1. Introduction

As a digital wealth manager, nearly everything you do with us or on our website or app will involve the collection, creation, use or sharing of data. Our objective with this policy is to explain how and why we collect, create, use, share, store, and delete data.

It also outlines the controls we offer to help you exercise your rights regarding your data, including:

• Privacy settings
• Notifications
• Marketing elections
• Website cookie management
• Client services

2. About this policy

This policy is provided by J.P. Morgan Personal Investing Limited (or “J.P. Morgan Personal Investing”), trading as J.P. Morgan Personal Investing (25 Bank Street, Canary Wharf, London, E14 5JP, UK) as a data controller under the UK Data Protection Act. The terms that cover your J.P. Morgan Personal Investing account can be found in our Terms and Conditions.

This policy applies to all our consumer banking and related services (referred to as the “J.P. Morgan Personal Investing Services”).

Over time, we’ll improve J.P. Morgan Personal Investing’s services, as well as developing new services. If this materially changes how we manage your data, we’ll update this policy. If you ever have questions or concerns, please get in touch.

This policy applies to:

• J.P. Morgan Personal Investing clients
• anyone who downloads our app
• anyone who browses our website or social media pages
• anyone who has specific permissions on accounts including power of attorney or appointed third parties
• applicants for a J.P. Morgan Personal Investing account
• anyone who contacts us either online, by telephone, post or any other method.

3. Your rights

3.1. The right of access    

You have the right to access the personal data that J.P. Morgan Personal Investing holds on you and request a copy of it.

3.2. The right to rectification      

You have the right to have inaccurate personal data corrected, or incomplete data completed.

3.3. The right to erasure (“the right to be forgotten”)

You have the right to ask us to delete the data held we hold. We are required to balance this right with our obligations under law and regulation with respect to record retention.

3.4. The right to object    

You have the right to object to the processing of your personal data when this is based on legitimate interest, including profiling.

3.5. The right to restrict processing        

You have the right to ask us to limit how we use your personal data, for example while we review or complete another request you’ve made under your data rights (like correcting your data).

3.6. The right not to be subjected to automated decision-making

Where it is not necessary for the performance of the contract or based on your explicit consent, you have the right not to be subject to a decision based solely on automated decision-making and profiling.

3.7. Right to data portability

You have a right to request a portable copy of your personal data which can be shared with a third party.

3.8. The right to withdraw your consent

Where you gave your consent to process your data, you can withdraw it any time.

3.9. The right to complain

If you want to exercise any of these rights, or have any complaints about how we process your data you can email us at privacy.team@personalinvesting.jpmorgan.com.

You also have the right to complain to the Information Commissioner’s Office, by visiting their website or calling their helpline on 0303 123 1113.

4. Your personal data

These are the types of data we collect, create, use, and share:

4.1. Personal details and identifiers

Your full name, home address, email address, phone number, and information that is used to verify your identity. Your gender is collected when you onboard and will only be taken into consideration where you have a pension product with us to meet our legal obligations. This can be photo ID, passport number, national insurance number, driving licence number, tax residency, and nationality.

4.2. Authentication data

The data you use to access J.P. Morgan Personal Investing services; including a password, and security questions and answers. This also includes your unique account number and user profile identifiers used for accessing our app.

4.3. Investment suitability and affordability information

Information used to assess your tolerance to investment risk and whether the investment products offered by J.P. Morgan Personal Investing are suitable and affordable for you. This includes, but is not limited to, your investment experience, tolerance to risk, investing timeframe, and your monthly incomings and outgoings.

4.4. Financial information

Information used to assess your financial situation. This may include your income, residential status, employment information, credit rating, dependents information, expenses, pensions, savings and investments, loans and mortgages, protection policies, financial objectives, County Court Judgments or bankruptcy.

4.5. Account information

Details relating to the account that you hold with us. This includes your account information, payment settings, assets under management, nominated bank account, unique identifiers, alerts, language set, contact and marketing preferences.

4.6. Transaction history and other reports

Events like contributions, transfers and withdrawals made on your account (including those via third parties such as Apple Pay and Google Pay).

4.7. Health and disability data

Data that you may provide to us relating to a disability or health issue(s) which is relevant to your use of our services or disclosed as part of the fact-find for the our restricted Financial Advice service. This might include the accessibility of our website or app or a change in your health status that impacts your use of our services.

4.8. Communications data

Records and results of any communications between you and us. This includes email, telephone, chat, Secure Messages, social media and letters. This might include open rates and dates/times, whether it was forwarded, and your interaction with the communication.

