Legal

Whistleblowing Policy

If you see something wrong at Tuppence, we want to know. Here is how to tell us, what we will do and how we protect you.

Effective October 8, 2026 Last reviewed October 8, 2026 Version 1.1

1. Why this matters

Businesses trust Tuppence with their payments and their customers’ data. If something is going wrong, whether fraud, a security weakness that is being ignored or a breach of the law, the people closest to it are often the first to notice. Tuppence AI Ltd, which operates Tuppence, wants them to speak up early and safely.

2. Who can use it

Anyone can use this policy: our director, anyone who works for us or with us (including contractors, partners and suppliers and their staff), businesses that use Tuppence, and members of the public.

This policy is for concerns about wrongdoing. If you are unhappy with our service, please use our complaints procedure. To report a security vulnerability, see our security page.

3. What to report

Please tell us if you reasonably believe that any of the following is happening, has happened or is likely to happen, in connection with Tuppence:

  • a crime, such as fraud, theft, bribery, money laundering or a sanctions breach;
  • a failure to meet a legal obligation, including data protection and consumer law;
  • a breach of our payment partners’ or the card networks’ rules;
  • a danger to anyone’s health or safety, or damage to the environment;
  • a risk to the security of our systems, or of our customers’ money or data, that is being ignored;
  • modern slavery or human trafficking in our business or supply chain;
  • a deliberate attempt to cover up any of the above.

You don’t need proof, only a reasonable belief. You will not be in trouble if you are honestly mistaken.

4. How to raise a concern

  • By email to contact@tuppence.ai, with “Whistleblowing” in the subject line. Our director reads every whistleblowing report.
  • By post, marked “Private and confidential: whistleblowing”, to Tuppence AI Ltd, 38 Greenvale Road, London SE9 1PD, United Kingdom.

Say what you have seen, when and who was involved, and how we can contact you. You can raise a concern anonymously, but it is harder for us to investigate and to keep you updated if we can’t reach you. If your concern is about our director, you can raise it directly with the authorities in section 7.

5. What happens next

  1. We aim to acknowledge your concern within five business days.
  2. Our director, or someone independent if the concern is about our director, will look into it, confidentially and fairly. We may ask you for more information.
  3. Where we can reach you, we aim to tell you when we have finished and, as far as we can without breaching anyone else’s confidentiality or the law, what we found and what we have done.

6. How we protect you

  • Confidentiality. We will do our best to keep your identity confidential and to share it only with the people who need to know to investigate, unless the law requires otherwise. Where we can, we will tell you first if we have to disclose it.
  • No retaliation. We do not tolerate anyone being dismissed, having their contract ended, being disciplined, treated unfavorably or harassed for raising a concern in good faith. Anyone who works for us and retaliates against a whistleblower will face disciplinary action or the end of their engagement. Raising a concern does not stop us taking any step under a contract for reasons unrelated to it, such as under our Terms of Service.
  • Your legal rights. People working in the United States may also be protected by federal and state whistleblower laws. Nothing in this policy or in any agreement with us stops you from reporting a concern to a regulator or law enforcement, or from getting legal advice.

Deliberately making a false report, knowing it to be untrue, is not protected.

7. Reporting outside Tuppence

We hope you will feel able to come to us first, but you don’t have to. You can report a concern to the appropriate authority, for example:

  • the Information Commissioner’s Office, the UK data protection regulator that oversees us;
  • the Federal Trade Commission or your state attorney general, about consumer protection or privacy;
  • the Internal Revenue Service, about tax;
  • the FBI or local law enforcement, about fraud and other crimes.

8. Responsibility and review

Our director is responsible for this policy, asks everyone who works for us to read it when they join, and aims to review it at least once a year.

9. About this policy

This policy explains how we aim to handle concerns. It does not form part of any employment, engagement, customer or supplier contract, and it gives no contractual rights, promise or warranty beyond those the law gives you. We may change it at any time. Nothing in it, or in any agreement with us, limits your legal rights as a whistleblower, including your right to make a protected disclosure or to report to a regulator or law enforcement.