Your information deserves care and clarity.

1. Scope and responsibility

This policy applies to personal information collected through the Welsbank public website and its general contact form, to the extent those activities are controlled by the entity operating this website.

The website brand and the institution that provides a financial product may be different entities. If an independent bank, card issuer, payment processor, identity-verification provider, or other service provider processes information under its own responsibility, its privacy notice may also apply.

Responsible organization: The legal name and registered address of the organization responsible for this website must be inserted here before publication. Do not treat the Welsbank brand name alone as the identity of a legal financial institution.

2. Information we may collect

The information collected depends on how you use the website and which features are enabled. For the public pages and contact form, categories may include:

Do not submit passwords, one-time verification codes, complete payment-card details, or other sensitive account credentials through the general contact form.

If Welsbank later provides account registration, online banking, transactions, or financial products, those features require additional disclosures that accurately describe the information collected by the actual providers.

3. How information is used

Depending on the feature and the actual processing activity, information may be used to:

• Receive, review, and respond to website enquiries.
• Operate, maintain, troubleshoot, and improve the website.
• Protect the website and its users against spam, misuse, and unauthorized requests.
• Maintain relevant technical and security records.
• Meet legal obligations and handle legitimate requests or disputes.
• Communicate about a request you have made.

Information should not be used for a new, incompatible purpose without an appropriate legal basis or notice where required.

4. Legal grounds for processing

Where applicable privacy law requires a legal basis, the responsible organization will rely on the basis appropriate to the activity. Depending on the circumstances, this may include responding to your request, fulfilling a contract, complying with a legal obligation, pursuing a legitimate interest that does not override applicable rights, or obtaining consent where required.

The legal basis varies by jurisdiction and processing activity. Consent, where relied upon, should be requested in a clear and appropriate manner and may be withdrawn subject to applicable law.

5. Cookies, sessions, and technical data

The site may use server sessions and other essential technical mechanisms to support security and basic functionality. The exact cookies and similar technologies depend on the deployed code and any enabled third-party services.

Essential technologies

Technologies required for functions such as session continuity and security may be used where appropriate. Browser settings can control some cookies, although blocking necessary cookies may prevent parts of the website from working.

Analytics and advertising

Do not assume that analytics, advertising pixels, or marketing cookies are used or absent based solely on this policy. The operator should inventory the live site, identify each provider, describe its purpose, and implement consent controls where required before enabling non-essential tracking.

6. When information may be shared

Personal information may be shared only as appropriate to the actual service and subject to applicable law. Potential recipients include:

• Hosting, infrastructure, and technical support providers operating the website.
• Security and abuse-prevention providers where actually used.
• Professional advisers or authorities when reasonably necessary for legal compliance or the establishment, exercise, or defense of legal claims.
• A relevant financial institution or service provider where you expressly make a request that requires it and the relevant service is genuinely available.

Any actual third-party sharing practices, service providers, and applicable safeguards should be documented before publication. This policy does not by itself authorize a provider to receive information.

We should not sell or disclose personal information for unrelated purposes without an appropriate legal basis and any notices or choices required by law.

7. Data retention and security

Information should be retained only for as long as reasonably necessary for its stated purpose, applicable legal requirements, dispute handling, and legitimate security needs. The actual retention period depends on the type of information and the operational requirements of the responsible organization.

The website uses technical measures intended to protect information, including server-side validation and prepared database statements for contact submissions. No website, transmission method, or storage system can be guaranteed to be completely secure.

The operator should limit access to personal information to authorized personnel and service providers, maintain appropriate backups and security updates, and have a process for responding to suspected data incidents.

8. Your privacy choices and rights

Depending on where you live and which laws apply, you may have rights to request access to personal information, correction of inaccurate data, deletion, restriction or objection to certain processing, data portability, or withdrawal of consent.

Some rights are subject to exceptions, identity verification, or legal retention requirements. The responsible organization may need to request sufficient information to verify your identity without collecting unnecessary additional data.

To submit a privacy request, use the contact page and clearly state that your message concerns privacy rights. Do not include passwords or full identity-document numbers in the initial message.

Where applicable law provides a right to complain to a data-protection regulator or supervisory authority, you may exercise that right through the relevant official channel.

9. Children’s privacy

This public website is not intended to invite children to submit unnecessary personal information. The operator should apply the age requirements and parental-consent rules that apply to its actual services and jurisdiction.

If you believe a child has submitted personal information inappropriately, contact the responsible organization through an official contact channel so the request can be reviewed.

10. International processing

Website infrastructure and service providers may operate in different locations. If personal information is transferred across borders, the responsible organization should identify the applicable transfer rules and implement required safeguards.

The actual hosting locations, recipients, and transfer safeguards should be confirmed before this section is treated as a complete disclosure.

11. Changes to this policy

This policy may be updated to reflect changes in the website, the responsible organization, service providers, legal requirements, or data-handling practices. The updated date should be changed whenever a substantive revision is published.

If a change requires notice or consent under applicable law, the operator should provide the appropriate notice or obtain consent rather than relying only on posting a revised policy.

12. Contact and complaints

For questions about this policy or a privacy request, use the Welsbank contact page. Before publication, insert the responsible legal entity’s privacy contact details and any required mailing address or designated privacy representative.

For a request concerning a separate bank, card issuer, or other independent financial provider, you may also need to contact that provider directly through its official privacy channel.