4.9. Device and technical data

Data such as unique device identifiers, IP addresses, device type and model, as well as operating system and version. This might also include network connection type, browser type, advertising ID and non-precise location data. We might infer that from other data such as IP address.

4.10. Biometric data

We create temporary facial recognition templates when we match your selfie to your photo ID as part of the identity verification stage of onboarding.

4.11. Location data

Your IP address and location data. This might include location data from your device if you allow location sharing in the app.

4.12. Usage data

Data generated from your website or in-app activity, such as what screens or product features you use and how long you spend using features within the app or on our site.

4.13. Cookies

We collect information from the devices you use to browse our website or app, and we may store information on your devices in the form of cookies. We use this information to:

• help maintain the security of J.P. Morgan Personal Investing services
• help ensure that our website and app communicate correctly with our other services
• remember your choices and settings
• collect and compile anonymous, aggregated information for statistical and evaluation purposes to help us understand how users use our services and help us improve those services
• provide you with a personalised web experience and more relevant ads.

Our Cookie policy is available in the legal section on our website and in our app.

4.14. Your feedback and opinions

If you choose to take part in our research initiatives, we will analyse your views and feedback to create insights that help us understand what people think about our brand and shape changes to our services and marketing campaigns.

5. Automated decisions

You can ask for information about any automated decision-making that has a legal or similarly significant effect on you. We’ll explain the logic involved, how we use the decision and any potential consequences. You can also object, give us extra information or ask us to review a decision. In certain circumstances you also have the right not to be subject to a decision based solely on automated processing.

5.1. Identity verification

We use automated processes to check your identity when you sign up. Where our process is not able to automatically confirm your identity, it will be reviewed by an agent. 

5.2. Onboarding fraud

When you open a J.P. Morgan Personal Investing account, we screen your personal details against fraud databases. The results could prevent you from using our products and services. Where our process identifies a positive fraud match, it will be reviewed by an agent.

5.3. Suitability

As a regulated investment manager, we are required to assess whether the investment products you are looking to take up are suitable for you and your tolerance for investment risk. Where our process identifies that investing might not be the best decision for you, we will be unable to offer you any J.P. Morgan Personal Investing product. If you would like to understand more about this decision, or you believe there has been an error, you will have the opportunity of discussing the suitability outcome with our Client Support Team.

6. How we use your data

These are several reasons we might use your data:

6.1. Client onboarding

To set up and provide your account and services, we collect personal information during the account opening process (via our website or mobile app) to confirm and verify your identity, meet regulatory compliance obligations including Know Your Customer (KYC) checks, and assess your tolerance to investment risk. We also authenticate your use of our services and screen against sanctions lists and other legal restrictions, and take other necessary steps to make our services available to you.

Data involved:

• Personal details and identifiers
• Biometric data
• Account information
• Authentication data
• Device and technical data
• Suitability and affordability information

Why we may need to use it:

• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us
• As part of our pre-checks as part of our onboarding process where we are entering into an agreement with you.

6.2. Providing you with client support and communicating with you

We record all interactions with our Client Support Team including, but not limited to, emails, phone calls, web chat and secure messages. We will also generate and keep a record of any regular or ad hoc statements and reports we produce for you.

Data involved:

• Personal details and Identifiers
• Authentication details
• Account data
• Transaction history and other reports
• Communication data

Why we may need to use it:

• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us
• As part of our pre-checks as part of our onboarding process where we are entering into an agreement with you.

6.3. Operating your account

On a day-to-day basis we process information necessary for us to operate your account, for your account to function correctly and to perform our contractual obligations. This can range from details required for us to trade your investments, to data necessary for our technology infrastructure to run. This information is usually generated automatically by your account and our systems or may be collected as a result of an interaction you have with our Client Support Team.

Data involved:

• Personal details and identifiers
• Authentication details
• Account information
• Communication data
• Suitability and affordability information

Why we may need to use it:

• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us
• As part of our pre-checks as part of our onboarding process where we are entering into an agreement with you
• If we have a legitimate interest in doing so to provide you with our services. That interest isn’t overridden by your interests or fundamental rights and freedoms.

6.4. Fraud prevention

This includes detecting, preventing and investigating fraud throughout our relationship with you.

Data involved:

• Personal details and identifiers
• Account information
• Transaction history
• Device and technical data
• Financial information

Why we may need to use it:

• If we have a legitimate interest in using your data to detect and protect against fraud. These interests aren’t overridden by your interests or fundamental rights and freedoms
• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us.

