Invest in Gold

This Privacy Policy (“Policy”) expresses our firm commitment to aid our users and visitors better understand what information we collect about them and what may happen to that information.

This Policy explains what we collect and how we use your personal data when you use our website https://www.aspora.com/, our mobile application (available on Android and IOS), (jointly referred as “Website” or “Platform”). and provide your information while using the services available on the Website and other services provided by Aspora (formerly known as ‘Vance’) (“Services”), and how we use and disclose that information. If anything here applies to only one of our Services or to customers in a particular country, we’ll explicitly point this out to you. This Policy applies to individuals located in the United Kingdom who use the Platform and the Services, and is issued in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), each as amended from time to time (including by the Data (Use and Access) Act 2025) (together, “UK Data Protection Law”).

If you have any questions or comments about the Policy, please contact us at dpo@aspora.com. Your use of the Website and/or Services and any personal information you provide on the Website remains subject to the terms of the Policy and our term of use policy available on our website. If you have a complaint about how we use your personal information, you may contact our Data Protection Officer (“DPO”), who may be reached at dpo@aspora.com. We will acknowledge your complaint within 30 (thirty) days of receipt, take appropriate steps to respond to it without undue delay and inform you of the outcome. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (“ICO”), as described in Section 13 below .

1. Data controller

The Data Controller for the collection and use of the Personal Information (as defined below) is Vance Technologies Limited, a company incorporated in England and Wales with company number 14378396 and having its registered office at 141 Curtain Road, 3rd Floor, London, England, EC2A 3BX, operating under the brand name ‘Aspora’ (formerly known as ‘Vance’).

2. Gathering of your personal information

2.1 “Personal information” (or “personal data”) means any information relating to an identified or identifiable living individual which, whether on its own or in combination with other information, may be used to identify or contact you, such as: name, address, email address, phone number, online identifier etc., and has the meaning given to “personal data” under UK Data Protection Law.

2.2 The specific personal details we gather from you depend on how you interact with our Platform. This includes but is not limited to information such as your name, gender, age, mailing address, phone number, email address, contact preferences, identification proof, photo, bank account/credit card/debit card details, Know Your Customer (KYC) details, passport, driving licence or other government-issued identification details and proof of address, and any other relevant information that helps us or our partners verify your identity. In connection with our gold services (the “Gold Services”) provided by Goldwise Holdings Limited (the “Authorised Vendor”), we may additionally collect information relating to: gold purchase and sale transaction history; gold holdings and vault/custody account details; gold delivery or redemption preferences; source of funds information required for AML/CFT compliance; and risk profile information relevant to your use of our gold investment services. We may also collect your marketing communication preferences, including which Marketing Channels you have consented to receive communications through. Where you choose to verify your identity using a selfie, video or liveness check, we (or our identity verification provider) may also process biometric data, as described in Section 6.5 below.

2.3 In connection with specific features of the Gold Services, Aspora additionally collects: (i) in respect of a recurring gold purchase established under a standing instruction (a “SIP”), the SIP mandate, tokenised card and payment authorisation records, pre-debit notification records, and, where the applicable compliance threshold is met, enhanced KYC Information; and (ii) in respect of an order for physical delivery of gold (a “Physical Gold Delivery Order”), a record of the verification of the government-issued identification document produced at handover, the delivery address, and delivery tracking, failed-delivery and redelivery records. Each category is addressed further in Sections 8 and 9 below.

2.4 If we determine it necessary, at our own discretion, we may also request and collect additional information from third parties. This could involve obtaining credit-related or identity verification information from a credit reference agency or fraud prevention agency (to the extent permitted by law) or verifying the identification details you provided during registration.

2.5 You acknowledge that it is your responsibility to ensure that your personal information is always accurate, complete, and up-to-date. We will also make reasonable efforts to give you the opportunity to request corrections to your personal information if it is found to be inaccurate. Additionally, you can request the deletion of your personal information, subject to applicable law. However, we may refuse or limit a request where we are permitted to do so under UK Data Protection Law, for example where the request is manifestly unfounded or excessive, where complying would adversely affect the rights and freedoms of others, or where we are required by law to retain the relevant personal information. Where we refuse or limit a request, we will tell you why and inform you of your right to complain to the ICO.

2.6 Children: Our Platform and Services are intended only for individuals aged 18 (eighteen) years or over. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under the age of 18 (eighteen) years without a lawful basis, we will take steps to delete that information promptly.

3. Information obtained through your usage of our service

3.1 We offer various Services that help you efficiently manage the contact information you provide to us as part of our Services. Typically, these contacts include details about individuals (or organizations), such as their names, email addresses, phone numbers, and online identifiers. In addition to this basic information, your Contacts may also include supplementary details about individuals, including their affiliations with organizations, job titles, birthdays, important dates, age, gender, general location, relationships, skills, interests, preferences, personal notes, photos, tags, and other categorizations.

