Privacy Policy

1. About us

We’re Fea Card Limited (Companies House number: 11620703). We’re the “controller” of the personal data that we collect about you through your use of the Bits website (www.getbits.app) (“Website”) or our Bits app (“App”). Basically – this means we decide the “what”, “why”, “how”, “who” and “where” of the processing.

We take the privacy of your information really seriously. We want to be clear and up-front with you about how we use your personal data. However, if you have any questions at all about this policy, please feel free to contact us using the follow details:

Address: Camden Gateway, 349 Royal College Street, London, England, NW1 9QS.

Email: hello@getbits.app.

2. Categories of personal data we may collect about you

We may collect identity and contact data about you, for example:

• Your name;
• Your date of birth;
• Your address;
• Your email address;
• Your mobile number;
• Your username and password; and
• Your preferences in receiving electronic marketing from us.

We may also collect the following financial data:

• Your payment card details (though we’ll only ever process this when you sign-up to the Bits service through the App); and
• Details of your bank account transactions (if you have signed up to a Bits service that includes reporting rent payments to Credit Reference Agencies to help improve your credit score).

We may also collect technical and usage data about you, for example:

• Your internet protocol (IP) address;
• Your type of device you use and your operating system;
• The date, times and frequency you access the Website or App;
• Your account activity (i.e. repayments, utilisation of credit, etc.); and
• Information about how you use and interact with our Website or App.

We will also process certain data about you that is provided to us by Credit Reference Agencies. Please see Section 11 (Credit Reference Agency Information Notice (CRAIN)), below, for details.

3. How we collect your personal data

We collect your personal data in the following ways:

Data that is given to us by you

• When you register with us and set up an account to receive the Bits service;
• When you request marketing (e.g. news and updates) to be sent to you; and
• If you contact us through the Website, the App email, telephone (or if you’re old school, by post) or through any other means!

Data that we receive from third parties and public sources

We may receive personal data about you from third parties and public sources, as set out below:

• Credit Reference Agencies. Please see Section 11 (Credit Reference Agency Information Notice (CRAIN)), below, for details.
• Analytics providers, such as Google. Please see Section 12 (Cookies), below, for details;
• Your bank, via our open banking partners such as Plaid (if you have signed up to a Bits service that includes reporting rent payments to Credit Reference Agencies to help improve your credit score);
• Regulatory compliance/identity verification services providers, such as Sumsub;
• Public sources. For example, reviews that you leave about the App on the Apple App Store may be displayed by us on the Website.

Data that is collected automatically

We automatically place cookies that are essential for the operation of the Website. For more information about the cookies we use, please see Section 12 (Cookies), below.

4. How we use your personal data (lawful basis)

We may need to process your personal data for the following reasons:

Performance of a contract

When you register with us, and throughout your use of the Bits services, including when we need to reach you to inform you about your account or your outstanding balance, in each case the lawful basis for processing your personal data is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.

Compliance with legal obligations

We may also need to process your personal data in order to comply with a legal obligation. For example, we may need to notify you about changes to our Bits Terms and Conditions, or this policy, or maintain internal records for legal, tax or regulatory purposes.

Legitimate interests

There may be circumstances where we process your personal data where it is necessary for our legitimate interests (and importantly, your interests and fundamental rights don’t override our interests).

Our legitimate interests include: (i) the running of our business (e.g. automatically placing cookies which are “strictly necessary” for the operation of our Website or App, taking calls you make to our customer service phone number, etc.); (ii) ensuring network security; (iii) preventing fraud; and (iv) processing data in the context of a business or share sale, reorganisation or restructuring exercise.

Consent

Less frequently, we will rely upon consent to process your personal data. We will ask for your consent if we process your personal data in the following situations:

1. Sending marketing emails to you about our products and services; or
2. Processing any personal data that is obtained through our use of cookies which aren’t essential for our operation of the Website (for example, cookies which are used for analytics purposes). For more information about the cookies we use, please see Section 12 (Cookies), below.

Changed your mind? Withdraw your consent…

You have the right to withdraw your consent at any time. If you’d like to withdraw your consent to marketing emails, you can do this by:

• Contacting us using the details provided at Section 1 (About us), above; or
• Following the opt-out links on any email marketing message sent to you by us

If you’d like to withdraw your consent to cookies, please clear your browser cookies. This will allow you to change your consent preferences the next time to access the site.

You can also block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including strictly necessary cookies) you may not be able to access all or parts of our Website.

