Privacy Notice

• Controller : Sonali Bangladesh (UK) Limited (SBUK)
• Registered Office : 29–33 Osborn Street, London, E1 6TD
• ICO Number : Z6225251
• Telephone : +44 (0)20 7877 8200
• Email (privacy) : privacy@sonalibank.co.uk

SBUK is the controller for the processing activities described in this notice. Certain services or correspondent banking activities may have their own supplementary privacy notices.

If you have any questions about this notice or wish to exercise your rights, please contact us using the details above. You also have the right to complain to the Information Commissioner’s Office (ICO) (see Section 17).

We collect limited personal data relating to individuals connected with our corporate clients, service providers, and counterparties, such as company directors, beneficial owners, authorised signatories, or employees of suppliers.

We collect data :

• Directly from you or your organisation – through onboarding forms, correspondence, or meetings.
• From third parties – such as credit reference agencies, regulatory databases, sanctions screening providers, fraud -prevention agencies, and publicly available sources (e.g., Companies House, World-Check, or professional directories).
• Automatically – when users visit our website or access secure portals (see Cookies, Section 7).

Retention : SBUK retains records in accordance with its Records Retention Policy, normally five to six years after the end of a business relationship, or longer where required by law, regulation, or for legitimate record-keeping purposes.

We process personal data for the following purposes, relying on one or more lawful bases under UK GDPR :

• Provide and manage services – including onboarding, servicing, and responding to queries or complaints.


  Lawful bases : Contract; Legitimate interests.

• Identity verification, sanctions screening, AML/CTF checks, fraud prevention, and regulatory reporting.


  Lawful bases : Legal obligation; Public interest; Legitimate interests.

• Creditworthiness and due diligence checks (where applicable).


  Lawful bases : Legitimate interests; Contract.

• Customer service, quality assurance, and training (including call recording).


  Lawful bases : Legitimate interests; Legal obligation (where applicable).

• Debt recovery and enforcement of our rights.


  Lawful bases : Contract; Legitimate interests.

• Operational administration, IT security, business continuity, and record keeping.


  Lawful bases : Legal obligation; Legitimate interests.

• Marketing and business communications – limited to corporate or professional contacts and subject to your communication preferences.

  Lawful bases : Legitimate interests for post/phone; Consent for electronic direct marketing where required by law.

• Compliance with legal and regulatory requirements – including court orders, requests from regulators, or law enforcement authorities.

  Lawful bases : Legal obligation; Public interest; Legitimate interests.

Where we rely on legitimate interests, we do so only after carefully balancing our interests against the rights and freedoms of the individuals whose data we process.

SBUK processes such data only where required by law or for specific regulatory reasons (for example, politically exposed person (PEP) checks or adverse media screening) and always in accordance with the UK GDPR and Data Protection Act 2018.

If you provide information about another individual (such as a director, authorised signatory, or beneficial owner), you must ensure they are aware of this notice and the basis on which their information is provided.

SBUK may disclose information to UK and overseas regulators, law enforcement, tax authorities, and fraud-prevention agencies, as permitted or required by law. Such disclosures may involve ongoing monitoring and screening.

Our website uses cookies and similar tools to enable essential site functions, remember preferences, analyse performance, and enhance security. You can control cookie settings through our website banner or your browser. For details, see our Cookies Notice below.

We rely on our business partners to keep us informed of any relevant changes to authorised personnel or contact details.

Individuals whose personal data we process have the following rights under UK GDPR: -

• Access – to request a copy of personal data held about them.
• Rectification – to correct inaccurate or incomplete data.
• Erasure – to request deletion of personal data where applicable.
• Restriction – to limit processing in certain circumstances.
• Objection – to object to processing, including for direct marketing.
• Data portability – to receive their data in a structured, commonly used format.

Requests can be made using the contact details in Section 1. We will respond within statutory timeframes. You also have the right to lodge a complaint with the ICO (Section 17).

We will only use personal data for new or additional purposes where they are compatible with the original purpose, where you have been informed, or where permitted by law.

We may share data with : -

• Service providers – including IT, cloud hosting, communications, scanning, and compliance systems.
• Professional advisers, auditors, and insurers.
• Correspondent banks, payment service providers, and clearing institutions – for transaction processing.
• Regulators, law enforcement, and government bodies – where required by law or regulation.
• Business partners and suppliers – engaged to provide services on our behalf under strict contractual terms.

All third parties are required to implement appropriate security measures and act only on our instructions.

When personal data must be transferred outside the UK (or the EEA where applicable), we ensure appropriate safeguards such as: - UK adequacy regulations;

• International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses (SCCs); or
• Other lawful transfer mechanisms recognised by UK GDPR.

You may request a copy of the relevant safeguards by contacting us.

SBUK does not make decisions based solely on automated processing that produce legal or significant effects on individuals.

We use information to detect and prevent fraud, money laundering, and other financial crimes, including: - Transaction monitoring;

• Sanctions and politically exposed person (PEP) screening; and
• Suspicious activity reporting to relevant authorities.

We may record telephone calls, emails, or other communications for : - Quality assurance;

• Training and monitoring; and
• Security purposes.

CCTV operates at our premises for safety and crime prevention, in accordance with signage and policy.

If you are dissatisfied with our handling of personal data, please contact us first so that we can try to resolve your concern.

You may also complain to the Information Commissioner’s Office (ICO) : -

• Website : ico.org.uk
• Address : Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone : +44 (0)303 123 1113

CCTV operates at our premises for safety and crime prevention, in accordance with signage and policy.

If you engage with SBUK via social media, please remember that such platforms are public. We may monitor publicly available mentions of SBUK for customer service or reputation management purposes.