Privacy policy

At Luno, we value your privacy and strive to protect your personal data. Luno will only collect and use your personal data in accordance with this Privacy Policy, our Cookie Policy and our Terms of Use.

This Privacy policy explains:

• which Luno entity controls your data;
• how we collect, process and share your personal data;
• the important security measures we maintain to secure your personal data;
• what rights you have in respect of the personal data we hold on you; and
• why and how we retain your personal data.

Our relationship with you

Depending on which country or region you have verified your Luno account in, you may be a customer of a specific Luno entity. References in this Policy to “Luno”, “we”, “us”, “our” or any similar term is to the relevant Luno entity you are a customer of. Here is a table which provides the information on which Luno entity who have contracted with:

The Luno company you contract with is your Data Controller. This means it is responsible for the collection, use, disclosure, retention and protection of your personal data in accordance with this Privacy Policy and all applicable laws.

Collecting your personal data

In order to open and operate an account for you, provide you with our products and services, or communicate with you, we may need to collect your personal data.

We may collect the following types of personal data:

• personal identification information such as your full name, date of birth, nationality, cellphone or mobile number, email address, place of residence (and/or proof of residence), employment status, industry of employment and/or national identification number or social security number;
• information for purposes of biometric identification such as the selfie you provide to us when creating your Luno account, video/audio recording, or other evidence of yourself with your identification documentation;
• national identity documentation such as a copy of your national identity document, drivers’ license or passport (including any relevant visa information) and/or any other information deemed necessary to comply with our legal obligations under financial or anti-money laundering laws;
• financial information such as your source of funds, bank account information, credit and/or debit card information, transaction history, tax documents, or other proof of income or net worth;
• transaction information such as your transaction data on your Luno account and information on the recipient of any transaction(s);
• correspondence such as information provided to us when engaging with our customer support and/or responses to surveys;
• information lawfully obtained from third parties such as credit information, online identifiers relating to fraud prevention, suspected criminal activity, sanction information or other personal information about you provided by a service provider appointed to help us provide our services;
• app and website usage, device and location information such as cookies, geolocation information, browser name and version information, IP address information, device fingerprint data, authentication data and/or click-stream data.

Personal data is collected in various ways, including:

• when you provide it to us such as when you sign up for a Luno account, use our products and services, or take part in customer surveys, competitions and promotions;
• when you communicate with us by email, chat, telephone or any other means, we collect the communication and any personal data provided in it;
• when you use the Luno platform we collect information on your transactions and usage of your Luno account;
• when we obtain information from third parties such as identity verification services, credit reference agencies, regulatory and enforcement agencies and public sources.

You must be 18 years or older to open a Luno account. Our products and services are directed at adults aged 18 years and over, and are not intended for individuals under 18 years old. Luno will not knowingly request to collect personal data from individuals under the age of 18. Luno makes all efforts to comply with applicable local legal requirements regarding children’s personal data.

Processing your personal data

We will only collect, use, share or otherwise process your personal data where it is necessary for us to carry out our lawful business activities and subject to the data protection laws in your country or state.

In doing so, we rely on one or more of the following lawful grounds for processing your personal data:

Contractual necessity: We may process your personal data where it is necessary in order for us to provide our products and services to you or to otherwise comply with our obligations under Luno’s Terms of use.

Consent: In some cases, we will only process your personal data where you provide us with your express consent for such processing.

Legal obligation: In some cases, we may need to process your personal data in order to comply with an obligation imposed by law.

Legitimate interest: In some cases, we may need to process your personal data where it is in our legitimate legal interests to do so.

How we use your personal data

More specifically, we may process your personal data for one or more of the following purposes:

• to verify your identity in accordance with Know Your Customer (KYC), Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) requirements;
• to perform sanctions screening on you in compliance with all required sanctions screening processes imposed by, for example, the United Nations, European Union, UK Treasury and US Office of Foreign Assets Control (OFAC) and to take measures to prevent transacting with individuals, companies and countries appearing on these sanctions lists;
• to manage and maintain your account with us;
• to detect and prevent fraudulent or unauthorised use of our products and services;
• to better manage our business and your relationship with us, including for purposes of quality control and staff training to make sure we continue to provide you with accurate information, products and services;
• to improve our products and services, and to develop new products and services;
• to notify you about benefits and changes to the features of our products and services;
• to market our services to you, including sending you communications about our products, features, promotions, surveys, news, updates and events, and to personalize our marketing messages to you. If you do not want us to send you marketing communications, you may opt out when creating your account. Alternatively, you may opt out at any point by using the “unsubscribe” option contained in any marketing email or submit a support ticket;
• to provide you with personalised advertising and marketing;
• to respond to your enquiries and to resolve disputes;
• in relation to legal claims, compliance, audit, risk management, law enforcement processes and regulatory functions;
• in connection with the acquisition, merger or sale of a business.

Where we are required to process criminal history information, biometric information or any other type of special personal data about you in connection with any of the purposes listed above, you expressly consent to the collection, use and storage of this personal data about you. If you choose to withdraw your consent, we refer you to the section below titled “Your right to access, update, or remove your personal data”. Please note that, should you withdraw your consent, you will no longer be able to use the Luno products and services.

