In short
TradeOrigin is a platform where corporates and banks raise, price and execute trade finance transactions. To do that we hold information about the organisations using it, the people who act for them, and the trade documents behind each deal.
Three things are worth knowing before the detail. Trade data is shared deliberately — a deal only works if the counterparties on it can see what they need to price and settle it. Bidding is not — no bank sees another bank's pricing. And we do not sell personal data, ever, nor use your documents to advertise to you.
This policy sits alongside the terms and conditions and the trust center, which covers the security controls behind it.
Who is responsible
The organisation that decides how and why your data is used, and how to reach it.
The controller
The contracting entity is [legal entity name], registered at [registered address]. Where your own institution is our customer, that institution is the controller for the personal data of its own staff and counterparties, and we act on its instructions for that data.
Reaching us about privacy
Write to support@tradeorigin.com, marked for the attention of [privacy contact or DPO]. Security issues have their own route on the trust center.
Which law applies
This policy is governed by [governing law], and you may complain to [supervisory authority]. Where other data protection laws apply to you because of where you are, we will honour the rights they give you.
What we collect
Four kinds of information, collected for four different reasons.
Onboarding and account data
Organisation type (bank or corporate), company or bank name, country, city, address, and the name, email address and phone number of your point of contact. This is what you give us when you enquire, register or are invited into a program.
Identity and compliance data
KYC documentation and the verification records created when we onboard your organisation, including one-time codes used to verify contact details, and the results of sanctions screening carried out on counterparties and countries as part of raising a deal.
Transaction and document data
Everything a deal carries: letters of credit and their amendments, invoices, transport and insurance documents, purchase orders, acceptance letters, bills of exchange, limits, bids, counter-bids, acceptances, signatures and the audit trail of who did what and when. Documents may contain personal data about your staff or your counterparties’ staff.
Technical and usage data
Sign-in events and multi-factor authentication status, session cookies, IP address, device and browser information, and diagnostic data captured when something goes wrong. Where you have enabled them, device tokens used to send you notifications.
Why we use it, and on what basis
Each use has a purpose and a lawful basis behind it. If a basis falls away, so does the use.
To run the platform
Creating accounts, authenticating people, routing a requirement to the right counterparties, carrying documents on a deal, and keeping the record of what happened. Basis: performance of our contract with your organisation, and our legitimate interest in operating the service.
To meet compliance obligations
KYC, sanctions screening, and the record-keeping that trade finance and financial crime rules require of us and of the banks on the platform. Basis: legal obligation, and legitimate interest in preventing financial crime.
To keep the platform secure
Multi-factor authentication, bot protection on sign-in and registration, audit logging, error monitoring and incident investigation. Basis: legitimate interest in protecting the service and the people using it.
To improve it and support you
Diagnosing faults, answering support requests, and understanding which parts of the product are used so we can make them better. Basis: legitimate interest, and consent where the law requires it.
To tell you about the product
Responding to your enquiry, and — where you have asked for it or where the law allows it for existing business contacts — sending you product information. You can stop this at any time and it will not affect the service. Basis: consent, or legitimate interest.
Who else sees it
Trade finance is a multi-party business, so some sharing is the product working as intended. The rest is a short list of processors.
Counterparties on your deals
This is the important one. A bank you invite to bid sees the requirement and the documents that deal exposes to it. A supplier or buyer inside a program sees its own transactions. Bids are sealed: no bank sees another bank’s pricing, on any product. Nobody sees a deal they are not a party to.
Service providers we use to run the platform
Cloud hosting and storage; an AI provider that extracts data from documents you upload, assists requests by voice and screens sanctions exposure; error monitoring; push notification delivery; and bot protection on sign-in. They act on our instructions, under contract, and may not use your data for their own purposes. The current list, with hosting regions, is in the diligence pack — ask and we will send it.
Professional advisers and authorities
Auditors, lawyers and insurers where they need it, and regulators, courts or law enforcement where we are legally required to disclose. We will tell you when we are permitted to.
On a change of business
If the business is sold or reorganised, data may transfer with it, subject to this policy and to whatever your contract with us says.
Never for sale
We do not sell personal data, we do not rent it, and we do not use the contents of your trade documents to target advertising at you or at anyone else.
Where it goes, and how long we keep it
Cross-border trade means cross-border data. Both questions have contractual answers.
International transfers
The platform serves counterparties in different countries, so data may be processed outside the country it came from — including by the service providers above. Where that happens we rely on the transfer mechanisms available under the applicable law and on contractual protections with each provider. If your regulator constrains where data may sit, raise it before onboarding.
How long we keep it
Account and transaction records are kept for the life of the relationship and then for [retention period], which is driven by the record-keeping obligations that apply to trade finance and anti-money-laundering. KYC records are kept for [KYC retention period]. Diagnostic data is kept for [technical retention period]. Specific periods are set out in the contract.
Deletion and export
You can ask for an export of your data or for it to be deleted. We will do so unless we are required to keep it — a settled transaction and its audit trail generally cannot be deleted on request, because both sides and their regulators rely on it.
Your rights
What you can ask us to do, and how quickly we will do it.
Access, correction and deletion
You can ask what we hold about you, ask us to correct it if it is wrong, and ask us to delete it where we are not required to keep it.
Objection and restriction
You can object to processing we carry out on the basis of legitimate interests, and ask us to restrict processing while a question is being resolved.
Portability
Where the law provides it, you can ask for the personal data you gave us in a portable form.
Withdrawing consent
Where we rely on consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
Making a request
Write to support@tradeorigin.com. We will verify who you are before acting — that check protects you — and respond within the period the applicable law allows. If you are unhappy with the outcome you can complain to [supervisory authority].
If your employer is our customer
Where your organisation is our customer, some requests are for it to answer rather than us. We will tell you promptly and, where appropriate, pass the request on.
Cookies
A short list, because there is a short list.
Keeping you signed in
A session cookie the browser cannot read from script, restricted to same-site use, signed so it cannot be edited and tied to the token it was issued with. It expires after eight hours. Without it you cannot stay signed in.
Remembering how you use the platform
A small cookie recording whether you are acting as a bank or a corporate, so the right interface loads.
Keeping bots out
Our bot-protection provider sets what it needs to tell a person from a script during sign-in and registration.
What we do not do
We do not use advertising cookies and we do not track you across other websites.
A few more things
Security
The controls protecting this data — certification, access control, encryption in transit, incident response — are set out in the trust center.
Not a service for children
TradeOrigin is a business platform. It is not directed at children and we do not knowingly collect their data.
Automated decisions
AI is used to read documents, assist requests and screen sanctions exposure. It supports the people making decisions; it does not replace a bank’s credit or compliance decision, and no financing decision is made about you solely by automated means.
Changes to this policy
If we change it materially we will say so on this page and, where it matters, tell you directly. The date at the top always shows when it last changed.
Questions about your data?
Ask us. If you are doing a privacy review for your institution, say so and we will send the diligence pack rather than making you assemble it from this page.