PRIVACY POLICY

Last updated: 13 August 2026

Finance Act Limited, trading as ESCALO («ESCALO», «we», «us», or «our»), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit our website, contact us, use our services, communicate with us, apply for a position, or otherwise interact with ESCALO.

ESCALO is committed to processing personal data lawfully, fairly and transparently and to maintaining appropriate technical and organisational measures to protect personal data.

This Privacy Policy applies to personal data processed by ESCALO in its capacity as a controller, unless we expressly state otherwise.

1. Who We Are

The company responsible for your personal data is:

Finance Act Limited
Trading as: ESCALO
Company number: 16839569
Registered office: 58 Oswald Terrace, Sunderland, England, SR2 9RP

For privacy and data protection enquiries, please contact:

Email: support@escalo.uk

Postal address:
Finance Act Limited
58 Oswald Terrace
Sunderland
England
SR2 9RP

Where ESCALO processes personal data on behalf of a business customer and acts solely as a processor, the relevant customer may remain responsible for determining the purposes and means of processing. In those circumstances, the customer’s privacy notice and contractual arrangements may also apply.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data we process in connection with:

• visitors to the ESCALO website;
• prospective and existing customers;
• representatives, employees and authorised users of business customers;
• merchants, partners, suppliers and service providers;
• individuals who communicate with us by email, telephone, forms or other channels;
• individuals whose information is provided to us by a customer, partner or other organisation;
• applicants and prospective employees;
• directors, beneficial owners, representatives and other individuals connected with businesses that interact with ESCALO;
• individuals whose personal data is processed as part of compliance, fraud prevention, risk management, sanctions screening, AML/KYC or similar processes.

This Privacy Policy does not necessarily apply to personal data that ESCALO processes solely on behalf of another organisation where that organisation is the controller. In those circumstances, the controller’s own privacy documentation may apply.

3. What Is Personal Data?

«Personal data» means information relating to an identified or identifiable individual.

Depending on how you interact with ESCALO, this may include information such as your name, contact details, identification information, professional information, transaction information, device information, communications and other information that can reasonably be associated with you.

Personal data does not generally include information that has been irreversibly anonymised so that you can no longer be identified.

4. Personal Data We May Collect

The information we collect depends on the nature of your relationship with ESCALO.

4.1 Identity and contact information

We may collect:

• full name;
• date of birth where required;
• nationality;
• residential or business address;
• email address;
• telephone number;
• country of residence;
• identification document information;
• professional title and role;
• company and employment information;
• account identifiers and usernames.

4.2 Business and corporate information

Where you represent a business, we may collect:

• company name;
• registered office and business address;
• company registration information;
• business activity;
• website and publicly available business information;
• information about directors, officers, shareholders and beneficial owners;
• authorised representatives and account administrators;
• ownership and control information;
• business contact information;
• information required to understand the nature and purpose of the business relationship.

4.3 Financial and transaction information

Where relevant to the services we provide, we may process:

• transaction details;
• payment information;
• account and balance information;
• payment instructions;
• transaction history;
• currency and amount information;
• settlement information;
• information concerning counterparties;
• information relating to payment routes and financial operations;
• bank or payment account information;
• information required to reconcile or investigate transactions;
• information relating to failed, rejected, reversed or disputed transactions.

Where required for legal, regulatory, fraud prevention or risk management purposes, we may also process information concerning the origin or destination of funds.

4.4 Verification and compliance information

To the extent required by applicable law or our compliance procedures, we may collect:

• identity verification information;
• identification documents;
• proof of address;
• corporate documentation;
• beneficial ownership information;
• source-of-funds information;
• source-of-wealth information;
• sanctions screening results;
• politically exposed person information;
• adverse media information;
• fraud prevention information;
• information relating to financial crime or regulatory risk.

Some of this information may fall within categories of data that require additional legal protections. We process such information only where permitted and where an appropriate legal condition applies.

