Privacy policy

AMNO Group Ltd, trading as Amno Solutions (“Amno”, “we”, “us”), is the controller of the personal data described in this policy. This policy explains what we collect through amnosolutions.com and the Amno Solutions platform, why we use it and the rights you have.

AMNO Group Ltd is registered in England and Wales, company number 16870880, registered office 15 The Broadway, Woodford Green, Essex, IG8 0HL, United Kingdom. Our data protection contact is privacy@amnosolutions.com, and our registration number with the Information Commissioner’s Office is 00014436798.

Amno is not a bank. The bank accounts you open through our platform are provided by Griffin, which uses your data for its own purposes as explained in section 6.

Our clients are UK companies, so most of the personal data we hold is about the people connected with them. This policy covers:

• People connected with our clients and applicants: directors, persons with significant control, other beneficial owners, and the people a client authorises to use the platform (“authorised users”).
• People our clients pay: employees, contractors and other payees named in a payroll run. They are not our clients, and we receive their details from the company paying them.
• Website visitors, and anyone who contacts us or whom we contact about our services.

We collect only what we need to open and run your company’s account, check who we are dealing with and send payments correctly.

Identity and contact — name, date of birth, residential address history, email address, mobile number and role in the company, from you and from Companies House.

Ownership and control — shareholdings, persons with significant control and other beneficial owners, from you and from Companies House.

Identity verification — a photo of an identity document, a facial image or live selfie, and the verification result, from you through the verification technology provided by Griffin.

Screening — the results of sanctions, politically exposed person, adverse media and identity fraud checks, from Griffin’s verification technology and screening providers.

Account and payments — balances, payroll runs, payment amounts and references, payment status and name-check results, from the platform and from Griffin.

Payees — name, sort code, account number, payment reference, amount and the result of the name check with the payee’s bank, from the company paying them.

Sign-in and security — email address, a one-way hash of your password, mobile number, a one-way hash of each confirmation code, and session records: when a session started and was last used, browser type and network address.

Communications — emails, support requests, complaints and anything you choose to tell us, including about circumstances that make you vulnerable.

Website — network address, browser type and pages requested, held in our server logs, and the two cookies described in our cookie policy.

We do not store your password or confirmation codes in a form anyone can read. If you do not provide the information we need for identity and business checks, we cannot open or keep open an account for your company.

Our contract is with the company, not with you personally, so for most purposes we rely on legitimate interests: ours, our client’s and Griffin’s interest in running accounts safely and paying people correctly. We have weighed those interests against yours and you can object at any time (section 12).

We rely on legitimate interests for:

• Opening and running the company’s account, onboarding, and giving authorised users access to the platform.
• Checking identity and ownership, and screening against sanctions, politically exposed person and adverse media lists — in preventing fraud and financial crime, and in meeting our obligations to Griffin.
• Checking payee names against their accounts before payments are sent, in the interest of our client and its payees that payments reach the right person.
• Securing sign-in, sending confirmation codes and keeping session records.
• Telling business contacts about our services.
• Establishing, exercising or defending legal claims.

We rely on legitimate interests and, where the law requires us to report or disclose, legal obligation, for monitoring transactions for fraud, money laundering and other financial crime, and for handling support requests and complaints.

We rely on legal obligation for keeping accounting, tax and payment records, and on your explicit consent for supporting you if you tell us about circumstances that make you vulnerable.

We do not sell personal data, and we do not use it for advertising or share it with advertisers.

Facial images used to verify identity are biometric data, which the law treats as special category data. We ask for your explicit consent at the verification step before this check runs. Where consent is not appropriate, we rely on the substantial public interest condition for preventing or detecting unlawful acts (Data Protection Act 2018, Schedule 1, paragraph 10).

Screening results can include information about criminal allegations, proceedings or convictions, for example from adverse media or sanctions checks. We use this only to prevent and detect fraud and financial crime, relying on the same Schedule 1 condition.

Information about vulnerability, such as a health condition you choose to tell us about, is used only to support you, with your explicit consent. You can withdraw consent at any time; withdrawal does not affect processing already carried out. We keep an appropriate policy document explaining how we protect this data and how long we keep it.