3.2 Through our Services, we provide tools to effectively manage the contact information you provide. Your Contacts play a crucial role in establishing connections and relationships. They contain information about individuals (or organizations), including names, email addresses, phone numbers, and online identifiers. Moreover, your Contacts may include additional details, such as organizational affiliations, job titles, birthdays, important dates, age, gender, general location, relationships, skills, interests, preferences, personal notes, photos, tags, and other categorizations.

3.3 Contact book access: The Contacts you create reflect certain relationships between you and the people or organizations they represent. These Contacts may explicitly indicate the nature of the relationship. Additionally, we may deduce the strength or nature of a relationship based on the presence or absence of specific contact information, such as mobile numbers or key dates, as well as shared elements like physical addresses or organizational affiliations. Inferred relationship information can also be derived from your interactions with individual Contacts, such as frequency of access or modification.

3.4 Connected Services: Many of our Services allow you to connect with external systems or databases that might contain information about your relationships. This includes “connections” on social networks or other platforms.

4. Gathering of automatic information, utilization of cookies and similar tracking technologies

4.1 We collect browser and cookie information when you first navigate to our websites. We use cookies to give you a better customer experience and for use of access. Certain cookies will allow you to leave and re-enter the Platform without re-entering your password. This will be monitored by a web server.

4.2 Cookies are text files stored, either on a temporary or persistent basis on the hard drive of your computer. Cookies are used for authenticating, session tracking and maintaining specific information about the use and users of the Platform (including user site preferences or the contents of electronic shopping carts). Cookie files may also be placed on your computer by Google Analytics for the purposes as set out in this paragraph.

4.3 Some of the data collected by cookies may constitute personal information under UK Data Protection Law (for example, where it includes an online identifier that can be linked to you). You can delete all cookies that are already on your computer’s hard drive by searching for files with “cookie” in it and deleting them. In addition, if you want to stop cookies from being stored on your computer, you can edit your browser settings so that cookies are blocked. Unfortunately, if you block cookies, you may not be able to use the full functionality of the Platform.

4.4 Web beacons consist of a small string of software code that represents a graphic image request on a Web page or email. There may or may not be a visible graphic image associated with the web beacon and often the image is designed to blend into the background of a Web page or email. Web beacons can be used for many purposes – including site traffic reporting, unique visitor counts, advertising auditing and reporting, and personalization. Web beacons used by Aspora are subject to the same consent requirements as cookies, as described in Section 4.7 below.

4.5 In order to improve the Platform and the Services, we use (temporary and persistent) cookies, authorised third parties cookies, web beacons and/or other technologies to collect data (which may include personal information). This data helps us to track browsing behaviour, to create specific or tailor-made offers or advertisements, and to monitor and record the visits and use of the Platform.

4.6 In order to understand how people use the Platform and for marketing analysis and quality improvement purposes, we (and/or third party service providers) may collect, record, and use on an anonymised or pseudonymised basis certain information (including the total number of transactions, viewed web pages, referring/exit pages, platform type, date/time stamp information and details like the number and location of mouse clicks on a given page, mouse movements, scrolling activity and the search words you use while being on and using the Platform.

4.7 In accordance with PECR, we will only store or access cookies and similar technologies on your device that are not strictly necessary for the provision of the Platform where you have given your consent through our cookie banner or consent management tool, save where UK Data Protection Law permits their use without consent (for example, cookies used solely to collect statistical information to improve the Platform, or to adapt its appearance or functionality to your preferences), in which case we will provide you with clear information about them and a simple and free means of objecting to them. You can change your cookie preferences or withdraw your consent at any time via dpo@aspora.com. You further agree to use the Platform only for lawful purposes.

4.8 From time to time you may find links to third party websites on the Platform. These links are provided for your information only and are not recommended by Aspora. Aspora has no control over the content of third party sites and accepts no responsibility or liability for them or for any loss or damage that may arise from your use of them. When accessing a third party website, you are advised to check such website’s terms of service and privacy policy to ensure compliance with applicable laws.

5. Gathering of personal information from social networking platforms

5.1 You may at times be permitted to log into our Website through your other social networking accounts. If you choose to do so, you will need to provide your email address and password associated with those social networking accounts. In order to proceed, we will request your permission to access and gather your basic information, which includes your name, profile picture, gender, networks, user IDs, date of birth, email address, and any other publicly available information on your account. If you grant us access to this information, we will be able to retrieve it even if you have not made it publicly visible. The information we receive from these social networking sites is stored along with the other information we collect or receive from you.

5.2 Please note that the information collected by these social networking sites is governed by their own policies. If you would like to understand how these sites utilize and disclose your information, including any publicly shared information, we recommend referring to the respective privacy policies of the social networking sites. We have no control over how any third-party site utilizes or discloses the personal information it gathers about you.

