Privacy Policy of Synovus Atlas Bank

1. Introduction

This Privacy Policy explains how Synovus Atlas Bank ("Synovus", "we", "us", or "our"), a banking institution operating in England, collects, uses, discloses, and protects your personal data when you use our products, services, websites, mobile applications, or otherwise interact with us.

We are committed to handling your personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services or providing your personal data to us, you acknowledge that you have read this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

Synovus Atlas Bank [Registered Address in England] [Contact Phone] [Contact Email]

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us using the details above.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Identification and Contact Data

• Full name
• Date and place of birth
• Residential and mailing address
• Email address
• Telephone numbers
• National insurance number or equivalent identifiers
• Passport, driving licence, or other identification details

3.2 Financial and Account Data

• Bank account numbers and sort codes
• Transaction histories and payment details
• Account balances and statements
• Credit and debit card details (subject to security and tokenisation measures)
• Loan, mortgage, savings, and investment information

3.3 Regulatory and Compliance Data

• Information required for Know Your Customer (KYC), anti-money laundering (AML), and sanctions screening
• Tax residency status and tax identification numbers
• Records required for fraud prevention and security checks

3.4 Technical and Usage Data

• IP address and device identifiers
• Browser type and version
• Operating system and platform
• Login data and security credentials
• Usage data relating to visits and interactions with our websites, online banking platforms, and mobile applications

3.5 Communication Data

• Records of emails, messages, letters, and telephone calls
• Chat logs and customer support communications
• Feedback, complaints, and survey responses

3.6 Marketing and Preference Data

• Marketing and communication preferences
• Records of consents and opt-outs
• Information on how you respond to our marketing communications

4. How We Collect Your Personal Data

We may collect personal data in the following ways:

• Directly from you when you apply for or use our banking products and services
• When you complete forms, sign contracts, or communicate with us by phone, email, online chat, post, or in branch
• Through our websites, mobile apps, and online banking platforms
• From transactions you carry out with or through Synovus Atlas Bank
• From publicly available sources, such as company registers or public databases
• From third parties, including:
  • Credit reference agencies
  • Fraud prevention agencies
  • Other banks and financial institutions
  • Payment service providers and card schemes
  • Business partners and intermediaries (e.g. brokers, introducers)
  • Government bodies and regulators when permitted by law

5. Legal Bases for Processing

We process your personal data only when we have a lawful basis to do so under UK data protection law. These legal bases include:

5.1 Performance of a Contract Where processing is necessary to enter into or perform a contract with you, including to:

• Open, maintain, and manage your accounts
• Provide banking, payment, lending, and investment services
• Execute transactions and provide statements

5.2 Compliance with Legal Obligations Where processing is necessary to comply with our legal and regulatory obligations, including to:

• Conduct KYC and AML checks
• Comply with banking, financial, and tax regulations
• Report to regulatory and governmental authorities
• Prevent, detect, and investigate fraud and financial crime

5.3 Legitimate Interests Where processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests. These include:

• Managing and improving our products, services, and customer relationships
• Ensuring network and information security
• Protecting our business from fraud, misuse, and security threats
• Exercising and defending legal claims

5.4 Consent Where you have given us your explicit consent for specific processing activities, such as certain types of marketing communications. You can withdraw your consent at any time, as described in section 10.

6. How We Use Your Personal Data

We may use your personal data for the following purposes:

6.1 Providing Banking Services

• Opening and managing your accounts
• Processing and recording transactions, payments, and transfers
• Providing online and mobile banking services
• Issuing cards and managing card-related services

6.2 Customer Relationship Management

• Responding to your enquiries and requests
• Providing customer support and dispute resolution
• Notifying you about changes to our terms, conditions, or policies

6.3 Risk Management, Security, and Fraud Prevention

• Verifying your identity and preventing unauthorised access
• Monitoring transactions for fraud and suspicious activity
• Conducting security checks and safeguarding systems and data

6.4 Compliance and Regulatory Reporting

• Fulfilling legal and regulatory obligations
• Cooperating with law enforcement, supervisory authorities, and courts as required by law

6.5 Marketing and Service Improvement

• Providing you with information about products, services, and offers that may be of interest to you, subject to your preferences and applicable law
• Conducting market research and analysing data to improve our services
• Personalising your experience with Synovus Atlas Bank

7. Sharing Your Personal Data

We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:

7.1 Group Companies and Affiliates

• Other entities within the Synovus group, where applicable, for internal administrative purposes, consolidated reporting, and the provision of integrated services.

