Invest in Gold

(Last updated on July 29, 2026)

Version 1.1. Effective date: July 29, 2026.

This Privacy Policy applies specifically to Aspora Gold UK, the gold and precious metals feature made available through the Aspora App in the United Kingdom. It is the “Aspora Privacy Policy” referred to in the Aspora Gold UK Terms and Conditions, and explains how Aspora and Goldwise collect, use, share and otherwise process your personal data in connection with Aspora Gold UK. It supplements, and should be read alongside, the general Aspora privacy notice, which covers your Aspora account and Aspora’s other products.

Capitalised terms used but not defined in this Privacy Policy have the meaning given to them in the Aspora Gold UK Terms and Conditions.

1. Who we are

1.1. “Aspora,” “we,” “us” or “our” means Vance Technologies Limited, trading as Aspora, with its office at 141 Curtain Road, 3rd Floor, London, England, EC2A 3BX. Aspora provides the Aspora App, customer onboarding, technical facilitation, transaction information and first-level customer support for Aspora Gold UK, as described in the Aspora Gold UK Terms and Conditions.

1.2. “Goldwise” means Goldwise Holdings Limited, the Gold Provider (as defined in the Aspora Gold UK Terms and Conditions) for Aspora Gold UK, or any replacement UK precious metals provider notified to you in accordance with those Terms, which provides the Gold Services (also referred to as the Precious Metals Services) — namely the gold and other precious metals purchase, sale, allocation, storage, vaulting, insurance, account-record and related services.

1.3. “Vault Operator” means Brink’s Global Services International, Inc. (“Brink’s”), or any replacement vault, custodian, storage provider, logistics provider or similar service provider appointed by Goldwise, provided that any replacement is notified to you in accordance with the Aspora Gold UK Terms and Conditions.

1.4. For most personal data processed in connection with Aspora Gold UK, Aspora is the controller. Goldwise processes personal data on Aspora’s behalf as a processor for most purposes, but acts as an independent controller specifically in respect of the precious metal’s ledger records (the record of your Gold Holding) that it maintains for its own regulatory, reconciliation and audit purposes. Section 6 explains this in more detail.

1.5. This document is the “Aspora Privacy Policy” referred to in the Aspora Gold UK Terms and Conditions.

1.6. If you have any questions about this Privacy Policy or how your personal data is used, contact Aspora’s Data Protection contact at dpo@aspora.com or write to us at the address above.

2. What personal data we collect

In connection with Aspora Gold UK, we collect and process the following categories of personal data:

Identity and contact data

Full legal name, date and place of birth, nationality, and a copy of government-issued identification (e.g. passport, driving licence).
Contact details: address, email address, phone number.

Verification and financial crime data

Occupation and employer details, source of funds and source of wealth information (for applicable thresholds), and purpose of transaction.
Politically Exposed Person (PEP) status, and sanctions and watchlist screening results.
Fraud, AML/CTF and sanctions screening outcomes, and any supporting documents you provide during onboarding or in response to a request.
Together with the identity and contact data above, we refer to the information in this category as your “KYC Information” (as defined in the Aspora Gold UK Terms and Conditions).

Transaction and holding data

Details of your orders, Transaction history and Gold Holding, including metal type, weight, purity and value.
Payment method details and payment/settlement records (card or bank details are typically processed by our payment partners rather than stored directly by us).

Delivery data (where the delivery feature is available and you use it)

Delivery address, recipient name, and identity/signature verification information collected by the courier at the point of delivery.

Technical and usage data

Device information, IP address, app usage and log data, and information collected through cookies or similar technologies (see the general Aspora Privacy Notice for full cookie details).

Marketing and advertising data

Your contact information in hashed form, used to create, target or measure advertising audiences on social-media and other digital advertising platforms, unless you opt out of personalised advertising (see Section 10).

Communications and support data

Records of your correspondence with Aspora or Goldwise, including complaints, support requests and call/chat records.

