Privacy Policy

This website is provided by MFM Investment Ltd, a company incorporated in England and Wales with company number 9088155 and registered office at 90-92 Pentonville Rd, London N1 9HS (“Moneyfarm”). MFM Investment Ltd is part of a group which is made up of different legal entities, including:

MFM Investment Ltd – Italian branch, registered office: Via Antonio da Recanate n.1 - 20124 Milano

together, the “Moneyfarm Group”.

This Privacy Policy is issued on behalf of the Moneyfarm Group. As such, any references to “Moneyfarm”, “we”, “us” or “our” in this Privacy Policy are references to the relevant company (as named above) in the Moneyfarm Group which is responsible for processing your data.

Moneyfarm is committed to protecting your personal information and other data provided to Moneyfarm via this website and our mobile application. If Moneyfarm requests information from which you could be identified (”personal data”), information of this type will only be used in accordance with this Privacy Policy. We will be the controller for your data when you purchase a product or service with us. We may also act as data processor, where you gained access to our products or services through another company.

It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements the other notices and is not intended to override them.

Moneyfarm’s products and services are not designed to appeal to or not available to, persons under the age of 18. Therefore, Moneyfarm does not knowingly attempt to solicit or receive any information from anyone under the age of 18.

This Privacy Notice provides specific information on the following topics:

• ✓
  Lawful basis of processing
• ✓
  What information does Moneyfarm collect and how does Moneyfarm collect this information from you?
• ✓
  What does Moneyfarm do with this information?
• ✓
  Retention of your data
• ✓
  Accuracy of your data
• ✓
  Security of your data
• ✓
  Data transfers and sharing your data with third parties
• ✓

Under data protection laws, Moneyfarm must have legal bases in order to process your personal data. The legal bases on which Moneyfarm may process your data are:

Consent: where you have consented for us to process your personal data for one or more specific reasons

Performance of a contract: in order to perform a contract we have with you

Legal obligation: where processing of the data is required by law. We are also required by law to retain certain information of those that register to open an account with us and the data of customers beyond the date when they cease to be our customers

Legitimate interest: in order to carry on the purposes of Moneyfarm’s business. We also have a legitimate interest in preventing fraud and money laundering and to verify identity, in order to protect our business and our customers; in order to understand how people interact with our website; to provide communication which we think will be of interest to you; to determine the effectiveness of promotional campaigns and advertising

Moneyfarm may need to collect information about you and your computer to allow you to use some services, including:

• ✓
  Identity data: First name, middle name, last name, email, marital status, title, date of birth, gender and copies of identity documents.
• ✓
  Contact data: billing address and telephone numbers.
• ✓
  Financial data: bank account and payment card details.
• ✓
  Transaction data: details about payments to and from you and other details of products and services you have purchased from us.
• ✓
  Suitability data: your investment knowledge and experience, financial situation, risk tolerance and capacity for loss, collected through our risk profiling questionnaire.
• ✓
  Technical data: internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• ✓

The information may be collected:

a. Directly from you

When you register or log in to our website or mobile application, or use any Moneyfarm service, including when you:

• ✓
  fill in forms or complete our risk profiling questionnaire;
• ✓
  transfer existing accounts or investments to Moneyfarm;
• ✓
  upload documents;
• ✓
  contact us by email, post, phone or chat, or make an enquiry.

b. Automatically

As you use our website or mobile application, we automatically collect information about your browsing activity and technical data about the device you use, through cookies, server logs and similar technologies. For more information, please see our Cookie Policy.

c. From third parties and publicly available sources

• ✓
  Technical data from analytics providers, advertising networks and search information providers.

• ✓
  Contact, financial and transaction data from providers of technical, payment, credit reference and delivery services, based both inside and outside the UK.

• ✓
  Identity and contact data from publicly available sources, such as Companies House and the Electoral Register.

• ✓
  Financial crime data from third-party providers we use to carry out checks relating to financial crime, fraud, sanctions and Politically Exposed Persons.

Providing your personal data

Some of the personal data we ask for is required by law or is necessary for us to enter into and perform our contract with you. If you do not provide this information, we will not be able to open your account or keep it active. Where providing certain information is optional, we will make this clear to you at the time we collect it.

