Open Banking Consent Notice

Version 4.2 | Last updated 30 October 2026

Key points

This summary is part of this Notice. It is here so that the most important information is easy to find before you connect a bank account. The full terms follow.

• Who provides the service. Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.
• Read-only access. We can see account details, balances and transactions for the accounts you choose. We cannot move money.
• Your explicit consent. We access nothing unless you give explicit consent by selecting "Connect via Finexer" and then approve access at your own bank.
• History and refresh. On first connection we import up to 5 complete UK tax years plus the current tax year of history, where your bank makes it available. While you are using Earnly, your data refreshes automatically about every 15 minutes.
• Time-limited. Access lasts 90 days and then stops unless you reconfirm it by selecting "Confirm". We remind you in the app from 14 days before expiry and by email 14 days, 7 days and 1 day before expiry.
• Easy to stop. You can disconnect at any time, free of charge, by selecting "Disconnect" in Settings → Integrations. This revokes your consent with Finexer and stops access immediately. You can also withdraw consent through your bank.
• Strict use limits. We use your bank data only to provide the Services you asked for. We never sell it, never use it for marketing, and never use it for credit scoring or affordability checks. Where our rules cannot categorise a transaction, we send only a cleaned merchant name and the amount to Anthropic's AI model to suggest a category (clause 8.2).
• Deletion. When you disconnect, withdraw consent, let your consent expire without reconfirming, or close your Account, your bank data is deleted following a 30-day cooling-off period, during which you can reactivate the connection or your Account, in which case your data is kept, or export your data as a CSV file. We do not keep transaction history after that period. Only the limited records listed in clause 9.4 are kept.
• Complaints. Complaints about the account information service are passed to Finexer within 1 Business Day, and you receive a final response within 15 Business Days (35 in exceptional cases). Finexer Ltd is responsible for handling these complaints and issuing the final response. You may be able to refer your complaint to the Financial Ombudsman Service free of charge.
• Help. If your circumstances make it harder for you to use the Platform or manage your data, tell us at support@earnly.co.uk and we will offer support (section 15).

1. About this document

1.1 This Open Banking Consent Notice (this "Notice") is issued by Earnly Limited, a private limited company registered in England and Wales (company number 16183799), whose registered office is at 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our").

1.2 This Notice explains how account information services are made available to you through the Platform and the services delivered through it (the "Services"); how your explicit consent to access your bank data is obtained; how long it lasts and how it is reconfirmed; how you can withdraw it; what we do and do not do with the data we receive; when we delete it; what you are responsible for; and how to complain.

1.3 This Notice applies to every person who connects, or attempts to connect, a Connected Account. It applies in addition to, and does not replace, the Terms and Conditions, the Privacy Policy, the Data Retention Policy, the AI Policy, the Financial Disclaimer and the Acceptable Use Policy.

1.4 This Notice forms part of the Agreement. "Agreement" means the Terms and Conditions and the documents incorporated into them.

1.5 Order of precedence. If there is any conflict or inconsistency between this Notice and another document forming part of the Agreement, the order of precedence in the "Documents forming part of the Agreement and order of precedence" clause of the Terms and Conditions applies. In summary: the Privacy Policy prevails on any matter concerning the processing of personal data; this Notice prevails over the Terms and Conditions and the other documents ranked below it on any matter concerning your consent to the AIS and the use of Open Banking Data; the Complaints Procedure prevails on how we handle complaints; and on every other matter the Terms and Conditions prevail over this Notice. Nothing in any document forming part of the Agreement limits any right or protection which the law gives you and which cannot be excluded or limited by contract, including without limitation your statutory rights as a Consumer and your rights under data protection law.

1.6 Where this Notice places a stricter restriction on how Earnly may access, use, share or retain Open Banking Data than any other document forming part of the Agreement, the stricter restriction in this Notice applies.

1.7 Finexer's own terms. Finexer's End User Terms and Privacy Notice (both effective 1 September 2026) govern Finexer's provision of the account information service to you, as between you and Finexer. Links to both are shown in the consent journey. Nothing in this Notice limits any obligation which Finexer owes you under those terms or under the Payment Services Regulations 2017.

2. Who this applies to

2.1 This Notice applies to both Consumers and Business Users. Where a clause applies only to one class of user, it says so expressly. All other clauses apply to everyone.

2.2 Consumers. If you use the Platform wholly or mainly for purposes outside your trade, business, craft or profession, you are a Consumer. You have the benefit of every clause in this Notice except those stated to apply only to Business Users. Nothing in this Notice affects your statutory rights.

