2025 NALA Privacy Policy (UK)


Welcome to NALA Payments Limited (“NALA”, “we”, “our”, “us”). We are committed to privacy compliance and to earning our users’ (“you”, “your”) trust.

‍

This is the Privacy Notice for  www.nala.com (the “Website”) and any mobile application (the “App”) that provides support to our services, which are operated by us.

Our Group’s registered address is International House, 64 Nile Street, London, United Kingdom, N1 7SR. For the purposes of the General Data Protection Regulation (“GDPR”), we are the data controller of your personal data.

We are committed to protecting your privacy and the security of the personal data we hold and process about you. This Privacy Notice explains how we collect information, what we use the information for, our legal basis for doing so, and what controls you have.

We reserve the right to change this Privacy Notice from time to time. This Privacy Notice was last updated on 24th October 2025.

1. What information do we collect?

Information you give to us:

We may collect and process the following personal information about you:

General personal details, which may include:

  • Your full name
  • Your residential address
  • Your contact details (email address and your telephone number)
  • Your date of birth
  • Your ID information including a photo verification
  • Your identity information including your image through a selfie verification
  • Your payment information (bank, debit card or pre-paid card information including billing address, PAN and CVV details, the sender name as well as the sort code and account number)
  • If you send high-value or high-volume transactions or as needed to comply with our anti-money laundering obligations under applicable law we may request additional information

Account sign-in information, which will include the following as set by you:

  • Username
  • Password

Also:

Information about the recipient: The individual making the transfer will provide us with the recipient's name, phone number, bank account, and purpose of payment.

Referral program information in the EU:

If you wish to participate in our referral program, please refer to the details of our Referral Program Terms and Conditions here. This forms the contractual agreement between you and us for the purposes of benefitting from our referral program.

Communications you send to us, (by telephone, email or otherwise), for example, to report a problem or to submit queries, concerns or comments regarding the Website, our service, or general comments.

With regard to each of your visits to the Website or App, we may collect the following information:

  • Device Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system.
  • Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from the Website (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.

We may receive information about you if you use any of the other websites we operate or the other services we provide.

Information we receive from others:

We are also working closely with third parties (including, for example, service providers, business partners, sub-contractors in technical, payment and delivery service providers, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them or publicly available sources.

If the personal information we hold about you is incorrect, please let us know. You may decide not to provide your personal information to us. However, in that case, please note we may not be able to deliver our services to you.

Third-Party Data Sharing

To operate our services and comply with legal and regulatory obligations, NALA shares personal data with trusted third-party service providers only where necessary and under written contractual safeguards. These providers include:

  • Payment and financial partners such as Modulr, banks and payment networks that process transfers and e-money services.
  • Fraud-prevention, AML and security vendors supporting our legal compliance and platform protection.
  • Cloud hosting and infrastructure providers (for example, AWS or Azure) providing secure data storage and operational support.
  • Analytics and marketing tools, where users have consented, to help us measure performance and improve our service.
  • Customer support and IT service providers that assist with user communications and system maintenance.

All such sharing is performed under written Data Processing Agreements (DPAs) in compliance with Article 28 of the UK GDPR and the Data Protection Act 2018. Each processor is obliged to process data only on NALA’s documented instructions, maintain confidentiality, and implement appropriate security measures

2. Access to contact list information

We may also collect and process your contact list information on your mobile device but only with your express permission.This information may include names, phone numbers, email addresses, images associated with the contacts etc.

This is to make it easier for the recipient data to be pre-filled and enable transactions to be processed faster and free of apparent errors.We shall only access your contact list with your explicit consent and only share applicable information with third parties solely for the purpose of processing the transaction.

We shall not send any information to your contacts or make use of any of the collected data for any other purpose apart from what is provided here.

