you, we may also receive information about you from our customers, business partners, financial service providers, identity verification services, and publicly available sources (e.g., name, address, phone number, country), as necessary to confirm your identity and prevent fraud.  We may also receive information about you from other sources, such as business partners, marketers, researchers, analysts, social network services, and other parties to help us supplement our records.

How We Use Your Information 

Nium uses the information we collect in connection with offering the Services, and for related business purposes as follows:

• Provide the Services, including performing any agreement we have entered into with a Nium Client or End Customer and manage your account, provide, operate, monitor, maintain and administer our Site and Services;
• Communicate with you about the Services, including any technical notices, updates, security alerts, and support and administrative messages and to respond to your comments, questions, and customer service requests;
• Send marketing communications about products, services, and events offered by Nium and others, and provide news and information we think will be of interest to you, in accordance with applicable legal requirements;
• Promote the security of Services, including to detect, investigate, and prevent fraudulent transactions and other illegal activities and protect the rights and property of Nium and others;
• Improve the Services, including internal operations, troubleshooting, testing, research, and de-bugging errors and developing new products and services;
• Comply with laws, rules and regulations, including to verify your identity and any disclosure or reporting obligations (including in connection with anti-money laundering, sanctions, and counter-terrorism financing rules/laws);
• Monitor and analyze trends, usage, and activities in connection with our Services;
• Create de-identified data sets to analyze and improve our Services;
• Any other purpose described to you at the time the information was collected; and
• For other purposes where you provide your consent.

The laws in some jurisdictions require companies to tell you about the legal grounds they rely on to process your information. Our legal basis for processing your information as described in this Privacy Policy are as follows:

• Where use of your information is necessary to perform our obligations under a contract or commitment to you. For example, to provide the Services you’ve requested from us, or to comply with our terms of service and other legal terms.
• Where use of your information furthers our legitimate interests or the legitimate interests of others. For example, to provide security for our Services, operate our business and our Services, make and receive payments, defend our legal rights, and prevent fraud.
• Where we use your information to comply with applicable legal obligations. For example, keeping track of purchases for tax and auditing purposes and comply with applicable sanctions and anti-money laundering rules.
• Where you have consented to our processing of your information for a particular purpose.

For the purposes discussed in this Privacy Policy, we may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.

Information We Disclose

Nium may use and disclose your information to provide the Services to you and in accordance with applicable law. We do not share or sell your personal information with any third party other than as described in this Privacy Policy.

We may disclose your information with the following third parties in the following instances:

• Affiliate entities, as permitted by law;
• Third-party partners and service providers, including financial institutions, card networks, contractors, service providers, as necessary to provide the Services to you, as needed to perform such services, which may include, payments, service fulfillment, web hosting, security and fraud prevention services, credit reference, or marketing or analytic services.
• Marketing, referral, or advertising and analysis partners that we partner with to market you
• Law enforcement, government officials, tax authorities or other third parties as required by law and when we believe that such disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, regulatory request or other legal process;
• Third parties when we have a legitimate business purpose as permitted by law;
• Companies, organizations, or individual in connection with a business transaction, such as a merger, sale of some or all of our assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business or in the event of a bankruptcy or related or similar proceedings.
• Other third parties with your consent or authorization.

We may also use or disclose aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you, to the extent permitted under applicable law.

Your Privacy Rights and Choices

Privacy Rights 

Depending on your jurisdiction of residence, you (or an authorized agent acting on your behalf) may be able to make certain requests based on the following rights related to your information, subject to certain exceptions and limitations:

• Right to Know and Access. You may request to know and receive a copy of the personal information  we hold about you. You can also request to port your information to another entity, where technically feasible.
• Right to Delete. You may request deletion of certain information we have about you.
• Right to Correct. You may request to correct or update personal information held by us that is incomplete or inaccurate.
• Right to Object or Restrict Processing. You may have the right to restrict or object to your personal information being processed for certain purposes.
• Right to Withdraw your Consent. To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. However, please note that we may not be able to continue providing the Services to you as a result.
• Right to Opt-Out. You have the right to opt out from the sale and sharing of your personal information, including the processing of your personal information for purposes of targeted advertising.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights provided under the law.
• Right to Lodge a Complaint. You may lodge a complaint about our practices with respect to your personal information with the supervisory authority of your country or state.
• Right to Appeal. As provided by applicable law, you may have the right to appeal our decision to deny your request. If we deny your request, we will provide you with information on how to appeal the decision, if applicable, in our communications with you.

