Privacy Policy

01

Who we are and what this policy covers

Pouch is a trading name of Pouch LTD, a company registered in England and Wales under company number 15278653, with registered office at 483 Green Lanes, London N13 4BS. In this policy, "Pouch", "we", "us", and "our" mean Pouch LTD.

This policy explains how personal data is processed by the Pouch API, the software that Pouch licenses to banks and financial institutions ("Clients" or "you"). The Pouch API sits on top of a Client's existing transaction-categorisation model and turns categorised transactions into live income and expense cycles, and the free cashflow that follows, which the Client uses to power its own money-management tools.

This policy covers personal data processed through the Pouch API service. It does not cover personal data that Pouch collects about visitors to its website or about business contacts, which is handled separately. The effective date of this policy is 2 June 2026.

Where you license the Pouch API, the processing of personal data is also governed by the data processing agreement (DPA) between you and Pouch, and by your Order Form. If there is any conflict between this policy and your DPA, the DPA prevails in relation to the processing it covers.

02

Our role: you are the controller, Pouch is your processor

When you use the Pouch API to process personal data relating to your end customers, you are the data controller and Pouch acts solely as your data processor. You determine the purposes and means of the processing; we process the personal data only on your documented instructions.

What this means in practice

• We process end-customer personal data only to provide the Pouch API service to you, and only on your documented instructions, as set out in your DPA;
• We do not use end-customer personal data for our own purposes, and we do not sell, rent, or trade it;
• You remain responsible for your obligations as controller, including establishing a lawful basis for the processing and providing the required privacy information to your end customers;
• Your end customers should direct any questions or rights requests about their data to you, as their controller, in the first instance.

If you are an end customer of a bank or financial institution that uses the Pouch API, the institution, not Pouch, is the controller of your data. Please contact your institution to exercise your rights.

03

How the Pouch API receives and processes data

You send the Pouch API data relating to your end customers, and the Pouch API processes that data to produce the cashflow intelligence outputs and returns them to you. The Pouch API works only with the data you choose to send to it; it does not retrieve that data from anywhere itself.

Pouch does not connect to, log in to, or retrieve data from your end customers' bank accounts. How personal data is handled in connection with the Pouch API is set out in your DPA.

04

Personal data processed through the Pouch API

The categories of personal data processed through the Pouch API are determined by the data you send. They typically include:

• Categorised transaction data, such as transaction amounts, dates, categories or labels, and counterparties, relating to your end customers;
• Account and identifier data needed to associate transactions with the correct end customer, as defined by your integration;
• Derived attributes that the Pouch API produces, such as detected income and expense cycles and free cashflow.

You control which fields you send to the Pouch API. We recommend that you send only the data necessary for the service and that you minimise or pseudonymise identifiers where you can. The Pouch API is not intended to receive special category data, and you should not send it unless this is expressly agreed in your DPA.

05

Purposes and instructions

We process end-customer personal data in order to provide, operate, maintain, support, secure, and improve the Pouch API service for you, namely to produce cashflow intelligence from the data you send and return it to you, together with any related purpose set out in your DPA. We carry out that processing on your documented instructions, which are set out in your DPA and Order Form and given through your configuration and use of the API.

As your processor, Pouch does not determine the purposes of the processing and does not rely on its own lawful basis for it. You, as controller, are responsible for identifying and documenting the lawful basis required under applicable data protection law (for example, Article 6 of the UK GDPR or EU GDPR), and any condition required for special category data, and for meeting your transparency obligations to your end customers.

06

Retention and deletion

We take reasonable steps to ensure that personal data processed through the Pouch API is retained only for as long as necessary for the purposes set out in this policy, and as required by law or in accordance with your DPA.

On termination of your agreement, or on your documented instruction, we will delete or return personal data in accordance with your DPA.

07

Sub-processors

To operate the Pouch API we use contractors, service providers, and other third parties that may act as our sub-processors, including cloud hosting and infrastructure providers. Each is engaged under a written contract that imposes data-protection obligations no less protective than those in your DPA.

A current list of our sub-processors for the Pouch API is available on request. We will give you advance notice of any intended change to our sub-processors and an opportunity to object, in accordance with your DPA.

08

International data transfers

Where we transfer personal data outside the United Kingdom or the European Economic Area in connection with the Pouch API, we put in place an appropriate safeguard before the transfer takes place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a finding of adequacy, as applicable. You can request further information about the safeguards we use using the contact details in section 12.

09

How we protect your data (security)

We use reasonable physical, technical, and organisational safeguards designed to protect personal data processed through the Pouch API against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

However, no method of transmission or processing can be guaranteed to be completely secure, and we therefore cannot promise absolute security. Further information about the security measures applicable to the Pouch API is available to you on request and through your DPA.

10

Assisting you with data-subject rights

Your end customers have rights over their personal data under applicable data protection law, including rights of access, rectification, erasure, restriction, portability, and objection. Because you are the controller, those rights are exercised against you, and you are responsible for responding to them.

As your processor, and taking into account the nature of the processing, we will provide reasonable assistance to help you respond to data-subject requests and to meet your related obligations, as set out in your DPA. Because Pouch does not retain end-customer personal data after processing, such requests will normally be fulfilled by you from your own systems.

We do not carry out solely automated decision-making that produces legal or similarly significant effects on your end customers. The Pouch API produces cashflow intelligence that you may use within your own tools; any decision taken using that output is yours.

11

Changes to this policy

We may update this policy from time to time to reflect changes in the Pouch API, our practices, technology, or legal requirements. The current version, with its effective date of 2 June 2026, will be made available to you. Where a change is material, we will bring it to your attention in accordance with your agreement.

12

How to contact us and lodge a complaint

If you have any questions about this policy or about how the Pouch API processes personal data, please contact us using the following details:

• General enquiries: connect@pouchlimited.com;
• Privacy and data-protection enquiries: connect@pouchlimited.com;
• Postal correspondence: 483 Green Lanes, London N13 4BS, United Kingdom.

Where you are entitled to do so under applicable law, you may lodge a complaint with your local data protection authority. In the United Kingdom, that authority is the Information Commissioner's Office (ICO), with which Pouch is registered under reference ZB741458 (ico.org.uk).

If you are an end customer of an institution that uses the Pouch API and you wish to exercise your rights or raise a concern about your data, please contact your bank or financial institution, which is the controller of that data.