2.3 Sole traders, contractors and freelancers. If you use the Platform for your own trade, business or profession as an individual, you are a Business User and an Individual. For the purposes of the account information service you are also treated as a retail customer under the Financial Conduct Authority's Consumer Duty, and you may be eligible to complain to the Financial Ombudsman Service (clause 14.9).

2.4 Organisations and the individuals who act for them. If you connect an account on behalf of a company, LLP, partnership or other organisation, that Organisation is a Business User, and you, as the individual acting for it (for example a director, partner or authorised employee), must have authority to do so (section 11). Micro-enterprises and other small businesses may be eligible to complain to the Financial Ombudsman Service (clause 14.9).

2.5 Personal data. Every Individual has rights under data protection law in every case, whether they are a Consumer, a sole trader or an individual acting for an Organisation. Those rights are explained in the Privacy Policy.

2.6 Eligibility. You must be 18 or over to connect an account. If you are an individual, you must be resident in the United Kingdom; if you act for an Organisation, it must be established in the United Kingdom. Only UK bank and payment accounts can be connected.

3. Definitions

3.1 In this Notice:

3.1.1 "Account" means your Earnly user account on the Platform. One Account can hold a personal (individual) profile and one or more companies.

3.1.2 "AIS" means the account information service, within the meaning of the Payment Services Regulations 2017, which Finexer provides to you and which Earnly makes available as Finexer's agent.

3.1.3 "ASPSP" or "your bank" means the account servicing payment service provider which holds a Connected Account, such as your bank, building society or e-money institution.

3.1.4 "Business Day" means Monday to Friday, excluding bank holidays in England and Wales.

3.1.5 "Business User" means anyone using the Platform for a trade, business or profession, including without limitation a sole trader, contractor, freelancer, partnership, LLP, limited company or other organisation, and any individual (for example a director) acting on its behalf.

3.1.6 "Connected Account" means a bank or payment account which you have authorised to be connected to the Platform through the consent journey described in section 5.

3.1.7 "Consent Period" means the period described in clause 7.1 for which access to a Connected Account lasts before it must be reconfirmed.

3.1.8 "Consumer" means an individual acting wholly or mainly outside their trade, business, craft or profession.

3.1.9 "Deletion Window" means the 30-day cooling-off period described in clause 9.3.4 and clause 7.6, during which you can reactivate the connection or your Account before your bank data is deleted.

3.1.10 "Individual" means any natural person who uses the Platform, whether as a Consumer or as a sole trader or other Business User.

3.1.11 "Open Banking Data" means the account details, balance and transaction data received in respect of a Connected Account.

3.1.12 "Organisation" means a company, LLP, partnership or other entity that is a Business User.

3.1.13 "Outputs" means estimates, categorisations, VAT treatment notes, confidence scores, forecasts, insights and any other automatically generated results produced by the Platform.

3.1.14 "Platform" means Earnly's responsive web application and website. If we release mobile apps, this Notice applies to them too.

3.1.15 "Provider" or "Finexer" means Finexer Ltd (company number 12191948), whose registered office is at 124 City Road, London, EC1V 2NX.

3.2 "Including" and similar words are to be read as "including without limitation". Headings do not affect interpretation.

4. Regulatory status, agency and responsibility

4.1 Agency disclosure. Before you connect any account, Earnly gives you the following disclosure, both in this Notice and on screen in the consent journey:

Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.

4.2 Who is responsible for the AIS. The AIS is a regulated service provided by Finexer. Earnly provides the AIS on Finexer's behalf as its agent. Finexer, as principal, is responsible to you for the AIS, including for anything Earnly does or fails to do in providing the AIS as Finexer's agent.

4.3 What Earnly does in its own right. Separately from the AIS, Earnly provides the Platform's technology, presentation and analytical features, including categorisation, tax estimates, forecasts and insights. Those features are not regulated by the Financial Conduct Authority. Earnly is responsible for them under the Terms and Conditions.

4.4 Earnly does not hold client money, does not carry on any regulated activity in its own right, and does not give financial, tax, accounting, investment or legal advice. No Output is regulated advice or a personal recommendation. The Financial Disclaimer explains what Outputs are and are not.