We also will take reasonable steps to verify your identity before responding to a request. If we are unable to verify your identity, we shall have the right, but not the obligation, to request additional information from you. If you are an End Customer, we may need the assistance of the Nium Client to complete your request.

To exercise your rights, please contact us at privacy@nium.com.

Marketing/Advertising Opt Out Rights

You can opt-out of marketing communications with us as provided under applicable law. For example, if you do not want to receive promotional emails from us, you may stop receiving such emails by clicking on the “unsubscribe” link provided in such emails. You may not, however, opt out of service-related emails and communications. Please note that it may take some time to process your request in accordance with applicable law.

Please refer to our Cookie Notice for more information on how you can opt-out of certain cookies.

Our Sites do not respond to Do Not Track signals. We honor global privacy signals in accordance with applicable law.

Retention of Your Information

We retain information for different periods of time depending on the purposes for which we collect and use it, as described in this Privacy Policy, and in accordance with our internal data retention policies. We will delete or de-identify information when it is no longer needed to fulfill these purposes unless a longer retention period is required to comply with applicable laws.  For example, Nium is required to collect and hold certain information under the Anti-Money Laundering and Counter-Terrorism Financing rules and other subordinate instruments (AML/CTF Laws). There may be technical or other operational reasons where we are unable to fully delete or de-identify your information. Where this is the case, we will take reasonable measures to prevent further processing your information.

International Transfers

We operate globally and in accordance with applicable law, may transfer, store, and/or process your information to or with other entities within the Nium Group or other third parties such as trusted service providers and partners in locations around the world, including the United States, Canada, Australia, New Zealand, the European Union, United Kingdom, Hong Kong, India, Indonesia, Malaysia, Malta, Singapore and Brazil for the purposes described in this Privacy Policy. The data protection laws of these locations may not provide the same protections as the data protection laws in the jurisdiction where you reside. Wherever your information is transferred, stored or processed by us, we take reasonable steps to protect your information in accordance with this Privacy Policy and applicable laws. These measures may include implementing Standard Contractual Clauses and/or international data transfer agreements to govern the transfer of your information, or other means recognized by applicable laws. By providing us with your information, you acknowledge and agree to any such transfer, storage, or processing.

If you have any concerns or complaints about our data processing activities, we urge you to first try to resolve such issues directly with us. However, if applicable, you may make a complaint to the data protection supervisory authority in the country where you are based, or seek a remedy through local courts if you believe your rights have been breached.

California Privacy Notice

If you are a California resident, the California Consumer Privacy Act (“CCPA”), as amended from time to time, requires us to provide you with certain notices prior to our collection and use of your personal information.

Purpose of Collection and Disclosure of Personal Information

We have collected and disclosed the below categories for personal information to provide the Services; communicate with you; marketing and advertising; Improve the Services; and for the business and commercial purposes as described in the “How We Use Your Information”. We do not collect, use, or disclose sensitive personal information for purposes other than those specified in this Privacy Policy, to provide the Services, or as permitted under applicable law.

Collection and Disclosure of Personal Information

In the past 12 months, we have collected the below categories of personal information:

• Identifiers;
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e);
• Professional or employment-related information; and
• Internet or other network or device activity (e.g., browsing history or usage information and associated device IDs and IP addresses.

We have disclosed the specific types of personal information described in the “What Information We Collect” section with affiliated entities; third-party partners and service providers; marketing partners; entities for legal purposes; and entities for business transactions further described in the “Information We Disclose” section.

Collection and Disclosure of Sensitive Personal Information 

In the past 12 months, we have collected and disclosed the following sensitive personal information with affiliated entities; third-party partners and service providers; marketing partners; entities for legal purposes; and entities for business transactions further described in the “Information We Disclose” section:

• Social Security number, driver's license, state Identification card, or passport number; and
• Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.

