Quick answer: every transfer creates a data trail that runs from your phone to at least three companies — your provider, an identity vendor and the paying bank. Under GDPR you can request a copy of that file, but you cannot stop the sharing: anti-money-laundering law requires it. What you control is which provider you use and how much extra data you hand over.
A EUR 200 transfer to Manila can generate a record holding your passport scan, a selfie, your source of funds and your recipient's bank details. Knowing what is in that file is the difference between a routine transfer and a problem you find out about years later.
What gets collected
- Identity: name, date of birth, nationality, address, ID images, sometimes a selfie.
- Financial: source of funds, occupation, salary band, bank and card numbers.
- Recipient: name, address, bank or wallet details, relationship to you.
- Technical: IP address, device ID, app version, login location.
- Behavioural: typing speed, tap pressure — fed into fraud scoring.
Who actually sees your data
| Party | What they see | Why |
|---|---|---|
| Your provider | Everything above | KYC, fraud checks |
| Identity vendor | ID images, selfie, address | Document verification |
| Screening vendor | Name, DOB, nationality | Sanctions, PEP checks |
| Correspondent bank | Name, account, amount | Payment execution |
| Payout partner | Recipient details, amount | Local delivery |
| Regulator | Anything, on request | Supervision |
What the provider is legally required to tell you
If the provider serves customers in the EU or UK, its privacy notice is not optional marketing text. Data protection law lists the items that must appear before or at the moment your data is collected:
- The identity and contact details of the controller — the legal entity, not just the app brand.
- Contact details for the data protection officer, where one is appointed.
- Each purpose of processing and the legal basis for it: contract, legal obligation, legitimate interest or consent.
- Where the legal basis is legitimate interest, what that interest actually is.
- The categories of recipients — identity vendors, screening vendors, correspondent banks, payout partners.
- Any transfer outside the EEA or UK, the safeguard used and how to obtain a copy of it.
- The retention period, or the criteria used to set it.
- Your rights: access, rectification, erasure, restriction, objection and portability, plus the right to complain to a supervisory authority.
If a provider cannot answer those eight points in writing, that is a governance problem, and it usually shows up later as a slow refund or an unexplained account freeze. It is worth reading that page before the first transfer rather than after the fifth.
How long the file survives
Retention is set by law, not by an app settings screen. The dominant rule across regulated markets is five years from the end of the business relationship or from the transaction, with a few jurisdictions going further. Deleting your account does not delete the file.
| Jurisdiction | Typical AML record retention | Practical effect for you |
|---|---|---|
| European Union | Five years after the relationship ends; member states may extend by up to five more | Copy of your file is available, deletion is not |
| United Kingdom | Five years after the relationship ends | Same position as the EU post-Brexit |
| United States | Five years for money transmitters | Records may sit with the state regulator as well |
| Australia | Seven years | Longer tail than the EU on the same transfer |
| Singapore, UAE, India | Five years under the local AML regime | Local payout partner keeps its own copy |
Two consequences follow. First, a transfer made today can still be reconstructed in 2031, including the IP address and device used. Second, the same transfer can exist in three separate five-year clocks — the sending provider, the correspondent bank and the payout partner — so a request to one company does not clear the record everywhere.
What you can demand
You can request a free copy of your data, ask for corrections, and complain to a data protection authority. Erasure is blocked by AML retention rules, but that does not leave you with nothing:
- Access: a copy of the personal data being processed, plus the purposes, categories and recipients.
- Rectification: wrong address, misspelled name, outdated phone number.
- Restriction: processing limited while a dispute about accuracy is resolved.
- Objection: a stop to processing based on legitimate interest, such as some marketing and profiling.
- Portability: data you supplied, in a machine-readable format, where processing rests on contract or consent.
How to file a data access request in practice
- Identify the controller. Look for the legal entity name in the privacy policy footer, not the app name in the store listing.
- Write, do not phone. Use email or the in-app form so a timestamp exists. Ask for "a copy of all personal data held about me, with the purposes, recipients and retention period".
- Expect identity checks. The provider must verify the requester, so a passport copy is normal here. Send it through the official channel only.
- Count the deadline. One month is the standard response window, extendable by two further months for complex or multiple requests, with notice of the extension.
- Escalate if ignored. A complaint to the supervisory authority in the provider's country costs nothing and creates a paper trail. In the EU, fines can reach EUR 20 million or 4% of global turnover.
A short request is enough: "I am a customer, I request access to my personal data under Article 15 GDPR, including the categories of recipients and the retention period. Please confirm receipt and the deadline." Vague requests get vague answers, so name the article and the items you want.
