Committee® Privacy Policy

Need to get in touch?

The Personal Information We Collect

We collect and process the following types of personal information:

• User Information: Name, Email, Telephone/Mobile Number
• Financial Information: Bank account details (account number, sort code, and account holder name).
• Transaction Data: Payment history, amounts deposited, payout details.
• Identity Verification Data: Collected through Plaid’s Identity Verification product for Know Your Customer (KYC) compliance.
• Optional Spending Preferences: If provided, how users plan to spend their payout (used for personalized offers).

How We Collect Your Personal Information

We collect personal data in the following ways:

• Directly from you: When you sign up, update your profile, or use app features.
• Through Plaid Financials: Plaid provides account holder name verification and executes Payment Initiation transactions on the user’s behalf.
• From Third-Party Services: If users opt to share spending preferences for personalized offers.

Why We Collect and Use Your Data

We use personal data to:

• Facilitate Secure Payments: Enable Payment Initiation via Plaid to process transactions within the app.
• Ensure Compliance: Fulfil legal and regulatory obligations, including KYC verification (based on legal obligation under UK financial regulations).
• Enhance User Experience: Improve app performance and personalize recommendations (optional).
• Security and Fraud Prevention: Protect against fraudulent activities and unauthorized access.

Legal Basis for Processing

Under the UK GDPR, we rely on:

• Contractual Necessity: To process user payments and verify identity for security.
• Legitimate Interest: For optional data collection related to spending preferences (not mandatory).
• User Consent: Required for executing every payment via Plaid's consent UI.

Who We Share Your Data With

We only share personal data with the following entities:

• Plaid Financials Ltd: To process payments and verify identity. See Plaid’s privacy policy: https://plaid.com/legal/#consumers.
• AuthoriPay Ltd: Soley for the purpose of compliance monitoring of financial transactions.
• The User's Bank: To execute deposits and payouts.

Data Retention and Security

• Retention Period: We store data as long as necessary for payment processing, compliance, and auditing. If a user deletes their account, personal data is permanently erased after 30 days.
• Storage Location: Hosted on Amazon Web Services (AWS) in London, UK via Google Cloud Firebase.

• Security Measures:
•   AES 256-bit encryption for sensitive data.
•   TLS encryption for transactions.
•   Two-factor authentication (2FA) for account access.

Data Breach Notification

User Rights Under UK GDPR

You have the right to:

• Access your data (Request a copy of your personal information).
• Correct your data (Fix incorrect or incomplete information).
• Request data deletion (In certain circumstances).
• Restrict processing (Limit how we use your data).
• Object to processing (If you disagree with how we use your data).
• Request data portability (Transfer data to another provider).

Payment Consent & Revocation

• How Consent Works: Users will be asked to review and approve each transaction before submission to comply with Strong Customer Authentication (SCA) requirements under PSD2 (Payment Services Directive 2).
• What Happens if Consent is Revoked? The Committee® app will no longer be able to process payments on behalf of the user, and payments will need to be manually initiated via the Settlement Screen.

How to Complain

If you have concernsabout our use of your personal information, you can:

• Contact us directly: Email dataprotection@committee-app.com or call 07473 573 462.
• Complain to the ICO:
  Information Commissioner's Office
  Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
•   Helpline number: 0303 123 1113
•   Website: https://www.ico.org.uk