4.5 Communications

We may retain information contained in communications between you and ESCALO, including:

• emails;
• support requests;
• enquiries;
• meeting notes;
• correspondence;
• call records where lawful and appropriate;
• information you provide through forms;
• feedback and complaints.

4.6 Website and technical information

When you access our website or online systems, we may collect certain technical information, including:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from technical information;
• language and time-zone settings;
• pages viewed;
• links followed;
• referring website;
• access times;
• session information;
• security and diagnostic information;
• information concerning website interactions.

Where appropriate, this information may be collected through cookies or similar technologies. Further information is provided in our Cookie Policy.

4.7 Recruitment information

If you apply for a role at ESCALO, we may collect:

• name and contact details;
• CV and employment history;
• education and qualifications;
• professional experience;
• references;
• interview information;
• right-to-work information;
• information necessary to assess suitability for a role;
• information you voluntarily provide during the recruitment process.

We may also collect information from recruitment platforms, professional networking websites, referees or other sources where permitted by law.

5. How We Collect Personal Data

We may collect personal data:

• directly from you;
• when you create or use an account;
• when you submit an enquiry;
• when you communicate with us;
• when you enter into or discuss a business relationship with us;
• when you use our website or services;
• from your employer or organisation;
• from other authorised representatives;
• from business partners and service providers;
• from public and commercially available sources;
• from companies registers and other official sources;
• from fraud prevention, compliance and identity verification providers;
• from financial institutions, payment providers or other relevant counterparties where necessary and lawful;
• through cookies and similar technologies.

Where we receive your personal data from another source, we will process it in accordance with applicable data protection requirements and, where required, provide appropriate privacy information.

6. Why We Use Personal Data

We may use personal data for the following purposes.

6.1 Providing and administering our services

We may process personal data to:

• provide requested services;
• establish and manage accounts;
• communicate with customers and authorised users;
• process instructions;
• facilitate transactions and settlements;
• maintain transaction records;
• provide customer support;
• investigate operational issues;
• manage accounts and permissions;
• maintain service availability;
• provide reports and operational information.

6.2 Managing business relationships

We may process personal data to:

• communicate with customers, partners and suppliers;
• manage contracts;
• conduct onboarding;
• verify authorised representatives;
• manage account access;
• maintain business records;
• assess service requirements;
• manage commercial relationships;
• resolve disputes and complaints.

6.3 Compliance and legal obligations

We may process personal data to:

• comply with applicable laws and regulations;
• conduct KYC and AML checks;
• perform sanctions screening;
• prevent financial crime;
• detect and investigate fraud;
• meet reporting obligations;
• respond to lawful requests from public authorities;
• maintain records required by law;
• establish, exercise or defend legal claims;
• comply with court orders and other legal processes.

6.4 Risk management and security

We may use personal data to:

• protect our systems and infrastructure;
• detect suspicious activity;
• prevent unauthorised access;
• identify and investigate security incidents;
• monitor operational risks;
• protect ESCALO, our customers, partners and other individuals;
• maintain business continuity;
• investigate misuse of our services.

6.5 Improving our services and technology

We may process information to:

• analyse how our services are used;
• identify technical issues;
• improve our systems;
• develop new features;
• improve operational efficiency;
• monitor service performance;
• conduct internal analysis;
• test and improve security controls.

Where practical and appropriate, we may use aggregated or anonymised information for analytical and development purposes.

6.6 Marketing and communications

Where permitted by applicable law, we may use contact information to send information about ESCALO, our services, developments, events or relevant business communications.

Where consent is required, we will obtain it before sending the relevant marketing communications.

You may unsubscribe from marketing communications at any time.

7. Lawful Bases for Processing

We process personal data only where we have a valid legal basis.

Depending on the circumstances, these may include:

7.1 Contract

We may process personal data where it is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

For example, this may apply when we:

• onboard a customer;
• provide services;
• process authorised instructions;
• administer an account;
• communicate regarding contractual matters.

