Privacy Notice Kanoo Foreign Exchange Services

1. Background


This Privacy Notice ('Notice ') sets out how Kanoo Travel Limited also known as Kanoo Foreign Exchange Services, a company incorporated in the United Kingdom, and all their brands (collectively referred to in this document as "Kanoo Travel", "we" "our" or "us") protects the privacy of your personal information. 


The family owned Kanoo Travel Group is the largest travel company in the Middle East, with locations across the world including the UK and a team of travel specialists in over 200 offices worldwide. We pride ourselves on our customer service, this includes how we handle your personal information.


We need to collect, use and disclose personal information to perform our business functions and activities, including processing the purchase of currency and other financial services on behalf of our customers. We are firmly committed to protecting the privacy and confidentiality of personal information and to maintaining various physical, electronic and procedural safeguards to protect personal information in our care.


We will be a "data controller" for the purposes of the General Data Protection Regulation 2016/679 ("GDPR") for any personal information you provide to us in connection with our relationship.


By providing personal information to us, you agree that this Notice will apply to how we handle your personal information and you consent to us collecting, using and disclosing your personal information as detailed in this Notice. If you do not agree with any part of this Notice, you must not provide your personal information to us. If you do not provide us with your personal information, or if you withdraw a consent that you have given under this Notice, this may affect our ability to provide services to you or negatively impact the services we can provide to you. For example, for most foreign currency transactions we are required to obtain your Name, Address and contact details, we cannot complete the transaction without this information.


2. What personal information do we collect?


Personal information is the meaning of personal data given under the GDPR. Personal information generally means information which relates to a living individual who can be identified from that information, or from that information and other information in a person's possession. 


Generally, the type of personal information we collect about you is the information that is needed to facilitate us providing goods, products or services on your behalf.


We therefore typically process the following types of personal information about you:


- contact information (such as name, residential/mailing address, telephone number, email address, etc.);

- payment account information (credit/debit card details, including card type, card number, security number and expiry date);

- Passport or other Photo Identification details;

- Utility Bill or similar documentation to identify you

- Documents to verify the purpose of your transaction and or source of funds i.e. Bank Statement or Invoice.


When you contact us for other purposes, we may also collect personal information about you in relation to those purposes. For example, we may collect your personal information, so we can contact you about a competition you have entered (e.g. if you win) or to respond to an enquiry or feedback you have sent to us. We also collect information that is required for use in the business activities of Kanoo Travel, including for example, financial details necessary to process various transactions and other relevant personal information you may elect to provide to us.

In some circumstances, we may collect personal information from you which may be regarded as sensitive information. Sensitive information may include (without limitation) your racial or ethnic origin, philosophical or religious beliefs or affiliations, biometric and genetic information and financial information and health information. We will only collect sensitive information in compliance with GDPR data protection laws, with your explicit consent and where it is reasonably necessary for, or directly related to, one or more of our functions or activities, unless we are otherwise required or authorised to do so by law. To the extent permitted or required under data protection laws, you consent to us using and disclosing your sensitive information for the purpose for which it was collected, unless we subsequently receive your consent to use it for another purpose. We will not use sensitive information for purposes other than those for which it was collected.

When we may collect CCTV images of you from equipment in place at our bureau de change stores , we will do so for the prevention and detection of crime and public safety.


3. How do we collect personal information?


We will collect your information when you register with us, when you ask us to provide you with any of our products or services, when you speak with us over the telephone, when you write to us, visit our stores and when you visit our website. We may use cookies to collect information about your use of our website.


The personal information taken such as name, address, date of birth, email address, country of birth, passport details, driving licence details and other identifying information is obtained when you open an account for the supply of services, transact either in branch or online.


We will only collect personal information in compliance with data protection laws. We usually collect your personal information from the information you submit during your relationship with us. We will collect this information directly from you unless it is unreasonable or impracticable to do so.


Generally, this collection will occur:

- when you deal with us either in person, by telephone, letter or email;

- when you visit any of our websites; or

- when you connect with us via social media.


