Privacy Policy

1. Introduction

This Privacy Notice explains how Monex group ("Monex", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal data in connection with its business activities. This Notice applies to individuals who interact with Monex, including clients, prospective clients, beneficial owners, authorized representatives, website users, and business contacts. Monex is committed to processing personal data in accordance with applicable data protection laws and regulations in the jurisdictions in which it operates. This Privacy Notice provides a high-level overview of how personal data is processed across the Monex group. Each Monex entity maintains its own local privacy notice, which contains more specific information about the processing of personal data in accordance with applicable local data protection laws and regulations. In the event of any inconsistency between this Privacy Notice and a local privacy notice, the local privacy notice shall prevail to the extent required by applicable law.

This Privacy Notice is designed to meet the transparency requirements of the EU General Data Protection Regulation (EU GDPR) and the UK GDPR, while remaining applicable to the processing of personal data in all jurisdictions in which Monex operates. Where local data protection laws require additional or different information, that information is provided in the relevant local privacy notice, which can be found on our website. Monex’s products and services are directed to businesses and to individuals acting in a business capacity, and are not intended for children; Monex does not knowingly collect personal data relating to children.

2. Data Controller

The relevant Monex entity with which you have a relationship will act as the data controller in respect of your personal data. MonexGlobal.com is operated as a global informational website by the Monex group. The provision of products or services is carried out solely by the relevant Monex entity, subject to local regulation. Monex operates through a group of affiliated entities across multiple jurisdictions, including the United States, United Kingdom, European Economic Area, and Mexico. Where necessary for the provision of services, personal data may be shared between Monex group entities acting as independent or joint controllers, as applicable. Where Monex entities act as joint controllers, they have entered into arrangements to determine their respective responsibilities for compliance with applicable data protection laws, in accordance with relevant legal requirements. Details of the relevant Data Controller are available in the regional legal section of this website.

Where the processing of your personal data is subject to the EU GDPR or the UK GDPR, Monex has appointed a representative in accordance with Article 27. The Data Protection Officer can be reached at privacy@monexglobal.com.

3. Categories of Personal Data

Monex may collect and process personal data obtained directly from you, from third parties, or from publicly available sources. Such data may include identification and verification information, contact details, financial and transactional data, and information relating to your business activities or relationship with Monex. In addition, Monex processes technical data relating to your use of its websites and platforms, including device identifiers, IP address, and usage information. Monex also processes information required for compliance purposes, including documentation and data necessary to meet anti-money laundering, counter-terrorist financing, sanctions, fraud prevention, and other regulatory requirements.

In limited circumstances, and only where permitted by applicable law, Monex may process special categories of personal data (for example, biometric data used for identity verification) and personal data relating to criminal convictions, offences or alleged offences (for example, information obtained through sanctions, politically exposed person (PEP), adverse-media and fraud-prevention screening). Where the EU GDPR or UK GDPR applies, Monex processes such data only where an additional lawful condition is met, including where processing is necessary for reasons of substantial public interest (such as the prevention and detection of money laundering, terrorist financing, fraud and other financial crime), for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.

Where Monex obtains personal data from sources other than you directly, those sources may include other Monex group entities, your employer or the organisation you represent, banks and other financial institutions, credit reference and fraud-prevention agencies, sanctions and PEP screening providers, identity-verification providers, public registers and competent authorities, and other publicly available sources.

4. Purposes of Processing

Monex processes personal data for the purposes of entering into and performing contracts, including the provision of foreign exchange, international payment, and related financial services. Personal data is also processed to comply with applicable legal and regulatory obligations, including know-your-customer requirements, anti-money laundering and sanctions screening, transaction monitoring, and regulatory reporting. In addition, Monex processes personal data for the purposes of risk management, including the prevention and detection of fraud and financial crime, credit risk assessment, and internal controls. Personal data may also be processed for internal business purposes, including audit, reporting, analytics, system administration, and the development and improvement of services. Where permitted by law, Monex may process personal data to communicate with you regarding products, services, and insights that may be of interest. Monex may use artificial intelligence and machine learning tools to support these purposes, as described in section 12.

The legal bases on which Monex relies for each of these purposes are described in Section 5. Where Monex relies on legitimate interests, those interests include operating, securing, growing and improving its business and systems, managing financial and operational risk, preventing and detecting fraud and financial crime, and keeping clients and business contacts informed about products and services relevant to them. Direct marketing is carried out only where permitted by applicable law, and you may object to it or withdraw your consent at any time.

5. Legal Basis for Processing

Where applicable under relevant data protection laws, Monex relies on one or more of the following legal bases for processing personal data:

• the necessity of processing for the performance of a contract or in order to take steps prior to entering into a contract;
• compliance with legal and regulatory obligations to which Monex is subject;
• the legitimate interests pursued by Monex or a third party, including the operation, security, and improvement of its business, except where such interests are overridden by your rights and interests;
• your consent, where required by applicable law.
• where Monex processes special categories of personal data or criminal offence data, the additional lawful conditions described in Section 3 (including processing necessary for reasons of substantial public interest, compliance with a legal obligation, or the establishment, exercise or defence of legal claims).

Where Monex is required by law, or by the terms of a contract with you, to collect personal data, or where the data is necessary in order to enter into or perform a contract, your failure to provide that data may mean that Monex is unable to open or maintain your account, provide the relevant products or services, or meet its legal and regulatory obligations.

