Contents

Privacy Policy - Bud Financial Limited

Last updated: 23 July 2026

This policy describes how Bud Financial Limited also referred to as (“Bud”, “we”, “our” and “us”) will use your Personal Data, through your use of this website, when you use products or services provided by us. It also describes your data protection rights, more information about your rights, and how to exercise them, is set out in the “Your Rights” section below.

This website is not intended for children (meaning persons under the age of 18). We do not knowingly collect data relating to children. If you become aware that a child has provided us with personal data without parental consent, please contact us at help@thisisbud.com.

When Bud is operating as a service provider to other businesses (e.g., a company providing you with a lending product or service), it processes your information on behalf of and at the instructions of those businesses. In that context, those businesses are the data controllers and their privacy policies will apply to the processing of your information. We encourage you to read their privacy policies.

1. Categories of Personal Data we may collect and process about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Category	Examples
Personal Identifiers and contact details	Given name(s), preferred name, username, email address, home address.
Demographic Information	Salutation, title and language preferences.
Consent Records	Records of any consents you have given, together with the date and time, means of consent and any related information (e.g., the subject matter of the consent).
Financial Information	Account details, balances, beneficiaries' details, standing orders, direct debits, rent and property details, transaction details and aggregated financial data.
Content Data	Records of your interactions with our online content, any interaction you may have had with such content (e.g., mouse hover, mouse clicks, any forms you complete in whole or in part) and any touchscreen interactions.
Technical and Usage Data	Internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
Views & Opinions	Preferred name, any views and opinions that you choose to send to us or publicly post about us on social media platforms and any feedback provided to us via the “Contact Us” functionality, including bug reports.
Marketing & Communications Data	Your preferences in receiving marketing from us and our third parties and your communication preferences.

‍

We may also collect personal data about you from publicly available sources for the purposes of completing our anti-money laundering and know-your-client checks that we are required to carry out as a regulated financial services firm.

We do not collect any special categories of personal data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

2. How is your Personal Data collected?

We use different methods to collect data from and about you including through:

Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- apply for our products or services;
- use our products or services;
- create an account on our website;
- subscribe to our service or publications;
- request marketing to be sent to you;
- enter a competition, promotion or survey; or
- give us feedback or contact us.
Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our Cookie Notice for further details.
Third parties or publicly available sources. Bud may also receive Personal Data about you from third parties.

3. Purposes and Legal Bases for Processing

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

To fulfil a contract, or take steps linked to a contract including:

To provide you with products and services including account consolidation, transaction categorisation, spending analysis and other insights, together with ancillary services such as customer support.
Confirming and verifying your identity.
To send you service, technical and other administrative emails, messages and other types of communications.

As required by Bud to conduct our business and pursue our legitimate interests, in particular:

To ensure our products and services are working as intended, including tracking outages or troubleshooting issues that you report to us.
For the purpose of ensuring the security of our products and services and processing activities.
For the purposes of detecting, preventing and investigating fraud.
For analytics and measurement to understand how our products and services are used. For example, we analyse data we collect to optimise product design and for the purposes of product improvement.
To conduct surveys and other market research to ensure our services are relevant to your needs.

Where you give us consent:

To access your transaction data from your banking or financial services provider(s) for the purposes of account consolidation, transaction categorisation, spending analysis and other insights.
For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable, or otherwise of interest to you.
Where we access information from your device using cookies or similar technologies.
On other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

For purposes which are required by law or to fulfil our regulatory obligations, including:

For “know your client” checks and screening against government, law enforcement agency sanctions lists and other legal restrictions.
In response to requests by legal or regulatory authorities, government or law enforcement authorities.

4. Disclosure of Personal Data to Third Parties

We may share your Personal Data with the following categories of Third Parties, if we do they will use your data in the ways described below:

Third Party	Purpose
Service Providers	With service providers who support Bud’s data processing activities.
Group Companies	We may share your personal data with members of the Bud group of companies, including our US subsidiary, where necessary for the purposes set out in this policy. Where data is transferred outside the UK in this context, the safeguards in Section 5 apply.
Legal & Regulatory Authorities	With legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation.

