Junction Connect Privacy Policy

1. Important Information and Who We Are

Purpose of this Privacy Policy

The purpose of this Privacy Policy is to explain our data practices clearly so that you can make informed decisions about how you interact with us. It explains how we handle your Personal Data when:

• You use our service(s), including through our website or mobile applications (this also applies to our customers and their users);
• You visit our websites;
• You visit our offices;
• You receive communications from us.

This website is not intended for children, and we do not knowingly collect data relating to children.

If you are aged 18 or under, please get your parent's/guardian's permission before you provide your Pesonal Data to our Website;

Please read this Privacy Policy alongside any other privacy notices or data collection statements we may provide at the time we collect Personal Data about you, This and any additional notices explain in detail how and why we are using your data for specific purposes. This Privacy Policy works alongside these other notices and does not override them.

Controller

This Privacy Policy is issued by Junction Connect Limited on behalf of Junction. When we use terms like "Junction", "we", "us" or "our" in this policy, we are referring to the relevant company within Junction that is responsible for handling your Personal Data. We will always let you know which Junction company is the data controller for your Personal Information at the time you purchase a product or service from us. For this website, Junction Connect Limited is the data controller and is responsible for how your data is used in this context.

Contact Details

If you have any questions about this Privacy Policy or how we handle your Personal Data, you can contact our Data Privacy Team using the details below:

• Address: Junction Connect Limited, 96 Kensington High Street, London, W8 4SG
• Email: privacy@junctionconnect.com

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK's independent authority for data protection matters (www.ico.org.uk), whose address is at:

• Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113

We take your privacy seriously and are committed to resolving any concerns you may have. If you are unhappy with how we handle your Personal Data, we would appreciate the opportunity to address your concerns before you contact the ICO. Please feel free to contact us in the first instance, If you are located in the EU or another country, you may also contact your local data protection authority to make a complaint.

Changes to the Privacy Policy and Your Duty to Inform Us of Changes

We review our Privacy Policy regularly to ensure it remains accurate and complaint with data protection laws. This version was last updated on 13th May 2025. If you would like to see a previous version of this policy, you can request it by contacting us.

It is important that the Personal Data we hold about you is accurate and up-to-date. Please let us know if your personal details change during your relationship with us so that we can keep our records correct.

Third-Party Links

Our website may include links to third-party websites, plug-ins, and applications. Clicking on these links or enabling those connections may allow third parties to collect or share data about you. Some pages on our website may also contain embedded content (e.g. videos, maps) from third parties. These providers may collect data about your interaction with that content, even if you do not actively click on it.

Please note that we do not control these third-party websites, and we are not responsible for their privacy practices or policies. When you leave our website, we recommend that you read the privacy policy of every site you visit to understand how your data may be collected and used.

2. The Data We Collect About You

We may collect, use, store, and share different kinds of Personal Data which we group as follows:

• Identity Data: includes your first name, last name, username or similar identifier, title, and official identification such as a passport or driver's licence.
• Contact Data: includes your billing address, delivery address, email address, and telephone numbers.
• Financial Data: includes your bank account details.
• Transaction Data: includes details about payments to and from us, and information about the products and services you have purchased from us.
• Technical Data: includes your IP address, login data, browser type and version, time zone setting, location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Usage Data: includes information about how you use our website, products, and services, such as page views, clicks, and navigation paths.
• Marketing and Communications Data: includes your preferences for receiving marketing communications from us and third parties, and your communication preferences (such as how you'd like us to contact you).

We may also collect, use, and share aggregated data, such as statistical or demographic information, for any purpose. Aggregated data may be derived from your Personal Data, but it is not considered Personal Data under the law because it does not directly or indirectly identify you. For example, we may use aggregated data to understand how users interact with our website. However, if we ever combine aggregated data with Personal Data in a way that could identify you, we will treat that combined data as Personal Data and handle it in line with this Privacy Policy.

We do not collect any Special Categories of Personal Data about you. This includes information such as:

• Race or ethnic origin.
• Religious or philosophical beliefs.
• Sexual orientation or sex life.
• Political opinions.
• Trade union membership.
• Health information.
• Genetic or biometric data.