6. How Aspora uses the collected information

6.1 How Personal Information Is Used

We collect your personal information and aggregate information about the use of our Website and Services to better understand your needs and to provide you with a better Website experience. Specifically, we may use your personal information for any of the following reasons on the lawful bases described in Section 6.4 below:

(a) To provide our Services to you, including registering you for our Services, verifying your identity and authority to use our Services, facilitating the purchase, sale, and holding of digital gold through our Platform, processing gold transactions and associated settlement instructions, and to otherwise enable you to use our Website and our Services;

(b) For customer support and to respond to your inquiries;

(c) For internal record-keeping purposes;

(d) To process billing and payment, including sharing with third party payment gateways in connection with Website and/or Services;

(e) To improve and maintain our Website and our Services (for example, we track information entered through the “Search” function; this helps us determine which areas of our Website users like best and areas that we may want to enhance; we also will use for trouble-shooting purposes, where applicable);

(f) Where you have provided your consent, or where otherwise permitted by PECR (including under the “soft opt-in” described in Section 7.1 below), in accordance with UK Data Protection Law, to send you marketing and promotional communications regarding our gold services, special offers, gold price alerts, new product launches, and other information about Aspora that we think you may find interesting, through any or all of the following channels: email, telephone calls, SMS/text messages, WhatsApp, and other social media platforms and electronic messaging services (collectively, “Marketing Communications”);

(g) To contact you via email, telephone (including telemarketing calls), facsimile, mail, SMS/text message, WhatsApp, and other electronic messaging platforms and social media channels, to deliver certain services or information, including service-related notifications regarding your gold holdings, transaction confirmations, gold price movements, or other matters relevant to your use of our Services; and, where you have provided consent, for Marketing Communications;

(h) For Aspora’s market research purposes, including, but not limited to, the customization of the Website or Services according to your interests;

(i) To share your personal information with our gold product partners, within the UK or outside the UK (including but not limited to partners in the United Arab Emirates and the United States, subject to applicable laws), for the purpose of making available to you gold leasing options and related gold yield products through the Platform. Such sharing will be carried out on the basis of our contract with you and, where required by applicable law, subject to the safeguards governing the international transfer of your personal data described in Section 11.6 below. By using the gold leasing features of the Platform, you acknowledge that your personal data may be transferred to and processed by such partners in jurisdictions outside the UK.

(j) We may use your demographic information (i.e., age, postal code, residential and commercial addresses, and other various data) to more effectively facilitate the promotion of goods and services to appropriate target audiences and for other research and analytical purposes (you may object to such processing at any time, as described in Section 13.3 below);

(k) To resolve disputes, to protect ourselves and other users of our Website and/or Services, and to enforce our Website’s terms and conditions;

(l) We also may compare personal information collected through the Website and/or Services to verify its accuracy with personal information collected from third parties; and

(m) We may combine aggregate data with the personal information we collect about you.

6.2 From time to time, Aspora may seek to use personal information for purposes not previously disclosed in this Policy. Where any such new purpose is compatible with the original purpose for which the information was collected, Aspora will update this Policy and provide you with advance notice of the change before commencing the new processing. Where the new purpose is not compatible with the original purpose within the meaning of UK Data Protection Law, Aspora will not commence such processing until it has provided you with advance notice and either obtained your consent or is otherwise permitted or required to carry out such processing by UK Data Protection Law or other applicable law. This Policy will be updated to reflect any such changes, and the updated version will be posted on our Platform with the revised effective date.

6.3 Where you have provided your explicit and informed consent through a separate, unbundled consent mechanism at the point of registration or at any later stage, you agree and provide consent to Aspora sharing marketing and promotional details with you through telemarketing, including but not limited to: emails, telephone calls, SMS/text messages, WhatsApp messages, and other social media platforms and electronic communication channels (“Marketing Channels”). Such consent is given freely, specifically, and with full knowledge of its scope, in accordance with UK Data Protection Law, including PECR. Registration or provision of information on the Platform alone shall not be construed as consent to receive Marketing Communications; consent must be actively and separately provided. Where your telephone number is registered with the Telephone Preference Service (“TPS”) or the Corporate Telephone Preference Service (“CTPS”), Aspora will only make live marketing calls to you where you have separately notified Aspora that, for the time being, you do not object to receiving such calls notwithstanding your TPS or CTPS registration, which you may record by checking the relevant consent box at the time of registration or in your account settings.

