Revolut Privacy Policy (Superseded URL)

This document establishes Revolut's data collection, processing, and use practices for UK customers. The policy authorizes collection of identity documents, bank account details, card numbers, location data, device activity, transaction history, and data obtained through Open Banking access to other financial accounts. The policy establishes that Revolut employs automated profiling and decision-making systems to determine eligibility for products including credit facilities, and specifies that users may request human review of automated decisions, access collected data, and submit objections through the Revolut app or dpo@revolut.com.

This is the Revolut Ltd Customer Privacy Notice (effective 17 March 2026), governing personal data processing for UK customers across all Revolut products and services, with the stated legal controller being either Revolut Bank UK Ltd or Revolut Ltd depending on the product used. The notice states that Revolut collects identity documents, financial details, device and location data, transaction history, biometric data for identity verification, credit reference agency data, Open Banking data, and behaviorally inferred data; the terms authorize use of this data for service delivery, fraud prevention, credit decisioning, automated profiling, product improvement, and marketing where permitted. A notable provision is the explicit commitment that Revolut will never sell personal data, alongside a broad automated decision-making disclosure including credit scoring and fraud detection that relies on profiling with potentially significant legal effects, which the document states is subject to rights of human review under applicable law. The notice engages UK GDPR and the UK Data Protection Act 2018 as primary frameworks, with the ICO as the lead supervisory authority, and separately references compliance obligations under AML, PSD2/Open Banking, and financial services regulation; international data transfers to third countries are disclosed and stated to be covered by Standard Contractual Clauses or other appropriate safeguards. For customers using investment, crypto, or credit products, additional standalone notices and just-in-time disclosures apply, creating a layered privacy framework where this document serves as the master notice but does not contain the full picture for all product lines.

The policy establishes that Revolut collects and processes a comprehensive range of personal financial and behavioral data, including information from external bank accounts via Open Banking. The policy authorizes use of this data in automated decision-making systems that determine product eligibility and financial terms. The policy specifies procedural rights including the ability to request human review of automated decisions, access personal data held by Revolut, submit data deletion requests, and object to specific processing activities or marketing communications.