4.5 Data protection roles. In line with Finexer's published Privacy Notice:

4.5.1 Finexer is an independent controller for the AIS consent journey, the authoritative consent and audit record, security and fraud prevention, and its own regulatory complaints;

4.5.2 Earnly is an independent controller of the data it receives and processes to provide the Platform; and

4.5.3 Finexer acts as Earnly's processor when it delivers data to Earnly, under Finexer's Data Processing Agreement.

4.6 The Privacy Policy explains how Earnly handles your personal data. Finexer's Privacy Notice explains how Finexer handles it. You can contact Finexer about data protection at privacy@finexer.com.

5. Your explicit consent and the consent journey

5.1 Explicit consent is required. Neither Earnly nor Finexer will access any account unless you have given your explicit consent to the AIS and have then approved access at your bank. Consent is never assumed, pre-selected or inferred from your use of the Platform.

5.2 What you see before you consent. Before you give consent, the consent screen shows you, in plain language:

5.2.1 the agency disclosure in clause 4.1;

5.2.2 the categories of data that will be accessed (account details, balances and transactions);

5.2.3 the purposes for which the data will be used (section 8);

5.2.4 the length of the Consent Period and how reconfirmation works (section 7);

5.2.5 how to withdraw consent (section 9); and

5.2.6 links to this Notice, the Privacy Policy and Finexer's End User Terms and Privacy Notice.

5.3 The journey. The consent journey operates as follows:

5.3.1 in the Platform you go to Settings → Integrations and choose to add a bank account, and you are shown the information in clause 5.2;

5.3.2 you give your explicit consent by selecting the button labelled "Connect via Finexer";

5.3.3 Earnly creates a pending connection record and requests a consent from Finexer covering only the accounts, balance and transactions scopes. No payment scope is requested;

5.3.4 you are redirected to Finexer's hosted screen, where you choose your bank;

5.3.5 you are redirected to your bank, where you log in and approve access using your bank's own security checks. Your online banking credentials are entered only at your bank. They are never entered into, transmitted through, visible to or stored by Earnly;

5.3.6 your bank returns you to the Platform. Earnly checks the consent with Finexer and retrieves the authorised accounts and balances, and then imports transaction history (clause 6.4); and

5.3.7 you see a confirmation. The Connected Accounts appear in Settings → Integrations with the number of days left in the Consent Period.

5.4 You may abandon the journey at any point before you approve access at your bank. If you do, the pending connection record lapses and no data is received.

5.5 Records of consent. Earnly records the date and time of your consent, the version of this Notice shown to you, the accounts and scopes authorised, and the date on which the Consent Period ends, together with each reconfirmation, withdrawal and expiry. Earnly keeps these records to evidence your consent to Finexer and to regulators (clause 9.4.1). Finexer keeps its own authoritative consent and audit record for 5 years from the end of the consent, as explained in its Privacy Notice.

6. Scope of consent

6.1 You choose which accounts to connect. You do not have to connect every account you hold with a bank.

6.2 You may connect accounts at more than one bank by repeating the journey in section 5 for each bank. You may link Connected Accounts to your personal profile or to any company in your Account.

6.3 Consent covers only account details, balances and transaction data. It does not extend to payment initiation, to confirmation of available funds, or to any other payment service. Earnly does not, and cannot, initiate payments, set up standing orders or Direct Debits, or move money from any Connected Account.

6.4 History. On first connection, Earnly imports up to 5 complete UK tax years plus the current tax year of transaction history (each UK tax year runs from 6 April to 5 April), to the extent your bank makes that history available. Some banks provide less.

6.5 Refresh. While the Consent Period lasts, Open Banking Data refreshes automatically about every 15 minutes while you have the Platform open, and also whenever you open the Platform or select Refresh. Earnly does not request data from your bank while you are not using the Platform.

6.6 If Earnly wishes to access any additional category of data, or to use Open Banking Data for any purpose not listed in section 8, it must first obtain your fresh explicit consent through the journey in section 5. A change of that kind is never made by updating this Notice alone.

7. Duration, reconfirmation and expiry

7.1 Consent Period. Access to a Connected Account is time-limited. It lasts for 90 days from the date on which you approve access, or from the date on which you last reconfirmed it.

7.2 Reminders. Earnly reminds you that the Consent Period is ending:

7.2.1 in the Platform, where the number of days remaining is shown in Settings → Integrations at all times, with an amber warning from 14 days before expiry and a red warning from 3 days before expiry; and

7.2.2 by email to the address registered to your Account, 14 days, 7 days and 1 day before expiry.

Each email reminder tells you that, if you do not reconfirm, the data for that account will be deleted as described in clause 7.6, and how to export it first.