6.4 Lawful Bases for Processing: Under UK Data Protection Law, we must have a lawful basis for each purpose for which we process your personal information. We rely on the following lawful bases: (i) performance of our contract with you, or taking steps at your request before entering into a contract (for the purposes described in paragraphs (a), (b), (d), (g) (in respect of service communications) and (i) of Section 6.1 above); (ii) compliance with a legal obligation to which we are subject, including our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the “MLRs”), the Proceeds of Crime Act 2002, the Terrorism Act 2000, UK financial sanctions legislation and UK tax and accounting legislation (for identity verification, KYC, customer due diligence, sanctions screening, record-keeping and regulatory reporting purposes); (iii) our legitimate interests (or those of a third party), provided that those interests are not overridden by your interests or fundamental rights and freedoms (for the purposes described in paragraphs (c), (e), (h), (j), (k), (l) and (m) of Section 6.1 above, and for fraud prevention, network and information security, and the establishment, exercise or defence of legal claims); and (iv) your consent (for Marketing Communications where consent is required under PECR, for non-essential cookies, and for the processing of biometric data described in Section 6.5 below). Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Where we rely on legitimate interests, you have the right to object to that processing, as described in Section 13.3 below. Where the provision of personal information is a statutory or contractual requirement (for example, for KYC purposes) and you do not provide it, we may be unable to provide the Services to you.

6.5 Special Category and Criminal Offence Data: Where you choose to verify your identity using a selfie, video or liveness check, we or our identity verification provider may use facial recognition technology to compare your image with your identity document, which involves the processing of biometric data for the purpose of uniquely identifying you. We will only process such biometric data with your explicit consent or where otherwise permitted under Article 9 of the UK GDPR and Schedule 1 to the DPA 2018 and, where you do not wish to give such consent, [an alternative means of verifying your identity will be made available to you]. In the course of sanctions, politically exposed person (PEP) and adverse media screening and fraud prevention checks, we may also process personal information relating to criminal convictions and offences, or information revealing political opinions, where this is necessary to comply with our legal and regulatory obligations or for the prevention or detection of unlawful acts, in accordance with Schedule 1 to the DPA 2018 and our appropriate policy document.

7. Marketing and promotional communications

7.1 Aspora may contact you with marketing and promotional details relating to our gold purchase, sale, and investment services, as well as other products and services offered by Aspora, through the Marketing Channels, including: (i) email; (ii) telephone calls; (iii) SMS and text messages; (iv) WhatsApp and instant messaging platforms; and (v) other social media platforms and electronic communication channels. Such Marketing Communications will only be sent where you have provided your prior, specific, informed and freely given consent in accordance with UK Data Protection Law, including PECR, save that, where permitted by PECR, Aspora may send you marketing emails and SMS messages about its own similar products and services where you have provided your contact details to us in the course of purchasing or negotiating the purchase of our Services and were given a simple means of refusing such communications at the time your details were collected and in each subsequent message (the “soft opt-in”). Your consent to receive Marketing Communications is separate from, and does not form part of, your acceptance of this Policy or our terms of use, or your registration on the Platform.

7.2 Nature of Consent: By checking the designated marketing consent checkbox at the time of registration on the Platform or at any time thereafter in your account settings, you explicitly agree and provide your consent to Aspora contacting you with marketing and promotional details through the Marketing Channels selected by you. Your consent is: (i) freely given — it is not a condition of registration or use of the Platform; (ii) specific — it relates to marketing communications from Aspora regarding its gold and financial services; (iii) informed — you have read this Policy and understand the nature and channels of communications; and (iv) unambiguous — it is given through a clear, affirmative action (an active tick-box). Pre-ticked or pre-selected consent checkboxes are not used by Aspora. Consent will not be inferred from your mere registration or use of the Platform.

7.3 Telemarketing Compliance: Where Aspora makes or facilitates marketing telephone calls, it shall comply with PECR and applicable guidance issued by the ICO, including by: (i) only making calls at reasonable times; (ii) identifying itself and the purpose of the call at the outset of each call and presenting a valid calling line identification number on which you can contact us; (iii) screening telephone numbers against the TPS and CTPS registers and not making live marketing calls to numbers registered with the TPS or CTPS, unless you have notified us that, for the time being, you do not object to receiving such calls; (iv) not making automated marketing calls unless you have specifically consented to receive them; and (v) maintaining a suppression list of individuals who have asked not to be contacted. Any complaints about marketing calls may be made in accordance with Section 13.6 below.

7.4 Withdrawal of Consent: You may withdraw your consent to receive Marketing Communications at any time, without affecting the lawfulness of any marketing carried out prior to your withdrawal, by: (i) following the unsubscribe link in any marketing email; (ii) replying “STOP” to any marketing SMS; (iii) updating your communication preferences in your account settings on the Platform; (iv) emailing dpo@aspora.com; or (v) telling us during any marketing call. Withdrawal of marketing consent will not affect your ability to use the Platform or our Services, and Aspora will continue to send you transactional and service communications necessary for the provision of our Services to you.

