Privacy policy

Last updated 13 November 2026.

This policy explains what personal information Express Remit Ltd collects when you use our app, our website or our customer support, why we collect it, who we share it with, how long we keep it, and your rights.

1. Who is responsible for your information

Express Remit Ltd is the controller of your personal information. We are registered in England and Wales, company number 10657696, at 124 City Road, London, EC1V 2NX, and with the Information Commissioner's Office, registration number ZA462150.

For any question about this policy or your information, email hello@expremit.com, call +44 20 8552 5105, or write to us at the address above, marked for the attention of the Data Protection Officer.

Express Remit Inc. is a separate company in Canada. This policy does not cover it.

2. What we collect

Information you give us

• Identity: your name, date of birth, nationality, and copies of identity documents such as a passport or driving licence, and, where we need it, a photo or short video of your face to confirm that you are the person in the document and that you are present (a liveness check).
• Contact details: your address, email address and phone number, and proof of address.
• About your transfers: the people you send money to and their details (such as name, country, bank account or wallet number), amounts, the reason for a transfer, and where the money came from when we need to ask.
• Payment details: the card or account you pay with. Full card numbers are handled by our payment processor, Shift4. We do not store them.
• Your messages: what you tell us by phone, email, the contact form or in the app, including complaints. Calls may be recorded for training, quality and to keep a record of what was agreed.

Information we collect when you use our services

• Your transfers and account activity: dates, times, amounts, status and the device used.
• Technical information: your IP address, device type, operating system and app version, which we use to keep your account secure and spot fraud.

Information from others

• Shift4 and your card issuer, about whether a payment was approved and the results of their security checks.
• Sanctions and politically exposed persons lists, and public records, which we check as required by law.
• Our payment partners abroad, about the status of a transfer.
• Police, regulators and other authorities, where they contact us.

If you give us information about someone else, such as the person you are sending to, please make sure they know you are doing so and where they can read this policy.

3. Why we use it, and our legal basis

Data protection law requires us to have a lawful basis for each use of your information.

• To provide our service (open your account, make your transfers, take payment, send refunds, support you): because it is necessary for our contract with you.
• To check who you are and prevent financial crime (identity checks, source of funds, sanctions screening, monitoring transfers, reporting suspicious activity to the authorities): because the law requires it, in particular the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
• To keep records and meet our other legal duties as a regulated firm, including answering our regulator, the courts and the police: because the law requires it.
• To prevent fraud, keep our service secure, handle complaints and improve our service: because it is in our legitimate interests, and in yours, to do so.
• To send you marketing about our own services: only with your consent, which you can withdraw at any time using the link in any message or by contacting us. We do not pass your details to other companies for their marketing.

Where the law requires us to collect information and you do not provide it, we will not be able to open your account or make a transfer.

Face checks. Comparing your face with your identity document uses biometric data, which the law treats as a special category of personal information. We use it only to confirm your identity and prevent fraud, and to meet our legal duties, under the conditions the Data Protection Act 2018 sets for preventing unlawful acts and meeting regulatory requirements. Where the law requires it, we will also ask for your explicit consent in the app before the check. Identity documents can also show information such as your ethnic origin, which we use only for the same purposes.

4. Fraud checks and automated decisions

To protect you and our service, payments and transfers are checked automatically for signs of fraud and financial crime. These checks are made by us, by Didit when we verify your identity, by Shift4 and by your card issuer, and can include 3-D Secure, where your bank asks you to approve the payment. As a result, a payment can be declined, or a transfer held for review, without a person being involved at that moment.

If a transfer is held or refused because of an automated check, a member of our team will review it if you ask. You can contact us to explain your situation and to challenge the decision.

