Privacy Policy of Synovus Elite Bank

1. Introduction

This Privacy Policy explains how Synovus Elite Bank ("Synovus", "we", "us", or "our"), a bank operating in England, collects, uses, discloses, and protects your personal data when you use our banking services, visit our branches, websites, or mobile applications, or otherwise interact with us.

We are committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently, in accordance with applicable data protection laws in England, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or interacting with Synovus, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller and Contact Details

The data controller responsible for your personal data is:

Synovus Elite Bank Region: England

If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, you can contact us using the contact information provided in your customer documentation or on our official website.

3. Personal Data We Collect

The types of personal data we collect about you depend on your relationship with Synovus and the products and services you use. We may collect and process the following categories of personal data:

3.1 Identification and Contact Details

• Full name, title, and date of birth
• Residential and correspondence addresses
• Email address and telephone numbers
• Nationality and country of residence
• Identification documents and numbers (such as passport, national ID, driving licence) and copies where legally required

3.2 Regulatory and Compliance Data

• Information required to comply with anti-money laundering (AML), know your customer (KYC), and counter-terrorist financing regulations
• Tax identification numbers and tax residency information
• Information relating to sanctions and politically exposed person (PEP) checks

3.3 Financial and Transaction Data

• Bank account numbers, sort codes, and IBANs
• Payment card numbers and related details (stored and used in accordance with security standards)
• Account balances, transaction histories, and payment details
• Loan and credit information, including credit limits, repayment history, and security or collateral details

3.4 Employment and Professional Information

• Employment status, employer details, and job title or profession
• Income details, financial circumstances, and source of funds where required

3.5 Online and Technical Data

• Login credentials and security information (such as usernames, passwords, and security questions)
• IP address, device identifiers, browser type, operating system, and settings
• Usage data relating to our websites, mobile apps, and online banking services
• Cookies and similar tracking technologies, as described in our Cookies Policy (where applicable)

3.6 Communication and Interaction Data

• Records of your communications with us, including calls, emails, messages, and in-branch interactions
• Feedback, complaints, and survey responses

3.7 Special Categories of Data We generally do not seek to collect special categories of personal data (such as health data or information about your religious beliefs) unless this is strictly necessary, you have provided it to us voluntarily, or we are legally required to process it. Where we do so, we will rely on an appropriate legal basis and apply additional safeguards.

4. How We Collect Your Personal Data

We collect personal data from various sources, including:

• Directly from you when you apply for or use Synovus products and services, complete forms, or communicate with us
• From your use of our online and mobile banking platforms, ATMs, and card transactions
• From publicly available sources, such as company registers, online directories, and public records
• From third parties, such as:
  • Credit reference agencies
  • Fraud prevention and risk management agencies
  • Payment service providers and correspondent banks
  • Business partners and introducers (for example, where you have given them permission to share information with us)
  • Government bodies, regulators, and law enforcement agencies where permitted or required by law

5. Legal Bases for Processing

Synovus processes your personal data only when we have a valid legal basis under applicable data protection laws. These include:

• Performance of a contract: To provide you with banking products and services, process your transactions, and fulfil our contractual obligations to you.
• Legal obligations: To comply with legal and regulatory requirements, including banking regulations, AML and KYC rules, sanctions screening, tax reporting, and record-keeping obligations.
• Legitimate interests: To pursue our legitimate business interests, provided these are not overridden by your rights and freedoms. This may include risk management, fraud prevention, improving our services, and protecting our assets and customers.
• Consent: Where you have given us explicit consent for specific processing activities, such as certain marketing communications or the use of optional cookies. You can withdraw your consent at any time.
• Vital interests or public interest: In rare cases, to protect someone’s vital interests or where processing is necessary for reasons of substantial public interest.

6. How We Use Your Personal Data

We may use your personal data for the following purposes:

6.1 Providing and Managing Banking Services

• Opening, administering, and closing accounts
• Processing deposits, withdrawals, transfers, card payments, and other transactions
• Providing loans, credit facilities, and overdrafts
• Managing standing orders, direct debits, and recurring payments

6.2 Customer Support and Relationship Management

• Responding to your enquiries, requests, and complaints
• Communicating with you about your accounts, transactions, and service updates
• Providing alerts, notifications, and statements

6.3 Risk Management, Security, and Fraud Prevention

• Verifying your identity and preventing identity theft
• Detecting, investigating, and preventing fraud, money laundering, and other financial crimes
• Monitoring accounts and transactions for suspicious activity
• Ensuring the security and integrity of our systems, networks, and premises

6.4 Legal and Regulatory Compliance

• Meeting our obligations under applicable laws and regulations in England and other relevant jurisdictions
• Cooperating with regulatory, supervisory, and law enforcement authorities
• Retaining records to demonstrate compliance

6.5 Business Operations and Service Improvement

• Conducting internal audits, quality checks, and performance reporting
• Improving our products, services, and customer experience
• Conducting research and statistical analysis, using aggregated or anonymised data where possible

6.6 Marketing and Communications

• Providing you with information about Synovus products, services, promotions, and events that may be relevant to you, subject to your marketing preferences and applicable laws
• Personalising marketing communications based on your profile and interactions, where permitted You may opt out of direct marketing at any time by following the instructions in our communications or contacting us using the details provided in your customer documentation.