7.3 Reconfirmation. To continue the connection you must reconfirm your consent before the Consent Period ends, by selecting "Confirm" against the account in Settings → Integrations and completing Finexer's reconfirmation flow. Under Finexer's End User Terms, reconfirmation is done through Finexer's flow and does not require you to authenticate again at your bank, although your bank may require it. Reconfirming is never harder than connecting for the first time.

7.4 Refreshing data in the Platform does not extend the Consent Period. Only reconfirmation starts a new Consent Period.

7.5 Expiry. If you do not reconfirm, access stops automatically at the end of the Consent Period. No further data is received, and the account is shown as needing reconfirmation. Your bank may also end access earlier for its own reasons.

7.6 Data after expiry. If the Consent Period ends without reconfirmation, a 30-day cooling-off period applies. If you reactivate the connection by reconfirming your consent within the cooling-off period, your existing data is kept and the connection continues. Otherwise, Earnly deletes the Open Banking Data received for that account, and the Outputs derived only from it, at the end of the cooling-off period. During the cooling-off period you can also export your transaction data as a CSV file (clause 10.1.4). The retention exceptions in clause 9.4 apply.

7.7 Your responsibility. You must reconfirm in good time if you want the connection to continue. If you do not, your transaction records in the Platform will have a gap and Outputs may be incomplete or out of date. Provided Earnly has given the reminders described in clause 7.2, Earnly is not responsible for the consequences of a lapse in consent.

8. How Earnly uses Open Banking Data

8.1 Permitted purposes. Earnly uses Open Banking Data only to provide the Services you have asked for, which are:

8.1.1 displaying account, balance and transaction information so that you can see your financial position in one place;

8.1.2 categorising transactions to a chart of accounts, with a VAT treatment note and a confidence score attached to each proposed categorisation, including obtaining an AI suggested category from Anthropic, limited as described in clause 8.2, where Earnly's rules, your own rules and the merchant-keyword table cannot categorise a transaction;

8.1.3 detecting transfers between your own accounts so that they are not double-counted as income or expenditure;

8.1.4 producing tax estimates, forecasts and insights;

8.1.5 providing customer support to you, when you ask for it;

8.1.6 keeping the Platform and your data secure, and detecting and preventing fraud and misuse of the Platform; and

8.1.7 complying with Earnly's legal and regulatory obligations, including its obligations to Finexer as principal.

8.2 How categorisation works. Categorisation is rules-based and runs within Earnly's own systems. When you confirm or correct a category, the merchant keyword and category (but no amount, account, user or company identifier) may be added to an anonymised merchant-keyword table which helps categorise transactions for all users. Personal names, person-to-person payment references and account references are excluded from that table. Only where Earnly's rules, your own rules and the merchant-keyword table cannot assign a category, Earnly uses a third-party AI model, Anthropic's Claude Haiku 4.5, to suggest one. In that case:

8.2.1 Earnly sends only a cleaned merchant name (for example "BT") and the transaction amount (for example £123.34). It never sends your name, any user, company, Account or bank account identifier, account numbers or sort codes, raw bank descriptions, references or dates, or the names of your customers;

8.2.2 before anything is sent, Earnly removes payments to or from individuals, person-to-person payments and transfers between your own accounts, and these are never sent;

8.2.3 Anthropic Ireland, Limited (with Anthropic, PBC as its sub-processor) acts as Earnly's processor, may process the data in the United States, and is contractually prohibited from training its models on it. Anthropic deletes it within 30 days, or keeps it for up to 2 years if its automated trust and safety systems flag the request under its Usage Policy, or longer where the law requires; and

8.2.4 the suggested category is labelled "AI suggested", is never marked as reviewed automatically, and is added to the merchant-keyword table only once a user confirms it. You review it and can change it, and your correction always prevails.

The AI Policy explains this in full.

8.3 What Earnly never does. Earnly must not, and does not:

8.3.1 sell, rent or license Open Banking Data to anyone;

8.3.2 use Open Banking Data for marketing, advertising or profiling for marketing purposes, whether for Earnly or for anyone else;

8.3.3 use Open Banking Data, or supply it or any Output to anyone, for credit scoring, credit referencing, affordability or creditworthiness assessment, lending decisions, insurance underwriting or debt collection;

8.3.4 use Open Banking Data to train any third-party AI model, or allow any third party (including Anthropic) to do so, or send any Open Banking Data to an AI model other than as described in clause 8.2;

8.3.5 use Open Banking Data to make any decision based solely on automated processing which has a legal or similarly significant effect on you; or

8.3.6 use Open Banking Data for any purpose other than those in clause 8.1 without your fresh explicit consent.

