Privacy Notice

Effective 26 Oct 2026. Version 2.0.

This notice explains how DOS & Co. Ltd. collects, uses, shares and keeps personal information, and the rights you have over it. It applies to everyone we deal with: our clients and the people connected to them, the people who pay or are paid through accounts we run, advisors who work with us, visitors to our websites, people who ask about our services, and anyone who calls or writes to us.

We use cookies and similar technologies on our websites and in our emails. Our cookie notice explains them. If you use one of our services through an AI assistant, our AI assistant connector notice adds to this notice for what happens through the assistant.

1. This Notice at a Glance

2. Who We Are

DOS & Co. Ltd. is the controller of your personal information. We are a company registered in England and Wales (number 08294966), with our registered office at 3rd Floor, Great Titchfield House, 14-18 Great Titchfield Street, London, W1W 8BD, United Kingdom. We are Authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 for the provision of payment services (firm reference number 1041318).

We trade under these names, and this notice applies whichever of them you deal with: DOS & Co., dospay, Cash Deposit Manager, Estate Account Service, UK Retention Deposit Scheme and UK Security for Expenses Scheme.

We are registered with the Information Commissioner's Office under number ZA798639.

Our data protection officer can be contacted at privacy@dos.co, or by post at SB.149 China Works, 100 Black Prince Road, London SE1 7SJ, marked for the attention of the Data Protection Officer.

3. Clients and the People Connected to Them

This section covers our clients, and the people connected to a client: directors, partners, trustees, beneficial owners, signatories, members, people who hold a mandate, and other people named in an application or account.

What we collect.

• Identity: name, date of birth, nationality, address history, and identity documents and their details.
• Contact: email address, telephone numbers and postal address.
• Verification: the results of identity checks, a photograph of you taken during the check, and the images of your identity document (see section 7).
• Screening: the results of checks against sanctions lists, lists of politically exposed persons and adverse media, including reports of alleged offences (see section 7).
• Financial: bank details, source of funds and source of wealth, company and credit information, property and title information, and charity register information.
• Transactions: payments into and out of accounts we run, statements, payment instructions and approvals, and the results of payee checks.
• Account use: how you use our client portal, including the devices you sign in from, the approximate location of each sign-in, how you signed in, and a profile photograph if you choose to add one.
• Derived: the risk rating we give a client, alerts raised by our monitoring, and the notes and decisions of our compliance team.

Where it comes from. From you; from the client or organisation you are connected to; from your professional advisor; from identity-verification, screening, credit and company-information providers; from public registers such as Companies House, HM Land Registry and the Charity Commission; from banks and payment systems; and from public sources such as news media.

Records naming children. Our services are for adults and organisations. Some records name a child, for example a beneficiary of an estate. Where that happens, the information comes from the adult or organisation we act for, and we use it only for that account.

4. People Who Pay or Are Paid, and Advisors

Payers and payees. When money is paid into or out of an account we run, we receive and record the name and bank details of the person paying or being paid, and we check them against sanctions and other lists. We may not contact you directly; this notice is published so that you can see how we handle your information.

Your professional advisor. If you have engaged a professional advisor, for example an accountant, solicitor, trustee or broker, and instructed us to work with them, we can give that firm controlled access to information about your accounts with us through a secure workspace. We only do this where you have appointed the firm to act for you, and only to the extent needed for the firm to carry out that engagement.

What the firm can see is set by us for each engagement and may include: the name and status of the linked account, its balance, statements and account documents, and your name or reference.

Where you have appointed a firm to arrange payments into your account with us (settlement or completion funds, for example) and we have enabled this for the engagement, verified members of that firm can also view the sort code and account number of the accounts we have linked to that engagement (and, where we have enabled it for payments from abroad, an account's IBAN): the details used to pay money in. Before those details are shown, the member must individually confirm their identity again at that moment; every viewing is recorded in an audit log that we and the firm's administrators can inspect; and we limit how often the firm can view these details and investigate unusual patterns. These details only allow money to be paid into your account with us. The firm is never shown the details of your own bank account elsewhere (the account you use to receive money from us), and cannot change where money is paid to you. The firm cannot see any account we have not linked to the engagement.

We share this information to perform our contract with you and to give effect to your instruction appointing the firm. Where the firm asks us to take an action on your account, your own approval remains required unless you have given the firm a written mandate to act alone, and even then we apply the limits agreed in that mandate.

