Legal

Privacy policy

Last updated: 20 July 2026

This privacy policy explains how we process personal data when you use this website and our onboarding form. Because we are established in the United Kingdom and offer services to individuals in the European Union, both the EU General Data Protection Regulation (EU GDPR, Art. 3(2)) and the UK GDPR apply to us.

1. Controller

GLOBALBANK LIMITED (“ONPEX”)
Unity House, Suite 888 Westwood Park, Wigan, WN3 4HE, United Kingdom
Company number 04600600, represented by its Director Heiko Schröter
E-mail: accounts@onpex.co

2. Data we process

  • Identity data: first and last name, date of birth
  • Contact data: e-mail address, phone number
  • Company data: company name, description of business activity, marketing and ownership information, LinkedIn/UpWork profile where provided, voucher code
  • Uploaded supporting documents: incorporation documents, tax IDs, registered agent appointment, CV and personal bank statements for the last three months. These documents contain identity and financial data.
  • Technical data: IP address, time of submission, browser/device information, captcha verification data.

3. Purposes and legal bases

  • Providing our service (facilitating and setting up bank/payment accounts with partner institutions) – Art. 6(1)(b) GDPR (contract / pre-contractual measures).
  • Identity verification (KYC), anti-money-laundering and fraud prevention – Art. 6(1)(c) (legal obligation) and Art. 6(1)(f) (legitimate interest).
  • Transferring your data and documents to partner banks in third countries – your explicit consent under Art. 6(1)(a) together with Art. 49(1)(a) GDPR (see sections 7 and 8).
  • Website operation, security and abuse prevention (incl. captcha) – Art. 6(1)(f) GDPR.

4. Recipients and processors

  • Hosting / server operation: [add and confirm provider and server location — the server IP known to us is registered to an organisation in Panama; the actual storage location must be confirmed as it determines the transfer safeguard].
  • Cloudflare, Inc. (“Turnstile” captcha), USA.
  • Pipedrive (CRM used to process your application), [confirm data location].
  • Partner banks and institutions in the USA, the United Kingdom and the United Arab Emirates, to which we transfer your application and supporting data for account opening (independent controllers).

5. Transfers to third countries

  • United Kingdom: covered by an EU adequacy decision; an adequate level of protection is ensured.
  • USA (e.g. Cloudflare, possibly partner institutions): transfer under the EU-US Data Privacy Framework where the recipient is certified, otherwise on the basis of standard contractual clauses (Art. 46 GDPR). [confirm certification/basis per recipient]
  • United Arab Emirates and possibly Panama: no adequacy decision exists. The transfer of your documents to partner banks in the UAE therefore relies on your explicit consent under Art. 49(1)(a) GDPR, which you give during onboarding. You are aware that these countries may not provide a level of protection comparable to the EU. You may withdraw your consent at any time with future effect.

6. Consent and withdrawal

Where we process data based on your consent or transfer it to a third country, you may withdraw your consent at any time with future effect, without affecting the lawfulness of processing before withdrawal. Withdrawal may mean we cannot continue the requested account opening.

7. Retention

We keep your data only as long as necessary for the stated purposes or as required by law. Statutory anti-money-laundering retention periods generally apply to KYC documents. [add concrete retention periods and deletion concept.]

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). You may also lodge a complaint with a supervisory authority – in Germany with the state data protection authority for your place of residence, in the UK with the Information Commissioner’s Office (ICO).

9. Captcha (Cloudflare Turnstile)

To protect our form against automated access we use Cloudflare Turnstile, which transmits technical data (incl. IP address, browser information) to Cloudflare. The legal basis is our legitimate interest in security and abuse prevention (Art. 6(1)(f) GDPR).

10. No automated decision-making

No solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Account opening is decided solely by the respective partner institutions.

11. Data security

We apply technical and organisational measures to protect your data, in particular transport encryption (TLS), access controls and separate storage of uploaded documents.

12. Changes

We update this policy when processing or the legal situation changes. The version published here applies.

Information on local saving updated: 24 September 2026.

Encrypted local application progress

Optional choice and purpose. If you select “Save progress encrypted on this device” in the application, this site automatically saves your entered text and selected documents after changes in this browser’s IndexedDB so you can resume after a reload. This choice is off by default. You can complete and submit the application without it, but unsaved entries will be lost if you reload or leave the page. Entering a recovery code reads existing saved progress at your request; later changes are not saved unless you enable local saving.

Legal basis and withdrawal. The legal basis for processing personal data in locally saved progress is your consent (Art. 6(1)(a) EU GDPR and, where applicable, UK GDPR). Your prior consent also authorises storage and access on your device under Art. 5(3) of Directive 2002/58/EC and, where applicable, section 25(1) of the German TDDDG and regulation 6 of the UK Privacy and Electronic Communications Regulations 2003. You can withdraw it at any time by unticking the box; this stops saving and deletes all locally saved entries and documents from this browser. The separate “Delete all saved progress” control and your browser’s site-data settings let you remove saved entries even when saving is already off. Withdrawal does not affect processing that was lawful before it. Declining or withdrawing local saving does not prevent you from submitting the application.

Storage and access. Saved form contents and documents are encrypted in this browser (AES-GCM); technical record identifiers and expiry information are stored with the ciphertext. The recovery code is displayed in your browser and is not sent to ONPEX. This feature does not send saved form contents, documents or the code to ONPEX or other recipients before you submit the application; it does not itself transfer them to another country. Other website functions, such as content loading and security checks, can contact servers as described above. Final submission sends your application and documents for processing under the rest of this policy. Someone with both access to your browser profile and your recovery code could read saved progress; use a trusted device and keep the code private. ONPEX cannot retrieve locally saved progress or delete it remotely.

Retention and deletion. Saved progress can be restored in the same browser on the same device for up to 24 hours after its last successful save; each successful subsequent save renews that period. Starting a new application does not remove earlier saved progress. Submitting or cancelling deletes only the saved progress currently in use. Unticking local saving or choosing “Delete all saved progress” removes every stored entry and document in this browser after confirmation, without clearing what is currently visible in the open form. Expired saved entries cannot be restored: active saved progress is removed when its expiry timer runs while the page is executing; older records are cleared when you next request local saving or restoration. If you do not return, expired encrypted records may remain on your device until you clear this site’s browser data. Your browser may clear them earlier. ONPEX cannot recover a lost code or locally saved progress removed by the browser.