6.5. Providing you with J.P. Morgan Personal Investing Guidance Services and J.P. Morgan Personal Investing Restricted Advice

We may use the information you provide to deliver both our J.P. Morgan Personal Investing Guidance Services, which offer general product and service insights, and our J.P. Morgan Personal Investing Regulated Advice Service, which provides personalised financial recommendations.

J.P. Morgan Personal Investing Guidance Services:

Where you request or are offered this service, we provide guidance on our products and services. If you choose to engage with this service, we may process your data to tailor our guidance to your needs.

Data involved:

• Personal details and identifiers
• Financial information
• Account information
• Transaction history

Why we may need to use it:

• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us
• If we have a legitimate interest in using your data to provide you with our services. These interests aren’t overridden by your interests or fundamental rights and freedoms.

J.P. Morgan Personal Investing Regulated Advice service:

Where you have decided to take advantage of the J.P. Morgan Personal Investing Restricted Advice service and have engaged a J.P. Morgan Personal Investing Adviser, we will process your information, including your financial advice fact-find to provide you with our recommendation.

In addition to the information mentioned above the regulated advice service may also use the health and disability information you choose to share with us as part of our fact-finding exercise, and information on your suitability and affordability.

• Health and disability data – The information will only be used to understand your unique circumstances and ensure that the financial advice we provide is suitable and tailored to your financial needs.
• Suitability and affordability information.

Why we may need to use it:

• To meet a legal obligation or
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us.
• If we have obtained your prior consent. This legal basis is only used in relation to processing that is entirely voluntary.
• If we have a legitimate interest in using your data to provide you with our services. These interests aren’t overridden by your interests or fundamental rights and freedoms.

6.6. Self-Managed investing

This includes carrying out the investments you have instructed us to make on your behalf and fulfilling our regulatory compliance obligations related to record keeping and reporting to the relevant tax authorities. Your trading activity will also be monitored for the purpose of detecting any account misuse.

Data involved:

• Personal details and identifiers
• Account information
• Financial information

Why we may need to use it:

• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of you entering into a contract with us.

6.7. Facilitate your use of third-party services

With your permission, we may provide you with services which have access to your account information (like Open Banking).

Data involved:

• Personal details and identifiers
• Account data
• Transaction history

Why we may need to use it:

• When we have your consent to grant access
• If we have a legitimate interest in using your data to provide you with our services. These interests aren’t overridden by your interests or fundamental rights and freedoms.

6.8. Marketing

For contacting you about J.P. Morgan Personal Investing investment updates, new features, and offers. This might be via email, phone call, in-app notification or online through social media ads or ads we place on websites you visit. We use this information to understand how you interact with our app, our website, social media channels and our online ads through analysing activity and behaviour.

It also helps us to:

• Understand people who are interested in becoming clients
• Build our marketing campaigns and personal investing services
• Understand how you engage with our emails and the content we share via email.

We use information we hold about you to understand if you could be interested in communications about occasional offers or information from us about other J.P. Morgan Group products. You have a right to object to this use of your data if you disagree with our use of it for this purpose.

Data involved:

• Personal details and identifiers
• Device and technical data
• Usage data
• Account information

Why we may need to use it:

• If we have a legitimate interest in using your data for marketing and prospecting
• If we have your consent to market to you.

6.9. Personalisation of our Services

We may employ common tracking technology (like cookies and pixels) so we can understand how you interact with our website and app and to show you the content we think is most relevant.

Data involved:

• Usage data
• Identifiers
• Device and technical data

Why we may need to use it:

• If we have your prior consent
• If we have a legitimate interest in using your data to provide services to you.

6.10. To meet our financial operating standards

This includes internal and regulatory reporting and business oversight such as internal audits and to produce reports to analyse our performance and manage our finances.

Data involved:

• Account data
• Transaction history
• Communication data

Why we may need to use it:

• If we have a legitimate interest in using your data to manage and operate the financial affairs of our business. These interests aren’t overridden by your interests or fundamental rights and freedom
• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us.

6.11. Research

This includes asking for your views and opinions on our brand, on new J.P. Morgan Personal Investing products and services we’re considering developing, and how we are doing in relation to our existing products and your experience with us as a client. We will conduct our research directly with you or through a partnership with our research partners.

Data involved:

• Personal details and identifiers
• Usage data
• Communications data
• Your feedback or opinions
• Health and disability data

*Our research will only use the health information you choose to share with us as part of our surveys. We will analyse your views and feedback to create aggregated insights that help us understand what people think about our brand and make our product more accessible and inclusive.