Every firm we work with must accept our intermediary terms and a data-processing agreement as a condition of its engagement, and must complete our verification checks before it can ask us to take any action. Individual members of the firm must verify using their firm email address to sign in, and re-verify regularly. What a firm does in its workspace (signing in, downloading documents, making administrative changes) is recorded in a tamper-evident audit log; documents a firm downloads are watermarked with the firm's name, the individual who took the copy and the time. We limit the volume of requests a firm can make, and we can suspend a firm's access at any time.

You can ask us what we share with a firm acting for you, ask us to end a firm's access to your information, or raise a concern, using the contact details in section 17. Ending a firm's access does not affect your own access to your accounts.

Members of advisor firms. If you work for a firm with a workspace, we hold your name, work email address, your sign-ins and verifications, and a record of what you do in the workspace.

5. Website Visitors and People Interested in Our Services

Reading our legal notices. You can read every one of our legal notices in full on our websites without telling us anything about yourself. We ask for an email address only when you want a PDF copy, so that we can tell you if that document changes. We record which document and version you took, when, and how you read it.

Enquiries and forms. When you ask for a quote, request a callback, fill in a form or join a waitlist, we hold what you tell us: usually your name, contact details, your organisation, and details of what you need. We also record how you found us, including the advertising campaign or link you arrived from.

How you use our websites and emails. We collect information about how you use our websites and the emails we send you. This includes your device and browser, the pages you visit, where you came from, and which emails you open and links you click. We use it to run and improve our websites, to understand interest in our services and which organisations it comes from, and to measure our advertising. Our cookie notice sets out each technology we use and the choices you have.

Our contact list. We keep a record of people we have dealt with or who have shown an interest in our services, with notes of our conversations and correspondence. Some of this comes from introducers, business contacts and public sources.

6. Callers and Correspondents

Calls. Calls to and from us may be recorded. We transcribe recordings and analyse them with automated tools, including AI, for these purposes: to check the quality of our service; to identify complaints; to identify signs that a caller needs extra support, which can include information about their health; to detect financial crime; and to train our staff. We remove bank details from transcripts before any AI analysis.

Email and meetings. Emails to our staff, and the calendar entries and contact details that come with them, are stored in our systems.

7. Sensitive Information

Identity checks with a photograph. To verify your identity, we use an identity-verification provider, Credas, which acts on our instructions. You take a photograph of yourself and of your identity document on Credas's secure page, and we compare the two through Credas to confirm that the document is yours and that you are present. We keep the result, the images of your document and your photograph as evidence of the check.

This check is a legal requirement for opening and keeping an account with us. When you start it, we ask you to confirm that you agree to it; that confirmation records that you understand what the check involves, and is not the only basis on which we rely. Where our handling of this information is biometric data, we rely on the substantial public interest in complying with regulatory requirements to establish whether someone has committed an unlawful act or been dishonest, and, in the alternative, in preventing and detecting unlawful acts.

Information about offences. Screening can return reports that a person has been accused, charged or convicted of an offence. We use this only to meet our legal obligations and to prevent financial crime, relying on the same substantial public interest conditions.

Information about health. Where a call or conversation tells us, or our analysis indicates, that someone needs extra support, this can include information about their health. We use it to protect the economic well-being of people at risk and to safeguard people at risk of harm, so that we can treat them fairly and offer suitable support.

We keep an appropriate policy document explaining how we handle sensitive information and how long we keep it.

8. Automated Decisions and Profiling

Temporary holds on accounts. Our monitoring applies rules to payments. Some rules can place a temporary hold on an account automatically when they are triggered, before a member of staff has reviewed it. Every hold is then reviewed by a person. If a hold is placed on your account we will notify you through our portal, and you can ask for it to be reviewed, give us your views and challenge the outcome, by contacting us. The law sometimes prevents us from telling you why a hold was placed.

Risk ratings. We give each client a risk rating from the information we hold. It decides the level of checks we carry out. One of our compliance staff always decides whether we accept or continue a relationship with a client.

Screening. We screen clients, the people connected to them, and people who pay or are paid through accounts we run.

Profiling for marketing. We score interest in our services from how people and organisations use our websites and emails, alert our staff when an organisation or person they follow visits, and use AI to group what enquirers tell us about how they found us. This is profiling for marketing. It has no legal or similar effect on you. You can object to it at any time and we will stop (section 14).