6. Disclosure of Personal Data

Personal data may be disclosed to other entities within the Monex group where necessary for the provision of services, internal administration, and compliance with regulatory requirements. Monex may also disclose personal data to third parties, including financial institutions, payment service providers, technology and infrastructure providers (including providers of artificial intelligence and machine learning services), identity verification and compliance service providers, and professional advisors. In addition, Monex may disclose personal data to competent authorities, regulators, courts, and law enforcement agencies where required or permitted by law. All disclosures are subject to appropriate contractual, legal, and security safeguards.

Personal data may also be disclosed in connection with a corporate transaction, such as a merger, acquisition, reorganisation, financing or sale of all or part of the business, subject to appropriate confidentiality and data protection safeguards.

7. International Transfers

Given the global nature of Monex's operations, personal data may be transferred to and processed in jurisdictions outside the country in which it was originally collected. Where such transfers occur, Monex ensures that appropriate safeguards are implemented in accordance with applicable data protection laws. These safeguards may include the use of standard contractual clauses or other approved transfer mechanisms, as well as ensuring that recipients are subject to equivalent data protection obligations.

Where the EU GDPR or UK GDPR applies, these mechanisms include transfers to countries covered by an adequacy decision, the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Agreement or Addendum, supplemented by additional measures where necessary. You may request further information about the safeguards that apply to transfers of your personal data, or a copy of them, using the contact details in Section 13.

8. Data Retention

Monex retains personal data for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting, and reporting requirements. Retention periods are determined based on the nature of the data, the purposes of processing, and applicable legal obligations. In certain circumstances, data may be retained for longer periods where required for the establishment, exercise, or defense of legal claims.

9. Data Subject Rights

Subject to applicable law, you may have rights in relation to your personal data, including the right to request access, rectification, erasure, restriction of processing, and, where applicable, data portability. You may also have the right to object to certain types of processing, including processing based on legitimate interests or for direct marketing purposes. Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal. Requests to exercise these rights may be submitted using the contact details set out below. Where applicable, you may also lodge a complaint with your local data protection supervisory authority. Where applicable, you may also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Monex will respond to requests within the period required by applicable law (under the EU GDPR and UK GDPR, generally within one month, which may be extended for complex requests). Rights may be exercised free of charge, save where applicable law permits a fee, and Monex may need to verify your identity before acting on a request. In some cases Monex may be unable to give full effect to a right where an exemption or legal obligation applies, in which case it will explain the reason.

Monex does not generally make decisions that produce legal or similarly significant effects concerning you based solely on automated processing. Where it does so, for example, automated sanctions, fraud-prevention or transaction-monitoring checks that may result in a payment or application being delayed, declined or referred for review, it does so only where permitted by applicable law and applies suitable safeguards, and you may request human intervention, express your point of view and contest the decision. You may also request information about the decision and the reasons for it.

10. Data Security

Monex implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures designed to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. Such measures include access controls, encryption, system monitoring, and regular assessments of security practices.

11. Cookies and Online Data

Monex uses cookies and similar technologies on its websites and digital platforms to ensure functionality, enhance user experience, and analyze usage. Further information is available in the relevant cookie notice.

12. Use of Artificial Intelligence

Monex uses artificial intelligence and machine learning tools, including third-party generative AI assistants to support its business activities. These tools may be used to assist with tasks such as drafting and reviewing documents, summarising information, analysing data, responding to enquiries, and supporting compliance, risk management and client service processes. Where personal data is processed using such tools, it is processed for the purposes and on the legal bases set out in sections 4 and 5 of this Notice.

Monex applies internal governance controls to its use of these tools. Its policies permit personal data to be input only into tools that Monex has approved for that purpose and that are subject to contractual terms governing the provider's use of the data. Monex requires such providers not to use personal data disclosed to them to train their models, to process it only in accordance with Monex's instructions, and to delete or return it in accordance with agreed retention periods.

Artificial intelligence tools are used to assist Monex's personnel rather than to replace their judgment, and the output of such tools is subject to human review before it is relied upon. Where a decision affecting you is taken solely by automated means, section 9 explains the circumstances in which that occurs, the safeguards that apply and the rights available to you, including the right to request human intervention, to express your point of view and to contest the decision.

Where applicable law requires it, including the EU Artificial Intelligence Act in respect of Monex entities established in the European Union, Monex will make clear where you are interacting directly with an artificial intelligence system rather than with a member of its personnel, and will identify content generated by artificial intelligence where identification is required.

13. Updates to this Notice

This Privacy Notice may be updated from time to time to reflect changes in legal requirements or Monex's data processing practices. The updated version will be made available on Monex's website.

Where required by applicable law, Monex will take additional steps to notify you of material changes to this Privacy Notice. Monex encourages you to review this Privacy Notice periodically.

14. Contact Details

Questions, requests, or concerns regarding this Privacy Notice or the processing of personal data may be directed to: Monex – Data Protection Office - privacy@monexglobal.com.

Alternatively, you may contact the relevant Monex entity with which you have a relationship. Further details regarding the relevant Monex entity acting as data controller are available in the regional "Compliance & Legal" section of this website.

If your query relates to the EU GDPR or UK GDPR, you may also contact our Article 27 representatives or our Data Protection Officer using the contact details on the website

15. Complaints

If you consider that the processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority in your jurisdiction.Monex encourages you to contact us first so that we have the opportunity to address your concerns.