Moneyfarm may use your personal data for the following purposes:

• ✓
  to provide the requested services to you;
• ✓
  to monitor traffic patterns and usage of the website and app to help to improve their design and functionality;
• ✓
  to record and store communications made via phone, video call, email or the chat function, as required by FCA rules;
• ✓
  to personalise your experience on the Moneyfarm website and app or communications/advertising;
• ✓
  to provide customer service, including to respond to your enquiries and fulfil any of your requests for information;
• ✓
  to send you important information regarding the Moneyfarm services and/or other technical notices, updates, security alerts, and support and administrative messages; and
• ✓

Fraud

We may carry out fraud prevention checks using fraud prevention databases. If false or inaccurate information is provided, and/or fraud is identified, details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We may access and use the information recorded by fraud prevention agencies from other countries.

We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services you have requested.

Fraud prevention agencies can hold your personal data for different periods of time, also depending on whether or not you are considered to pose a fraud or money laundering risk.

A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services you have requested, or we may stop providing existing services to you.

Pre-populating information

In order to carry out your instructions, Moneyfarm may also pre-populate the forms of third party websites with the personal data you have supplied us with. This may be done manually or through secure and encrypted data transfers.

Moneyfarm will not retain your personal data for longer than is necessary for the purposes for which the personal data is processed. This means that your data will only be retained for as long as it is still required to provide you with services or is necessary for legal reasons. When calculating the appropriate retention period for your data Moneyfarm considers the nature and sensitivity of the data, the purposes for which Moneyfarm is processing the data and any applicable statutory retention periods. Using these criteria, Moneyfarm regularly reviews the personal data which we hold and the purposes for which it is held and processed. Our regulatory requirements mean that we are obliged to retain data for a minimum of seven years from the end of our business relationship with you.

When Moneyfarm determines that personal data can no longer be retained (or where you request Moneyfarm to delete your data in accordance with your right to do so (please see below for more information), Moneyfarm ensures that this data is securely deleted, anonymised or destroyed.

However, please note that, in some circumstances Moneyfarm may decide to retain your personal data for research or statistical purposes and, in such circumstances, Moneyfarm will anonymise your data before retaining it.

It is important that the personal data Moneyfarm holds about you is accurate and current. Please keep Moneyfarm informed if your personal data changes during your relationship with us.

In order to protect your personal data, Moneyfarm has appropriate organisational and technical security measures. These measures include storing data on a dedicated and secure server with at least 256-bit encryption, restricting access to your personal data to certain employees, ensuring the Moneyfarm internal IT systems are suitably secure, and implementing procedures to deal with any suspected data breach.

In the unlikely event of a data breach, Moneyfarm will take steps to mitigate any loss or destruction of data and, if appropriate, will notify you and any applicable authority of such a breach.

In addition to the above, where Moneyfarm has given you (or where you have chosen) a password which enables you to access certain parts of the website, you are responsible for keeping this password confidential and should not share your password with anyone. When setting a password you should make it as secure as possible and not use the same password for different purposes.

Moneyfarm will not disclose your personal data to third parties other than as described in this section unless it is otherwise legally permitted or required to do so.

Moneyfarm may share your data with other members of the Moneyfarm Group.

Moneyfarm may also need to pass your information to third party service providers which maintain, administer or develop the website on our behalf and the information will only be provided for such limited purposes and as detailed below. In addition, Moneyfarm may provide aggregate statistics about its customers, sales, traffic patterns and related website information to reputable third-parties, but these statistics will include no personally identifiable information.

Moneyfarm may transfer your personal data to third parties of the following types:

• ✓
  companies providing identity or financial validation services;
• ✓
  financial product providers;
• ✓
  Payment services companies acting on your, or our behalf;
• ✓
  banks;
• ✓
  companies providing analytics services;
• ✓
  data, service and software providers;
• ✓
  companies collecting and publicising customer reviews;
• ✓

The security of your data is important to us and Moneyfarm will therefore, only transfer your data to such third parties if one or more of the following apply:

• ✓
  you have expressly consented to your data being shared with specific third parties;
• ✓
  the third party needs to access the personal data for the purposes of providing any contracted services to you;
• ✓
  the third party has agreed to comply with Moneyfarm’s instructions, required data security standards, policies, and procedures and put adequate security measures in place;
• ✓
  the transfer complies with any applicable cross border transfer restrictions and suitable safeguards have been put in place; and
• ✓
  a fully executed written contract that contains suitable obligations and protections has been entered into between the parties.

