Skip to content
← Back to home

Privacy Policy

"Monzo's Full Irish Moment" Campaign

Last updated: April 2026

1. Data Controller

Prime Directive AI Ltd (company number 16551401), registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("we", "us", "our") is the data controller for personal data collected through this campaign. Contact: privacy@primedirective.ai.

2. Data We Collect

  • Photos: Images uploaded as part of the promotion.
  • Contact details: Phone number (if provided) for verification and notification.
  • Payment details: Monzo.me link for reward payments.
  • Location data: Approximate geolocation (if you choose to share it). This is optional and does not affect your reward.
  • Technical data: Device type, browser, IP address, and usage analytics.

3. How We Use Your Data

  • To verify photo submissions and process reward payments.
  • To prevent fraudulent or duplicate entries.
  • To share your photo on social media (only with your explicit consent).
  • To improve our services and understand campaign performance.
  • To maintain audit logs as required by financial services regulation.
  • To enable you to check your submission status.

4. Legal Basis

We process your data based on:

  • Contract: Processing necessary to fulfil the promotion terms (reward payment).
  • Consent: For optional photo sharing on social media and optional geolocation collection.
  • Legitimate interest: For fraud prevention and service improvement.

5. Data Sharing and Subprocessors

We do not sell your personal data. We may share data with:

  • Supabase Inc.(EU region) — database hosting and file storage.
  • Anthropic PBC(United States) — automated photo analysis for verification purposes.
  • Twilio Inc.(United States) — SMS notification delivery.
  • Google LLC(United States) — website analytics (Google Analytics 4).
  • Monzo Bank Ltd (United Kingdom / Ireland) — for payment processing and account verification. We share your monzo.me link and submission status with Monzo for the purpose of fulfilling the reward payment.
  • Law enforcement or regulatory bodies when required by law.

6. International Data Transfers

Some of our service providers are based in the United States. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

7. Automated Decision-Making

We use automated photo analysis to verify that submitted photos meet the campaign requirements. This automated process may approve, reject, or flag your submission for manual review. You have the right to request human review of any automated decision. All submissions flagged for concerns are reviewed by a human before any payout decision is made.

8. Data Retention

Personal data will be retained for 12 months after the campaign ends, after which it will be securely deleted. Photos for which consent was given for social media use will be retained until consent is withdrawn. Audit logs required for regulatory compliance may be retained for up to 6 years in accordance with Central Bank of Ireland record-keeping requirements.

9. Your Rights

Under GDPR, you have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Erase your data ("right to be forgotten").
  • Restrict or object to processing.
  • Withdraw consent at any time (for photo sharing and geolocation).
  • Request human review of automated decisions.
  • Lodge a complaint with the Data Protection Commission (dataprotection.ie).

To exercise any of these rights, email privacy@primedirective.ai.

10. Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Commission within 72 hours in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

11. Cookies and Analytics

We use Google Analytics (GA4) to understand how the campaign site is used. This involves cookies and similar technologies. You will be asked for consent before analytics cookies are set. No personally identifiable information is shared with Google.

12. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with the updated date.

← Back to home

Prime Directive AI Ltd. Company number 16551401. Registered in England and Wales. 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.