The customer service is shocking. They restricted my account after I tried to pay with my new bank card. The wanted the first 6 digits and last 4 digits of the card. I used my Revolut card, so I sent this in as requested. They replied 10 days later to say they would also want a copy of a second card. If it was about security I would understand but why would they require a second card? They surely could have restricted my account to the one card I had provided. It is definitely in breach of GDPR. They also sent me an email containing 12 digits of my card. I'll take it they don't purge or encrypt their data which is really reassuring.