We also do not collect any information about criminal convictions or offences.

If You Do Not Provide Personal Data

In some cases, we may need to collect certain Personal Data:

• Because it is required by law; or
• Because it is necessary under the terms of a contract we have with you (or are about to enter into).

If you do not provide the data when requested, we may not be able to perform the contract (for example, we might not be able to provide a product or service you have requested).

We only ask for the Personal Information we genuinely need in order to deliver our services and meet our legal obligations.

If a situation arises where we cannot provide a service due to missing data, we will let you know at the time and explain your options.

Offensive Content

If your Personal Data contains any material which may reasonably be deemed to be offensive, inappropriate or objectionable or otherwise engage in any disruptive behaviour in relation to the Website or our services, we may remove such content and/or suspend the use of the Website. We may also remove any such material from any of our social media pages.

Where we reasonably believe that you are or may be in breach of any applicable laws, for example on hate speech, we may disclose your personal information to relevant third parties, including to law enforcement agencies or your internet provider. We would only do so in circumstances where such disclosure is permitted under applicable laws.

3. How Is Your Personal Data Collected?

We collect Personal Data in a few different ways:

Direct interactions

• You may give us your Personal Data by filling in forms or by contacting us by post, phone, email, or otherwise.
• This includes when you:
  • Use our products or services;
  • Request marketing to be sent to you;
  • Request help solving technical issues;
  • Give us feedback;
  • Contact us.

Automated technologies or interactions

As you browse our website, we may automatically collect Technical Data about your device, browsing actions, and usage patterns. We collect this data using technologies such as:

• Cookies;
• Server logs;
• Web beacons or similar tools.

For more details on how we use cookies and similar technologies, please see our Cookie Policy.

4. How We Use Your Personal Data

We will only use your Personal Data when the law allows us to. Most commonly, we will rely on one of the following legal bases:

• Contract: when we need to process your data to enter into or fulfil a control with you (for example, to provide you with a service).
• Legal obligation: when we need to comply with a legal or regulatory requirement.
• Legitimate interests: when it is necessary for our business (or a third party's business), and your rights and interests do not override those interests. (For example, we may use your data to help improve our services or protect against fraud).

Consent

We do not generally rely on consent as our legal basis for processing your Personal Data. However, we will ask for your consent before sending you marketing communications from third parties via email or text. You can withdraw your consent at any time by contacting us, or by using the unsubscribe link included in our emails or texts.

Purposes for Which We Will Use Your Personal Data

Below we have set out how we use your Personal Data, including:

• The type of data involved;
• The purpose we are using it for;
• The legal basis we rely on to do so;
• Where applicable, our legitimate interests.

Please note that we may use your Personal Data for more than one lawful reason, depending on the specific purpose.

If you'd like more details about the exact legal basis we are relying on for a particular activity, please feel free to contact us.

Types of Personal Data:

• Identity: e.g. first name, last name, date of birth, passport or driver's licence.
• Contact: e.g. billing and delivery address, email address, phone numbers.
• Financial: e.g. bank account details, payment history.
• Transaction: e.g. details of payments made and products/services purchased.
• Governmental: e.g. national ID numbers, tax/VAT registration numbers, data required for regulatory compliance (KYV/AML).
• Profile: e.g. your preferences, feedback, survey responses, interests.
• Technical: e.g. IP address, browser type/version, device type, OS, time-zone.
• Usage: e.g. information about how you use our website, products, or services.
• Marketing and Communications: e.g. your preferences for receiving communications and marketing.

Purpose / Activity

We may use your Personal Data for the following purposes:

• To register you as a new customer.
• To provide and deliver our services, including managing payments, fees, charges, currency exchange, and collecting outstanding payments.
• To manage our relationship with you, e.g. by notifying you of changes to our terms or policies, resolving technical issues, or requesting feedback on our service.
• To administer and protect our business and website, including activities such as troubleshooting, data analysis, system maintenance, support, hosting, reporting, and conducting anti-money laundering (AML) checks.
• To deliver relevant website content and improve your user experience.
• To use data analytics to improve our website, products, services, marketing, and customer relationships.
• To suggest services that may be relevant or of interest to you based on your interactions with us.
• To respond to legal claims, law enforcement requests, or regulatory investigations.

