I will reformulate the question: under which of the 6 legal basis defined by the GDPR you feel is adequate to justify the processing of the financial data of a user ? Your Privacy Notice does not give that information as it simply says: "If you are from the European Economic Area (“EEA”), our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it."
You must explicitly specify the legal basis for each of the processing you are doing.
I am putting this discussion public to give you a chance to show to your EU customer you are actually willing to follow regulations.
Last edited by fransknorge; Aug 10, 2018 at 1:16 am