What you can legitimately refuse to hand over
Data minimisation is a legal principle, not a preference: a provider may only collect what is necessary for the stated purpose. In practice that gives you room to push back on requests that are clearly unrelated to moving money.
- Social media handles, unless the provider can explain the fraud or sanctions link.
- Employer letters or payslips for a small transfer that is already funded from a bank account in your own name.
- Marketing consent bundled into onboarding — consent must be separable and refusable.
- Biometric selfies where a document check and a liveness test already satisfy the rule, in jurisdictions that treat biometrics as a special category.
Refusing something the provider genuinely needs will stall the transfer, so read the request before objecting. The test is simple: is this item tied to a stated purpose, and is the same purpose already met by something you have supplied?
Where your data crosses borders
Most remittance groups run operations, support desks and cloud infrastructure outside the customer's country, so a transfer from Europe to Asia can move personal data in the opposite direction as well. Two mechanisms do the legal work: an adequacy decision, where the destination country is pre-approved, and standard contractual clauses, a set of approved terms signed by both companies. The United Kingdom, Switzerland, Japan, Canada, Israel, New Zealand, South Korea and the United States under the Data Privacy Framework are commonly relied on for the first route; everything else usually runs on clauses plus a transfer risk assessment.
What matters for a sender is not the legal name of the mechanism but whether the provider states it. "We may transfer data internationally" is not an answer. "We transfer to the Philippines under standard contractual clauses, and you can request a copy" is.
Five checks before you send
- Search the privacy policy for "retention", "third parties" and "marketing". Nothing stated? Ask support.
- Check the provider is licensed in your jurisdiction — a licence in a weak regime gives weak recourse.
- Give only what is required; a national ID number is rarely needed for a wallet transfer.
- Use a dedicated email for financial accounts, so phishing is easy to spot.
- Treat any post-transfer message asking you to "confirm" details as fraud.
Red flags in a privacy policy
| What you see | Why it matters |
|---|---|
| No legal entity, only a brand name | No clear controller to send a request or complaint to |
| Retention described as "as long as necessary" | The law requires a period or the criteria used to set it |
| Recipients listed as "partners" without categories | You cannot tell whether banks, brokers or advertisers receive the data |
| Rights mentioned but no contact route | Access requests quietly go nowhere |
| Marketing consent pre-ticked | Consent obtained that way is not valid consent |
| No mention of international transfers | A global provider that claims to keep everything local is either wrong or vague |
Related guides
- KYC for International Money Transfers in 2026
- Verification of Payee in 2026: How Beneficiary Name Checks Work
- Sent Money to the Wrong Account? How to Recover a Transfer
- How to Cancel or Refund an International Transfer in 2026
- How to Compare Money Transfer Providers in 2026
- How to Check if a Provider Is Legit
Frequently asked questions
1. Can I send money without giving my ID?
Only below small thresholds; above roughly EUR 1,000 verification is mandatory.
2. Does my recipient see my data?
Only your name, sometimes your address. Your ID and date of birth are not shared.
3. Do remittance apps sell my data?
Not usually to brokers, but marketing and analytics vendors are common. Opt out where offered.
4. Is a bank safer than an app?
Not automatically. Banks share data with correspondent and screening vendors too.
5. Can I delete my account and records?
You can close the account; records stay for the legal retention period.
6. Are wallet transfers less private?
They expose a phone number and wallet ID instead of an IBAN. Identity data is the same.
7. How do I report a provider mishandling my data?
Complain to the provider, then to your data protection authority. Keep the reference.
8. What if the provider goes bankrupt?
Records are an asset and may transfer to an administrator; retention duties continue.
9. Can I ask for the data my provider sent to a bank abroad?
Yes. An access request covers the data and the categories of recipients, including correspondent banks and payout partners. You may not receive the internal risk score itself, because scoring models and thresholds are often treated as confidential, but you are entitled to know that automated checks were applied and to ask for human review of a decision that affected you.
10. Does closing my account stop marketing emails?
Not always. Marketing based on consent ends when consent is withdrawn, which is a separate action from closing the account. Use the unsubscribe route and, where the provider relies on legitimate interest instead, object in writing so the request is on record.
The bottom line
You cannot opt out of remittance data collection, and you should not want to — those records are what make a misdirected payment recoverable. Choose providers that state their retention period, hand over only what is required, and treat every post-transfer message as fraud.
Affiliate Disclosure: This page may contain links to affiliate partners. If you click and make a purchase, we may earn a small commission at no extra cost to you. Our recommendations are based on research, not on compensation received.