7.2 Legal obligation

We may process personal data where necessary to comply with a legal or regulatory obligation.

This may include obligations relating to:

• financial crime prevention;
• AML and KYC;
• sanctions;
• tax;
• accounting;
• regulatory reporting;
• record keeping;
• responding to lawful authorities.

7.3 Legitimate interests

We may process personal data where necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and developing our business;
• maintaining secure systems;
• preventing fraud and abuse;
• managing customer and partner relationships;
• improving services;
• protecting our legal rights;
• conducting internal administration;
• maintaining business continuity;
• communicating with business contacts.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are appropriately balanced against your rights.

7.4 Consent

Where required by law, we may rely on your consent.

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7.5 Vital interests

In limited circumstances, we may process personal data where necessary to protect someone’s vital interests.

7.6 Other lawful grounds

Where applicable, we may rely on other lawful grounds available under UK data protection law.

We determine the appropriate lawful basis before processing personal data and maintain appropriate records of our processing activities.

8. Special Category Data

Certain types of personal data receive additional protection under data protection law.

These may include information concerning:

• health;
• biometric data used for identification;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• sex life or sexual orientation.

ESCALO does not seek to collect special category data unnecessarily.

Where special category data is processed, we will do so only where permitted by applicable law and where an appropriate additional condition for processing applies.

9. Criminal Offence Data

Where appropriate and lawful, ESCALO may process information relating to criminal convictions, offences or allegations for purposes such as:

• fraud prevention;
• financial crime prevention;
• AML and KYC;
• sanctions and compliance;
• legal obligations;
• risk management.

Such information will only be processed where permitted by applicable law and with the appropriate safeguards.

10. Who We May Share Personal Data With

We may disclose personal data where necessary for the purposes described in this Privacy Policy.

Depending on the circumstances, recipients may include:

Service providers

We may use third-party providers for services such as:

• cloud hosting;
• infrastructure;
• software;
• CRM systems;
• communications;
• identity verification;
• compliance screening;
• fraud prevention;
• cybersecurity;
• analytics;
• accounting;
• legal services;
• professional services;
• customer support.

These providers may process personal data on our behalf and are required to comply with appropriate contractual and data protection requirements.

Financial and payment counterparties

Where necessary to provide services or complete transactions, information may be shared with:

• banks;
• payment institutions;
• electronic money institutions;
• payment processors;
• settlement providers;
• financial infrastructure providers;
• relevant counterparties.

Professional advisers

We may disclose information to:

• lawyers;
• auditors;
• accountants;
• insurers;
• consultants;
• other professional advisers.

Authorities and regulators

We may disclose personal data where required or permitted by law to:

• regulators;
• law enforcement agencies;
• courts;
• government authorities;
• tax authorities;
• financial crime authorities;
• other competent public bodies.

Corporate transactions

Personal data may be disclosed where necessary in connection with:

• a merger;
• acquisition;
• restructuring;
• financing;
• sale of assets;
• corporate reorganisation;
• potential transaction involving ESCALO.

Where appropriate, confidentiality and data protection safeguards will apply.

11. International Transfers

ESCALO may use service providers, partners and infrastructure located outside the United Kingdom.

As a result, personal data may be transferred to countries outside the UK.

Where a transfer is a restricted transfer under applicable UK data protection law, we will use an appropriate legal mechanism and safeguards.

Depending on the circumstances, this may include:

• transfer to a country recognised as providing an adequate level of protection;
• an applicable adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to EU Standard Contractual Clauses;
• another legally recognised transfer mechanism;
• an applicable exception where permitted by law.

Where appropriate, we assess the legal and practical protections available for international transfers and implement supplementary safeguards where required.

Information concerning international transfers is maintained as part of our data protection governance.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods depend on:

• the nature of the information;
• the purpose for which it is processed;
• the nature of our relationship with you;
• contractual requirements;
• legal and regulatory obligations;
• financial crime and compliance requirements;
• limitation periods;
• potential legal claims;
• security and audit requirements.

