Privacy Policy

1. About This Policy

1.1This Privacy Policy explains how Marble Bank Ltd ("the Bank", "we", "us", "our") collects, uses, shares and protects personal data. It applies to personal data of visitors to our website at marblebank.app and any online banking platform or mobile application (the "Website"), applicants for our services, Clients, and individuals connected with a Client, such as directors, shareholders, beneficial owners, authorised signatories, representatives, guarantors and payment counterparties.

1.2If you provide us with personal data about another person, such as a director or beneficial owner of your company, please make sure that you have informed them about this Privacy Policy.

1.3The Bank processes personal data in accordance with applicable data protection laws, including, where applicable, the EU General Data Protection Regulation (the "GDPR"). The Bank has adopted the GDPR as its minimum standard for all processing, wherever our Clients are located. The Bank is also bound by banking confidentiality obligations under the Offshore Banking Act, Chapter 73:02.

2. Who We Are and How to Contact Us

The controller responsible for your personal data is:

• Marble Bank Ltd, Company No. 2026/C0112
• Registered office: 3 Kings Lane, St. George, Roseau, Commonwealth of Dominica
• Email: hello@marblebank.app

2.1The Bank has designated a data protection officer. You can contact our data protection officer about any matter relating to this Privacy Policy or your personal data at privacy@marblebank.app.

2.2If the Bank becomes required to appoint a representative in the European Union under Article 27 GDPR, it will publish the representative's details in this Privacy Policy.

3. Personal Data We Collect

Depending on your relationship with us, we collect and process the following categories of personal data:

• Identity data: name, date and place of birth, nationality, gender, photograph, identity document details and copies, tax identification number and tax residence.
• Tax status data: your countries of tax residence and tax identification numbers, whether you are a US person, US tax forms (such as IRS Form W-9 or W-8 series forms) and other tax self-certifications, and, for entities, their tax classification and the tax status of their controlling persons.
• Contact data: residential and correspondence address, email address and telephone number.
• KYC and verification data: copies of identity documents, proof of address, and biometric facial data (facial images and video captured for liveness detection and matching against your identity document).
• KYB and beneficial ownership data: for corporate Clients, information about directors, shareholders, beneficial owners, authorised signatories and other controlling persons, including their identity and contact data and their ownership or control interests.
• Financial and transaction data: account details, balances, payment instructions, transaction history, beneficiary and counterparty details, card data, lending and collateral information, and investment information.
• Source of funds and source of wealth data: information and documents about your income, assets, business activities, employment and the origin of the funds and assets you hold with or transfer through the Bank.
• Virtual asset data: wallet addresses, transaction hashes, blockchain transaction data and related risk scores, and information exchanged with other virtual asset service providers under the Travel Rule.
• Device and technical data: IP address, device identifiers, browser type, operating system, geolocation derived from IP address, login data and information collected through strictly necessary cookies and, if you consent, through Google Analytics (see our Cookie Policy).
• Communications data: records of emails, messages, support requests, complaints and, where applicable, recorded calls.
• Screening data: results of screening against sanctions lists, politically exposed person (PEP) lists and adverse media, including information about criminal allegations or convictions where it appears in those sources.
• Profile and risk data: your risk rating, fraud indicators and information generated by our monitoring systems.
• Marketing preferences: your choices about receiving marketing communications.

3.1Some of the data above is special category data (biometric data used to identify you) or data relating to criminal convictions and offences (screening results). We process such data only where the law allows, as explained in section "Purposes and Legal Bases" below.

4. Where We Get Your Personal Data

We collect personal data:

• directly from you, when you visit the Website, apply for services, use our services or contact us;
• from your company or another Client, if you are connected with a corporate Client or are a payment counterparty;
• from our identity verification and screening provider, which verifies your identity documents and performs liveness checks and screening on our behalf;
• from public registers, such as company registries and beneficial ownership registers;
• from sanctions, PEP and adverse media screening databases;
• from blockchain analytics providers and public blockchain records;
• from payment partners, card issuing partners and correspondent banks, in connection with payments and transactions; and
• from regulators, law enforcement agencies or other public authorities, where they provide information to us.

