Skip to main content

Data protection notice

Personal data is information which directly or indirectly identifies you. We at Investec Bank plc are committed to processing your personal data in accordance with EU data protection laws. For the purposes of EU data protection laws, Investec Bank plc is the data controller. It may be necessary for you to give us personal data so that we can provide you with access to the Investec API Developer Portal, fulfil any contractual relationship with you, as a result of applicable laws, regulations and/or codes of practice and for the other purposes as set out in this notice where in our legitimate interests.

Collecting your personal data

We may collect your personal data in a number of ways, including from:

  • you, for example, when you:
    • ask us to contact you
    • contact and interact with us
    • enter into any agreement with us
    • call us, we will monitor and/or record your telephone calls
    • register for and use the Investec API
  • public sources for example, Companies House 


What personal data we collect

Types of information we may collect includes:

Type of information

Examples of information

Personal details


contact details

employment details

Information we have from our dealings with you or from anyone acting on your behalf

recordings of telephone calls with us

records of our interactions/correspondence with you

How we will use your personal data

We will use your personal data for the following reasons: 

  • to verify your identity
  • to verify the accuracy of the data you have provided to us
  • provide access to the Investec API Developer Portal
  • to manage your accounts
  • to manage any contractual relationship with you
  • to comply with applicable laws, regulations and/or codes of practice

How we will disclose your personal data

We may disclose certain personal data as follows:

  • to other affiliates in the Investec Group. Investec Group consists of Investec Bank plc (a company registered in the UK) and Investec Limited (a company registered in South Africa) and any of their direct or indirect subsidiaries and/or holding companies.
  • to our professional advisors, receivers and administrators (where applicable), and service providers (including for example, information technology systems providers) who may help us provide products or services
  • to courts, governmental and non-governmental agencies, regulators and ombudsmen
  • law enforcement agencies
  • relevant tax authorities
  • to any relevant third party in the course of an acquisition, sale, transfer, reorganisation or merger of parts of our business or our assets 
  • as required or permitted by law or regulation, where we are under a duty to disclose or share your personal data in order to comply with any legal obligation or to protect the rights, property, or safety of the Investec Group, our clients, or others

Transfer of Personal Data Outside the European Economic Area (“EEA”)

We may transfer your personal data to recipients who may carry out services on our behalf (including affiliates in the Investec Group) located in countries outside of the EEA, including in South Africa.  If we transfer your personal data to a country where the data privacy laws are not equivalent to those in the EEA, we will take all necessary steps to protect your personal data in accordance with applicable data privacy laws.

Your Rights

You have the right to:

  • request access to and rectification or erasure of your personal data
  • obtain restriction of processing or to object to processing of your personal data
  • data portability (i.e. to request the transfer of personal data from one data controller to another in certain circumstances). 

If you wish to exercise any of these rights you should contact the Data Protection Officer as described below.  You also have the right to lodge a complaint about the processing of your personal data with your local data protection authority. 

Security and Data Retention

We will take steps to protect your personal data against loss or theft, as well as from unauthorised access, disclosure, copying, use or modification, regardless of the format in which it is held. Subject at all times to applicable laws, we will retain your personal data for a period up to 7 years from the end of the relationship.

Changes to this Data Protection Notice

We may revise or supplement our Data Protection Notice from time to time to reflect for example, any changes in our business, law, markets, or the introduction of any new technology.

Enquiries, Requests or Concerns

All enquiries, requests or concerns regarding this Notice or relating to the processing of personal data, should be sent to the Data Protection Officer at Investec Bank plc, 30 Gresham Street, London, EC2V 7QP or by email to [email protected].