Talk to us

Privacy Policy

Explains how we collect, use, and protect data

This Privacy Notice explains how Andromeda Bridge Corporation Limited (operating as “Spike”) collects, uses, shares, and protects your personal data when you use the Spike App, the Spike website, or otherwise interact with us. It is provided to satisfy our information obligations under Articles 13 and 14 of the UK GDPR and the Data Protection Act 2018.

In this Notice, “personal data” has the meaning given in the UK GDPR. Other capitalised terms used here have the meaning given in the Master Definitions Schedule unless they are defined here.

The data controller of your personal data is Andromeda Bridge Corporation Limited, a company incorporated in England and Wales with company number [●] and registered office at [●]. You can contact us:

  1. by email: privacy@spikeapp.com (or such other address as we publish from time to time);
  2. by post: Data Protection, Andromeda Bridge Corporation Limited, [registered office].

Where we have appointed a Data Protection Officer (DPO), the DPO can be contacted using the same channels.

We collect personal data that you give us, that we collect automatically, and that we receive from third parties.

This includes the data you provide when you create a Spike Account or use the Spike App, such as:

  • identification data: name, date of birth, nationality;
  • contact data: email address, phone number, postal address;
  • authentication data: password (stored as a salted hash), authentication factors;
  • connection data: identifiers and metadata of the Linked Accounts and Linked Wallets you connect, but not credentials of the Service Provider account;
  • instruction data: the content of the Instructions you submit through the Spike App; and
  • communications data: the content of any communications you have with our support team.

When you use the Spike App or the Spike website, we may automatically collect:

  • device data: device identifier, operating system, browser type, screen resolution;
  • usage data: pages and features accessed, timing, errors;
  • network data: IP address, approximate geolocation derived from IP, network operator;
  • cookie and similar tracking data, as set out in the Cookies & Tracking Notice; and
  • security and fraud signals.

We may receive data from:

  • Service Providers, such as transaction status, balances, and lifecycle events relating to your Linked Accounts;
  • Platform Partners, where you access the Spike App through their interface;
  • identity, fraud, and sanctions providers, where used by us or by a Service Provider for risk and compliance purposes;
  • public sources, such as company registers and sanctions lists; and
  • analytics and advertising providers.

We use your personal data to provide, maintain, and improve the Spike App and the Spike Platform, including to: create and authenticate your Spike Account, connect Linked Accounts and Linked Wallets, capture and process Instructions, generate status updates, and respond to your communications. The lawful basis is performance of our contract with you (Article 6(1)(b) UK GDPR).

We use your personal data to comply with applicable laws, including AML/CTF Laws, sanctions laws, tax reporting laws, and obligations to cooperate with Governmental Authorities. The lawful basis is compliance with a legal obligation (Article 6(1)(c) UK GDPR).

We use your personal data to detect and prevent fraud, abuse, security threats, and breach of our Acceptable Use Policy. The lawful basis is our legitimate interests in protecting Spike, our users, our partners, and the integrity of the Spike Platform (Article 6(1)(f) UK GDPR).

We send you operational messages about your Spike Account, your Instructions, and changes to the Platform Documentation. The lawful basis is performance of our contract with you (Article 6(1)(b) UK GDPR).

Where you have given consent, we may send you product updates, offers, and newsletters. You may withdraw consent at any time, including by using the unsubscribe link in any marketing email. The lawful basis is your consent (Article 6(1)(a) UK GDPR).

We use aggregated and de-identified usage data to understand how the Spike App is used and to improve it. Where the data is identifiable, the lawful basis is our legitimate interests in product improvement (Article 6(1)(f) UK GDPR).

We do not seek to collect special category personal data. Where we receive it (for example, in a free-text support communication), we will process it only to the extent necessary, on a recognised lawful basis under Article 9 UK GDPR (typically explicit consent or, in compliance contexts, substantial public interest).

We share personal data only as necessary and as set out below.

To enable Instructions to be carried out, we share relevant data with the Service Providers you choose to connect to and, where applicable, with the Platform Partner through which you access the Spike App. Each Service Provider and Platform Partner is an independent data controller of the personal data it receives.

We engage processors to provide infrastructure (cloud hosting), analytics, customer-support tooling, fraud prevention, identity verification, and similar services. Each processor is contractually bound to process personal data only on our instructions and to maintain appropriate security.

We disclose personal data to Governmental Authorities where required by applicable law, by court order, or by a binding regulator request. Where lawful and reasonably practicable we will notify you.

Where Spike is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be disclosed to the counterparties and their advisers, subject to confidentiality and applicable data-protection requirements.

We may share personal data with other parties where you have given specific consent.

We are based in the United Kingdom. Where personal data is transferred outside the United Kingdom, including to Service Providers, Platform Partners, or processors located in other jurisdictions, we use one or more of the following safeguards:

  • a UK adequacy regulation in respect of the destination country;
  • UK-equivalent Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable); and
  • supplementary measures (such as encryption and access controls) where required by transfer-impact assessment.

You may obtain a copy of the safeguards used by contacting us at privacy@spikeapp.com.

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with our legal obligations. Typical retention periods are:

  • Spike Account and Instruction records: for the duration of your Spike Account and at least five (5) years after closure, in line with AML/CTF record-keeping obligations;
  • communications data: typically two (2) years after the last communication;
  • marketing preferences: until you withdraw consent, plus a short period to record the withdrawal; and
  • technical logs: typically twelve (12) months.

Specific retention periods may be longer where required by law (for example, in connection with regulatory investigations, litigation, or tax reporting).

Subject to applicable conditions, you have the following rights under the UK GDPR:

  • the right to be informed (this Notice serves that purpose);
  • the right of access to your personal data;
  • the right to rectification of inaccurate personal data;
  • the right to erasure of personal data in certain circumstances;
  • the right to restrict processing in certain circumstances;
  • the right to data portability for data we process by automated means on the basis of your consent or our contract with you;
  • the right to object to processing based on legitimate interests, including direct marketing;
  • the right to withdraw consent at any time where processing is based on consent; and
  • the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects (we do not currently use such decisioning in the Spike App).

To exercise any of these rights, contact us at privacy@spikeapp.com. We will respond within one (1) month of receipt of a valid request, with a possible extension of up to two further months for complex or numerous requests.

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO):

  1. Online: ico.org.uk/make-a-complaint;
  2. By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF;
  3. By telephone: 0303 123 1113.

Our use of cookies and similar tracking technologies on the Spike App and the Spike website is described in the Spike Cookies & Tracking Notice.

We may update this Notice from time to time. The current version is identified by version number and effective date. Material changes will be brought to your attention through the Spike App, by email, or by another reasonable means. Your continued use of the Spike App after the effective date of an updated Notice constitutes acceptance of the changes, except where applicable law requires fresh consent.