Our Lawful Basis for Processing

We will only process your Personal Data where we have a lawful basis for doing so. As mentioned above, the most common bases we rely on are:

• Performance of a contract: when we need to process your data to enter into or perform a contract with you;
• Compliance with a legal obligation: where we are required to process your data to meet a legal or regulatory requirement;
• Legitimate interests: where processing is necessary for our legitimate business interests (or those of a third party), and your interests and fundamental rights do not override those interests.

Our legitimate interests may include (but are not limited to):

• Recovering debts owed to us;
• Keeping our records accurate and up-to-date;
• Understanding how customers use our products or services;
• Managing and growing our business;
• Providing IT services and ensuring network security;
• Preventing fraud and ensuring compliance;
• Supporting a business reorganisation or internal restructuring;
• Informing and improving our marketing strategy;
• Developing new services and improving existing ones.

If you would like more information about the lawful basis we rely on for any specific use of your Personal Data, or how we assess and balance our legitimate business interests against your rights and freedoms, please contact us. We are happy to explain our approach and ensure you feel confident in how your data is handled.

Marketing Preferences

We aim to give you control over how we use your Personal Data for marketing and advertising.

Third-Party Marketing

We do not share your Personal Data with third parties for their own direct marketing purposes.

Opting Out

You can ask us to stop sending you marketing messages at any time by:

• Clicking the unsubscribe link in any marketing email or text we send you; or
• Contacting us directly at marketing@junctionconnect.com

Please note that opting out of marketing communications does not affect messages that are service-related or required for contractual or legal purposes.

Cookies and Tracking Technologies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of our website may not function properly or may become inaccessible.

Change of Purpose

We will only use your Personal Data for the purposes for which it was collected, unless we reasonably believe that we need to use it for a different purpose that is compatible with the original one. If you would like an explanation of how the new purpose is compatible, please contact us. If we need to use your data for an entirely unrelated purpose, we will notify you and we will explain the legal basis for doing so. In some circumstanes, we may process your Personal Data without your knowledge or consent where this is required or permitted by law.

5. Disclosure of Your Personal Data

We may share your Personal Data with trusted third parties, but only where necessary and for the purposes set out in this Privacy Policy. These third parties include:

• Internal Third Parties: other companies within Junction who provide services such as IT, operations, or group-level support (see Glossary for more detail).
• External Third Parties: such as professional advisers, service providers, regulators, or authorities (also defined in the Glossary).
• Business Partners or Investors: in the context of a sale, transfer, merger, acquisition, or investment involving all or part of our business or assets. If such a change occurs, the new owner may use your Personal Data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your Personal Data and to handle it in accordance with applicable laws.

We do not allow third-party service providers to use your data for their own purposes. They are only permitted to process your Personal Data:

• For specified purposes;
• In accordance with our instructions; and
• Under strict confidentiality and data protection terms.

6. International Transfers

We may share your Personal Data within Junction and selected third parties. Some of these recipients are located outside the European Economic Area (EEA), which means that your data may be transferred internationally.

Whenever we transfer your Personal Data outside of the EEA (or, where relevant, the UK), we ensure that your data receives a similar level of protection by using one or more of the following safeguards:

• Adequacy decisions: We only transfer data to countries that the European Commission (or the UK government) has formally recognised as providing an adequate level of data protection.
• Standard Contractual Clauses (SCCs): For transfers to countries without adequacy decisions, we may use contracts approved by the European Commission that require the recipient to protect your Personal Data to EU standards.
• Derogations for specific situations: In rare cases, where no other safeguards are available, we may rely on limited exemptions under Article 49 of the GDPR, such as where the transfer is necessary to perform a contract with you, or with your explicit consent.

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.