7. Sharing Your Personal Data

Synovus may share your personal data with carefully selected third parties for the purposes set out in this Privacy Policy, and only where we have a lawful basis to do so. These recipients may include:

• Other entities or branches within the Synovus group, where applicable, for internal administrative and risk management purposes
• Service providers and professional advisers who assist us in operating our business and providing services, such as:
  • IT and cloud service providers
  • Payment processors and card schemes
  • Identity verification and KYC service providers
  • Auditors, legal advisers, and consultants
• Correspondent banks, intermediary banks, and payment networks involved in processing international or domestic payments
• Credit reference agencies, fraud prevention agencies, and risk management partners
• Business partners or intermediaries who introduced you to Synovus, where necessary for managing the relationship and as permitted by law
• Regulatory, governmental, tax, and law enforcement authorities, courts, and dispute resolution bodies, where required to comply with legal or regulatory obligations or to protect our rights

We require any third party that processes personal data on our behalf to protect it in accordance with applicable data protection laws and to use it only for the purposes we specify.

8. International Transfers

In the course of providing banking services and conducting our operations, we may transfer your personal data to countries outside the United Kingdom. Where we do so, we will ensure that appropriate safeguards are in place to protect your personal data, including:

• Transferring to countries that the UK government has deemed to provide an adequate level of data protection; or
• Using standard contractual clauses or other legally recognised safeguards; and
• Implementing additional security and organisational measures where necessary.

You may contact us for more information about the safeguards we use for international data transfers.

9. Data Retention

Synovus will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Providing banking services and managing our relationship with you
• Complying with legal, regulatory, and accounting requirements
• Resolving disputes and enforcing our rights

We apply specific retention periods depending on the type of data and the applicable legal requirements. In many cases, banking and transaction records must be retained for a minimum period required by law. When personal data is no longer needed, we will securely delete, anonymise, or otherwise dispose of it.

10. Security of Your Personal Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures may include:

• Encryption and secure transmission technologies
• Access controls, authentication mechanisms, and staff training
• Physical and logical security for our premises and systems
• Regular monitoring, testing, and assessment of our security practices

While we strive to protect your information, no system can be completely secure, and you should also take steps to protect your own information, such as keeping your login details confidential and notifying us promptly of any suspected compromise.

11. Your Data Protection Rights

Subject to certain conditions and exceptions under applicable law, you have the following rights regarding your personal data:

• Right of access: To obtain confirmation of whether we process your personal data and to access that data and certain related information.
• Right to rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure: To request deletion of your personal data where there is no longer a valid reason for us to keep it, subject to legal and regulatory obligations.
• Right to restriction: To request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: To receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit it to another controller, where technically feasible and legally permitted.
• Right to object: To object to processing based on our legitimate interests or for direct marketing, including profiling related to such marketing.
• Rights relating to automated decision-making: To request human intervention, express your point of view, and contest decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

To exercise your rights, please contact us using the information provided in your customer documentation or on our official website. We may need to verify your identity before responding to your request. We will respond within the timeframe required by law.

12. Cookies and Online Tracking

When you visit Synovus websites or use our mobile applications, we may use cookies and similar technologies to collect certain information automatically. These technologies help us to:

• Enable core site and app functionality
• Remember your preferences and settings
• Improve the performance and usability of our digital services
• Analyse usage and traffic patterns
• Deliver relevant content and, where permitted, marketing communications

You can manage your cookie preferences through your browser or device settings and, where available, through our cookie consent tools. For more information, please refer to our separate Cookies Policy, where provided.

13. Children’s Data

Synovus products and services are generally not directed at children, except for specific products designed for minors under appropriate parental or guardian oversight. Where we process personal data relating to children, we take particular care to protect their privacy and, where required, obtain consent from a parent or legal guardian.

14. Third-Party Links

Our websites and applications may contain links to third-party websites, services, or content that are not controlled by Synovus. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites or services you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. When we do so, we will revise the "last updated" date and, where appropriate, notify you through our usual communication channels or by posting a notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how Synovus handles your personal data.

16. Complaints and Contact

If you have concerns about how Synovus processes your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the competent supervisory authority in England responsible for data protection matters, typically the Information Commissioner’s Office (ICO).

Contact details for Synovus are available in your customer documentation and on our official website. When contacting us, please include sufficient information for us to identify you and understand your request or concern.

This Privacy Policy applies to the banking services and operations of Synovus Elite Bank in England and is intended to explain our data protection practices in a clear and transparent manner.