For example, information relating to a business relationship or transaction may need to be retained for a period after the relationship ends because of legal, accounting, regulatory, compliance or dispute-resolution requirements.

When personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our retention procedures.

Where deletion from backup systems is not immediately technically possible, data may remain in secure backups until those systems are overwritten or securely deleted in accordance with our backup lifecycle.

13. Data Security

ESCALO takes the security of personal data seriously.

We maintain technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure;
• misuse;
• other unlawful or unauthorised processing.

Depending on the nature and sensitivity of the information, security measures may include:

• access controls;
• authentication mechanisms;
• role-based permissions;
• encryption where appropriate;
• secure infrastructure;
• logging and monitoring;
• vulnerability management;
• security testing;
• backup and recovery procedures;
• staff confidentiality obligations;
• employee security training;
• incident response procedures;
• supplier security controls.

No system or method of transmission over the internet can be guaranteed to be completely secure.

If we become aware of a personal data breach that is required to be notified to the ICO or affected individuals under applicable law, we will take the required steps within the applicable timeframe.

14. Cookies and Similar Technologies

ESCALO may use cookies and similar technologies on its website.

These technologies may be used for purposes including:

• enabling essential website functionality;
• remembering preferences;
• understanding website usage;
• measuring performance;
• improving website functionality;
• maintaining security;
• supporting analytics;
• marketing, where permitted.

Where consent is required, we will request it before placing or using the relevant non-essential cookies.

You can manage cookies through your browser settings and, where available, through our cookie preference mechanism.

More information will be provided in our separate Cookie Policy.

15. Direct Marketing

Where permitted by law, ESCALO may send business communications about our services, developments, events or related information.

We will comply with applicable rules governing electronic marketing.

Where consent is required, we will obtain consent before sending marketing communications.

You can unsubscribe at any time by:

• using the unsubscribe mechanism provided in the communication; or
• contacting us at support@escalo.uk

Even where you opt out of marketing, we may continue to send essential service, contractual, security or legal communications where necessary.

16. Automated Decision-Making and Profiling

ESCALO may use automated tools or systems for purposes such as:

• fraud detection;
• transaction monitoring;
• security;
• compliance screening;
• risk assessment;
• operational analytics;
• service optimisation.

Automated processing does not necessarily constitute solely automated decision-making under applicable data protection law.

Where ESCALO carries out solely automated decision-making that has legal or similarly significant effects on an individual and the relevant legal requirements apply, we will provide the safeguards required by applicable law.

These safeguards may include appropriate information about the decision, mechanisms for requesting human intervention, and an opportunity to challenge a decision where applicable.

We will take reasonable steps to ensure that automated systems are appropriately designed, monitored and reviewed.

17. Your Data Protection Rights

Depending on the circumstances and subject to applicable legal limitations, you may have the following rights.

Right to be informed

You have the right to receive clear information about how we use your personal data.

This Privacy Policy is intended to provide that information.

Right of access

You may ask us for confirmation as to whether we process your personal data and, where applicable, request a copy of that personal data.

This is commonly known as a Subject Access Request.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may ask us to delete your personal data.

This is sometimes called the «right to be forgotten».

The right is not absolute. For example, we may be required to retain information to comply with legal obligations, establish or defend legal claims, or meet other lawful requirements.

Right to restrict processing

In certain circumstances, you may ask us to restrict the processing of your personal data.

Where processing is restricted, we may continue to store the information but will generally not use it for other purposes unless permitted by law.

Right to data portability

In certain circumstances, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and to request that it be transmitted to another controller where technically feasible and legally applicable.

Right to object

You may have the right to object to certain processing based on legitimate interests or other applicable grounds.

You have an absolute right to object to direct marketing.

Where you object to direct marketing, we will stop processing your personal data for that purpose.

Rights relating to automated decision-making

Where applicable, you may have rights relating to solely automated decisions that produce legal or similarly significant effects.