8. Recurring gold purchases (SIP)

8.1 In connection with an SIP, Aspora and its payment service provider process the following Personal Information, in addition to the KYC Information and Transaction data otherwise described in this Policy: (a) the SIP mandate, comprising the amount, frequency, debit date and the payment card or method nominated for that SIP; (b) card tokenisation data, being the tokenised representation of the Customer’s payment card and the associated consent record (amount, frequency and time) held by Aspora’s payment service provider for merchant-initiated Transactions, it being noted that neither Aspora nor the Authorised Vendor retains the full card number; (c) authentication records generated on the establishment or amendment of a SIP mandate, including the strong customer authentication (such as 3-D Secure) obtained in accordance with the Payment Services Regulations 2017 on the initial card authorisation and, on any change of payment card, the zero-value verification authorisation obtained for the replacement card; (d) the pre-debit notification record confirming that notice of an upcoming scheduled debit has been sent to the Customer’s registered contact channel, together with the amount and due date stated in that notice; (e) the status of each SIP cycle, including any failed debit, retry, missed cycle or refund, and the price, spread, fees and quantity of gold recorded in the Transaction confirmation; and (f) where the Customer’s cumulative purchases under a SIP, or any other measure applied by the Authorised Vendor, exceed such threshold as may be notified to the Customer, enhanced KYC Information, including source-of-funds or source-of-wealth information, obtained prior to the processing of further purchases under that SIP, in accordance with applicable anti-money laundering law, including the MLRs.

8.2 This Personal Information is processed to establish, execute, monitor and, where necessary, reverse purchases made under a SIP; to issue the notifications referred to above; to prevent fraud; and to comply with Aspora’s obligations under applicable anti-money laundering and counter-terrorism financing law. It is disclosed to the Authorised Vendor, as the party executing the relevant purchase, and to Aspora’s payment service provider, the relevant card network, acquiring bank and payment gateway, each acting as an independent Controller or as Aspora’s Processor for the purpose of processing payments under the SIP, as further described in the Section 11.1 below.

8.3 Cancellation of a SIP terminates the collection of further Personal Information under that mandate but does not affect records of purchases already completed, which continue to be held in accordance with Section 15 of this Policy.

9. Physical gold delivery

9.1 Where a Customer places a Physical Gold Delivery Order, the Authorised Vendor, as supplier, and its appointed logistics partners process the following Personal Information, in addition to the Customer’s existing KYC Information: (a) identity verification at handover, comprising the record of verification of the original government-issued identification document (the Customer’s passport, UK photocard driving licence or other government-issued photographic identification accepted by the Authorised Vendor) produced by the named recipient at the point of delivery, including the type of document produced and the outcome of the verification; (b) the delivery address and dispatch information provided by the Customer at checkout; (c) delivery tracking records, comprising allocation, dispatch and delivery-attempt timestamps, the identity of the courier or logistics partner, and the tracking status made available to the Customer in the Aspora App; and (d) failed-delivery and redelivery records, comprising the record of each unsuccessful delivery attempt, of the secure storage of the relevant product, of any redelivery or collection arranged by the Customer and the fee applicable to it, and of any resulting reversal, refund or restoration of digital gold to the Customer’s Gold Holding.

9.2 Aspora does not require the Customer to submit a further copy of the identification document referred to above where it already forms part of the Customer’s KYC Information, save where additional verification is required by law or is reasonably necessary for fraud prevention, compliance or fulfilment.

9.3 This Personal Information is processed to fulfil the Physical Gold Delivery Order, to confirm that gold is delivered only to the named recipient, to provide delivery tracking and status updates, to investigate and resolve a failed delivery or a missing, incorrect or defective product, and to comply with the Authorised Vendor’s insurance, anti-money laundering and consumer-protection obligations (including under the Consumer Rights Act 2015). It is disclosed to the Authorised Vendor and to the logistics or courier partners it appoints, each of which receives only the Personal Information necessary to perform delivery, and, where a product issue is raised, to the Authorised Vendor for investigation and resolution, as further described in Section 11.1 below.

10. Security

We implement appropriate technical and organisational security measures, as required by UK Data Protection Law, which are designed to protect your personal information from unauthorized access or disclosure. Aspora may use encryption, passwords, and physical security measures to help protect your personal information against unauthorized access and disclosure. No security measures, however, are 100% complete. Therefore, we do not promise and cannot guarantee, and thus you should not expect, that your personal information or private communications will not be collected and used by others. You should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. To the extent permitted by law, Aspora is not responsible for any unauthorised use of your information or activity on your account resulting from your failure to keep your password and log-in credentials secure. Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will notify the ICO where required by UK Data Protection Law.