We may collect personal information about you:


- when you purchase or make enquiries about a potential currency purchase or other products and services;


- when you enter competitions or register for promotions;

- when you subscribe to receive marketing from us (e.g. e-newsletters);

- when you request other information from us; or

- when you provide information, or use our services, on social media.

Unless you choose to do so under a pseudonym or anonymously, we may also collect your personal information (other than sensitive information) when you complete a survey or provide us with feedback. 

In some circumstances, it may be necessary for us to collect personal information about you from a third party. This includes where a person makes a purchase on your behalf. Where this occurs, we will rely on the authority of the person providing the information to act on behalf of any other individual involved in the purchase.

Where you make a purchase on behalf of another person (e.g. a family or group booking, or a purchase made for an employee), you agree you have obtained the consent of the other person for Kanoo Travel to collect, use and disclose the other person's personal information in accordance with this Notice and that you have otherwise made the other person aware of this Notice. 

You should let us know immediately if you become aware that your personal information has been provided to us by another person without your consent or if you did not obtain consent before providing another person's personal information to us.

We make every effort to maintain the accuracy and completeness of your personal information which we store and to ensure all your personal information is up to date. However, you can assist us with this considerably by promptly contacting us if there are any changes to your personal information or if you become aware that we have inaccurate personal information relating to you (see section 13 below). We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal information that you, or a person acting on your behalf, provide to us.

4. How do we use your personal information?

Registration and administration.

We use your information to enable you to register with us and, once your registration is complete, for the administration of your account, to contact you, to update our records about you, and to respond to and process your queries and requests.


Our products and services

We use your information so that we can supply you with our products and services which you use and to meet our contractual obligations to you. We also use your information to notify you about changes or developments relating to our products and services which you use.


We might contact you by mail, telephone, email, or text unless you have asked us not to. If you are a registered customer, we may also display personalised advertising to you when you use our online account service and mobile app. You can change your preferences at any time by calling us, writing to us, contacting your local branch or by updating them online. If you do opt out, you may still see some generic, non-personalised advertising when you are using our online services.


We will not provide information about you to companies outside our Group to use for their own marketing purposes.


Prevention and detection of crime

Kanoo Travel Ltd and our products and services are subject to the Money Laundering Regulations 2007 and regulated by HM Revenue and Customs. Some of our products and services are also subject to regulation by the Financial Conduct Authority ("FCA"). We may be required by the Money Laundering Regulations 2007, by HM Revenue & Customs, by the FCA or other regulatory bodies, by the police or other law enforcement agencies, by a court or otherwise by law to use your information in the detection, prevention or prosecution of crime, tax evasion, fraud or audit purposes.



We may use your information to send you information concerning our products or services which you use and our similar products or services which we think may be of interest to you. This may include information concerning promotions or offers which could benefit you. If you do not wish to receive this information from us, please tell us at registration. If you change your mind after registration, please contact us to let us know by using our contact details found at the end of this Privacy Policy or, if we have sent you this information by email, by following the instructions in our email.


Credit controls or debt collection agencies

We may share your information with credit control or debt collection agencies, for example, if you owe us money and we engage their services to recover it from you.


On a business sale or purchase

If we decide we want to sell our business or receive an offer to buy our business we may have to share your information with a prospective purchaser and their legal, financial or other advisers. In these circumstances, we will take appropriate steps to ensure that your information is properly protected.


5. Is personal information disclosed to third parties?


We do not and will not sell, rent out or trade your personal information. We will only disclose your personal information to third parties in the ways set out in this Notice and as set out below, and in accordance with local data protection laws. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. You may sometimes ask us about, or we may sometimes ask you if you are interested in, products or services which we are unable to provide but which someone else we know be able to provide (for example, travel or financial services such as International Money Transfers). We will never pass your information to a Kanoo Travel contact unless you have asked us to do so. Please note that we are not responsible for and cannot be liable to you for any products or services of any Kanoo Travel contact or any acts or omissions of any Kanoo Travel contact.


Note that, in this Notice, where we say "disclose", this includes to transfer, share (including verbally and in writing), send, or otherwise make available or accessible your personal information to another person or entity.