8.4 Who Open Banking Data is shared with. Earnly shares Open Banking Data only with:

8.4.1 Finexer, as principal for the AIS;

8.4.2 Earnly's hosting and infrastructure providers that need access to deliver the Services, acting only on Earnly's written instructions, under confidentiality and security obligations, and prohibited from using the data for their own purposes. They are named on the Sub-processor List;

8.4.3 Anthropic Ireland, Limited, with Anthropic, PBC as its sub-processor, which receives only a cleaned merchant name and transaction amount, as described in clause 8.2, to suggest a category, acting only on Earnly's written instructions and prohibited from training its models on the data;

8.4.4 anyone you choose to share it with yourself, for example by exporting it. The Platform does not offer team or accountant access, so no other person can view your Account through the Platform;

8.4.5 a court, regulator, law enforcement agency or other public authority (including without limitation HM Revenue and Customs exercising statutory powers), only where Earnly is legally required to do so; and

8.4.6 a purchaser of all or substantially all of Earnly's business, only where the purchaser is bound to use the data solely for the purposes, and subject to the restrictions, in this Notice, and only after Earnly has told you.

8.5 Earnly does not share Open Banking Data with anyone else.

8.6 Other people's data. Transaction descriptions can include the names of other people, such as customers, suppliers or people you pay. Earnly processes that information only for the purposes in clause 8.1 and deletes it with the rest of the Open Banking Data. The Privacy Policy explains how it is protected.

8.7 Outputs are proposals. Categorisations and other Outputs are proposals which you review and may correct. Where you correct a categorisation, your correction prevails.

9. Withdrawing consent and deletion

9.1 You can withdraw at any time. You may withdraw consent for any Connected Account at any time, free of charge, and without giving a reason, by:

9.1.1 selecting "Disconnect" against the account in Settings → Integrations;

9.1.2 revoking access through your bank's online banking, app or customer service; or

9.1.3 emailing support@earnly.co.uk from the email address registered to your Account, in which case Earnly will disconnect the account within 1 Business Day of receipt.

9.2 As easy as connecting. Disconnecting in the Platform takes no more steps than connecting. Earnly will not require you to call, will not ask you to justify your decision, and will not show you repeated retention screens. Earnly may show you one confirmation screen that explains the effect of disconnecting and reminds you to export any data you need.

9.3 What happens when you withdraw. When you withdraw consent:

9.3.1 if you disconnect in the Platform, Earnly revokes the consent with Finexer immediately and access stops immediately;

9.3.2 no further Open Banking Data is received for that account;

9.3.3 Earnly confirms the disconnection to you on screen; and

9.3.4 a 30-day cooling-off period applies, during which you can export your transaction data as a CSV file, or reactivate the connection by reconnecting the account through the journey in section 5, in which case your data is kept. Otherwise, Earnly deletes the Open Banking Data received for that account, and the Outputs derived only from it, at the end of the cooling-off period, subject only to clause 9.4.

9.4 Retention exceptions. Earnly may keep the following after the 30-day period, only for the purpose stated and for no longer than the period stated in the Data Retention Policy:

9.4.1 records of consent and connection events described in clause 5.5 (but not the transaction data itself), to evidence compliance to Finexer and to regulators, for 6 years from the end of the consent;

9.4.2 data relevant to an open complaint, dispute or legal claim, until it is resolved, and then for the period stated in the Data Retention Policy;

9.4.3 data Earnly is required to keep by law or by order of a court, regulator or other competent authority;

9.4.4 encrypted backup copies, which are overwritten in the normal backup cycle within 35 days and are not restored for any other purpose in the meantime; and

9.4.5 anonymised data that no longer identifies you or any other person, including without limitation the merchant-keyword table described in clause 8.2.

9.5 Earnly does not keep your Open Banking Data to meet your own record-keeping obligations. You are responsible for keeping your own business and tax records. Before you disconnect, you should export any data you need using the CSV export.

9.6 Withdrawing through your bank. If you revoke access through your bank, Earnly treats the account as disconnected from the time it learns of the revocation, and clauses 9.3.2, 9.3.4 and 9.4 apply.

9.7 Effect on your Agreement. Withdrawing consent does not close your Account or end your Agreement. To end your Agreement, follow the "Termination" clause of the Terms and Conditions. If you are a Consumer, you also have the rights described in the "Your right to cancel if you are a Consumer" clause of the Terms and Conditions.