Griffin provides the bank account behind the platform. Amno and Griffin are each an independent controller: we share onboarding, verification, account and payment data with each other so that Griffin can decide whether to open an account, run it and meet its legal obligations. Griffin uses this data under its own privacy policy at griffin.com/privacy, which explains how Griffin uses identity verification, screening, transaction monitoring, credit reference and fraud prevention providers. Please read it alongside this policy. You can send us requests about data we share with Griffin and we will coordinate the response with Griffin.

We also share personal data with:

• Payees’ banks, through Griffin, to check payee names and to make payments.
• Service providers acting on our instructions, including Amazon Web Services for platform hosting in the London region, Twilio for delivery of confirmation codes by text message, and our email and productivity software providers. They may use the data only to provide their service to us.
• Our professional advisers, including the external compliance advisers who independently review our transaction monitoring, and our auditors, lawyers and insurers.
• Police, regulators, courts and fraud prevention agencies, where the law requires it or where it is necessary to prevent or detect crime.
• A buyer of, or investor in, our business, under confidentiality obligations, if we sell or restructure all or part of it.

The platform and its data are hosted in the UK, in the Amazon Web Services London region. Some of our service providers process personal data outside the UK: Twilio may process mobile numbers in the United States to deliver confirmation codes.

When personal data leaves the UK, we make sure it is protected by one of the safeguards UK law allows: UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguard that applies.

Some of our team work remotely outside the UK. When they access personal data, they do so on Amno’s own secure systems and under Amno’s control. Griffin’s own providers, some of which are outside the UK, are described in Griffin’s privacy policy.

We use automated tools to verify identity, screen names against sanctions and other lists, check payee names and monitor payments for fraud and financial crime. These tools can flag an application or a payment, and can hold a payment while it is reviewed.

We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing. A person at Amno or at Griffin reviews flagged items before a final decision, such as declining an application or closing an account. You can ask for a person to review a decision, give us your point of view and contest the outcome.

Griffin makes the final decision on whether to open an account. Griffin’s privacy policy explains its own use of automated tools.

We keep personal data only as long as we need it for the purposes in section 4, then delete or anonymise it.

• Onboarding, identity verification and screening records; account, payroll run and payment records, including the payee details used in them; and support requests and complaints: seven years after our relationship with the company ends.
• Applications that do not proceed: two years after the application closes.
• Sign-in and session records: while the session is live, and ninety days afterwards.
• Website server logs: ninety days.
• Marketing contact details: until you unsubscribe, after which we keep a minimal record so that we do not contact you again.

We may keep data for longer if the law requires it, if it is needed for a legal claim or investigation, or if Griffin or a regulator asks us to preserve it.

Personal data is encrypted in transit and at rest. Passwords and confirmation codes are stored only as one-way hashes. Sessions end after thirty minutes of inactivity, every payroll run needs a one-time code sent to the authorised user’s mobile, and every action on an account is logged. Access to personal data is limited to staff who need it, and they are bound by confidentiality.

No system is completely secure. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.

We may email business contacts about our services. Where you use a company email address we rely on our legitimate interests; if you are a sole trader or partnership, or if the law otherwise requires it, we ask for your consent first. Every marketing email lets you unsubscribe, and you can also write to us at any time.

Messages about your account, such as security alerts, payment confirmations and changes to our terms, are not marketing and continue while you use the platform.

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data, or to restrict how we use it;
• object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing;
• receive data you gave us in a portable, machine-readable format, where the law gives that right;
• withdraw consent where we rely on it;
• ask for a person to review a decision made by automated means, and contest it.

Write to privacy@amnosolutions.com. We will reply within one month, or tell you within that month if we need up to two more because a request is complex. Some rights are limited: we cannot delete records the law requires us to keep, or fraud prevention records while they are still needed.

If you are unhappy with how we have handled your data, please complain to us first at the same address. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We will update this policy when the way we use personal data changes, and show the date of the latest version at the top. If a change materially affects how we use your data, we will tell authorised users by email before it takes effect.