Your personal information may be disclosed to the following types of third parties:


- our contractors, suppliers and service providers, including without limitation:

in each of the circumstances set out in section 4 ("How do we use your personal information?");

suppliers of IT based solutions that assist us in providing products and services to you (such as any external data hosting providers we may use);

publishers, printers and distributors of marketing material;

marketing, market research, research and analysis and communications agencies;

mailing houses, freight services, courier services; and

external business advisers (such as lawyers, accountants and auditors);

- any third party to whom we assign or novate any of our rights or obligations;

- your employer, where you are an employee of one of our corporate, business or government clients and your purchase is for work purposes via a corporate customer purchasing process.

- as required or authorised by applicable law, and to comply with our legal obligations;

- customs and immigration to comply with our legal obligations and any applicable customs/immigration requirements relating to your purchase;

- government agencies and public authorities to comply with a valid and authorised request, including a court order or other valid legal process;

- various regulatory bodies and law enforcement officials and agencies, including to protect against fraud and for related security purposes; and

- enforcement agencies where we suspect that unlawful activity has been or may be engaged in and the personal information is a necessary part of our investigation or reporting of the matter.

Other than the above, we will not disclose your personal information without your consent unless we reasonably believe that disclosure is necessary to lessen or prevent a threat to life, health or safety of an individual or to public health or safety or for certain action to be undertaken by an enforcement body (e.g. prevention, detection, investigation, prosecution or punishment of criminal offences), or where such disclosure is authorised or required by law (including applicable privacy / data protection laws).

On our websites, you may choose to use certain features that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with us. These features, which include social networking and geo-location tools, are operated by third parties, including social networks, and are clearly identified as such. These third parties may use or share personal information in accordance with their own privacy policies. We strongly suggest you review the third parties' privacy policies if you use the relevant features.

6. Is personal information transferred overseas?

The information that we collect from you and about you may be transferred to and stored at a destination outside the European Economic Area ("EEA") (which may not offer the same level of data protection).  It may also be processed by Kanoo or a supplier's staff operating outside the EEA (including third party product issuers). Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your information, you agree to this transfer, storing or processing of your information outside of the EEA. We will take reasonable steps to ensure that such information is treated securely and in accordance with this Policy, but please be aware that countries which are outside the EEA may not offer the same level of data protection.


7. Security of information

We are committed to safeguarding and protecting personal information and will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any personal information provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information transmitted, stored or otherwise processed. Kanoo Travel has implemented various physical, electronic and managerial security procedures to protect the personal information it holds from loss and misuse, and from unauthorised access, modification, disclosure and interference. Kanoo Travel regularly reviews security technologies and will strive to protect your personal information as fully as we protect our own confidential information. We are a "PCI DSS" compliant company, meaning that we apply certain high standards of security in respect of your payment information, ensure appropriate access controls so that access to your information is only granted to those of our people that need to use it in the course of their work, carry out regular penetration testing of our systems and reviews of our software.

Kanoo Travel is not responsible for any third party's actions or their security controls with respect to information that third parties may collect or process via their websites, services or otherwise.

We will destroy or de-identify personal information once we no longer require it for our business purposes, or as required by law.


8. Your rights in relation to the personal information we collect

If you wish to:

- update, modify, delete or obtain a copy of the personal information that we hold on you; or

- restrict or stop us from using any of the personal information which we hold on you, including by withdrawing any consent you have previously given to the processing of such information; or

- where any personal information has been processed based on your consent or as necessary to perform a contract to which you are a party, request a copy of such personal information in a suitable format

You can request this by emailing us at the address set out in section 13 below. You will receive acknowledgement of your request and we will advise you of the timeframe within which you will receive your information.

We endeavour to respond to such requests within a month or less, although we reserve the right to extend this period for complex requests.

We reserve the right to deny you access for any reason permitted under applicable laws. Such exemptions may include national security, corporate finance and confidential references. If we deny access or correction, we will provide you with written reasons for such denial unless it is unreasonable to do so and, where required by local data protection laws, will note your request and the denial of same in our records. 

Further correspondence regarding your request should only be made in writing to the Data Protection Office at the address set out in section 13 below. 