9.8 Withdrawing consent may reduce what the Platform can do and the completeness and accuracy of Outputs.

9.9 Closing your Account. If you close your Account, all Connected Accounts are disconnected, each consent is revoked with Finexer, and clauses 9.3 to 9.5 apply to all Open Banking Data.

10. What you can see

10.1 The Platform shows you:

10.1.1 an itemised transaction feed as received from your bank, comprising the description, merchant, amount, date and bank-supplied category for each transaction;

10.1.2 balances as received from your bank;

10.1.3 account numbers masked to the last four digits; and

10.1.4 an export of your transaction data in CSV format, available at any time while your Account is open and during the Deletion Window.

10.2 Your online banking credentials are never visible in the Platform because Earnly never receives them.

10.3 Data in the Platform is shown as received from your bank through Finexer. It may be delayed, incomplete or inaccurate for reasons outside Earnly's control, including without limitation outages, data-quality issues or connection failures at your bank or at Finexer.

11. Authority to connect, joint accounts and business accounts

11.1 Authority. You must connect only an account which you hold, or which you are authorised by every necessary account holder to connect and to share through the AIS. By connecting an account you confirm that this is true.

11.2 Joint accounts. You may connect a joint account only if your bank allows you to authorise access to it on your own. If you connect a joint account, you must:

11.2.1 tell each other account holder that the account is connected to the Platform and that their transaction data will be processed as described in this Notice and the Privacy Policy; and

11.2.2 disconnect the account promptly if another account holder objects.

11.3 Business accounts. If you connect an account held in the name of an Organisation, you confirm that you are authorised by that Organisation, under its bank mandate and internal approvals, to connect the account and to share its data through the AIS. You must disconnect the account immediately if your authority ends, for example because you cease to be a director, partner or employee. Because the Platform does not offer team access, the connection cannot be transferred to another person's Account; another authorised person must connect the account afresh from their own Account.

11.4 If you are a Business User: you are responsible for third-party claims against Earnly, and Earnly's reasonable investigation costs, arising from an account being connected in breach of clause 11.1 or 11.3, to the extent set out in the "Indemnity" clause of the Terms and Conditions. That responsibility applies only to the extent the loss was caused by the breach and does not apply to the extent the loss was caused by Earnly's own breach or negligence. Where an Organisation and the individual who registered for it are both responsible, the joint and several liability provisions in the "Organisations: authority and joint and several liability" clause of the Terms and Conditions apply.

11.5 If you are a Consumer: you do not give Earnly any indemnity under this Notice. Your responsibility for any breach of this section is determined by the general law.

12. Security and unauthorised connections

12.1 You must keep your Account login details, the one-time codes we email you at sign-in, any device PIN and your online banking credentials secure and confidential, and must not share them with anyone. Earnly will never ask for your online banking credentials. If anyone claiming to be from Earnly asks for them, do not provide them and report it to us.

12.2 You must tell Earnly at security@earnly.co.uk without undue delay, and in any event within 24 hours of becoming aware, if:

12.2.1 an account has been connected without proper authority;

12.2.2 someone else has accessed, or tried to access, your Account; or

12.2.3 data shown in the Platform appears to belong to someone else or is materially wrong.

12.3 If you suspect your online banking has been compromised, you should also contact your bank immediately.

12.4 On receiving a report under clause 12.2, Earnly will:

12.4.1 disconnect the affected account, or suspend access to your Account, where needed to prevent further harm;

12.4.2 notify Finexer without undue delay and within 24 hours where Open Banking Data may have been accessed without authority;

12.4.3 investigate and tell you what it has found and what it has done; and

12.4.4 where a personal data breach has occurred, notify the Information Commission (ICO) within 72 hours where required, and tell affected individuals without undue delay where there is a high risk to them.

12.5 Earnly may suspend or disconnect a Connected Account without notice if it reasonably suspects that the account was connected without authority, that your Account has been compromised, or that the Platform is being used fraudulently. Any suspension of your Account is decided by a person, not solely by automated means. Earnly will tell you as soon as it is lawful and safe to do so.

13. Responsibility and liability

13.1 Your records. You remain responsible for your tax position, for the accuracy and completeness of your own records, for reviewing and correcting categorisations, and for all filings and payments to HM Revenue and Customs. The Financial Disclaimer sets out your verification duties.

13.2 Third-party systems. Delivery of Open Banking Data depends on Finexer and on your bank. Earnly does not control their systems and does not guarantee the availability, continuity, accuracy, completeness or timeliness of their data. Earnly will tell you, through the Platform, about any known connection outage affecting your Connected Accounts.