These may include rights to obtain information, request human intervention and challenge the decision.

18. How to Exercise Your Rights

To exercise any of your data protection rights, contact us at:

support@escalo.uk

You may also write to:

Finance Act Limited
58 Oswald Terrace
Sunderland
England
SR2 9RP

You do not generally have to use a particular form or wording when making a request.

To protect personal data, we may need to verify your identity before responding to a request.

Where we reasonably require additional information to verify your identity, we may ask you to provide appropriate information.

We will respond to valid requests without undue delay and generally within one calendar month.

Where legally permitted, this period may be extended by up to a further two months where a request is complex or where we have received a number of requests.

If an extension is required, we will inform you within the applicable initial period and explain why.

We will not normally charge a fee for exercising your rights.

However, where permitted by law, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

19. Complaints

If you have concerns about how ESCALO processes your personal data, we encourage you to contact us first so that we can investigate and attempt to resolve the issue.

You also have the right to lodge a complaint with the UK’s data protection regulator:

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk/

The ICO is the UK’s independent supervisory authority responsible for data protection and privacy matters.

Nothing in this Privacy Policy limits your legal right to complain to the ICO or seek a judicial remedy.

20. Third-Party Websites and Services

Our website may contain links to websites, applications or services operated by third parties.

Those third parties may have their own privacy policies and data processing practices.

ESCALO is not responsible for the privacy practices of third-party websites or services that we do not control.

We encourage you to review the privacy notice of any third-party service before providing personal data.

21. Children

Our website and business services are generally intended for businesses and adults.

We do not knowingly collect personal data from children where such collection is not appropriate or permitted.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact us at support@escalo.uk

If we become aware that we have collected personal data from a child in circumstances where we should not have done so, we will take reasonable steps to address the situation.

22. Confidentiality and Business Information

Some information provided to ESCALO may constitute confidential business information rather than personal data.

This Privacy Policy concerns personal data and does not replace contractual confidentiality obligations, non-disclosure agreements, terms of service or other agreements that may apply to a business relationship.

Where applicable, confidential business information will be handled in accordance with the relevant contractual and legal obligations.

23. Data Accuracy

We seek to keep personal data accurate and up to date where necessary for the purposes for which it is processed.

You should notify us if information you have provided to us changes or is inaccurate.

Where appropriate, we may verify or update information using reliable sources, particularly where accuracy is important for compliance, security, financial or operational purposes.

24. Data Minimisation

ESCALO seeks to collect and process only personal data that is reasonably necessary for the relevant purpose.

We do not intend to collect personal data simply because it is available.

The information required may differ depending on the service, relationship, transaction, regulatory requirement or other circumstances.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to our services;
• changes to our business;
• changes in technology;
• changes to applicable law;
• regulatory developments;
• changes in how we process personal data;
• improvements to the clarity or accuracy of this notice.

When we make material changes, we will take reasonable steps to bring those changes to your attention where required.

The «Last updated» date at the beginning of this Privacy Policy indicates when the document was most recently updated.

26. Contact Us

If you have any questions about this Privacy Policy, how we process personal data, or your data protection rights, please contact us.

Finance Act Limited trading as ESCALO

Registered office:
58 Oswald Terrace
Sunderland
England
SR2 9RP

Company number: 16839569

Privacy contact:
support@escalo.uk

27. Important Information About This Privacy Policy

This Privacy Policy is intended to explain how ESCALO handles personal data in a clear and transparent manner.

It does not create contractual rights beyond those provided by applicable law or any separate agreement between ESCALO and a customer, partner, employee or other individual.

Where a specific contractual agreement, service-specific privacy notice or other legally required notice provides more specific information about a particular processing activity, that information may apply in addition to this Privacy Policy.

This Privacy Policy should be read together with any applicable:

• Terms and Conditions;
• Cookie Policy;
• AML/KYC documentation;
• Risk and Compliance documentation;
• Customer agreements;
• recruitment privacy information;
• other service-specific notices.