7.2 Service Providers and Professional Advisors

• IT and cloud service providers
• Payment processors and card networks
• Data storage and archiving providers
• Identity verification and fraud prevention providers
• Auditors, legal advisors, consultants, and other professional service providers

7.3 Other Financial Institutions and Partners

• Correspondent banks and intermediary banks
• Credit reference agencies
• Other banks and payment service providers involved in transactions
• Business partners and intermediaries involved in offering our services

7.4 Public Authorities and Regulators

• Law enforcement agencies, courts, regulators, and government bodies where required by law or where necessary to protect our rights, customers, or the public.

7.5 Business Transfers

• In connection with any merger, acquisition, restructuring, or sale of all or part of our business or assets, subject to confidentiality obligations and applicable data protection laws.

We do not sell your personal data.

8. International Transfers of Personal Data

As a bank operating in England, we may transfer your personal data to countries outside the UK and the European Economic Area (EEA), for example when using international payment systems or engaging service providers located abroad.

Where we transfer your personal data internationally, we will ensure that appropriate safeguards are in place, such as:

• An adequacy decision by the UK Government for the target country; or
• Standard contractual clauses or other contractual protections approved by the UK Information Commissioner’s Office (ICO).

You may contact us for more information about the safeguards in place for international transfers.

9. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements.

In particular, we generally retain personal data for the duration of your relationship with Synovus Atlas Bank and for a period thereafter as required by law and banking regulations. Retention periods may vary depending on the type of data and the context of processing.

When personal data is no longer required, we will securely delete or anonymise it.

10. Your Rights

Under the UK GDPR and applicable data protection laws, you may have the following rights in relation to your personal data:

10.1 Right of Access You may request confirmation as to whether we process your personal data and, if so, obtain a copy of your personal data and information about how we process it.

10.2 Right to Rectification You may request that we correct or complete any inaccurate or incomplete personal data.

10.3 Right to Erasure In certain circumstances, you may request that we delete your personal data, for example where it is no longer necessary for the purposes for which it was collected or where you withdraw consent (if consent was the basis for processing). This right is not absolute and may be subject to legal retention obligations.

10.4 Right to Restriction of Processing You may request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of the data or consider an objection.

10.5 Right to Data Portability Where processing is based on consent or the performance of a contract and carried out by automated means, you may request to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller where technically feasible.

10.6 Right to Object You may object at any time to processing based on our legitimate interests, including profiling based on those interests. We will stop processing your personal data unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms or where processing is necessary for legal claims.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object, we will stop processing your data for such purposes.

10.7 Rights Related to Automated Decision-Making If we use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review of the decision, to express your point of view, and to contest the decision, unless an exemption applies.

To exercise any of these rights, please contact us using the contact details in section 2. We may need to verify your identity before fulfilling your request.

11. Marketing Communications

We may use your personal data to send you information about Synovus Atlas Bank products, services, and offers that may be of interest to you, in accordance with your preferences and applicable law.

You can change your marketing preferences or opt out of marketing communications at any time by:

• Following the unsubscribe instructions in our emails or messages; or
• Contacting us using the details in section 2.

Even if you opt out of marketing communications, we may still send you non-marketing communications, such as service messages, notifications about your account, and information about changes to our terms or policies.

12. Security of Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures may include:

• Encryption and pseudonymisation of data where appropriate
• Access controls and authentication mechanisms
• Secure networks and monitoring for suspicious activities
• Regular testing and review of our security measures

While we strive to protect your personal data, no system or transmission of data over the internet can be guaranteed to be completely secure. You are responsible for keeping your login credentials and passwords confidential and for notifying us promptly of any suspected unauthorised use of your accounts.

13. Cookies and Similar Technologies

Our websites and online services may use cookies and similar technologies to collect technical and usage data and to enhance your user experience.

We will provide you with specific information about our use of cookies, including the types of cookies we use and how you can manage your preferences, in our separate Cookie Policy or via cookie banners displayed on our websites.

14. Third-Party Websites

Our websites and services may contain links to third-party websites or services that are not operated by Synovus Atlas Bank. We are not responsible for the privacy practices or content of such third parties.

We encourage you to review the privacy policies of any third-party websites or services you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

When we make material changes, we will take appropriate steps to inform you, such as posting a prominent notice on our website or contacting you directly. The date of the latest version will be indicated at the beginning or end of this policy.

Your continued use of our products and services after any changes to this Privacy Policy will constitute your acknowledgement of the updated policy.

16. Contact and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way we handle your personal data, please contact us using the details provided in section 2.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

Information Commissioner’s Office (ICO) Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk

We encourage you to contact Synovus Atlas Bank first so that we can address your concerns directly where possible.