Privacy Policy

This Privacy Policy explains how WhiteStone National Financial Services B.V. ("WhiteStone National", "we", "us", or "our") collects, uses, and shares your personal data when you use our website, mobile app, or services.

We are the data controller for the personal data we process about you. This means we are responsible for ensuring that your data is processed in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR).

1. Introduction

Your privacy matters to us. This policy is written in plain language wherever possible, but it is a legal document. If anything is unclear, please contact us using the details at the end of this policy.

2. Data we collect

We collect the following categories of personal data:

2.1 Information you provide to us

• Identity data — first name, last name, date of birth, nationality, and government-issued identity documents;
• Contact data — email address, phone number, and postal address;
• Financial data — bank account details, transaction history, income information, and source of funds;
• Communication data — messages you send to our support team and records of our responses.

2.2 Information we collect automatically

• Device data — IP address, device type, operating system, and browser version;
• Usage data — pages visited, features used, and how you interact with the app;
• Location data — approximate location derived from IP address, used for fraud prevention.

2.3 Information from third parties

• Identity verification data — from our KYC and AML service providers;
• Credit reference data — where you apply for a credit product;
• Fraud prevention data — from industry databases used to detect fraud.

3. How we use your data

We use your personal data for the following purposes:

• To verify your identity and comply with anti-money laundering obligations;
• To provide the services you have signed up for, including processing transactions and maintaining your account;
• To prevent and detect fraud, unauthorised access, and other unlawful activity;
• To communicate with you about your account, including responding to your questions and sending service notifications;
• To improve our services, by understanding how customers use them;
• To comply with legal and regulatory obligations.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Contract — processing is necessary to provide the services you have requested;
• Legal obligation — processing is required for us to comply with applicable laws, including anti-money laundering and tax reporting requirements;
• Legitimate interests — processing is necessary for our legitimate interests, such as preventing fraud and improving our services, provided these interests are not outweighed by your rights;
• Consent — where you have given us explicit consent, for example for marketing communications.

5. Sharing your data

We do not sell your personal data. We share it only where necessary to deliver our services, and always under strict contractual protections.

We may share your data with:

• Partner banks and payment processors — who hold your funds and process transactions on our behalf;
• Identity verification providers — to confirm your identity as required by law;
• Fraud prevention services — to detect and prevent fraud;
• Regulators and law enforcement — where we are legally required to do so;
• Professional advisers — such as auditors and lawyers, under confidentiality obligations.

6. Data retention

We retain your personal data for as long as your account is active, and for a period afterward as required by law. Financial records must typically be retained for at least five years after the end of the customer relationship, in accordance with Dutch and EU regulations.

When we no longer need your data, we securely delete or anonymise it.

7. Your rights

Under applicable data protection law, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you;
• Right to rectification — to ask us to correct inaccurate or incomplete data;
• Right to erasure — to ask us to delete your data, subject to legal retention obligations;
• Right to restrict processing — to ask us to limit how we use your data;
• Right to data portability — to receive your data in a commonly used, machine-readable format;
• Right to object — to object to certain processing, including direct marketing;
• Right to withdraw consent — where processing is based on consent.

To exercise any of these rights, please contact us at support@whitestonenational.com. We will respond within one month.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• End-to-end encryption of data in transit using TLS 1.3;
• Encryption at rest using AES-256;
• Strict access controls and least-privilege principles for our staff;
• Continuous monitoring of our systems for suspicious activity;
• Regular independent security audits and penetration testing.

9. International transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.

10. Cookies

We use a limited number of cookies to operate our website and understand how it is used. For full details, please see our Cookie Policy.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you by email or through the app before they take effect.

12. Contact

If you have any questions about this policy or how we handle your data, please contact:

Data Protection Officer
WhiteStone National Financial Services B.V.
Keizersgracht 123
1015 CJ Amsterdam
Netherlands
Email: privacy@whitestonenational.com

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.