5. Purposes and Legal Bases

We use your personal data only where we have a legal basis to do so under Article 6 GDPR and, for special category data and data relating to criminal convictions and offences, only where Article 9 or Article 10 GDPR allows it. The table below sets out the main purposes and the legal bases we rely on.

5.1Where we refer to a legal obligation and the obligation arises under the laws of the Commonwealth of Dominica or another country outside the EU/EEA, we rely, where the GDPR applies, on our legitimate interest in complying with the laws to which we are subject.

5.2Where we rely on legitimate interests, we balance our interests against your rights and freedoms. You can ask us for more information about this balancing.

5.3If you do not wish to consent to biometric verification, please contact us before you start onboarding. Where feasible, we will offer you another way to verify your identity, but if no alternative is available we may not be able to accept your application.

5.4If you do not provide the personal data we need to meet our legal obligations or to enter into a contract with you, we will not be able to provide our services to you.

6. Automated Decision-Making and Profiling

We use automated tools to support our compliance and risk processes, including:

• client risk scoring based on information such as your country, business activity, expected transactions and screening results;
• fraud and transaction monitoring, which analyses transactions and activity patterns to identify unusual or suspicious behaviour;
• blockchain analytics, which assess the risk associated with virtual asset wallet addresses and transactions; and
• automated identity verification and liveness checks.

6.1These tools generate alerts and risk indicators. Decisions to decline an application, end a relationship, refuse a transaction or freeze assets are not taken solely by automated means: they are taken by our staff, who review the automated results. If we ever made a decision based solely on automated processing that produced legal or similarly significant effects for you, you would have the right under Article 22 GDPR to obtain human intervention, to express your point of view and to contest the decision. Some information about our monitoring may not be disclosed where the law prohibits it.

7. Who We Share Your Personal Data With

We share personal data only where necessary for the purposes described above and with recipients bound by appropriate confidentiality and data protection obligations. Recipients include:

• our identity verification and screening provider, which performs identity verification, liveness checks, business verification, sanctions, PEP and adverse media screening, transaction monitoring, virtual asset wallet risk scoring and Travel Rule messaging on our behalf;
• our group service company, which provides operations, compliance and technology support to the Bank under an intra-group services agreement;
• payment and virtual IBAN providers, payment networks and electronic money institutions;
• correspondent banks;
• our card issuing partner;
• specialist virtual asset custody and wallet technology providers engaged by the Bank, liquidity and exchange counterparties, and other virtual asset service providers under the Travel Rule;
• cloud hosting and information technology providers, and Google (Google Analytics), only for website visitors who have consented to analytics cookies;
• professional advisers, including lawyers, accountants and consultants;
• external and internal auditors;
• the Financial Services Unit and other regulators and supervisory authorities;
• the Financial Intelligence Unit of Dominica and other financial intelligence units;
• tax authorities, including the competent tax authority of the Commonwealth of Dominica and, where applicable, the US Internal Revenue Service, to which we disclose tax status and account information where required under the US Foreign Account Tax Compliance Act (FATCA) or the OECD Common Reporting Standard (CRS), and which may exchange that information with the tax authorities of the countries where you are tax resident;
• courts, tribunals and law enforcement authorities, where required or permitted by law; and
• any person to whom the Bank transfers or proposes to transfer its business, subject to appropriate confidentiality protections.

7.1We do not sell your personal data.

8. International Transfers

8.1The Bank is established in the Commonwealth of Dominica, its operations are supported by our group service company and our service providers and partners are located in various countries. Your personal data may therefore be transferred to and processed in countries outside your own, including countries that may not offer the same level of data protection.

Where the GDPR applies to a transfer of personal data outside the EU/EEA, we ensure that it is protected as required by Articles 44 to 49 GDPR, by:

• an adequacy decision of the European Commission for the destination country; or
• standard contractual clauses approved by the European Commission, together with supplementary measures where needed; or
• another safeguard or derogation permitted under the GDPR.