For more information about the cookies we use, please see Section 12 (Cookies), below.

5. If you don’t provide your personal data…

Where we need to collect personal data by law, or under the terms of the contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel the Bits service/the contract you have with us. We will notify you if this is the case at the time.

6. Why we process your data (purposes)

At Bits, we process your personal data for specific purposes, namely:

6.1 To Provide and Manage Your Subscription Service

We process your personal data to set up, maintain, and administer your Bits subscription account. This includes verifying your identity, processing your subscription payments, issuing your Bits store card (and, if you sign up for it, the Bits Credit Card), and managing your account settings (e.g., updating payment dates or billing details). This ensures you can access and use our service effectively.

6.2 To Report Payment Activity to Credit Reference Agencies

A core purpose of Bits is to help you build your credit history. We share details of your subscription payments (e.g., amounts and timeliness) with credit reference agencies such as Experian and TransUnion, etc.

6.3 To Facilitate Transactions in the Bits Store

If you use the Bits Store Card to make purchases within our app, we process your personal data to authorise, process, and record these transactions.

6.4 To Facilitate Transactions on the Bits Credit Card

If you sign up for and use the Bits Credit Card to make purchases at online or in-person retailers, we process your personal data to authorise, process and record these transactions.

6.5 To Ensure Compliance with Legal and Regulatory Obligations

We process your data to meet our legal responsibilities, such as conducting identity verification and transaction monitoring, fraud or money laundering prevention, retaining records as required by law, and responding to lawful requests from authorities. This helps us operate responsibly and protect both you and our business.

6.6 To Improve and Personalise Our Service

We analyse your usage data (e.g., how you interact with the app or educational tools) to enhance our service, fix technical issues, and tailor your experience. This might include offering relevant credit education content or adjusting features based on user trends, ensuring Bits remains valuable to you.

6.7 To Communicate with You

We use your contact details to communicate with you (either directly or via third-party services) essential information and updates about your account (e.g., payment reminders, subscription changes) and respond to your inquiries via email, phone, etc. This helps us provide you with Customer Service tailored to your individual circumstances.

6.8 To Protect Our Business and Users

We process data to detect and prevent fraudulent activity, unauthorised access, or misuse of the Bits service. This includes monitoring account activity and working with third-party security providers to safeguard your information and ours.

6.9 To Assess Eligibility and Manage Risk

Using internal models, we evaluate your payment history and account activity to assess your ongoing eligibility for the service and manage our risk.

Your personal data is processed only to the extent necessary for these purposes, and we strive to limit its use to what is required to deliver the Bits service effectively. For more details on the types of data we collect and how we share it, please refer to the relevant sections of this Privacy Policy.

7. Who we may share your data with

We may share your personal data with third parties that are “controllers” in their own right, who will be responsible for how they handle your data, how it is protected and how long it is retained.

The categories of third parties we may share your data with are:

• service providers that help us deliver our service to you and/or perform our contractual obligations;
• service providers that help us improve our service;
• vendors whose goods and services are available for purchase through our App;
• payment processors that handle transactions between you and us and transactions you make using our services;
• transaction counterparties to whom we may sell or transfer parts or all of our business or assets;
• our professional advisers;
• fraud prevention agencies;
• credit reference agencies (see Section 11 (Credit Reference Agency Information Notice (CRAIN)), below, for details);
• regulators, law enforcement or other state authorities if required by law and in accordance with the appropriate procedures.

The third party controllers that we share your personal data with may include:

• Stripe: Stripe processes any payments made in the App. You can find more information about how Stripe handles your personal data here.
• Transact Payments Limited: If you sign up for the Bits Credit Card, Transact Payments Limited will be the provider of the card and will process your data according to their privacy policy.
• Thredd UK Ltd.: If you sign up for the Bits Credit Card, Thredd is the payments processing service provider who will handle transactions made on the credit card. You can find more information about how Thredd handles your data here.
• Plaid Financial Ltd.: If you sign up for Bits Rent Reporting, Bits will need to share your personal data with Plaid Financial Ltd. Bits provides you with regulated account information services as an agent of Plaid Financial Ltd., an authorised payment institution regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number: 804718) for the provision of payment services, including account information services. You can access the privacy policy of Plaid Financial Ltd. here.
• CIFAS: The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found at https://www.cifas.org.uk/fpn.