13.3 What is never excluded. Nothing in this Notice excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else which cannot lawfully be excluded or limited.

13.4 If you are a Consumer: Earnly is responsible for loss or damage you suffer which is a foreseeable result of Earnly breaching this Notice or failing to use reasonable care and skill. Loss is foreseeable if it is obvious that it will happen or if, when the Agreement was made, both you and Earnly knew it might happen. Earnly is not responsible for loss which is not foreseeable, or for loss caused by your own failure to follow this Notice, including without limitation a failure to reconfirm consent after the reminders in clause 7.2 or a failure to verify an Output before relying on it. Your statutory rights under the Consumer Rights Act 2015 are not affected.

13.5 If you are a Business User: the exclusions and limitations in the "Limitation of liability" clause of the Terms and Conditions apply to this Notice. Without limiting that clause, and subject to clause 13.3, Earnly is not liable to a Business User for:

13.5.1 any penalty, interest, surcharge or additional tax charged by HM Revenue and Customs or any other tax authority;

13.5.2 any loss arising from reliance on an Output that has not been verified as required by the Financial Disclaimer;

13.5.3 any inaccuracy, incompleteness, delay, corruption or unavailability of data originating from Finexer or your bank;

13.5.4 any consequence of a lapse, expiry or withdrawal of consent, provided Earnly has given the reminders described in clause 7.2; or

13.5.5 loss of profit, revenue, goodwill, anticipated savings or business opportunity, whether direct or indirect, or any loss or corruption of data except as provided in the "Limitation of liability" clause of the Terms and Conditions.

13.6 Liability cap. Earnly's total liability is subject to the "Limitation of liability" clause of the Terms and Conditions.

13.7 Nothing in this section affects any liability which Finexer owes you as principal in respect of the AIS.

14. Complaints

14.1 How to complain. You can complain to Earnly:

14.1.1 by email to complaints@earnly.co.uk;

14.1.2 using the online complaint form at https://earnly.co.uk/complaints;

14.1.3 in the Platform, through Settings → Help; or

14.1.4 by post to Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU.

Tell us what went wrong, what you would like us to do, and the best way to contact you. We accept complaints in any reasonable form and will not require you to use particular words. The Complaints Procedure explains the full process.

14.2 Acknowledgement. We will acknowledge your complaint within 2 Business Days of receipt and tell you who is handling it.

14.3 Complaints about the AIS. A complaint about the account information service (for example about connecting, consent, reconfirmation, disconnection or the data received from your bank) is a complaint about a regulated payment service for which Finexer is responsible as principal. Earnly will refer it to Finexer within 1 Business Day of receipt and tell you that it has done so. Earnly will give Finexer all the information and help it needs to investigate. You may also complain to Finexer directly at complaints@finexer.com.

14.4 AIS timescales. Finexer Ltd is responsible for handling these complaints and issuing the final response. You will receive a final response to an AIS complaint, addressing all points raised, within 15 Business Days of the complaint first being received by Earnly or Finexer. In exceptional circumstances beyond its control, you will instead receive a holding reply within 15 Business Days explaining the reasons for the delay and when you will receive a final response, which will be no later than 35 Business Days after the complaint was first received.

14.5 Other complaints. A complaint about the Platform or about Earnly that does not concern the AIS is handled by Earnly. If we resolve it to your satisfaction by the close of the third Business Day after receipt, we will confirm this to you in writing. Otherwise, we aim to send you a final response within 20 Business Days, and in any event will do so within 8 weeks of receipt.

14.6 Complaints about your personal data. Complaints about how we handle your personal data can also be sent to privacy@earnly.co.uk. They are dealt with under the data protection complaints procedure in the Privacy Policy: we acknowledge them within 2 Business Days and tell you the outcome within 1 month, and in any event within 3 months. You also have the right to complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.

14.7 Final response. Every final response explains the decision and any remedy offered. A final response to an AIS complaint also tells you about your right to refer the complaint to the Financial Ombudsman Service and includes a link to its information leaflet.

14.8 Financial Ombudsman Service. If you are an eligible complainant and you are not satisfied with the final response to an AIS complaint, or you have not received a final response within the time limits in clause 14.4, you may refer your complaint to the Financial Ombudsman Service. The service is free. You must normally refer your complaint within 6 months of the date of the final response, and within 6 years of the event complained of or, if later, 3 years from when you became aware (or ought reasonably to have become aware) that you had cause to complain. Contact: financial-ombudsman.org.uk; 0800 023 4567; complaint.info@financial-ombudsman.org.uk; Financial Ombudsman Service, Exchange Tower, London E14 9SR.