Some of the third parties we work with are located outside the United Kingdom, including in the European Economic Area and the United States. When we transfer your personal data outside the UK, we make sure it is protected by one of the following safeguards:

• ✓
  only transferring your personal data to countries which have been deemed to provide an adequate level of protection for personal data by UK Government under the UK’s data adequacy regulations (for example, the countries of the European Economic Area);
• ✓
  where your data will be transferred to a country not covered by such regulations, entering into the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued under the UK GDPR, supported by a transfer risk assessment and any supplementary measures needed; or
• ✓
  where your data will be transferred to the US, ensuring that the third party to which Moneyfarm are transferring your data is part of the Privacy Shield.

For more information about how Google will use your personal data, please see Google's Privacy & Terms

Bastian is a virtual assistant based on an artificial intelligence system, available on our website and in our app.

Using Bastian is optional. You can always manage your account and contact us through the usual channels on our platform.

When you use Bastian you are not interacting with a person, but with an artificial intelligence system.

When you use Bastian, we process the following categories of personal data:

• ✓
  the content of your conversations: the questions, requests and other messages you write to Bastian and the answers Bastian gives you;
• ✓
  your account data that Bastian consults in order to answer you, such as portfolios, returns, transactions, your investor profile (including your suitability assessment) and appointments;
• ✓
  data relating to the operations that Bastian prepares at your request and that you confirm, such as setting up or changing a regular contribution, managing your watchlist or booking an appointment. This also includes the details of any purchase or sale of financial instruments and the date and time of your confirmation;
• ✓
  technical and usage data, such as account and session identifiers, the date and time of your interactions, your device and system logs.

You do not need to give Bastian any personal information beyond what is strictly necessary for your request. In particular, please do not enter:

• ✓
  special category data within the meaning of Article 9 UK GDPR, for example information about your health or your racial or ethnic origin;
• ✓
  personal data relating to criminal convictions and offences (Article 10 UK GDPR);
• ✓
  personal data about other people, for example family members;
• ✓
  passwords or login credentials.

If you nevertheless enter any of this information, it will be kept only within the record of the conversation, for the period required by law, and then deleted.

• ✓
  Providing the Bastian service: processing the data listed above is necessary for the performance of the contract to which you are a party (Article 6(1)(b) UK GDPR).
• ✓
  Preparing and carrying out the operations you request and confirm: your request and subsequent confirmation constitute an instruction to Moneyfarm. Processing is necessary for the performance of the contract (Article 6(1)(b) UK GDPR). Bastian never carries out an operation without first showing you what it is about to do and obtaining your explicit confirmation.
• ✓
  Recording and retaining conversations to comply with our regulatory obligations, including, where applicable, the requirements to record and retain communications and orders relating to investment services under the FCA Handbook. Processing is based on a legal obligation (Article 6(1)(c) UK GDPR).
• ✓
  Handling complaints: if you make a complaint, we will process the data from your conversations with Bastian that is needed to handle it, in compliance with our legal obligations (Article 6(1)(c) UK GDPR).
• ✓
  Protecting our rights and checking and improving the quality, accuracy and security of Bastian: some conversations may be reviewed by our authorised staff, including in pseudonymised form. Processing is based on our legitimate interest in offering an accurate and reliable service (Article 6(1)(f) UK GDPR).

Bastian does not provide investment, tax, legal or financial advice and does not make personal recommendations. Bastian does not assess the suitability of investments either: suitability is assessed by Moneyfarm solely as part of its own suitability process.

Bastian does not make significant decisions about you based solely on automated processing within the meaning of Articles 22A to 22D UK GDPR, because every operation always requires your explicit confirmation.

Please remember that artificial intelligence systems can sometimes give answers that are inaccurate, incomplete or out of date. If there is any discrepancy, the information in your account and in the documents we send you always prevails over what Bastian tells you.

To operate Bastian, we use third-party technology providers acting as processors under Article 28 UK GDPR, on the basis of written agreements:

• ✓
  OpenRouter Inc., 169 Madison Avenue, Ste 2404, New York, USA, which provides the artificial intelligence model on which Bastian is based;

• ✓
  hosting and cloud computing providers, which host the technical infrastructure of the service.

These providers process your data only to provide the service to us and in accordance with our instructions. Your data is not used to train the artificial intelligence models of third-party providers.