11. Disclosure

We may share the information that we collect about you, including your personal information, as follows:

11.1 Third-Party Roles And Data Sharing: In connection with the Gold Services, Personal Information may be processed by more than one entity, each occupying a distinct role as controller or processor (respectively, “Controller” and “Processor”) under UK Data Protection Law and other applicable data protection law. Aspora acts as Controller of the Personal Information it collects for onboarding, KYC, the functionality of the Aspora App, first-level customer support and the administration of the Customer’s account. The Authorised Vendor acts as an independent Controller of Personal Information it processes to perform the Gold Services (including the purchase, sale, storage, redemption and delivery of gold and the execution of a SIP) and, in certain circumstances, as Aspora’s Processor where it processes Personal Information solely on Aspora’s documented instructions. A Vault Operator appointed by the Authorised Vendor acts as the Authorised Vendor’s Processor, or as an independent Controller where required by applicable law, in each case for the limited custody and vaulting purposes disclosed to the Customer. A logistics or delivery partner appointed by the Authorised Vendor acts as a Processor and receives only the Personal Information necessary to perform delivery, including identity verification at handover. A payment provider, acquirer, card network or payment gateway acts as an independent Controller or Processor of payment data, including SIP mandate and card tokenisation data, in accordance with its own terms and applicable payment-network rules. Each entity is responsible for its own compliance with applicable data protection law in respect of the Personal Information it Controls, and this Policy describes only the processing for which Aspora is responsible as Controller or, where applicable, Processor.

11.2 Information Disclosed To Protect Us And Others: We may disclose your information including Personal Information if: (i) it is pursuant to Services that you have requested; (ii) Aspora reasonably believes that disclosure is necessary in order to comply with a legal process (such as a court order, search warrant, etc.) or other legal requirement of any governmental authority, (iii) disclosure would potentially mitigate our liability in an actual or potential lawsuit, (iv) reasonably necessary to enforce this Policy, our terms and conditions etc. (v) disclosure is intended to help investigate or prevent unauthorized transactions or other illegal activities, or (vi) necessary or appropriate to protect our rights or property, or the rights or property of any person or entity.

11.3 Information Disclosed To Third Party Service Providers And Business Partners: We may contract with various third parties for the provision and maintenance of the Website, Services and our business operations, and Aspora may need to share your personal information and data generated by cookies and aggregate information (collectively, “information”) with these vendors and service agencies. For example, we may provide your information to a credit card processing company to process your payment. The vendors and service agencies will not receive any right to use your personal information beyond what is necessary to perform its obligations to provide the Services to you. If you complete a survey, we also may share your information with the survey provider; if we offer a survey in conjunction with another entity, we also will disclose the results to that entity.

11.4 Information Disclosed To Law Enforcement Or Government Officials: We will disclose your information, including, without limitation, your name, town or city, postcode, telephone number, email address, user ID history, quoting and listing history, and fraud complaints, to law enforcement or other government officials (including, where applicable, the National Crime Agency, HM Revenue & Customs, HM Treasury’s Office of Financial Sanctions Implementation and the police) if we are required to do so by law, regulation or other government authority or otherwise in cooperation with an investigation of a governmental authority.

11.5 Information Disclosed At Your Request: We may share your personal information with other users or third parties to whom you explicitly ask us to send your information or if you explicitly consent to such disclosure upon receipt of a specific Service.

11.6 International Transfers Of Personal Information: Aspora is part of a group of companies with operations outside the UK, and certain of our service providers and partners (including the Authorised Vendor, our technology and customer support providers and our gold product partners) may be located in, or process personal information from, countries outside the UK, including [the United Arab Emirates, India and the United States]. Where we transfer your personal information outside the UK, we will ensure that the transfer is made in accordance with UK Data Protection Law by relying on: (i) UK adequacy regulations in respect of the destination country (including, for certified US organisations, the UK Extension to the EU-US Data Privacy Framework); (ii) appropriate safeguards, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses issued under UK Data Protection Law, together with a transfer risk assessment; or (iii) where applicable, an exception permitted under UK Data Protection Law. You may request further information about, or a copy of, the safeguards we use by contacting us at dpo@aspora.com.

12. Links to external websites

The Website may contain links to other websites or resources over which Aspora does not have any control. Such links do not constitute an endorsement by Aspora of those external websites. You acknowledge that Aspora is providing these links to you only as a convenience, and further agree that Aspora is not responsible for the content of such external websites. We are not responsible for the protection and privacy of any information which you provide while visiting such external websites and such sites are not governed by this Policy. Your use of any external website is subject to the terms of use and privacy policy located on the linked to external website.

13. Updating, deleting and correcting your personal information

13.1 You may choose to restrict the collection or use of your personal information in the following ways: You can review, correct and delete your personal information by emailing us at dpo@aspora.com. You must promptly reach out to us to change your information if your personal information changes or is inaccurate. We may need to request specific information from you to verify your identity before acting on your request, to ensure that your personal information is not disclosed to, or changed by, any person who is not entitled to it.