14.9 Who is eligible. You are eligible to complain to the Financial Ombudsman Service if, when you complain, you are:

14.9.1 a consumer;

14.9.2 a micro-enterprise, meaning a business with fewer than 10 employees and an annual turnover or annual balance sheet total of €2 million or less;

14.9.3 a small business, meaning a business which is not a micro-enterprise, with fewer than 50 employees and either an annual turnover of less than £6.5 million or an annual balance sheet total of less than £5 million;

14.9.4 a charity with an annual income of less than £6.5 million; or

14.9.5 a trustee of a trust with a net asset value of less than £5 million.

Sole traders are generally eligible as consumers or micro-enterprises. The Financial Ombudsman Service decides eligibility in each case.

14.10 Other disputes. Earnly does not use an alternative dispute resolution scheme, as it is not required to. Complaints about the AIS can go to the Financial Ombudsman Service through Finexer as described above. If a complaint about anything else is not resolved, you may take it to the courts described in section 17.

15. Extra support and vulnerable customers

15.1 Some people need extra support because of their health, a life event, their financial resilience or their confidence with technology or money. If anything about your circumstances makes it harder for you to use the Platform, understand this Notice or manage your connections, please tell us at support@earnly.co.uk.

15.2 Our support is by email, Monday to Friday, 9:00 to 17:30 UK time, excluding bank holidays in England and Wales, and we aim to reply within 2 Business Days. Depending on your needs, we can:

15.2.1 explain this Notice or a consent, reconfirmation or disconnection step in a different way;

15.2.2 provide information in large print, as an accessible PDF or as a plain-text email;

15.2.3 arrange a telephone call as a reasonable adjustment if email does not work for you;

15.2.4 deal with a person you authorise to act for you, once we have verified their authority;

15.2.5 give you more time to respond to us; and

15.2.6 disconnect accounts or close your Account for you on request.

15.3 We will record information about your circumstances only with your consent and only to give you the support you need. The Privacy Policy explains how we protect it.

15.4 We will never use what you tell us about your circumstances to treat you less favourably.

16. Changes to this Notice

16.1 Earnly may change this Notice only for one or more of the following reasons: to reflect a change in the law, in regulation or regulatory guidance, or in Finexer's requirements as principal; to reflect a change in the Platform or the Services; to address a security risk; or to make the Notice clearer.

16.2 Earnly will give you at least 30 days' notice of any material change, by email and in the Platform, before it takes effect. If you do not agree to a material change, you may disconnect your accounts and end your Agreement free of charge before the change takes effect, as described in the "Changes to the Agreement" clause of the Terms and Conditions.

16.3 If a material change is adverse to you, Earnly will ask you to accept it positively before it applies to you. Continued use alone will not be treated as acceptance of a material adverse change.

16.4 Any change to the categories of data accessed, or to the purposes for which Open Banking Data is used, requires your fresh explicit consent under clause 6.6 and cannot be made by notice alone.

16.5 Earnly may make minor changes which do not adversely affect you, such as correcting typographical errors, without notice. The current version is always available in the Platform and at https://earnly.co.uk/legal/open-banking-consent-notice.

17. Governing law and jurisdiction

17.1 This Notice and any dispute or claim arising out of or in connection with it, including any non-contractual dispute or claim, is governed by the law of England and Wales.

17.2 If you are a Business User, the courts of England and Wales have exclusive jurisdiction.

17.3 If you are a Consumer, you may bring proceedings in the courts of England and Wales or, if you live in Scotland or Northern Ireland, in the courts of the part of the United Kingdom where you live, and the mandatory consumer protection law of that part of the United Kingdom applies to you.

18. Contact

Earnly Limited
41 New Cross Street
Swinton
Manchester
England
M27 4TU

• General support: support@earnly.co.uk
• Complaints: complaints@earnly.co.uk or https://earnly.co.uk/complaints
• Data protection: privacy@earnly.co.uk
• Security and unauthorised access: security@earnly.co.uk

Emails from noreply@notify.earnly.co.uk, including consent reminders, are sent from an address that is not monitored. Please use the addresses above to contact us.

Finexer Ltd
124 City Road, London, EC1V 2NX

• Complaints: complaints@finexer.com
• Data protection: privacy@finexer.com
• End User Terms and Privacy Notice