7. Data Security

We take the security of your Personal Data seriously. We have put in place appropriate technical and organisational measures to protect your data from being:

• Accidentally lost;
• Used or accessed without authorisation;
• Altered; or
• Disclosed inappropriately

We also limit access to your Personal Data to only those employees, agents, contractors, and other third parties who need to know for business purposes. These individuals or organisations will only process your data on our instructions and under strict confidentiality agreements or duties.

We have established procedures to detect, investigate, and respond to any suspected Personal Data breach. Where we are legally required to do so, we will notify you and the appropriate data protection authority without delay.

8. How Long We Keep Your Data

We only keep your Personal Data for as long as necessary to fulfil the purposes for which we collected it, including to meet any legal, regulatory, tax, accounting, or reporting requirements.

We may keep your data for longer:

• If you make a complaint; or
• If we reasonably believe there may be legal action related to our relationship with you.

To determine the appropriate retention period, we consider:

• The amount, nature, and sensitivity of the data;
• The potential risk of harm from unauthorised use or disclosure;
• The purposes for processing your data and whether those could be achieved in other ways;
• Any legal, regulatory, tax, accounting, or similar obligations.

Legal Minimum Retention

By law, we must retain basic customer information, such as your Contact, Identity, Financial, and Transaction Data, for six years after you stop being a customer, for tax and compliance purposes.

Your Rights to Erasure

In some cases, you can ask us to delete your Personal Data sooner. Please see Your Legal Rights below for more information on your right to request erasure.

Anonymised Data

Where possible, we may anonymise your Personal Data (so that it can no longer be linked to you). We may use anonymised data for research or statistical purposes indefinitely, without further notice to you.

9. Your Legal Rights

Under data protection laws, you have certain rights in relation to your Personal Data. These rights may apply in different situations and are subject to specific conditions.

You have the right to:

• Request access to your Personal Data
• You can ask for a copy of the Personal Data we hold about you and check that we are processing it lawfully.
• Request correction of your Personal Data
• You can ask us to correct any incomplete or inaccurate information we hold about you.
• Request erasure of your Personal Data
• You can ask us to delete or remove your Personal Data where there is no good reason for us to continue processing it (also known as the "right to be forgotten").
• Object to processing of your Personal Data
• You can object to our processing of your data where we rely on a legitimate interest (or those of a third party) and you feel it impacts your rights and freedoms. You also have the right to object if we process your data for direct marketing purposes.
• Request restriction of processing your Personal Data
• You can ask us to suspend the processing of your Personal Data in certain situations, e.g. if you want us to establish its accuracy or the reason for processing it.
• Request transfer of your Personal Data
• You can ask us to transfer your Personal Data to you or to another party. This applies to automated data you initially provided with your consent or under a contract.
• Withdraw consent at any time
• Where we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew your consent.

If you would like to exercise any of these rights, please contact us using the details provided in the How to Contact Us section above.

No fee usually required

You will not usually have to pay a fee to access your Personal Data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

10. Glossary

Lawful Basis means the legal reason we are allowed to collect and use your Personal Data under data protection law. There are several lawful bases, and we rely on different ones depending on the purpose of the processing.

Legitimate Interest means we have a genuine and justifiable business reason for processing your Personal Data, e.g. to run our services effectively, improve our website, prevent fraud, or grow our business.

Performance of Contract means processing your data where it is necessary for carrying out a contract with you, or to take steps at your request before entering into a contract, e.g. when we provide a product or service that you have requested.

Personal Data or Personal Information means any information that can identify you, either on its own or when combined with other details. It does not include data where your identity has been removed. This is known as anonymous data.

Compliance with a Legal Obligation means processing your Personal Data when we are required to do so by law, e.g. to comply with tax, regulatory, or anti-money laundering obligations.

Third parties

Internal Third Parties

• Other companies within Junction, acting as joint controllers or processors, who are based in UK, EEA, and UAE. These group companies provide IT and system administration services, product development, and centralised reporting and leadership support.