13.2 Notwithstanding account closure or a request for erasure, Aspora is required to retain certain categories of Personal Information from closed accounts for the mandatory periods set out in Section 15 of this Policy, including to comply with its anti-money laundering and counter-terrorist financing obligations ( including under the MLRs, the Proceeds of Crime Act 2002 and the Terrorism Act 2000), its tax and VAT record-keeping obligations (including under the Finance Act 1998, the Value Added Tax Act 1994 and the Companies Act 2006), to establish, exercise or defend legal claims within the limitation periods under the Limitation Act 1980 , and otherwise to prevent fraud, collect any fees owed, resolve disputes, investigate complaints, enforce these terms and take any other action permitted by applicable law. Where Personal Information that Aspora is required by law to retain is the subject of an erasure request, Aspora will inform the Customer of this and will restrict processing of that data to the extent possible pending expiry of the relevant mandatory retention period, after which it will be securely deleted or anonymised. Following deletion or removal of an account (including at the end of any applicable retention period), Aspora shall not be responsible for any Personal Information not included within the deleted or removed account.

13.3 Your Rights: Subject to the conditions and exemptions set out in UK Data Protection Law, you have the following rights in relation to your personal information: (i) the right to be informed about how we collect and use your personal information; (ii) the right of access to your personal information and to receive a copy of it; (iii) the right to rectification of inaccurate or incomplete personal information; (iv) the right to erasure of your personal information; (v) the right to restrict our processing of your personal information; (vi) the right to data portability, being the right to receive the personal information you have provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where our processing is based on your consent or our contract with you and is carried out by automated means; (vii) the right to object at any time to processing based on our legitimate interests and an absolute right to object to processing for direct marketing purposes (including profiling related to direct marketing); (viii) where our processing is based on your consent, the right to withdraw your consent at any time; and (ix) rights in relation to automated decision-making, as described in Section 13.4 below.

13.4 Automated Decision-Making: As part of our onboarding, KYC, fraud prevention and transaction monitoring processes, we may use automated tools, including to verify your identity, to screen against sanctions and PEP lists and to identify potentially fraudulent or suspicious activity. Where we take a decision based solely on automated processing which produces legal or similarly significant effects for you (for example, declining to open an account or blocking a Transaction), we will inform you of the decision and put in place appropriate safeguards, including enabling you to make representations about the decision, to obtain human intervention on our part and to contest the decision. We will not take such decisions on the basis of special category data except where permitted by UK Data Protection Law.

13.5 Exercising Your Rights: You may exercise any of your rights by contacting our DPO at dpo@aspora.com. We will respond to your request without undue delay and in any event within one (1) month of receipt (or, where we have asked you for information to confirm your identity or to clarify your request, within one (1) month of receiving that information). This period may be extended by up to a further two (2) months where requests are complex or numerous, in which case we will inform you of the extension and the reasons for it within the initial one (1) month period. When responding to a request for access, we will carry out reasonable and proportionate searches for your personal information. We will not usually charge a fee, but we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

13.6 Complaints: If you are dissatisfied with how we have handled your personal information, we encourage you to contact our DPO first at dpo@aspora.com so that we can try to resolve your complaint. We will acknowledge your complaint within 30 (thirty) days of receipt, take appropriate steps to investigate it without undue delay, keep you informed of its progress and inform you of the outcome. You also have the right to lodge a complaint with the Information Commissioner’s Office (or its successor, the Information Commission), the UK supervisory authority for data protection, at telephone 0303 123 1113; website www.ico.org.uk.

14. What choices do I have regarding use of my personal information?

Where you have consented to receive Marketing Communications, we may send you promotional or informational messages regarding our gold services, special offers, gold price updates, and other matters of interest via the Marketing Channels you have consented to. You may withdraw your consent or opt-out of any or all Marketing Channels at any time by: (i) following the unsubscribe instructions in any email we send you; (ii) replying “STOP” to any SMS we send you; (iii) updating your communication preferences in your account settings on the Platform; (iv) contacting us at dpo@aspora.com; or (v) telling us during any marketing call. We will action opt-out requests as soon as possible and, in any event, within [15] business days. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal. Even if you opt-out of Marketing Communications, we may still send you transactional or service-related communications regarding your gold holdings, account activity, or any Services you have requested or received from us, as these are necessary for the performance of our contract with you.

15. Data retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, tax, accounting, and reporting obligations. The specific retention period applicable to your personal data depends on the category of data and the purpose for which it is held. In all cases, where multiple legal obligations apply to the same record, we will retain it for the longest applicable period. The following periods apply to the principal categories of personal data we hold:

15.1 Identity, KYC and Customer Due Diligence (CDD) Records: This includes government-issued identity documents, proof of address, source of funds documentation, and all records obtained through our KYC/CDD process. These are retained for a minimum of five (5) years from the later of: (i) the date of completion of the relevant transaction; or (ii) the date of termination of our business relationship with you or closure of your account. This period is mandated by regulation 40 of the MLRs. In accordance with the MLRs, at the end of this period we will delete any personal information obtained for anti-money laundering purposes unless we are required to retain it by law or for the purposes of actual or anticipated legal proceedings, or you have consented to its retention.