‍

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

5. International Transfer of Personal Data

Where we transfer Personal Data outside the UK to a country not subject to a UK adequacy decision, we ensure that the transfer is protected by appropriate safeguards, including the UK-US Data Bridge (where the recipient is certified under that framework), the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses.

Where we process Personal Data of individuals located in the European Economic Area - for example, in connection with any EU operations - and that data is transferred outside the EEA to a country not subject to a European Commission adequacy decision, we ensure it is protected by the EU Standard Contractual Clauses (2021 version).

To understand more about the protections we have in place over the transfer of Personal Data, you may contact us using the details in Section 11 below.

6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

7. Data Retention

We take every reasonable step to ensure that your Personal Data is only retained for as long as necessary for the purposes for which it was collected.

The criteria we use to determine how long we retain your Personal Data include: the duration of our relationship with you and the nature of the services we provide; any legal or regulatory obligations that require us to retain data for a minimum period (for example, financial records retention requirements under FCA rules and applicable statutory limitation periods); whether retention is necessary to establish, exercise or defend legal claims; and any consent you have provided and its continued validity.

Once the applicable retention period has expired, we will permanently delete or fully anonymise your Personal Data. A more detailed retention schedule setting out specific periods by data category is currently under development and will be incorporated into this policy in due course.

To find out more about how long we retain specific categories of your data, please contact us at help@thisisbud.com.

8. Your Rights

You have a number of rights under data protection laws in relation to your personal data, including:

Right	Description
Access	You can request that we provide you with a copy of the Personal Data that we hold about you and to check that we are processing it lawfully.
Correction	If you believe the Personal Data we hold on you is inaccurate, you can request that we update or correct it, although we may need to verify the accuracy of the new data you provide to us.
Withdrawal of Consent	If we rely on your consent to process your Personal Data, you may withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
Objection or Opt-out	You may request us to stop processing your Personal Data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Erasure	If we no longer need your Personal Data and have no other legal basis for processing, you can request that we delete it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
Restriction	This enables you to ask us to suspend the processing of your personal data in the following scenarios: If you want us to establish the data's accuracy. Where our use of the data is unlawful, but you do not want us to erase it. Where you need us to hold the data even if we no longer require it, as you need it to establish, exercise or defend legal claims. You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
Portability	You may ask us to provide you or a third party with a copy of the Personal Data you provided to us in a portable format, to use with other organisations. Note that this right only applies to automated information which you initially provided consent for us to use, or where we used the information to perform a contract with you.
Automated Decision-Making	Where we make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects, you have the right not to be subject to such decisions. You may request human review, express your point of view, and contest the decision. Given that our services include automated transaction categorisation and spending analysis, please contact us if you have concerns about any automated processing that affects you.

‍

To exercise any of these rights you can get in touch with us using the details set out below. We will respond to all legitimate requests within one month of receipt. Occasionally, it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you within one month and keep you updated.

If you have unresolved concerns, you have the right to complain to a data protection authority where you live, work or where you believe a breach may have occurred. In the UK, this is the Information Commissioner’s Office (www.ico.org.uk)

9. Direct Marketing

If you provide your consent, we may process your Personal Data in order to contact you with information regarding services that may be of interest to you. You may withdraw your consent and unsubscribe for free at any time, using the contact details below or by following the instructions in any email marketing you may have received from us. If you opt out, we may still send you other types of emails, such as support, service, and other emails about our ongoing business relationship.

For other marketing services that we provide, such as downloadable reports or fact sheets, we will rely upon our legitimate interests to provide you with those, as you have expressly requested them.

10. Changes to this policy and your duty to inform us of changes

We keep our privacy policy under regular review. We will notify you of any material changes to this policy by email or by placing a prominent notice on our website prior to the change becoming effective.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

11. Information relating to Bud

Bud’s address is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

Bud is registered with the Information Commissioner’s Office under registration number ZA198709.

Bud is a private limited company registered in England & Wales (registration number 09651629) and is regulated by the FCA under registration number 793327.

To get in touch with Bud, please email: help@thisisbud.com

For details on what information we may collect when you visit our website, please refer to our Cookies Notice

‍