Privacy notice

1. Who is responsible for your information

Covent Garden FX Limited is the controller of the personal information described in this notice. Our trading address is 30 Jubilee Market Hall, Covent Garden, London WC2E 8BE. Contact [email protected] or 0207 240 9921 about your information or this notice.

2. Information we collect and where it comes from

We receive information from you when you create an account, place a currency order or buyback, provide documents or declarations, visit our shop or contact us. It may include your name, contact details, address, date of birth, nationality, identity documents, company and beneficial ownership details, transaction history, payment references, bank account details, source of funds and the purpose of a transaction.

We also receive payment status information from payment providers, delivery updates from carriers, and identity, fraud, sanctions or politically exposed person screening results from verification providers such as LexisNexis. Public registers and screening sources may supply business or identity information. The precise checks depend on the transaction and our legal duties.

When you use the website, we may process IP addresses, device and browser information, security events, diagnostic errors and cookie preferences. Contact records may include emails, calls and messages you choose to send us. Do not send identity documents or bank credentials through the general enquiry form.

3. Why we use information and our lawful bases

Orders and accounts: to quote, arrange payments, complete orders and buybacks, deliver currency and answer service enquiries. Our basis is taking steps at your request before a contract or performing our contract with you.

Legal and regulatory duties: to verify identity and business ownership, assess source of funds, perform required screening, keep records and make disclosures required by law. Our basis is compliance with legal obligations, including anti-money-laundering legislation.

Security, fraud prevention, support and legal claims: to protect customers and the service, investigate problems, respond to complaints and establish or defend claims. Where this is not required by law or necessary for a contract, our basis is our legitimate interests in running a secure, reliable service and resolving disputes, balanced against your rights.

Optional analytics and marketing: where consent is required, we use these only with your consent. You can change cookie preferences or withdraw marketing consent without affecting earlier lawful use. Withdrawing marketing consent does not stop essential order or compliance messages.

4. Who receives information

Access is limited to people and organisations that need information for these purposes. Recipients may include authorised staff; identity and screening providers such as LexisNexis; payment providers such as Fena and our card processor; banks; Royal Mail and other agreed delivery providers; hosting, security, email and technical support providers; professional advisers; and authorities where disclosure is required or permitted by law.

The new website uses Cloudflare Turnstile for abuse prevention, Postmark for service email, Sentry for error diagnostics and optional Vercel Analytics. Providers may process information on our instructions or, for some activities, as independent controllers under their own notices. We do not sell your personal information.

5. Automated checks and review

Our systems use transaction information and verification results to check eligibility, identify risks and route orders for further checks. This can delay an order or require more information. Contact us if you believe information or a result is wrong, want an explanation or want a person to review an outcome. We may need to limit an explanation where disclosure would be unlawful. This notice does not ask you to waive any applicable safeguards or rights concerning automated decisions.

6. How long we keep information

Anti-money-laundering identity and transaction records are normally kept for the statutory five-year period measured from the end of the business relationship or completion of an occasional transaction, as applicable. We then delete or anonymise them unless a lawful exception permits or requires further retention.

Other records follow their purpose and applicable legal requirements: account information while needed to operate the relationship; enquiries and complaint records while needed to resolve the matter and handle relevant claims; security and diagnostic records for a proportionate operational period; and marketing preferences until changed, with a minimal suppression record where needed to respect an opt-out. A deletion request does not require us to remove records that the law requires us to keep.

7. Overseas processing

Some suppliers may process or access information outside the UK. Where a restricted transfer occurs, an appropriate legal mechanism is required, such as UK adequacy regulations or approved contractual safeguards with any necessary transfer assessment. Contact us for information about the relevant safeguards and how to obtain a copy, subject to appropriate redactions. We do not claim that all processing remains in the UK or that every supplier uses the same mechanism.

8. Cookies and security

Essential technologies support account access, security and the service you request. Optional analytics are controlled through cookie preferences. See the cookie notice and preference controls for the technologies actually enabled on the site. A map or another external service you choose to load may also receive technical information under its own privacy notice.

We use appropriate technical and organisational measures to protect information, including access restrictions and secure transmission. No system is completely secure. Please use a strong password and contact us promptly if you suspect unauthorised account access.

9. Your rights and how to exercise them

Depending on the circumstances, you can request access, correction, erasure, restriction, portability or object to processing. You can object to direct marketing at any time and withdraw consent where we rely on it. Some rights are limited where processing is legally required, including anti-money-laundering record keeping.

Contact us using the details above. We may need proportionate information to verify your identity. We normally respond without undue delay and within one month. If a lawful extension or exception applies, we will explain it. Requests are normally free; any permitted fee or refusal must meet the legal conditions.

You may complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. We would welcome the chance to address your concern first, but you do not have to contact us before approaching the ICO.

10. Incidents and changes

If a personal data breach is notifiable to the ICO, we will report it without undue delay and, where feasible, within 72 hours of becoming aware. If it is likely to result in a high risk to affected individuals, we will inform them without undue delay unless a lawful exception applies.

We will publish an effective date when this notice is approved and update it when our processing changes. If a change requires further information or consent, we will provide that before starting the affected processing.