3. How we collect your personal data

Directly from you, when you onboard, place an order, request delivery, contact support, or raise a complaint.
Through Aspora’s existing customer onboarding and KYC verification flow, which is also used for Aspora Gold UK.
From Goldwise and the Vault Operator, including Transaction confirmations, balance updates and delivery status.
From identity verification, sanctions-screening and fraud-prevention providers we or Goldwise use.
From payment providers, banks and card networks involved in processing your payment.
Automatically, through your use of the Aspora App (device and usage data).

4. Why we use your data, and our lawful basis

Under UK GDPR, we must have a lawful basis for each way we use your personal data. The table below sets out the main purposes and the basis we rely on.

Purpose	Lawful basis
Verifying your identity and carrying out KYC, AML/CTF, sanctions and fraud checks before allowing you to transact	Legal obligation (Money Laundering Regulations 2017 and related law) and legitimate interests (preventing financial crime)
Processing your orders to buy, sell, store or (where available) take delivery of precious metal	Performance of a contract with you
Sharing your data with Goldwise and the Vault Operator so they can provide the Gold Services	Performance of a contract with you; legitimate interests in operating the service
Investigating and resolving complaints, refunds, chargebacks and disputes	Legitimate interests; legal obligation where applicable
Detecting and preventing fraud and other financial crime	Legitimate interests; legal obligation
Complying with regulatory, tax and law enforcement requests	Legal obligation
Sending you service messages (order confirmations, delivery updates, risk warnings, changes to these terms)	Performance of a contract; legal obligation (for required disclosures)
Sending you marketing about Aspora Gold UK and other Aspora products or services, by email, SMS, WhatsApp, push notification or similar channels	Consent (where required by PECR) or legitimate interests, and always with an opt-out
Creating, targeting or measuring advertising audiences using your contact information in hashed form on social-media and other digital advertising platforms	Consent (where required) or legitimate interests; always with an opt-out for personalised advertising
Improving and securing the Aspora App	Legitimate interests

Where we rely on legitimate interests, we have considered that our (or Goldwise’s) interest in operating Aspora Gold UK safely and lawfully is not overridden by your own interests or fundamental rights.

We share your personal data, to the extent necessary for the purposes above, with:

Goldwise, so that it can provide the Gold Services, including maintaining your Gold Holding record. We do not share copies of your identity-verification documents or KYC Information with Goldwise, unless required by law or specifically disclosed to you; Goldwise relies on Aspora’s completion of your onboarding checks.
The Vault Operator (Brink’s Global Services International, Inc.), so that it can hold and account for your allocated precious metal.
Payment providers, acquirers, banks, card networks and payment gateways, to process your payments and settlements.
Logistics, courier or delivery providers, where you request physical delivery.
Identity verification, sanctions-screening, fraud-prevention and compliance providers, including credit-reference agencies.
Our professional advisers, auditors, insurers, regulators, tax authorities, law enforcement bodies and courts, where necessary or where we are legally required or permitted to do so.
Aspora’s affiliates, contractors and service providers who support our systems and operations, under appropriate contractual safeguards.
Social-media and other digital advertising platforms, using your contact information in hashed form to create, target or measure advertising audiences, unless you opt out of personalised advertising.

We do not sell your personal data to third parties. Other than sharing your contact details in hashed form with advertising platforms as described above, we do not share your personal data with Goldwise, the Vault Operator or any other party for their own independent marketing purposes.

6. Goldwise’s role as an independent controller for the metals ledger

6.1 For most purposes, Goldwise processes your personal data on Aspora’s instructions, under a data processing agreement between Aspora and Goldwise.

6.2 However, Goldwise acts as an independent controller specifically in respect of the precious metals ledger — the record of your Gold Holding (the quantity of precious metal allocated to you, recorded in the Goldwise ledger and the applicable Vault Operator’s account or other storage record, as defined in the Aspora Gold UK Terms and Conditions) — which Goldwise and the Vault Operator must maintain in their own right for regulatory, reconciliation and audit purposes, and in some cases for anti-money laundering compliance in their own name.

6.3 Where Goldwise acts as an independent controller, it is separately responsible for complying with data protection law in respect of that processing. You may need to contact Goldwise directly for matters specific to its controller role; Aspora will help direct your request appropriately if you contact us instead.