Why we may need to use it:

• If we have your consent
• If we have a legitimate interest in using your data to conduct research and product analysis.

These legal bases are only used in relation to processing that is entirely voluntary – they are not used for processing that is necessary or obligatory in any way.

6.12. Security

This includes maintaining the security of our website and our app.

Data involved:

• Personal details and identifiers
• Usage data
• Device and technical data
• Location data

Why we may need to use it:

• To meet a legal obligation
• If we have a legitimate interest in using your data to ensure the physical and electronic security of our business, premises and assets. These interests aren’t overridden by your interests or fundamental rights and freedoms.

6.13. IT operations

This includes the management of our communications systems, operation of IT security and IT security audits.

Data involved:

• Communication data
• Device and technical data
• Personal details and identifiers
• Account data

Why we may need to use it:

• If we have a legitimate interest in using your data to securely run our IT and communications systems. These interests aren’t overridden by your interests or fundamental rights and freedoms
• To meet a legal obligation
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us.

6.14. Improving J.P. Morgan Personal Investing services and products

This includes understanding how you interact with and use our app, website and social media pages. It also includes understanding how you interact with our app or website and allows us to improve on what works, what doesn’t and build new J.P. Morgan Personal Investing Services for you. We may also receive information relating to you from third-party analytics providers.

Data involved:

• Personal details and identifiers
• Device and technical data
• Usage data

Why we may need to use it:

• If we have a legitimate interest in using your data to improve our services
• If we have your prior consent
• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us.

6.15. Investigations

This includes detecting, investigating and preventing breaches of policy, and criminal offences, in accordance with applicable law.

Data involved:

• Transaction history
• Usage data
• Social media and other public records and third-party data sources
• Financial information

Why we need to use it:

• To meet a legal obligation.
• If we have a legitimate interest in using your data to detect and protect against breaches of our policies and the law. These interests aren’t overridden by your interests or fundamental rights and freedoms.

6.16. Legal compliance and legal proceedings

For compliance with our legal and regulatory obligations under applicable law and for us to establish, exercise and defend our legal rights.

Data involved:

• Personal details and identifiers
• Account data
• Transaction history
• Financial information

Why we may need to use it:

• In connection with a contract you may enter into with us, including in preparation of your entering a contract with us
• To meet a legal obligation.

7. Sharing personal information with third parties

We will disclose your data to certain third parties from time to time.

7.1.   Members of the J.P. Morgan Group

• If you are an existing or a prospective customer of J.P. Morgan Personal Investing (where you have started but not completed your application), we share some of your information with other members of the J.P. Morgan Group to comply with our KYC and anti-money laundering obligations.
• If you are an existing customer of both J.P. Morgan Personal Investing and Chase UK, we share some of your information, to facilitate account linking through the Chase UK App and to support your use of J.P. Morgan Personal Investing, or because you asked us to.
• If you have opted into marketing messaging across both J.P. Morgan Personal Investing and Chase UK, we share some of your data to market to you through various channels such as email and calls.

7.2. Banks and payment providers

To process payments from or to your account.

7.3. Open Banking providers

If you authorise them, we’ll share data about your account so their services work for you.

7.4. Service providers

So they can help us provide you with J.P. Morgan Personal Investing services. Examples include vendors who host our database, or vendors who assist us with our marketing efforts.

7.5. Social and search advert platforms and advertising partners

We advertise our services on social media, search platforms and with advertising partners. These campaigns sometimes require sharing personal data.

The data we share is limited to:

• Your email address
• Your device ID

We protect your data using a technical process called “hashing” when we transfer data to an ad platform.

Your data is used to check if you have an account with our search and social advertising platforms or advertising partners when we place adverts. If you don’t have an account, your data is deleted immediately. If you do, we will ask the social or search ad platform to take one of the following actions:

• You will be served a J.P. Morgan Personal Investing ad where we think you could be interested
• We ask our social media and advertising partners to show our adverts to people who, like you, are interested in investment services
• You are excluded from our online marketing campaigns because you already use the services we are advertising
• We advertise J.P. Morgan Personal Investing services with our advertising partners and ad platforms without sharing personal data. Here our ads will be displayed on websites and in response to search requests where people are looking for investment services or tax wrappers.

7.6.  Courts Service

We may be required to share your data in relation to a legal filing or claim in the exercise or defence of legal rights or obligations.

7.7.  Government bodies, agencies, regulators and authorities

We can be asked to share your data with these bodies on a regular or ad hoc basis. Examples include the UK Financial Conduct Authority and HM Revenue and Customs.