External Third Parties

• Service providers acting as data processors based in the USA, UK, EEA, and UAE who provide IT and system administration and support services.
• Professional advisers based in the UK, EEA and UAE, acting as processors or joint controllers, including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services.
• Regulators and other authorities based in the UK and EEA, such as HM Revenue & Customs, acting as processors or joint controllers, who require reporting of processing activities in certain circumstances.
• Other third parties acting as processors based in UK and EEA, including recruitment agencies, debt collecting agencies and fraud prevention agencies, who provide consultancy, debt recovery, credit checks and anti-money laundering services.

Your Legal Rights in Detail

You have the right to:

• Request access to your Personal Data (commonly known as a "data subject access request"). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in the following scenarios:
  • If you want us to establish the data's accuracy.
  • Where our use of the data is unlawful, but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
  • Request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
  • Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

11. Cookies Section

We use cookies and similar technologies to make your experience on the Junction Connect website better. Some cookies are needed to make the website work properly, while others help to improve the site and give you the best experience.

A website cookie is a small text file that websites save onto your web browser. The file collects data on what you see and do on the website, so that the website can function properly, remember your preferences, and analyse how you use it.

By clicking accept all cookies, you agree to the use of these cookies. You can control the use of these cookies by going into manage cookies at any time.

Like most sites on the internet, this Website uses Cookies to:

• Ensure that web pages can function correctly.
• Store preferences, such as the language you have selected or the font size.
• Understand the user's browsing experience.
• Collect anonymous statistical information, such as which pages the user has visited or how long the user has stayed on the Website.

The use of Cookies makes it possible to optimise browsing, adapting the information and services offered to the user's interests in order to provide them with a better experience whenever they visit the Website. This Website uses Cookies to function, adapt and facilitate the user's browsing experience as much as possible.

Types of Cookies

When browsing the Website, own and third party cookies are used. Third-party cookies are those that are managed by service providers outside us.

Likewise, Cookies, depending on their permanence, can be divided into session or permanent cookies. The former expire when the user closes the browser. The latter expire when the purpose for which they are used is fulfilled (for example, for the user to remain identified on the Website) or when they are manually deleted.

Additionally, depending on their purpose, Cookies can be classified as follows:

• Technical and personalisation cookies, essential for the correct functioning of the page and necessary for the provision of certain services requested by users when accessing and using the Website. If these cookies are deactivated, users will not be able to receive the contents and services correctly.
• Analytical cookies, used for monitoring and statistical analysis of user behaviour. They collect information about the user's experience, normally anonymously, although sometimes they can also be used to identify the user. If these cookies are deactivated, the Website may continue to function. However, the information captured by these cookies about the use of the website allows us to improve the functioning of the website.
• Advertising Cookies, used to analyse the user's browsing and to be able to show them personalised advertising based on their interests. If these cookies are deactivated, the Website may continue to function.
• Personalisation cookies: these are cookies that allow information to be remembered so that the user can access the service with certain characteristics that can differentiate their experience from that of other users, such as, for example, the language, the number of results to be shown when the user performs a search, the appearance or content of the service depending on the type of browser through which the user accesses the service or the region from which the user accesses the service, etc.

Disable the use of Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

When do I give my consent to the use of cookies?

When users access the Website and before they start browsing, they are warned about the use of Cookies so that they can give their consent in relation to our Cookies Policy if they click on accept the installation of cookies. If users do not consent to the use of Cookies, they may modify or refuse their installation or, in any case, they may stop using the Website and cease browsing.

How can I revoke my consent?

The user may, at any time, revoke the consent granted in relation to the use of Cookies that they authorise us to make, for which they must delete the Cookies stored on their equipment (computer or mobile device) through the settings and configurations of their Internet browser.

However, please note that, in most cases, deleting or disabling Cookies could affect the functionality of our Website and limit your access to certain areas or services offered through it.

12. Privacy Settings

We use First-Party Cookies and Third-Party Cookies.

First-Party Cookies are created by us (JunctionConnect.com) and are used to ensure the website works as it should.

Third-Party Cookies are created by trusted partners for use on our website and are used for analytics purposes only.