8.2For other transfers, we apply equivalent contractual and security protections. You can request information about the safeguards used by contacting our data protection officer.

9. How Long We Keep Your Personal Data

9.1We keep personal data only for as long as necessary for the purposes for which it was collected and to meet our legal and regulatory obligations.

In particular:

• records of customer due diligence, transactions and related correspondence are kept for at least 7 years after the end of the business relationship or the date of the transaction, as required by anti-money laundering laws;
• records may be kept for longer where a matter is under investigation, where a competent authority requires it, or where they are needed for legal claims;
• data relating to applications that are declined or do not result in a business relationship is kept for at least 7 years from the date of the decision, because the decision and its basis form part of our anti-money laundering records;
• marketing preferences are kept until you withdraw your consent or object; and
• cookie data is kept for the periods set out in our Cookie Policy.

9.2When personal data is no longer needed, we securely delete or anonymise it.

10. How We Protect Your Personal Data

10.1We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or destruction. These include encryption, access controls based on job role, multi-factor authentication, logging and monitoring, staff confidentiality obligations and training, and due diligence and contractual controls on our service providers.

10.2No method of transmission over the internet or of electronic storage is completely secure. You also play a part in protecting your data by keeping your login details secure, as explained in our Terms of Use.

10.3If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by Article 34 GDPR where it applies.

11. Your Rights

Subject to applicable law, you have the right to:

• access your personal data and receive a copy of it;
• rectification of inaccurate or incomplete personal data;
• erasure of your personal data in certain circumstances;
• restriction of processing in certain circumstances;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• data portability, to receive personal data you provided to us in a structured, commonly used and machine-readable format, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• complain to a supervisory authority, where the GDPR applies, including the supervisory authority in the EU/EEA country where you live or work, or where an alleged infringement took place.

11.1To exercise your rights, contact our data protection officer at privacy@marblebank.app. We may need to verify your identity before acting on your request. We will respond within one month of receipt. Where a request is complex or we receive several requests, we may extend this period by up to two further months and will tell you if we do so.

Limits under anti-money laundering law. Some rights are limited where we must keep or process personal data to meet our anti-money laundering, counter-terrorist financing and sanctions obligations. For example, we cannot erase due diligence or transaction records before the end of the legal retention period, and we cannot disclose information where doing so would breach the prohibition on tipping-off or prejudice an investigation.

11.2We would appreciate the opportunity to address your concerns before you approach a supervisory authority, so please contact our data protection officer first.

12. Children

12.1Our services are not intended for, and are not provided to, persons under the age of 18. We do not knowingly collect personal data from children through the Website. If you believe that a child has provided personal data to us, please contact our data protection officer and we will delete it, unless we are required by law to keep it.

13. Marketing

13.1We send marketing communications only where you have consented or where the law otherwise allows, for example to existing Clients about similar services. We do not direct marketing to persons in the EU/EEA or in other jurisdictions where we do not offer our services.

13.2You can opt out of marketing at any time by using the unsubscribe link in any marketing message or by contacting privacy@marblebank.app. You will continue to receive service and regulatory communications that we must send you.

14. Cookies

14.1The Website uses strictly necessary cookies and, only with your consent, Google Analytics cookies, which help us understand how the Website is used. Google Analytics is provided by Google Ireland Limited and Google LLC, acting as our processor; data may be transferred to the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. You can accept, reject or withdraw consent at any time through "Cookie settings" on the Website. For details, see our Cookie Policy.

15. Changes to This Policy

15.1We may update this Privacy Policy from time to time to reflect changes in the law, our services or how we process personal data. The current version is always published on the Website with the date of the latest update. Where changes are significant, we will inform Clients by email or through the Website.

16. Contact Us

For any question about this Privacy Policy or your personal data, please contact:

• Data Protection Officer: privacy@marblebank.app
• General enquiries: hello@marblebank.app
• Post: Data Protection Officer, Marble Bank Ltd, 3 Kings Lane, St. George, Roseau, Commonwealth of Dominica

16.1Last updated: 07/09/2026