Your Rights
Date: April 2026
You have the following rights in relation to your personal data. Some rights are absolute; others depend on the lawful basis we rely on or the specific circumstances of your request.
Right to Access
Request a copy of the personal data we hold about you, together with information about how and why it is processed, who it is shared with, and how long it is retained. Free of charge unless manifestly unfounded or excessive.
Right to Correction
Request that inaccurate or incomplete personal data we hold about you is corrected without undue delay. Where we have shared the inaccurate data with third parties, we will inform them.
Right to Deletion
Request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis. Subject to our legal retention obligations.
Right to Restrict Processing
Request that we restrict (pause) processing of your personal data in certain circumstances i.e. where you contest its accuracy; where processing is unlawful but you prefer restriction to erasure; where you have objected and we are assessing our legitimate grounds.
Right to Object
Where we process your personal data on the basis of legitimate interests, or for direct marketing, you have the right to object at any time. For direct marketing, the right is absolute and we will stop immediately.
To exercise use the unsubscribe link in any marketing email.
Right to Data Portability
Where processing is based on your consent or contract performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format for example, to port your transaction history to another provider.
Withdrawal of Consent
Where we rely on your consent as the lawful basis for processing, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.
To withdraw use your in-app settings.
Automated Decision-Making
Where NALA uses automated systems to make decisions with legal or similarly significant effects on you (e.g. account access, transaction limits, fraud flags), you have the right to request human review, express your point of view, and contest the outcome.
How to exercise your rights
Contact our DPO at dpo@nala.money. We will:
- Acknowledge your request within five business days
- Respond within one calendar month of receipt
- Notify you within the first month if we need to extend this period by up to two further months, explaining the reason
- Not charge a fee unless your request is manifestly unfounded or excessive
- Ask you to verify your identity before processing your request, to protect your data
- Tell you clearly if we are unable to fulfil a request and advise you of your right to complain to your supervisory authority