7. International transfers

7.1 Your Gold Holding is currently stored by the Vault Operator (Brink’s) in secure vaulting facilities in London, United Kingdom, as described in the Aspora Gold UK Terms and Conditions. Personal data connected with your Gold Holding, such as your account reference and holding records, is processed in connection with that storage.

7.2 If Goldwise appoints a different Vault Operator or changes the storage location in the future (including to a location outside the United Kingdom), you will be notified in accordance with the Terms and Conditions, and any resulting transfer of personal data will be subject to the safeguards described below.

7.3 We and Goldwise may also transfer your personal data outside the United Kingdom where our respective group companies, professional advisers, or other service providers (such as identity verification, sanctions-screening, fraud-prevention or IT service providers) operate internationally.

7.4 Where we or Goldwise transfer your personal data outside the United Kingdom, we ensure an appropriate safeguard is in place, such as: a UK adequacy regulation covering the destination country; the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or another mechanism recognised under UK data protection law.

7.5 You can ask us for more information about the safeguards that apply to a particular transfer by contacting us using the details in Section 1.

8. How long we keep your data

8.1 We keep your KYC Information, AML/CTF and Transaction records for as long as required under the Money Laundering Regulations 2017 and related guidance — generally for at least 5 years after the end of our relationship with you, and longer where a longer period is required by law or an ongoing investigation.

8.2 We keep your Gold Holding and Transaction records for as long as you hold a balance with Aspora Gold UK, and for a further period afterwards to meet our legal, accounting and audit obligations.

8.3 We keep complaint records for as long as needed to demonstrate how a complaint was handled, in line with regulatory expectations.

8.4 Where we no longer need your personal data, we delete or anonymise it in accordance with our data retention policy.

9. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data, where there is no legal requirement for us to keep it.
Ask us to restrict how we use your data, in certain circumstances.
Object to processing based on legitimate interests, or to direct marketing at any time.
Ask us to transfer your data to another provider, where technically feasible (data portability).
Withdraw consent, where we rely on consent, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in Section 1. We may need to verify your identity before responding, and some rights are subject to exceptions (for example, we cannot delete data we are legally required to retain for AML purposes).

If you are not satisfied with how we have handled your request or your personal data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Marketing

10.1 We may send you marketing about Aspora Gold UK and other Aspora products or services by email, SMS, WhatsApp, push notification or other channel you’ve provided, in accordance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, as described in the Aspora Gold UK Terms and Conditions.

10.2 You can opt out of marketing at any time through the Aspora App settings, by using the unsubscribe link in an email, or by contacting us. Opting out of marketing will not stop us sending you service messages about your account or Transactions.

10.3 Unless you opt out of personalised advertising, we may use your contact information in hashed form to create, target or measure advertising audiences on social-media and other digital advertising platforms. You can opt out of this at any time through the Aspora App settings or by contacting us; this will not affect service messages or other marketing you have agreed to receive.

11. Cookies and similar technologies

The Aspora App may use cookies or similar technologies for functionality, security and analytics purposes. Full details are set out in the general Aspora Privacy Notice and in-app cookie settings.

12. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption, access controls and regular security testing. Goldwise and the Vault Operator are contractually required to maintain equivalent security standards over the data and precious metal they hold on your behalf. No method of transmission or storage is completely secure, but we work to protect your information to a high standard.

13. Age restriction

Aspora Gold UK is only available to individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18 in connection with this product.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Gold Services, our providers, or applicable law. We will normally give at least 30 days’ notice of a material change, in the same way as set out in the Aspora Gold UK Terms and Conditions, except where an immediate change is required by law, a regulator, fraud prevention, security or urgent operational reasons. We will notify you of material changes through the Aspora App, email or another appropriate channel.

15. How to contact us

If you have any questions about this Privacy Policy, or want to exercise any of your rights, please contact:

Email: dpo@aspora.com
Post: Vance Technologies Limited office at 141 Curtain Road, 3rd Floor, London, England, EC2A 3BX

You can also complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator, at any time.