If you’re a tax resident of a country other than the UK, we may be required to share information about you and your accounts with the relevant tax authorities. The obligations can ask for us to share this information directly, or through the local tax authority. The relevant tax authorities can share that information with other appropriate tax authorities or government bodies. We may ask you to provide us with extra information or to fill in tax forms to help us with this.

7.8. Fraud prevention agencies

To prevent fraud and money laundering.

7.9. Law enforcement and fraud detection agencies

To help with the detection, prevention and investigation and prosecution of criminal activities, including fraud and money laundering.

7.10. Professional advisers

So they can provide services to us. This includes accountants, financial advisers, lawyers and other outside professional advisors.

7.11. Purchasers or assignees of our business

If our business, or part of it, is sold or reorganised.

If you want to know more about any of these third parties, please get in touch.

7.12. The law firm Hugh James
We provide links to Hugh James' wills and lasting power of attorney (LPA) services in our app and client website and may also provide links by email. However we don’t share any of your personal data with Hugh James.

8. Third parties we receive your data from

We may receive certain data about you from various third parties from time to time, including:

• Members of the J.P. Morgan Group
• Fraud prevention agencies/Financial crime agencies
• Open Banking vendors
• Central and local government
• Research and advertising agencies and data marketplaces

9. Third party data: fraud prevention

We share data with search databases or receive data from fraud prevention and credit reference agencies, as part of our client onboarding process and during your relationship with us as a client.

10. International data transfers

J.P. Morgan Personal Investing is part of the J.P. Morgan Group which uses shared technology. We also have governance and reporting obligations to the wider group. As a result, we will transfer your data within the J.P. Morgan group, and to third parties as set out above.

For this reason, we will transfer your data to other countries outside of the UK that may have different laws and data protection compliance requirements, including data protection laws of a lower standard to those enacted in the UK. These transfers will only take place for the purposes outlined in this policy.

Where we transfer your data to other countries outside of the UK, we will do so on the basis of:

• Adequacy decisions, where a country has been deemed to provide adequate protections to individuals
• Binding Corporate Rules when transfers occur within the J.P. Morgan Group;
• Standard contractual clauses
• Other valid transfer mechanisms or derogations.

To receive more information about the safeguards that we apply to international transfers of your data, please get in touch.

11. Other information

This is any information that does not reveal your specific identity or relate to anyone identifiable:

• Browser and device information
• App usage data
• Information collected through cookies, pixel tags and other technologies
• Demographic information and other information provided by you that does not reveal your specific identity
• Information that has been aggregated in a manner such that it no longer reveals your specific identity

Sometimes this other information is associated to you or combined with your personal data. When this happens, it becomes personal data. If that happens, we treat it as personal data. We will treat it as personal data as long as it is combined and identifies you.

12. Data security

We have a global security program designed and implemented through our policies, guidelines and controls to protect your data from misuse or accidental, unlawful or unauthorised destruction, loss, alteration, disclosure, acquisition or access.

Our people can only access as little of your data as they absolutely must. Anyone who can access your data must keep it confidential and only use it for the shortest period required.

13. Data accuracy

We take reasonable steps designed to ensure that any data that we process are accurate and, where necessary, kept up-to-date. We also take reasonable steps to ensure that any of your data that we process that is inaccurate are erased or rectified without delay. From time to time, we may ask you to confirm the accuracy of your data.

14. Data minimisation

We take reasonable steps designed to ensure that your data that we process is limited to the data reasonably required in connection with the purposes set out in this notice.

15.  Data retention

We will retain your data in line with our data retention policy and for the minimum period required. The duration of the retention period is determined by a number of criteria including the nature of our relationship with you, UK law, the type of data and the J.P. Morgan Personal Investing services that the data relates to. Once we no longer need to retain your data in a form that identifies you, we will either permanently delete or destroy it, archive and secure it so that it is beyond practical use; or anonymise it.

16. Updates to this policy

We will update this policy from time to time for example when we change the data we collect or the ways in which we process it.

17. Contact details

If you have any comments, questions or concerns about how we process your data, then please contact our privacy team at privacy.team@personalinvesting.jpmorgan.com or via post at J.P. Morgan Personal Investing, 25 Bank Street, Canary Wharf, London, E14 5JP, UK.

You can contact our Data Protection Officer at EMEA.Privacy.Office@jpmchase.com or via post at J.P. Morgan Personal Investing, 25 Bank Street, Canary Wharf, London, E14 5JP, UK.