3. How do we use your data?

We use your personal data for the following purposes:

  1. Service Relationship, which includes: Providing our services to you. These services include e-money and related payment services including but not limited to: the storage of electronic funds, the transfer of electronic funds both domestically and cross-border, the withdrawal of electronic funds, other capabilities surrounding the functionalities of digital wallets, and the operation of related financial services. Providing customer support and account administration and communicating with you about your engagement with us, such as changes in our terms or following up on an incomplete registration process.Managing payments for the services we provide you, which includes the billing process.
  2. Communicating with you at your request to provide you with information about our services in order to take steps prior to entering into a service engagement.
  3. Performing service enhancement activities. This includes conducting statistical analysis on online activity, usage, browser, device and other data.
  4. Ensuring proper administration of our business which includes keeping appropriate records, resolving complaints and managing our business relationships and opportunities.
  5. Preventing, detecting and fighting fraud or other illegal or unauthorized activities which includes monitoring operations, user activity and networks for fraud prevention and crime detection purposes, including information from third parties who may monitor our Website and systems and alert us about suspicious activities, auditing our systems and deploying security measures.
  6. Request and verify by automated means your financial related information, as well as share it, where required, with the relevant authorities to comply with our legal obligations related to financial, Anti-Money Laundering and tax regulations, among others. When you enter in your personal details to obtain an initial quote using our service, we will check your identity and credentials provided through our third party Know Your Customer / Anti-Money Laundering provider.
  7. Providing you with marketing communications about our services: We may use your personal data to provide you with information on related products and services that you may be interested in, such as other e-money and related payment services. This information will be provided electronically, either via our Website, App, or email. We will not transfer any of your personal data to third parties for this purpose unless you give us your explicit consent. You may opt out of this at any time by telling us, or if we have contacted you via email, you will be given an option to opt out by clicking the relevant email link.
  8. Product & advertising profiling: we analyse your personal data to create profiles about your likely preferences and to inform how we develop our product and advertising. This may include segmenting users, tailoring in-product communications, prioritising features and otherwise improving our services. This processing does not involve sharing your personal data with third parties for them to create their own profiles.
    • Categories used & sources: we use information including identifiers (e.g. name, email, phone number, cookie/advertising ID's), account and transaction metadata, device/usage data, interaction and support history, and inferences we generate (segments such as "active user" and "likely to engage"). We do not use special-category data for this purpose.. Sources include you (when you provide details to us), your device, our service logs, and analytics tools acting as our processors. We do not purchase third-party data or share your personal data with third parties for this purpose. Profiles are retained only as long as necessary for these purposes.
    • Your choices: you can object to profiling based on our legitimate interests at any time by clicking here.
  9. Advertisers, targeting, & lookalike audiences: We work with advertising platforms and use advertising tools (i) to target our existing customers with specific campaigns, (ii) to exclude our existing customers from certain campaigns, and (iii) to reach people who are similar to our customers (“lookalike” or “audience expansion” features). To do this, we may upload hashed identifiers (such as email or phone number) of our customers to the platform or allow the platform to collect identifiers via our website/app. The platform compares these identifiers to its users and builds or suppresses audiences accordingly. We and the platform each act as independent controllers for our respective processing; in some cases, we may be joint controllers with the platform for targeting and measurement.
  • Categories used & sources: identifiers (e.g., name, email, phone number, cookie/advertising IDs), commercial history, device/usage data (via cookies/SDKs), and general location. Sources include you (when you provide details to us), your device (when you use our services) and from our advertising partners. When we upload lists, they are hashed during upload for protection.
  • Your choices: you can manage your consent here at any time, object to our legitimate interests processing by contacting us, or you can also manage ads settings directly with the relevant platform(s).
  1. Where necessary, we may use your personal data to establish, exercise or defend legal claims in suspected or actual legal proceedings.

Please see here for the details of our Basis & Data Collection Justification.

4. What lawful basis do we rely on for processing your personal data?

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are required to identify and inform you of the lawful basis on which we collect and process your personal data. We only process your personal data when one or more of the following lawful bases apply:

  1. Performance of a contract (Article 6(1)(b) UK GDPR)

We process your personal data where it is necessary for the performance of a contract we have with you, or to take steps at your request before entering into such a contract.

