Privacy policy

1. The organisations involved

Primores Group Ltd, trading as Sarafi Bartar London (company number 13465962, registered office 1 King Street, London W6 9HR), runs this website and the Sarafi Bartar customer channel. Primores is the controller for the information it uses to run the website and to answer enquiries made to Sarafi Bartar by phone, email or WhatsApp (section 1a).

Persici Financial Services Limited provides the regulated payment service. Persici acts as the data controller for personal information processed for its payment services, customer due diligence, transactions, regulatory records and complaints, even where Sarafi Bartar introduced you. Registration, orders and order tracking take place on Persici's customer portal.

Contact Primores (Sarafi Bartar): email info@primores.co.uk, call +44 20 7112 8809 or write to Primores Group Ltd, 1 King Street, London W6 9HR.

Contact Persici: its Data Protection Contact at queries@pfs.ltd (mark the message Data Protection Contact), call +44 (0)3333 446 307 or write to Data Protection Contact, Persici Financial Services Limited, 197E Hagley Road, Birmingham B16 9RD. Persici is registered with the Information Commissioner's Office (ZA906128). Sarafi Bartar can receive an enquiry and help direct it to the appropriate team.

1a. Website and enquiries (Primores)

• Enquiries: when you contact Sarafi Bartar by phone, email or WhatsApp, we use your name, contact details and what you tell us to answer you, explain our services and help you place or track an order. Lawful basis: our legitimate interest in answering enquiries and, where you are considering a transfer, steps you ask us to take before a contract. If your enquiry concerns an order or payment service, we may pass it to Persici to deal with.
• Running the website: our hosting provider processes technical information such as IP address, browser and device type and the time of each request to deliver the website and keep it secure. Lawful basis: our legitimate interest in a secure, reliable website.
• Staff accounts: the staff area of the website uses sign-in accounts for authorised staff only.
• What the website does not collect: there is no contact form or order form on this website, and newsletter sign-ups are not currently offered.
• Service providers: Lovable (website platform and hosting), Supabase (database for exchange rates and staff sign-in), our email provider and WhatsApp process information on our behalf or as part of the service you choose to use. Some providers may process information outside the UK; where that happens, UK data-protection law requires appropriate safeguards and you can ask us about them.
• How long: enquiry details and messages are kept only as long as needed to answer you and deal with any follow-up, and longer only where needed for a complaint, a legal claim or a legal requirement. Anything that becomes part of a customer record is kept under section 9.

2. Information we may collect

• Name, contact details, address and identification information.
• Account, login, verification and security information.
• Source-of-funds and source-of-wealth evidence, transaction purpose, recipients, bank details, rates, fees, receipts and payment status.
• Screening, risk-assessment, fraud-prevention and compliance records.
• Messages, questions, complaints and communications preferences.
• IP address, device and browser information, login activity, security logs and cookie preferences.
• Limited card-payment information provided by the payment processor, such as card type, last four digits and authorisation status. We do not intentionally store full card numbers or card security codes.

Additional information may be required in particular circumstances; we do not collect all categories from every visitor.

3. Where information comes from

We receive information from you, people legitimately connected with an order, our agent and support staff, financial institutions, card processors, identity-checking and sanctions-screening providers, public registers, regulators and other lawful sources. We may also create administrative, risk and audit records when reviewing transactions or providing services.

4. Why we use information

Information may be used to answer enquiries; open or maintain a customer profile; verify identities; assess and process orders; provide tracking and receipts; protect accounts and payment systems; prevent fraud; comply with anti-money-laundering and sanctions rules; maintain records; resolve disputes and complaints; and improve website reliability and service quality.

Our lawful bases can include taking steps towards or performing a contract, legal obligations, legitimate interests and consent where required. For sensitive or criminal-offence information, an additional lawful condition may be needed. Identity checks that use facial images or liveness checks may involve biometric information, used for identity verification, fraud prevention and financial-crime compliance.

Risk rules and screening tools may flag an issue or suggest a review, but staff review the relevant information before a significant decision is made.

5. Financial-crime and verification records

Payment-service providers must carry out identity and transaction checks. Some information is collected because of legal duties and may have to be retained even if you ask for deletion. Certain investigations or suspicious-activity information may not be disclosed where law restricts disclosure.

6. Who may receive information

Information can be shared where necessary and lawful with the payment-service provider, Sarafi Bartar as agent, banks, card companies, payment processors, identity and screening providers, hosting and communications providers, professional advisers, auditors, regulators, law enforcement and other relevant payment participants. We do not sell personal information.

7. International transfers

Some payment and verification activities can involve recipients outside the UK. Where personal information is transferred internationally and UK data-protection law requires safeguards, the responsible controller will use an appropriate legal mechanism or permitted exception.

8. Information security

We use proportionate measures to control access, verify users and protect records. No digital system can be guaranteed completely secure. Never send passwords, one-time codes, full card information or sensitive identity documents over ordinary email, SMS or messaging apps unless you have been specifically directed to a secure method. When documents or bank details are needed, Persici asks for them through its customer portal, an order-tracking link or another secure link.

WhatsApp is an approved channel for contacting Sarafi Bartar. Please do not send identity documents, bank or card details, passwords or one-time codes by WhatsApp unless we have asked you to and told you how. Messages are kept on WhatsApp only for a short period; anything that must be kept is copied to your customer record and retained under this policy. Keep your phone and WhatsApp account secure.

9. How long information is kept

Records are retained only while there is a lawful reason. Customer-due-diligence and supporting transaction records required by money-laundering rules are generally kept for five years after the relevant customer relationship ends or the occasional transaction is completed, unless another lawful retention requirement applies. Other records may be retained for accounting, complaints, fraud prevention, security or legal claims.

10. Your privacy rights

Depending on the circumstances, you may request access to your information, correction, deletion, restriction, portability or object to certain processing. You can withdraw consent where consent is the lawful basis; this does not undo earlier lawful processing or prevent retention required by law. You may object to direct marketing at any time.

To make a request about information Sarafi Bartar uses for the website and enquiries, contact info@primores.co.uk; for information about payment services, contact Persici at queries@pfs.ltd. We may need to verify your identity before releasing information.

11. Marketing and service messages

Sarafi Bartar does not currently send marketing newsletters. Messages required for an order, verification, security or a legal notice are different from marketing. Marketing is sent only where permitted by law. You can unsubscribe or object to direct marketing. Information collected solely for anti-money-laundering purposes is not repurposed for marketing unless that further use is lawful and any necessary express consent has been obtained.

12. Website cookies and similar tools

Some technologies are needed for essential features and security; others, such as marketing or certain analytics technologies, may require your consent. The Cookie Policy explains what this website uses and your choices.

13. Questions and complaints

Please contact the relevant data controller using the details above. Persici acknowledges a data-protection complaint within 30 days. You may also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.