Vigorous Bank

🔒 Our Commitment to Your Privacy & Security

At Vigorous Bank, protecting your personal and financial information is our highest priority. We are committed to maintaining the confidentiality, integrity, and availability of your data through industry-leading security measures, strict internal policies, and full compliance with Cayman Islands and international data protection standards. This Privacy and Security Statement explains how we collect, use, share, and protect your information when you bank with us.

We operate in full compliance with the Cayman Islands Data Protection Law (2021 Revision), the Data Protection Act, and international best practices including GDPR standards where applicable. Our security framework is aligned with the standards set by the Cayman Islands Monetary Authority (CIMA), the Caribbean Financial Action Task Force (CFATF), and global cybersecurity frameworks.

📋 What Information We Collect

We collect and process personal information necessary to provide you with banking services, comply with legal obligations, and improve our products. This includes:

• Identity Information: Full name, date of birth, passport or government ID details, and proof of address.
• Contact Information: Email address, phone number, and postal address.
• Financial Information: Account balances, transaction history, credit history, income details, and investment holdings.
• Technical Information: IP address, device identifiers, browser type, and login timestamps for security monitoring.
• Communication Records: Call recordings (for quality and training), email correspondence, and secure messages sent through our online banking platform.

We collect this information directly from you when you open an account, apply for a product, use our services, or contact our support team. We may also receive information from credit reference agencies and fraud prevention agencies as permitted by law.

⚙️ How We Use Your Information

Your personal data is used only for legitimate banking purposes, including:

• Managing and administering your accounts and transactions.
• Processing loan, mortgage, and credit applications, including credit checks.
• Detecting, investigating, and preventing fraud, money laundering, and other financial crimes.
• Complying with legal and regulatory obligations (e.g., anti-money laundering, sanctions screening).
• Communicating with you about your accounts, service updates, and important security notices.
• Improving our products, services, and website functionality through analytics (anonymised where possible).
• Providing you with relevant offers and marketing communications (you may opt out at any time).

We never sell your personal data to third parties. Any sharing of information is done strictly under legal obligations or with your explicit consent.

🤝 When We Share Your Information

Vigorous Bank shares your personal data only in limited circumstances:

• Credit Reference Agencies: To assess creditworthiness, verify identity, and prevent fraud.
• Fraud Prevention Agencies: To detect and prevent financial crime. Information may be retained by these agencies for up to six years.
• Regulatory and Law Enforcement: When required by law, court order, or regulatory request (CIMA, Financial Reporting Authority, or international partners).
• Service Providers: Trusted third parties who process data on our behalf (e.g., card processors, IT hosting, print/mail providers). These parties are bound by strict data protection contracts.
• With Your Consent: Any other sharing will only occur with your explicit permission.

We do not transfer your personal data outside the Cayman Islands unless adequate safeguards are in place, such as standard contractual clauses or approved binding corporate rules.

📜 Your Rights Under Cayman Islands Data Protection Law

You have the following rights regarding your personal data. All requests are free of charge and will be responded to within 30 days.

• Right to Access: Request a copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: Correct inaccurate or incomplete information.
• Right to Erasure (Right to be Forgotten): Request deletion of your data where no legal obligation to retain it exists.
• Right to Restrict Processing: Limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing for direct marketing or legitimate interests.
• Rights Related to Automated Decision-Making: Request human intervention for automated credit decisions.

To exercise any of these rights, please contact our Data Protection Officer (DPO) at dpo@vigorousbank.com or by post at the address above. You also have the right to lodge a complaint with the Cayman Islands Ombudsman at www.ombudsman.ky.

🛡️ How We Keep Your Money and Data Safe

Vigorous Bank employs multiple layers of security to protect your accounts:

• Strong Customer Authentication (SCA): Required for all electronic payments and sensitive account actions.
• Biometric Login: Fingerprint and facial recognition available on our mobile banking app.
• Real-Time Alerts: Instant SMS, email, or push notifications for transactions over $1,000 KYD, failed login attempts, and profile changes.
• Card Lock/Unlock: Instantly disable your debit or credit card from mobile banking if lost or stolen.
• Secure Messaging: All communication through online banking is encrypted and audited.
• Regular Security Audits: Independent penetration testing and vulnerability assessments conducted quarterly.
• Employee Training: Mandatory data protection and cybersecurity training for all staff, refreshed annually.