This includes processing for purposes such as:

  • Providing our products and services to you;
  • Managing payments, billing, and account administration;
  • Communicating with you regarding your account, transactions, or service requests; and
  • Providing customer support or responding to your queries before you engage our services.
  1. Our legitimate interests (Article 6(1)(f) UK GDPR)

We process personal data where it is necessary for our legitimate business interests (or those of a third party), provided such interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests include:

  • Service and product improvement: enhancing, developing, and maintaining our services and features to better meet user needs.
  • Business administration: ensuring the proper management and continuity of our operations, including record-keeping, complaint resolution, and maintaining business relationships.
  • Fraud prevention and security: preventing, detecting, and addressing fraudulent, unauthorised, or illegal activities, and safeguarding the integrity of our systems and network.
  • Marketing and promotions: promoting our services and offers to existing customers, where lawful under the Privacy and Electronic Communications Regulations 2003 (PECR).
  • Customer-list uploads (hashed identifiers): promoting our services while protecting user identities through hashing, minimisation, and opt-out options.
  • Analytics and product insights: improving our products and user experience through aggregated and pseudonymised profiling.

You may object to processing based on legitimate interests at any time by contacting privacy@nala.money, and we will stop processing your data unless we have compelling legitimate grounds to continue (for example, legal obligations or defence of claims).

  1. Consent (Article 6(1)(a) UK GDPR)

We rely on your explicit consent where required for certain types of processing. This applies in situations such as:

  • Marketing communications: where you have opted in to receive updates, offers, or promotions from NALA. You can withdraw your consent at any time.
  • Advertising cookies and online identifiers: where we use online identifiers (such as device IDs or tracking technologies) for analytics, lookalike audiences, or targeted advertising — we will only do so after obtaining your consent through cookie banners or in-app settings.
  • Referral program: as described in our referral program clause, we will only process referral-related data after obtaining the referred individual’s explicit consent.
  • Third-party marketing: if you have explicitly agreed for us to share your details with selected partners for marketing purposes.

You may withdraw consent at any time by contacting privacy@nala.money or through the relevant in-app or website settings. Withdrawal of consent does not affect processing carried out before the withdrawal.

  1. Compliance with legal obligations (Article 6(1)(c) UK GDPR)

We process your personal data where necessary to comply with legal and regulatory obligations imposed on us under UK law. This includes:

  • Compliance with Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), and financial crime prevention regulations;
  • Record-keeping and reporting obligations under HMRC and other financial supervisory requirements;
  • Compliance with tax, accounting, and corporate governance obligations;
  • Responding to lawful requests from regulatory authorities, law enforcement, or courts; and
  • Establishing, exercising, or defending legal claims.
  1. Vital interests (Article 6(1)(d) UK GDPR)

In rare circumstances, we may process your personal data to protect your or another individual’s vital interests; for example, where it is necessary to prevent physical harm or safeguard life.

5. How does NALA share your information and why?

In order to deliver our services, your personal data may also be transferred to the following third parties:

‍

Our service providers and partners:

In order to deliver our services, your personal data may also be transferred to the following third parties:

We use third parties to help us operate and improve our services and facilitate the fulfilment of essential service functions. These third parties assist us with various tasks, including personal information hosting and maintenance, with security tools and others, to verify and confirm the information that you provide to us. We may also share your information with the banks, telecommunications providers and other financial services firms who facilitate payments, among others.

In corporate transactions:

We may transfer your personal information if we are involved, whether in whole or in part, in a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy or other change of ownership or control.

When required by law:

We may disclose your personal information if reasonably necessary with regulators, law enforcement agencies or authorities or where mandatory under a court order: (i) to comply with a legal process, such as a court order, subpoena or search warrant, government / law enforcement investigation or other legal requirements; (ii) to assist in the prevention or detection of crime (subject in each case to applicable law); or (iii) to protect the safety of any person.

To enforce legal rights:

We may also share information: (i) if disclosure would mitigate our liability in an actual or threatened lawsuit; (ii) as necessary to protect our legal rights and legal rights of our users, business partners or other interested parties; (iii) to enforce our agreements with you; and (iv) to investigate, prevent, or take other action regarding illegal activity, suspected fraud or other wrongdoing.

