Privacy notice

This notice explains how Upstate Corporate handles personal data for customers, applicants, business representatives and visitors to this website.

It applies to banking, lending and wealth services provided through our platform and to enquiries made through our contact channels.

Identity and contact data: name, date of birth, address, email, telephone number and identification document details.

Financial data: account balances, transactions, payment instructions, income and expenditure information provided during assessment.

Technical data: device, browser, IP address, session and security event information used to protect your account.

Business data: entity details, ownership structure and details of authorised representatives where the customer is a company.

To open and operate accounts, execute payments, assess applications and provide the services you request.

To meet legal and regulatory obligations, including identity verification, sanctions screening, financial crime prevention and record keeping.

To protect accounts through monitoring, authentication, fraud detection and incident investigation.

To improve our services and communicate about changes to terms, pricing or security.

We rely on performance of a contract, compliance with legal obligations, legitimate interests in operating a secure banking service, and consent where consent is specifically requested.

Where we rely on consent, you may withdraw it at any time without affecting processing that has already taken place.

We share data with service providers who help us operate the platform, with payment networks required to execute your instructions, and with authorities where disclosure is legally required.

We do not sell personal data. Providers act on documented instructions and are bound by confidentiality and security obligations.

Account and transaction records are retained for the periods required by financial services law after a relationship ends.

Application data for unsuccessful applications is retained for a shorter period sufficient to evidence the decision, then deleted or anonymised.

Subject to applicable law, you may request access to your data, correction of inaccuracies, deletion where no legal obligation requires retention, restriction of processing, and portability.

Requests can be made through secure messaging inside digital banking or by writing to us at clientservices@upstatecorporate.online. We may need to verify your identity before acting.

We apply encryption in transit and at rest, multi-factor authentication, least-privilege internal access, monitoring and audited administrative action.

No system is entirely without risk. Report anything suspicious immediately so we can act quickly.

We update this notice when our processing changes. Material changes are communicated through digital banking or by email before they take effect.