🍪 Cookies & Online Tracking

Our website and online banking platform use cookies to enhance your experience, remember your preferences, and analyse site traffic. We use the following types of cookies:

• Strictly Necessary Cookies: Required for core functionality (login, security, session management). Cannot be disabled.
• Functional Cookies: Remember your preferences (language, region).
• Analytics Cookies: Help us understand how visitors use our site (anonymised data).
• Marketing Cookies: Used only with your explicit consent for personalised advertising.

You can manage your cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may affect website functionality.

⏱️ How Long We Keep Your Data

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and regulatory requirements. Typical retention periods:

• Account and transaction data: 7 years after account closure (per anti-money laundering laws).
• Loan and mortgage records: 7 years after full repayment or account closure.
• Marketing consents: Until you withdraw consent, plus 2 years.
• Call recordings: 6 months for general enquiries, 7 years for complaints or disputed transactions.

After the retention period, your data is securely deleted or anonymised for analytical purposes.

🧠 Zero Trust & Cyber Resilience Framework

Vigorous Bank operates a strict Zero Trust architecture — we never trust, always verify. Every access request is authenticated, authorized, and encrypted continuously. Our cyber resilience includes real-time threat hunting, deception grids, and isolated micro-segmentation for critical systems. We maintain 99.999% availability for core banking with geographic redundancy across our Caribbean data centres.

Additionally, we provide every customer with a free digital identity monitoring service that scans the dark web for compromised credentials linked to your email or phone number.

🌱 Ethical Data Use & Green Digital Pledge

Vigorous Bank is proud to combine privacy with sustainability. Our servers run on renewable energy, and we use AI models optimized for low carbon footprint. We never profile customers based on sensitive attributes, and all algorithmic decisions undergo fairness audits twice a year. Your data is never used for unethical surveillance or price discrimination.

🐞 Vulnerability Disclosure & Bug Bounty

We invite security researchers to report vulnerabilities via our responsible disclosure program. Vigorous Bank offers financial rewards for qualifying security findings. Report securely to security@vigorousbank.com — we guarantee a response within 48 hours and legal protection for good-faith research.

🌍 Global Transaction Shield

For customers transacting internationally, we offer an optional Global Transaction Shield feature: geo-velocity checks, currency pattern analysis, and automatic suspicious transaction holds. All cross-border data flows are protected with advanced encryption and comply with international data transfer agreements.

🚨 What to Do If You Suspect Fraud or a Security Issue

If you believe your account has been compromised, you have received a suspicious communication claiming to be from Vigorous Bank, or you notice unauthorised transactions:

1. Call us immediately: +1 345 999 0000 (24/7 fraud hotline).
2. Lock your cards: Use mobile banking or call the number above.
3. Change your online banking password: Do this from a trusted device.

Remember: Vigorous Bank will never call, text, or email you asking for your full PIN, password, or to move money to a "safe account". If in doubt, hang up and call us back on a number you trust.

👶 Children's Privacy

Our student and young adult accounts (ages 13-17) require parental or guardian consent. We do not knowingly collect personal data from children under 13 without verifiable parental consent. For accounts held by minors, parents have access rights and can review transaction history.

📅 Updates to This Privacy & Security Statement

We may update this statement periodically to reflect changes in legal requirements, our services, or security practices. The "Last Updated" date at the bottom of this page indicates when changes were made. Material changes will be communicated to you via email or a prominent notice on our website. We encourage you to review this page regularly.

📬 Contact Our Data Protection Officer

If you have any questions about this Privacy & Security Statement, or wish to exercise your data protection rights, please contact:

Data Protection Officer
Vigorous Bank
60 Nexus Way, Camana Bay, Grand Cayman KY1-9006, Cayman Islands
Email: dpo@vigorousbank.com
Phone: +1 (345) 999-0000 (ask for Data Protection Office)

For general enquiries, please email contact@vigorousbank.com.