Some of the providers listed above may process data outside the United Kingdom, for example in the United States. In these cases, the transfer takes place on the basis of UK adequacy regulations or, failing that, the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, supplemented where necessary by additional measures following a transfer risk assessment.

Personal data processed through Bastian is kept only for as long as strictly necessary for the purposes for which it was collected, in accordance with applicable law. In particular:

• ✓
  conversations and instructions subject to the recording requirements under the FCA rules on investment services are kept for 5 years. This period may be extended to up to 7 years at the request of the Financial Conduct Authority;

• ✓
  in the event of a complaint or dispute, the data needed is kept for as long as necessary to handle and resolve it. This period may exceed the one indicated above.

You can exercise your rights in relation to this data as described in the section “Your rights” below.

Your personal data is protected by legal rights, which include:

• ✓
  Right to rectification: you have the right to require us to correct any inaccuracies in your data.
• ✓
  Right to erasure: you have the right to require us to delete your data, subject to certain legal requirements.
• ✓
  Right to restriction of processing: you have the right to require us to restrict the way in which we process your personal data. Right to data portability: you have the right to receive the data you have provided to us in a machine-readable format, or have it sent to another organisation, where we process it on the basis of consent or contract.
• ✓
  Right to object to processing: you have the right to object to processing based on our legitimate interests.
• ✓
  Right of access: you have the right to request access to personal data that we may process about you.
• ✓
  Right to withdraw consent: you have the right at any time to withdraw consent allowing us to process your personal data. This will not affect the legality of any processing prior to the date of such withdrawal.

If you would like to exercise any of the above rights, please:

• ✓
  put your request in writing and send it to us through your usual registered channel (e.g. registered e-mail);
• ✓
  specify the right you wish to exercise.

For more information or to exercise your data protection rights please, please contact us at: hello@moneyfarm.com.

Moneyfarm may use your personal data to notify you of news about Moneyfarm, changes to the website, special events or new services that Moneyfarm thinks may be of interest to you if you have consented to, and have not at any point opted out from, receiving marketing communications.

If, at any time, you would rather not receive such information, please contact Moneyfarm in writing, either by post or email (to hello@moneyfarm.com) to let us know. All emails include links to unsubscribe options, to allow you to stop or tailor the emails you receive at any time.

If you ask not to receive such news, Moneyfarm will still need to keep your personal data so that you can continue to use the website and so that Moneyfarm can deal with the administration and security of the website. Moneyfarm will still contact you by email or post for anything necessary for the administration of your membership and to comply with any legal or other important conditions; however, Moneyfarm will not then email you or contact you for promotional purposes without your subsequent consent.

We will also contact existing active customers when we think information or a new service is relevant to them. Don’t worry, you will continue to receive these relevant notifications even if you restrict marketing communications.

We will ensure that we obtain your consent before we share your personal data with any company outside of the Moneyfarm Group for marketing purposes.

From time-to-time Moneyfarm may request information from users for the purposes of running contests or competitions. Participation in these contests or competitions is completely voluntary and you, therefore, can choose whether or not to disclose this information for this purpose

For more information about the cookies we use, please see our Cookies Policy.

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how we use personal data. The date at the top shows when it was last updated. Where changes are significant, we will tell you by email or through our app before they take effect.

The Moneyfarm website may contain links to and from other third party websites of interest (advertisers and affiliates). However, once you leave this website, be aware that Moneyfarm does not have any control over such websites. Therefore, Moneyfarm cannot be responsible for the protection and privacy of any information which you provide whilst visiting such websites and such websites are not governed by this Privacy Policy. You should exercise caution and look at the privacy policy applicable to the website in question.

You should also be aware that you have the right to raise any concerns in relation to how we process your personal data to the Information Commissioner’s Office (ICO).

We have appointed a data protection officer (DPO) who is responsible for dealing with any such concerns, in addition to overseeing questions in relation to this Privacy Policy and handling requests in relation the exercise of your legal rights. If you have any concerns, questions, or requests, please contact the DPO using the details set out below.

Our full details are:

Full name of legal entity: MFM Investment Ltd

Email address: dpo@moneyfarm.com

Postal address: 90-92 Pentonville Rd, London N1 9HS

Telephone number: +44 [0] 203 745 6991

If you believe at any time that we have not handled your data in accordance with this Policy you should contact the Data Protection Officer. You may also contact the Information Commissioner’s Office (ICO) who supervise the protection of data by companies within the UK.

Last update 29/10/2026