With other entities within NALA Group:

When it is necessary for operational reasons such as the use of a group-wide logistics and IT infrastructure and for any administrative purposes to organise, develop and deliver our services and products, run our organisation and decide on future strategies.

In certain circumstances we may ask for your consent to share your personal data with explicitly identified third parties, including entities within NALA Group, so that they can contact you for marketing purposes or provide you with their own products or services. We will only do so if you have given us your explicit consent to share your personal information in this way, which can be given via a pop-up screen on the Website. You can withdraw your consent at any time by emailing us.

With our NALA ambassadors:

We may share your personal data (the referrer's) with the NALA ambassador whose referral code you used. This sharing is based on your explicit consent, which you provide when you submit the ambassador's referral code and accept this privacy policy & referral program T&C's. The ambassador uses this data to track the referral and, in some cases, to offer you exclusive promotions or customer support. You may withdraw this consent at any time by contacting us.

6. How we use clickstream data

NALA may collect and use clickstream data to profile your behaviour on our website and to understand how you interact with our online presence. This data is collected through the use of web analytics software, and may include information about the websites and pages you visit, as well as the actions you take on those pages.

‍

We use this data to improve our website and to better understand our users' needs and preferences. We may also use this data to personalise your experience on our website and to show you relevant content and offers.

‍

We take the protection of your personal data seriously and have implemented appropriate technical and organisational measures to ensure that your data is collected, used, and stored in compliance with the General Data Protection Regulation (GDPR) and other relevant local legislation in our various countries of operation. We also ensure that your data is only used for legitimate business purposes and is not shared or sold to third parties without your consent.

‍

You have the right to access, correct, and delete any personal data that we collect about you. If you wish to exercise any of these rights, please contact us at privacy@nala.money

How do we send information outside of the UK?

We take the protection of your personal data very seriously. All personal data we collect is stored securely and processed in accordance with the UK GDPR and the Data Protection Act 2018.

Your data may be stored on secure cloud servers located within the United Kingdom or the European Economic Area (EEA). Where we transfer or allow access to your data outside the UK, we ensure that appropriate safeguards are in place to protect it.

These safeguards may include:

  • A UK adequacy regulation confirming that the destination country ensures an adequate level of data protection; or
  • The use of approved transfer mechanisms, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), together with supplementary measures where required to ensure equivalent protection.

We only make such transfers where they are necessary for the provision of our services, for example where a service provider (such as a cloud hosting provider or payment processor) operates outside the UK.

You may request further information about the safeguards we apply to international data transfers by contacting us at privacy@nala.money.

What are your rights?

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a number of rights regarding how we handle and process your personal data. These rights are designed to give you control and transparency over your personal information.

You have the following rights:

  • Right to be informed – You have the right to be informed about how we collect and use your personal data. This Privacy Notice fulfils that obligation (Article 13, UK GDPR).
  • Right of access – You may request a copy of the personal data we hold about you by submitting a “data subject access request” under Article 15 UK GDPR.
  • Right to rectification – You can ask us to correct or complete any inaccurate or incomplete personal data we hold about you (Article 16).
  • Right to erasure (“right to be forgotten”) – You can request that we delete your personal data in certain circumstances, for example, where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent (Article 17).
  • Right to restrict processing – You may ask us to restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy (Article 18).
  • Right to data portability – Where processing is based on your consent or carried out by automated means for the performance of a contract, you can request that we provide your data in a structured, commonly used, machine-readable format or transfer it to another controller (Article 20).
  • Right to object – You can object to our processing of your personal data where it is based on our legitimate interests or for direct marketing purposes (Article 21). If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds or where processing is required for legal claims.
  • Rights related to automated decision-making and profiling – You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you (Article 22).
  • Right to withdraw consent – Where we rely on your consent for processing (for example, marketing or referral programmes), you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
  • Right to lodge a complaint – If you believe we have not handled your personal data in accordance with data-protection law, you can lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority:

You can exercise any of these rights by contacting us at privacy@nala.money. We may need to verify your identity before acting on your request.