8. International transfers

Some of the third parties that we need to share your personal data with are based outside the UK, so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK.
• We may use specific contracts (approved for use in the UK) which give personal data the same protection it has in the UK. Please contact us if you want further information.

9. How long we hold your data

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We don’t want to hold your personal data longer than we need to (because keeping data secure ain’t cheap!).

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

10. Your rights

You have the following rights in relation to your personal data:

• Right to access: You can request a copy of the personal data we hold about you and check that we are lawfully processing it.
• Right to rectification: You can ask us to correct your personal data if it is inaccurate or incomplete. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes!
• Right to erasure: In certain circumstances, you can ask us to delete or remove your data from our systems.
• Right to restriction: In certain circumstances, you can ask us to stop using your personal data or limit the ways in which we can use it.
• Right to data portability: You can ask us to move, copy or transfer your personal data where you have provided consent for us to use it or where we used the information to perform a contract with you.
• Right to object: You have the right to object to our use of your personal data where we use it for our legitimate interests.

If you want to exercise your rights, please feel free to contact us using the details provided at Section 1 (About us), above.

Any complaints?

You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”), the UK’s data protection regulator. The ICO’s contact details can be found on their website at https://ico.org.uk/.

11. Credit Reference Agency Information Notice (CRAIN)

In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (CRAs): Experian, Equifax, and/or TransUnion. To do this, we will supply your personal information to CRAs and they will give us information about you.

Information we give CRAs will include information from your credit application and about your financial situation and financial history. CRAs will supply us with both public information and information on your shared credit, financial situation and financial history, as well as fraud prevention information.

We will use this information to:

• assess your creditworthiness and whether you can afford to take the product;
• check that the data you provided to us is correct;
• prevent criminal activity, fraud and money laundering;
• manage your account(s);
• trace and recover any debts; and
• ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow from Bits and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you have signed up to a Bits service that includes reporting rent payments to Credit Reference Agencies to help improve your credit score, information about your rental payments and track record as a tenant will be shared with Equifax. Equifax will add this information to the credit reference data they hold about you respectively and use it as a controller, in accordance with their fair processing notice (a copy of which can be found using the link below), including to assist organisations to:

• assess and manage any new tenancy agreements you may enter into;
• assess your financial standing to provide you with suitable products or services;
• manage any accounts that you may already hold, for example reviewing suitable products or adjusting your current product in light of your current circumstances;
• contact you in relation to any accounts you may have and recovering debts that you may owe; and
• verifying your identity, age and address, to help other organisations make decisions about the services they offer;
• help prevent crime, fraud and money laundering; and

for Equifax to:

• undertake statistical analysis, analytics and profiling; and
• conduct system and product testing and database processing activities, such as data loading, data matching and data linkage; and

Please be aware that Equifax may continue to hold and use your information following termination of your Bits services.

If you would like advice on how to improve your credit history you can access independent and impartial advice from www.moneyadviceservice.org.uk (you can get a copy of your Statutory Credit Report by visiting www.experian.co.uk/consumer/statutory-report).

If you are unhappy with anything relating to our rent reporting service, please contact us on the contact details above. You also have the ability to get in touch with the Information Commissioner’s Office. More information about this can be found using this link here: https://ico.org.uk/concerns/.

If you would like to see more information on these, and to understand how the credit reference agencies each use and share your data as bureau data (including the legitimate interests each pursues) this information is provided in the links below. The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail on the CRAIN section of each of their websites:

• Experian – www.experian.co.uk/crain
• Equifax – www.equifax.co.uk/crain
• TransUnion – https://www.transunion.co.uk/crain

12. Cookies

What’s a cookie?

A cookie is a small file of letters and numbers that is stored on your browser or the hard drive of your computer, smartphone or other device. Amongst other things, cookies can gather information about your use of the Website/App.

What types of cookies do we use?

• Essential: These cookies enable core functionality such as security, verification of identity and network management. These cookies can’t be disabled.
• Marketing: These cookies are used to track advertising effectiveness in order to provide a more relevant service and deliver better ads to suit your interests. We will always ask for your consent before placing these.
• Functional: These cookies collect data to remember choices users make and given a more personalised experience. We will always ask for your consent before placing these.
• Analytical: These cookies help us to understand how visitors interact with our Website/App, discover errors, and provide better overall analytics. We will always ask for your consent before placing these.

If you’d like to withdraw your consent to cookies, please clear your browser cookies. The next time you access the website you will be able to change your preferences.