Sharing your personal data

We may share your personal data with:

• any person that works for us or for one of our group companies;
• any entity that forms part of the Luno group of companies in order to process payments you have authorised, provide you with support or otherwise provide our products and services to you;
• financial and other institutions we partner with to process payments you have authorised and otherwise to provide our products and services;
• third party cryptocurrency (or virtual or digital asset) service providers when you send cryptocurrency over the blockchain. The third party service provider may also use this information to screen and process the relevant transaction;
• companies and organisations that provide services to us, including in relation to technical infrastructure, marketing and analytics, and web and app development;
• companies and organisations that assist us with identity verification, background screening and due diligence. In particular, we may use Onfido Limited (Onfido) to assist us in verifying your identity by determining whether the selfie you take when creating your Luno account matches the photo of you in your accepted identity document. We may also use the services of Daon (UK) Ltd. to perform a facial similarity or ‘liveness’ check which involves checking the image provided in your accepted identity document against a video or series of quickly taken selfies that you submit. The information collected from your photos may include biometric data;

• companies and organisations that assist us with fraud prevention services. In particular, we may use SardineAI Corp. (Sardine) to assist us with verifying your identity or protecting you and/or us against fraud or other financial crime, and to take action we reasonably deem necessary based on the results of such enquiries;

• certain services, including those provided by GeoComply Solutions Inc. (Geocomply), will make use of your location data. You consent to us and GeoComply transmitting, collecting, maintaining, processing and using your location data in order to provide and improve location-based services. You may withdraw this consent at any time by turning off the location settings or by notifying us in writing that you would like to withdraw such consent (which may result in you no longer being able to use Luno’s products and services);
• our professional advisers, consultants and other similar services.

We will otherwise treat your personal data as private and confidential and will not share it with other parties except:

• where you have given us permission to do so;
• where we believe it is reasonably necessary to comply with any law, regulation, legal process or governmental request (for example to comply with reporting requirements under tax and AML laws or to respond to law enforcement requests), to enforce our Terms of use or other agreements, or to protect the rights, property, or safety of us, our customers or others;
• where we may transfer rights and obligations pursuant to our agreement with you.

Security of your personal data

Luno places great importance on ensuring the security of your personal data. We regularly review and implement appropriate and reasonable technical and organisational security measures to keep your personal data safe. Employees of Luno are trained to handle personal data securely and with the utmost respect, failing which they may be subject to disciplinary action. Although we take steps to secure your personal data, we cannot guarantee that your personal data will always remain secure and, in the event of a data breach, we refer you to the section below titled “Data breaches”. Importantly, you are responsible for securing the login credentials for your Luno account and otherwise complying with the Account Security section of Luno’s Terms of Use.

International transfers of your personal data

Luno is a global organisation and, in the course of providing our products and services to you, your personal data may be transferred to, stored and processed outside of the jurisdiction in which you reside, and the laws of those countries may differ from the laws applicable in your own country. For example, data collected in the European Economic Area (EEA) may be transferred to, stored and processed at a destination(s) outside of the EEA.

By accepting this Privacy Policy, and then submitting your personal data, you expressly consent to the transfer, storing or processing of such personal data outside of your jurisdiction.

Electronic marketing

We may send you information about our products, services, news and promotions, or otherwise communicate with you, by email, push or in-app notifications, text message or other means for marketing purposes. When we communicate with you for marketing purposes we will do so only in accordance with applicable law, including consent or opt-out rules.

You may always opt out of receiving marketing communications at a later stage by clicking on the “Unsubscribe” option included in every marketing communication sent to you and you can also manage your communications preferences via your account communications settings in our app or on our website.

Please note that unsubscribing from marketing content will not stop you from receiving important communications in relation to the security or operation of your account or the Luno product.

Additional matters relating to personal data

Retention of personal data

Luno will retain your personal data, in compliance with this Privacy Policy and the Terms of Use, for the duration of your relationship with us, and afterwards for such period as may be necessary for our legitimate business purposes (including compliance with our legal obligations, preventing fraud, resolving disputes and enforcing agreements), to protect the interests of Luno and its customers, and as required by law.

Your biometric data is held by our third party service providers for a period of no longer than 1 year from the time when you cease to be a customer of Luno.

Incomplete personal data

Where indicated (for example in application forms or account opening forms), it is obligatory to provide your personal data to us to enable us to process your application for our products or services. Should you decline to provide such personal data, we may not be able to process your application/request or provide you with our products or services.

Your Rights

Most of the data Luno collects, and the ways in which we use it, are necessary for us to provide and improve the services we provide to you, or to comply with our obligations. In certain situations, we give you the ability to choose how we use your data.

Depending on the country or state in which you live, you may have certain rights relating to your personal data, including the right to:

• ask us for a copy of the personal data we hold about you;
• ask to have your personal data transferred to you or to a third party chosen by you in a structured, commonly used and machine readable format;
• object to the processing of your personal data, including processing for marketing purposes;
• opt out of the sharing of your personal data with our affiliates or third parties (either for the specific purposes outlined in this policy or for the purpose of marketing their products and services to you); or
• ask that we correct, delete, or restrict the processing of your personal data.

Please submit a support ticket if you would like to exercise any of the above rights which you are entitled to exercise free from discrimination. These rights are limited in some situations and we may not be able to agree to your request. This could be because we have a legitimate reason for processing your personal data (for example where we have legal obligation to process your personal data, or it is in our legitimate interests to do so) or the right does not apply to the personal data we hold about you.

Data breaches

We will notify you and, where applicable, the relevant supervisory authority, of any data breach in accordance with local law.

Credit and debit card data

We do not store your full credit and debit card data. This data is securely transferred and stored off-site by an authorised payment vendor in compliance with Payment Card Industry Data Security Standards (PCI DSS). This information is not accessible to Luno or Luno’s employees or any agent acting for or on behalf of Luno.

Revisions to this Privacy Policy

We may amend this Privacy Policy from time to time. You should visit the website regularly to check when this Privacy Policy was last updated and to review the current Policy. We will do our best to notify you of any substantive amendments to the Privacy Policy and any such notice will be posted on our application or our website, or sent by email to the address associated with your Luno Account (see Electronic Communications).

Contacting Luno in relation to personal data

Should you have any query in relation to this Privacy Policy or how we handle your personal data, please contact us by submitting a support ticket.