Your Rights and Choices under the CCPA

You may submit a verifiable request for information regarding the categories of personal Information collected, sold, or disclosed by us; purposes for which categories of personal information are collected or sold by us; categories of sources from which we collect personal information; categories of third parties with whom we disclosed or sold personal information; and specific pieces of personal information we have collected about you during the past 12 months. Such information is set forth above in this Privacy Policy.

Please see the “Your Privacy Rights and Choices” section for information about the additional rights you have with respect to your personal information under California law and how to exercise them. We do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA.

Financial regulations, including the Gramm-Leach-Bliley Act, may permit us to deny certain requests by California residents. If you are an individual located in the United States who applies for or obtain our financial product or service to be used primarily for personal, family, or household purposes, your personal information is subject to our U.S. Consumer Privacy Notice.

Shine the Light Disclosure

The California “Shine the Light” law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we disclose certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. We do not currently disclose personal information for these purposes.

Brazil Privacy Notice

If you are located in Brazil, the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados – LGPD, Law No. 13,709/2018) requires us to provide you with additional information regarding how we process your personal data.

Legal Bases for Processing

We process your personal data based on the following legal bases under LGPD Art. 7: (a) consent, where specifically obtained; (b) compliance with legal or regulatory obligations; (c) execution of a contract to which you are a party; (d) legitimate interest, subject to assessment under LGPD Art. 10; (e) credit protection; and (f) fraud prevention. For sensitive personal data (including biometric data for KYC), we rely on the legal bases set forth in LGPD Art. 11.

Your Rights under the LGPD

We assure you that you will never be discriminated against by exercising your rights. However,  please note that where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Nium shall (i) bear the burden of demonstrating the manifestly unfounded or excessive character of the request; and (ii) refuse to act on the request, indicating the factual or legal reasons that prevent the immediate adoption of the measure.

The rights of the Data Subjects under the LGPD differ a little from the rights under the GDPR. Thus, please see below the rights you have over your Personal Data under LGPD Art. 18: (i) confirmation of processing; (ii) access; (iii) correction; (iv) anonymization, blocking, or deletion of unnecessary data; (v) data portability; (vi) deletion of data processed with consent; (vii) information about entities with which data has been shared; (viii) information about the consequences of denying consent; (ix) revocation of consent. Contact us at privacy@nium.com.

Encarregado (Data Protection Officer)

Our Encarregado pelo Tratamento de Dados Pessoais can be contacted at dpo@nium.com.

International Transfers and Complaints

Your personal data may be transferred internationally in accordance with LGPD Arts. 33-36. You have the right to file a complaint with the ANPD at www.gov.br/anpd.

Information Security 

We maintain a variety of administrative, physical, and technical safeguards designed to prevent unauthorized use, access, processing, destruction, loss, alteration, or disclosure of the information we process. In the event that any information under our control is compromised as a result of a breach of security, we will investigate the situation and where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations. Please note, however, that no data security measures can be guaranteed to be completely effective. Consequently, we cannot ensure or warrant the security of any information.

Children’s Privacy 

We do not knowingly collect or solicit any information from anyone under the age of 16 or knowingly allow such persons to register for our Services. In the event that we learn that we have collected personal information from a child under age 16, we will delete that information as quickly as possible. If you believe that we might have any information from a child under age 16, please contact us using the contact information below.

Third-Party Links and Features 

This Services may contain links to, and incorporated features from, other websites or third parties that are not owned or maintained by us. Unless otherwise stated, we make no warranties or representations regarding such links or features, or the products or services offered by them. We do not control the privacy or security practices of third parties, or the locations where they process data. You should read the privacy and security policies of such third parties, as their practices may differ from ours.

Contacting Us 

If you have any questions about this Privacy Policy or our data processing activities, please contact us at privacy@nium.com or send physical mail to the relevant entity provided in this section that is the data controller of your information.  You can also contact our Data Protection Officer by emailing dpo@nium.com.

You can contact the applicable supervisory authority or other public body with responsibility for enforcing privacy laws in the countries or regions that we operate in the event that you feel we have not resolved your inquiry:

Changes

Any changes to this Policy become effective when posted to the Services and as indicated by the date at the top of this Policy. If you have registered for an account through the Services, we will notify you of any material changes to this Policy by using any of the contact information you have provided to us or by other means in accordance with applicable legal obligations.