9. How We Use AI

We use AI tools to help our staff read and summarise documents, draft replies and reports, suggest how to handle screening results, analyse call transcripts, and group enquiries. Our AI providers act on our instructions, and some of them are in the United States (section 12). AI output is advice to our staff. Apart from the temporary holds described in section 8, a person makes every decision that affects you.

10. Why We Use Your Information, and Our Lawful Basis

Information we collect to meet anti-money-laundering law is used only for preventing money laundering and terrorist financing, unless the law allows otherwise or you agree. We may also use information for other purposes that are compatible with those set out above.

11. Who We Share It With

We share personal information only as this notice describes. We do not sell your personal information. We share it with:

• Banks and payment systems, and payee-checking services, in the UK, to hold money and make and check payments.
• Identity-verification, screening, credit and company-information providers. Our identity-verification and screening providers are in the UK and the European Economic Area. Some of these providers may process information outside the UK (section 12).
• Regulators and public bodies, including the Financial Conduct Authority, HM Revenue & Customs and the Information Commissioner's Office.
• The National Crime Agency, the police and other law-enforcement bodies, including reports of suspected money laundering. The law may prevent us from telling you about such a disclosure.
• Courts, and parties to legal proceedings.
• Our accountants, auditors, insurers and professional advisors.
• Your professional advisor, where you appoint one (section 4).
• Companies in our group, for internal administration. Their names are available on request.
• Service providers who act on our instructions: hosting and IT, communications and telephony, email delivery, e-signature, accounting, customer-relationship management, document scanning and AI services, in the UK, the European Economic Area, the United States, Australia and New Zealand.
• Advertising and analytics platforms, in the United States and the European Economic Area, with limited information to measure and target our advertising.
• Our review provider, if you leave a review, in Israel, with reviews stored in the United States.
• Anyone who buys, or is considering buying or investing in, our business or part of it, under confidentiality terms.

12. Transfers Outside the UK

Our main systems are hosted in the UK. Some of our service providers process information outside the UK:

• The European Economic Area and Israel, covered by the UK's adequacy regulations.
• The United States, other than reviews (below), protected by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or, where the provider is certified, by the UK Extension to the EU-US Data Privacy Framework.
• Other countries: for accounting, New Zealand, covered by the UK's adequacy regulations, and Australia, protected by the UK Addendum to the EU standard contractual clauses.
• Reviews: reviews you choose to publish are stored with our review provider in the United States.

You can ask us for a copy of the safeguards we rely on.

13. How Long We Keep It

Any of these periods is extended while a complaint, claim, investigation or legal hold is open, and for as long as the law requires. Deleted information may remain in secure backups for up to seven days before it is overwritten.

14. Your Rights

You have these rights over your personal information. Some have limits, which we set out here.

• To be informed, which this notice does.
• To access a copy of your information. We may withhold information where the law allows or requires it, for example to prevent or detect crime, to protect legal advice or to protect other people's information, and the law may prevent us from telling you why.
• To have inaccurate information corrected.
• To have your information deleted, except where we must keep it, for example records that anti-money-laundering law requires us to keep until the retention period ends, or information we need for legal claims.
• To restrict our use of your information while a concern is resolved.
• To move information you gave us, where we use it on the basis of consent or a contract and by automated means.
• To object to our use of your information on the basis of legitimate interests. We will stop unless we have compelling grounds to continue, such as preventing financial crime, or need it for legal claims.
• To withdraw consent at any time, where we rely on it. This does not affect what we did before.
• Rights about automated decisions: to be told about a temporary hold, to give your views, to ask for a person to review it, and to challenge it (section 8).

You can object to direct marketing, including profiling for marketing, at any time, and we will stop. Use the unsubscribe link in any message, or contact us.

How to make a request. Please use our request form at privacy@dos.co. We also accept requests made in other ways. If you are signed in to our client portal we already know who you are; otherwise we may ask for information to confirm your identity, proportionate to your request. We reply within one month. There is no fee.

Requests about someone else. We act on a request made for someone else only with evidence of the authority to make it. Records about a person who has died are available to their personal representatives under the terms of the account.

15. Complaints

If you are unhappy with how we have handled your information, please contact our data protection officer first (section 2). We will acknowledge your complaint within 30 days.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

16. Changes to This Notice

We may update this notice. The version on this page applies from its effective date, shown at the top. Earlier versions are available on request.

17. Contact Us

• Requests about your information: privacy@dos.co
• Data protection officer: privacy@dos.co
• Post: SB.149 China Works, 100 Black Prince Road, London SE1 7SJ