5. Who we share it with

We share your information only where needed for the purposes above:

• Shift4, which processes card payments for us. Shift4 acts for us when it processes your payment, and as an independent controller for its own legal and fraud checks. Its own privacy notice is at shift4.com.
• Didit, which carries out identity verification for us, including document checks and face checks. Didit acts only on our instructions and does not sell biometric information. Its notice for people being verified is at didit.me.
• Banks and payment partners in the destination country, which pay your recipient. They receive what they need to do so, usually your name and the transfer details, and the recipient's details. Money transfer rules require your name and other details to travel with the payment.
• Companies that provide services to us, such as hosting, email and customer support systems, under contracts that require them to protect your information and use it only on our instructions.
• Regulators and authorities, including the FCA, HM Revenue & Customs, the National Crime Agency, the police and courts, where the law requires or allows it.
• Professional advisers and auditors, and any business that takes over all or part of ours, under the same protections.

We do not sell your personal information.

6. Sending information outside the UK

A transfer abroad means sending some of your information to the country you are sending money to, so that the money can be paid. Some of our service providers, including Didit, may also process information outside the UK. Where the country does not have data protection law recognised by the UK as adequate, we use the safeguards the law allows, such as the UK's approved contract terms, or rely on the transfer being necessary to carry out the transfer you have asked us to make. You can ask us for details.

7. How long we keep it

The law requires us to keep records of your identity and your transfers for five years after our relationship with you ends, or after a one-off transfer is completed. We may keep information longer if the law requires it, if we need it to deal with a complaint or legal claim, or if an authority has asked us to. We then delete it or make it anonymous.

Messages sent through our website contact form that are not about an account are kept for up to two years.

8. Closing your account and deleting your information

You can close your account and ask us to delete your information at any time, free of charge. You can do this in the app, from your account settings, or without the app: through the contact form, choosing Close my account, by email to hello@expremit.com, or by phone on +44 20 8552 5105. Our close your account page explains the steps.

• Deleted within 30 days of closing your account: information we do not have to keep by law, such as your login details, app settings, saved devices and marketing preferences. Marketing stops straight away.
• Kept for five years after your account closes: your identity details, copies of your identity documents and the results of identity checks, records of your transfers and the people you sent money to, and information we collected to meet our anti-money laundering duties. The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 require us to keep these. During that time we use them only to meet our legal duties, and access to them is restricted. We then delete them or make them anonymous, unless section 7 gives a reason to keep them longer.

9. How we protect it

We use technical and organisational measures to protect your information, including encryption when it is sent to and from our app and website, access controls, and staff training. No system is perfectly secure. If a breach of your information is likely to put you at high risk, we will tell you without undue delay, and we will report breaches to the Information Commissioner where the law requires.

10. Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to our use of it based on our legitimate interests, and to stop marketing at any time;
• ask for information you gave us in a format you can take elsewhere;
• withdraw your consent where we rely on it; and
• ask for a person to review a decision made automatically.

Some rights are limited by law. In particular, we cannot delete information we must keep to meet the money laundering rules in sections 7 and 8, and we cannot tell you about some financial crime checks. We will explain if a limit applies.

To use your rights, including asking for a copy of your information (a subject access request), contact us in any way: by email, phone, post, or the contact form, choosing My personal data. You do not need to use a particular form of words. It is free. We will reply within one month of receiving your request. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we need to. We will ask you to confirm your identity before we release any information, so that we never give your information to someone else.

11. Complaining to the regulator

If you are unhappy with how we have used your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Our website

Our website does not use advertising or analytics cookies, and does not track you for marketing.

• Contact form: we use what you send (your name, email, the topic, any transfer reference and your message) to answer you.
• Bot protection: the contact form uses Cloudflare Turnstile to tell people from automated programs. Cloudflare processes information about your browser and device to do this, under its own Turnstile privacy addendum.
• Server logs: our hosting keeps short-term records of requests, such as IP addresses, to keep the website running and secure.

Links to other websites are for your information. Their own privacy policies apply.

13. People under 18

Our service is only for adults living in the United Kingdom. We do not knowingly collect information about anyone under 18, except as the recipient of a transfer.

14. Changes to this policy

We will update this policy when the way we use your information changes. The current version is always on this page, with the date it was last updated. If a change is significant, we will tell you in the app or by email.