15.2 Gold Transaction Records: This includes records of all gold purchase and sale transactions, settlement instructions, gold holding balances, transaction confirmations, and related financial data. These are retained for a minimum of six (6) years from the end of the financial year in which the relevant transaction took place. This period reflects the longer of the AML/CFT minimum of five (5) years (under the MLRs) and the record-keeping requirements of up to six (6) years under UK tax and company law (including the Finance Act 1998, the Value Added Tax Act 1994 and the Companies Act 2006), which govern financial records for tax and accounting purposes.

15.3 Account and Platform Data: This includes your account registration details, profile information, login credentials, contact preferences, and usage data generated through your interaction with the Platform. This data is retained for the duration of your account relationship with us and for a further period of five (5) years following account closure, to the extent required by our AML/CFT obligations and to enable us to handle any post-closure queries, complaints, or legal claims arising from the relationship.

15.4 Marketing Consent Records: Records of your consent to receive Marketing Communications — including the date and means by which consent was given, the version of the consent language in force at that time, and records of any subsequent withdrawal — are retained for the duration of our business relationship and for a further period of five (5) years following withdrawal or account closure. This enables us to demonstrate compliance with our obligations under UK Data Protection Law (including PECR), and to respond to any regulatory enquiries or complaints regarding Marketing Communications sent during the consent period.

15.5 Business Correspondence and Communications: This includes emails, in-app messages, customer support records, and other correspondence between you and Aspora in connection with your use of the Platform or Services. These are retained for a minimum of six (6) years from the date of issue or receipt, reflecting the limitation period for contractual and other claims under the Limitation Act 1980.

15.6 Legal Claims and Dispute Records: Where personal data is relevant to an actual or anticipated legal claim, regulatory investigation, or dispute, we will retain that data for as long as is necessary to pursue or defend the relevant proceedings, including any applicable limitation and appeal periods under the laws of England and Wales or any other applicable jurisdiction.

15.7 SIP Mandate, Card Tokenisation and Payment Records: This comprises the SIP mandate, card tokenisation references, payment authorisation and consent records, pre-debit notification records and SIP cycle status records. These are retained for the same minimum period as Gold Transaction Records above — six (6) years from the end of the financial year in which the relevant Transaction took place or, in the case of a cancelled SIP under which no further purchase is made, in which the cancellation took place — consistent with Aspora’s obligations under applicable anti-money laundering law and UK tax law.

15.8 Physical Delivery and Identity Verification Records: This comprises delivery address and tracking records, the record of identity verification produced at handover, and failed-delivery, redelivery and collection records. These are retained for a minimum of five (5) years from the date of delivery or, where delivery fails and the relevant Physical Gold Delivery Order is reversed, from the date of that reversal, consistent with Aspora’s anti-money laundering record-keeping obligations and to enable the investigation of delivery disputes and product claims.

15.9 Deletion, Anonymisation and Erasure Requests: At the end of the applicable retention period, we will securely delete or anonymise your personal data so that it can no longer be attributed to you. Where you exercise your right to erasure under UK Data Protection Law, we will honour that request unless retention is required or permitted by applicable law — including our AML/CFT, tax, and commercial record-keeping obligations set out above — in which case we will inform you of the basis on which the request cannot be fulfilled and restrict processing of the retained data to the extent possible pending the expiry of the relevant retention period.

16. Use of Aspora information

16.1 In order to facilitate the provision and utilization of services, the Website allows you to share personal information with Aspora. When entering into a service agreement, it may be necessary to provide Aspora with your name, email address, phone number, or personal address.

16.2 Your password serves as the key to access your account: It is important to create a password that includes unique combinations of numbers, letters, special characters, and the like. Furthermore, it is crucial that you do not disclose your password to anyone. If you choose to share your password or personal information with others, you bear sole responsibility for any actions performed through your account. If your password is compromised in any way, it is imperative that you promptly notify Aspora in order to change your password. This will help you regain control over your personal information and prevent any legally binding actions from being taken on your behalf.

17. Contact us

For full details about the Aspora group members and where they operate, please contact us at: dpo@aspora.com. If at any time you believe that we have not adhered to this Policy, please contact us at dpo@aspora.com and we will seek to promptly determine and correct the problem. You also have the right to complain to the ICO, as described in Section 13.6 above.

18. Changes to this policy

Please note that this Policy may change from time to time. If we change this Policy in ways that affect how we use your Personal Information, we will advise you of the choices you may have as a result of those changes. We will also post a notice that this Policy has changed and, where the changes are material, we will notify you in advance by email or through the Platform.