Version 2.0
Updated: 12 September 2026
We have put together this privacy policy to let you know:
The data controller responsible for the processing of your personal data described in this privacy policy is:
One Finance Limited
Agora Business Centre Level 2
Triq Il-Wied Ta' L-Imsida
Msida MSD 9020, Malta
Registration number: C 108849
E-mail for data protection matters: support@onebanking.app
One Finance Limited is a company organised under the laws of Malta ("oneBanking", "we", "us", "our"). We operate the website onebanking.app and the oneBanking App (jointly the "Platform").
oneBanking does not currently provide payment, e-money, investment or crypto-asset services and does not hold or transfer customer funds. Balances and transactions shown in the beta version of the oneBanking App are simulated test data. We therefore do not process payment or transaction data relating to real funds.
We also offer a Virtual Private Network (VPN) application called oneVPN, which is developed and maintained by our technology partner Netsepio Ltd. When you use oneVPN, personal data is also processed by Netsepio in accordance with Netsepio's own privacy practices. We remain responsible for integrating oneVPN into the oneBanking environment and for providing user support.
We process your personal data when you:
We collect personal data about you from the following sources:
We have divided the personal data we process into the following categories:
Under the GDPR, we must have a clear purpose and a valid legal basis for processing your personal data. At oneBanking, the legal basis for processing your personal data is one of the following:
We use the personal data we collect for the following purposes:
Administration and management of our relationship with you, such as reviewing your registration, setting up your Platform Account and providing Customer Support. The legal basis for such processing is the agreement you have entered into, or are about to enter into, with us, or our legitimate interest.
Provision of our services. The legal basis for the provision of our services is the agreement you have entered into with us.
Newsletter and product updates. If you subscribe to our newsletter or join our waitlist, we will keep you informed about our launch, new features and offers. The legal basis is your consent, which you can withdraw at any time via the unsubscribe link in each e-mail or by contacting us.
Accounting and auditing requirements. The legal basis for such processing is mandatory law, such as the Maltese Companies Act (Chapter 386 of the Laws of Malta), the Income Tax Act (Chapter 123 of the Laws of Malta) and other applicable legislation.
Business development and security, such as compiling statistics, analysing usage data to improve our services and protecting the Platform against misuse. The legal basis for such processing is our legitimate interest in maintaining our relationship with you, improving our services and keeping the Platform secure.
Assessing or defending legal claims and protecting ourselves from fraud, as well as in connection with a reorganisation, transfer of business, merger, IPO or acquisition. The legal basis for such processing is our legitimate interest in defending ourselves against legal claims, protecting our company from fraud and being able to reorganise or scale our business.
We share your personal data with trusted third-party service providers that act as our processors and process personal data only on our instructions:
We have carefully reviewed our service providers and ensured that their processing of your personal data complies with EU standards and the GDPR.
When you use oneVPN, your personal data is also processed by Netsepio Ltd., which acts as an independent controller for the operation of the VPN service (see section 10).
We may also disclose personal data to public authorities, courts or other third parties where we are required to do so by law or where necessary to establish, exercise or defend legal claims.
Some of our service providers operate outside the EU/EEA. In these cases, we ensure that the data is transferred in accordance with the applicable requirements of the GDPR, primarily on the basis of the European Commission's Standard Contractual Clauses (SCC) together with supplementary security measures, or, where available, other transfer mechanisms that comply with the GDPR.
If oneBanking engages in a merger, acquisition, reorganisation, sale of some or all of its assets or shares, financing, initial public offering or similar transaction or proceeding, or steps in contemplation of such activities (such as due diligence), oneBanking may share personal data with the third parties involved, subject to standard confidentiality arrangements.
We store your personal data for the purposes set out above during the term of our contractual relationship with you, for as long as we otherwise have meaningful contact with you, or as may otherwise be required by law.
When the purpose for which your personal data was collected is no longer relevant, we will stop processing your personal data and either delete or anonymise it securely. We may retain your personal data for an extended period to the extent required by law, if necessary to assess or defend legal claims, or to maintain our automated disaster recovery backup systems.
Under mandatory law, we are required to keep certain personal data due to:
Newsletter data is stored until you withdraw your consent.
As a data subject, you have the following rights under the GDPR:
To exercise any of these rights, please contact us at support@onebanking.app.
If you have any questions or concerns about oneBanking's processing of your personal data, please contact the data controller:
One Finance Limited
Agora Business Centre Level 2, Triq Il-Wied Ta' L-Imsida, Msida MSD 9020, Malta
E-mail: support@onebanking.app
In-app chat available
Hours: 09:00 – 17:00 CET, Monday through Friday
Languages: English and German
You have the right to lodge a complaint with a supervisory authority if you are not satisfied with our processing of your personal data. Our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), Malta, www.idpc.org.mt. You may also contact the supervisory authority in your country of residence; a list of all EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.
When you use the oneVPN application, the following categories of personal data are collected and processed:
This data is used to provide, maintain and improve the oneVPN service, ensure its security and respond to your inquiries. With your explicit consent, we may also send marketing communications related to oneVPN, which you can opt out of at any time.
Your information may be shared with Netsepio Ltd. and with carefully selected service providers that support the operation of oneVPN. When data is transferred outside the EU, we ensure that such transfers comply with GDPR requirements through mechanisms such as Standard Contractual Clauses (SCC).
For more information on how oneVPN processes your personal data, please review the oneVPN-specific privacy documentation in the app or on our website.
We may need to update this privacy policy, for example when we add new features to the services, due to changes in law or regulations, or as a result of evolving industry standards. You will be informed about material changes via e-mail or a notice in the Platform. The current version is always available at onebanking.app/privacy-policy.