Please note that, if you request that we restrict or stop using personal information we hold on you or withdraw a consent you have previously given to the processing of such information, this may affect our ability to provide services to you or negatively impact the services we can provide to you. For example, most currency exchanges must be made with an individual's full name and address and in some cases and appropriate identification (e.g. passport details). We cannot complete transactions for you without that information in certain circumstances.

You must always provide accurate information and you agree to update it whenever necessary.  You also agree that, in the absence of any update, we can assume that the information submitted to us is correct, unless we subsequently become aware that it is not correct.

You can at any time tell us not to send you marketing communications by email by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us as indicated below (section 13).

In any of the situations listed above, we may request that you prove your identity by providing us with a copy of a valid means of identification for us to comply with our security obligations and to prevent unauthorised disclosure of personal information.

We reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your personal information, and for any additional copies of the personal information you request from us.

9. Social media integrations

Our websites and mobile applications may use social media features and widgets (such as "Like" and "Share" buttons/widgets) ("SM Features"). These are provided and operated by third party companies (e.g. Facebook) and either hosted by a third party or hosted directly on our website or mobile application. SM Features may collect information such as the page you are visiting on our website/mobile application, your IP address, and may set cookies to enable the SM Feature to function properly.

If you are logged into your account with the third-party company, then the third party may be able to link information about your visit to and use of our website or mobile application to your social media account with them. Similarly, your interactions with the SM Features may be recorded by the third party. In addition, the third party company may send us information in line with their policies, such as your name, profile picture, gender, friend lists and any other information you have chosen to make available, and we may share information with the third party company for the purposes of serving targeted marketing to you via the third party social media platform. You can manage the sharing of information and opt out from targeted marketing via your privacy settings for the third party social media platform.

Your interactions with these SM Features are governed by the privacy policy of the third-party company providing them. For more information about the data practices of these third-party companies, and to find out more about what personal information is collected about you and how the third party uses such personal information, please refer to their privacy policy directly.

10. IP addresses

When you access our website, On-line ordering Tool, use any of our mobile applications or open electronic correspondence or communications from us, our servers may record data regarding your device and the network you are using to connect with us, including your IP address. An IP address is a series of numbers which identify your computer, and which are generally assigned when you access the internet.  

We may use IP addresses for system administration, investigation of security issues and compiling anonymised data regarding usage of our website and/or mobile applications. We may also link IP addresses to other personal information we hold about you and use it for the purposes described above (e.g. to better tailor our marketing and advertising materials, provided you have opted in to receive electronic marketing). 


11. Tracking technologies / cookies

We may use third-party web analytics services on our websites and mobile apps, such as those listed in our Cookies Policy. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyse how visitors use our websites and apps.

For information regarding our use of cookies and tracking technologies, refer to our Cookies Policy on our website.


12. Linked sites

Our websites may contain links to third party websites over which we have no control. We are not responsible for the privacy practices or the content of such websites. We encourage you to read the privacy policies of any linked third-party websites you visit as their privacy policy and practices may differ from ours.


13. Feedback / complaints / contact

If you have any enquiries, comments or complaints about this Notice or our handling of your personal information, or wish to inform us of a change or correction to your personal information, would like a copy of the information we collect on you or would like to raise a complaint or comment, please contact your consultant or the Data Protection Office using the details set out below:

Email:  [email protected]

Post:    Data Protection Officer, Kanoo Travel Ltd, 34 Union Street Birmingham B2 4SR
We will respond to any enquiries or complaints received as soon as practicable. 

However, if you'd still like to make a formal complaint or have concerns regarding the ways in which we use your information, you can contact the Information Commissioner's Office (also known as the "ICO"). The ICO is an independent authority and the UK's supervisory authority for information rights. 

You can register your concerns on the ICO site


14. Changes to our Notice

We may amend this Notice from time to time. If we make a change to the Notice, the revised version will be posted on our website. We will post a prominent notice on our website to notify you of any significant changes to our Notice and indicate at the end of the Notice when it was most recently updated. It is your responsibility, and we encourage you, to check the website from time to time to determine whether there have been any changes. If we update our Notice, in certain circumstances, we may seek your consent.


Updated May 2018