We respond to all valid requests in accordance with the time limits and conditions set out in the UK GDPR (normally within one month).

How long will we keep your data for?

In accordance with the storage limitation principle under Article 5(1)(e) UK GDPR, we only retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

We will:

  • Retain your personal data for as long as your account or contractual relationship with NALA remains active.
  • Retain limited data thereafter only as needed for legitimate business purposes, including compliance with legal or regulatory obligations (for example, financial-record and anti-money-laundering retention requirements under UK law, typically up to five years).
  • Anonymise or securely delete data once retention is no longer justified.

If you would like further details on our retention schedule, please contact: privacy@nala.money.

‍

How do we protect your information?

We apply appropriate technical and organisational measures to safeguard your personal data, as required under Article 32 UK GDPR and the Data Protection Act 2018. These include:

  • Encryption of data in transit and at rest;
  • Access controls, authentication, and logging;
  • Regular security assessments and staff training;
  • Secure data-hosting environments and incident-response procedures.

If you are given (or create) a password to access parts of our services, you are responsible for keeping it confidential and for preventing unauthorized access to your account. We recommend that you do not share your password with anyone.

Where we upload customer lists for advertising or analytics purposes, all identifiers are hashed or pseudonymised before upload to ensure they cannot be directly linked back to an individual without additional information.

What cookies and similar technologies do we use?

Please see our Cookie Notice for more information on why we use them and how you can better control their use through your browser settings and other tools.

‍

How can you contact NALA?

If you have questions regarding your privacy and rights, please let us know how we can help.

Email: privacy@nala.money Post mail: International House, 64 Nile Street, London, N1 7SR.

‍

Send Love Home

Community

Our roadmapLive updatesBuild with NALANALA Merch StoreNALA Partner Programs

Company

Our StoryPurposeCareersFAQsOur BlogPressLicenses

Transparency

Terms of ServicePrivacy PolicyCookiesStay safeComplaints Procedure
In the United Kingdom, NALA Payments Ltd is a registered EMD agent of Modulr FS Limited, which is an Electronic Money Institution authorised by the Financial Conduct Authority with firm reference number 900573. Electronic Money products are not covered by the Financial Services Compensation Scheme (FSCS). Customer funds will be held in one or more segregated accounts and safeguarded in line with the Electronic Money Regulations 2011. For more information, please see Modulr’s UK Safeguarding Explanation here.

In the European Union, NALA Payments Netherlands B.V. is a partner of Modulr Finance B.V., a company registered in the Netherlands with company number 81852401, which is authorised and regulated by De Nederlandsche Bank (DNB) as an Electronic Money Institution (relationship number R182870) for the issuance of electronic money and payment services. Your account and related payment services are provided by Modulr Finance B.V. Your funds will be held in one or more segregated accounts and the full value safeguarded in line with the Financial Supervision Act.

In the United States, Nala Inc. partners with the financial services software company, Sila Inc. (“Sila”) and Priority Technology Holdings Inc. (“Priority Commerce”), either directly or through its subsidiary Finxera, Inc. (NMLS #1168701) and/or its authorized affiliates, contractors and partners (including but not limited to the following Banks: Wells Fargo, N.A., Comerica Bank, Axos Bank, and Western Alliance Bank) to offer you electronic fund transfers and provide you with an account. Nala Inc. is a financial technology company, not a bank.

Mufasa Payments LLC, a subsidiary of Nala Inc., partners with Lead Bank (NMLS #635532) to offer you electronic fund transfers and provide you with an account. Mufasa Payments LLC is a financial technology company, not a bank.

In certain states in the United States where it holds the necessary licenses, money transmission services may be provided by Nala Payments LLC (NMLS: 2530895), a subsidiary of Nala Inc., pursuant to its own state-issued money transmitter licenses and registration as a Money Services Business (MSB) with the United States Treasury Financial Crimes Enforcement Network (MSB: 31000335047569). In such cases, the partnership with Mufasa Payments LLC, Sila Inc. and Lead Bank N.A. may not be utilized or required. The availability of services and regulatory status may vary by geographic location and customer location.

© Copyright NALA INC 2026.