Data Privacy Notice

GILBERT ALLEN & CO NOTIFICATION TO CLIENT DATA SUBJECTS TO SATISFY ART. 13/14

1. Data protection under the EU General Data Protection Regulation (EU GDPR)

The EU GDPR aims to harmonize data protection law across EU Member States and introduces higher data protection standards as well as transparency of personal data collection and processing for our clients. This privacy notice contains general information on what personal data GILBERT ALLEN & CO collects, what it does with that information, and what rights you have. If you have any questions or comments, please contact j.d@gilbert-allen.co.uk
‘Personal data’ is any information that relates to an identified or identifiable natural person (rather than to a legal entity, such as a company).
As part of our commitment to protect your personal data in a transparent manner, we want to inform you:

• why and how GILBERT ALLEN & CO collects, uses and stores your personal data;
• the lawful basis on which your personal data is processed; and
• what your rights and our obligations are in relation to such processing.

2. What types of personal data do we collect?

GILBERT ALLEN & CO (“GILBERT ALLEN & CO”, “we”, “our”, or “us”) will, depending on the service we provide to you (if any), collect and process personal data about you including:

• personal details such as your name, identification number, date of birth, documents (including a copy of your national identity card or passport), phone number, physical and electronic address, and family details such as the name of your spouse, partner, or children;
• financial information, including payment and transaction records and information relating to your assets (including fixed properties), financial statements, liabilities, taxes, revenues, earnings and investments (including your investment objectives);
• tax domicile and other tax-related documents and information;
• where applicable, professional information about you, such as your job title and work experience;
• details of our interactions with you and services you use;
• identifiers we assign to you, such as your client code, including for accounting purposes;

If relevant to the services we provide to you, we will also collect information about your business partners (including other shareholders or beneficial owners), dependants or family members, representatives, and agents. Before providing GILBERT ALLEN & CO with this information, you should provide a copy of this notice to those individuals.

3. On which legal basis and for which purposes do we process personal data?

3.1 Legal basis for processing

Depending on the purpose of the processing activity (see section 3.2), the processing of your personal data will be one of the following:

• necessary for the legitimate interests of GILBERT ALLEN & CO, without unduly affecting your interests or fundamental rights and freedoms (see below);
• necessary for taking steps to enter into or executing a contract with you for the services you request, or for carrying out our obligations under such a contract, such as when we use your data for some of the purposes in sections 3.2(a), (b) (c) and (j) below (as well as certain of the data disclosures described in section 4);
• required to meet our legal or regulatory responsibilities, including when we conduct the checks referred to in section 3.2(a) below and make the disclosures to authorities, regulators and government bodies referred to in sections 3.2(g) and 4 below;
• in some cases, necessary for the performance of a task carried out in the public interest;
• when we use special categories of personal data, necessary for establishing, exercising or defending legal claims or where the processing relates to personal data manifestly in the public domain; and
• in limited circumstances, processed with your consent which we obtain from you from time to time (for instance where required by laws other than the EU GDPR), or processed with your explicit consent in the case of special categories of personal data such as your medical information.
Examples of the ‘legitimate interests’ referred to above are:
• pursuing certain of the purposes in sections 3.2(a) to 3.2(k) below;
• exercising our rights under Articles 16 and 17 of the Charter of Fundamental Rights, including our freedom to conduct a business and right to property;
• when we make the disclosures referred to in section 4 below, providing products and services and assuring a consistently high service standard across the GILBERT ALLEN & CO Group, and keeping our customers, employees and other stakeholders satisfied. More information about what this entails can be found in section 11; and
• meeting our accountability and regulatory requirements,
in each case provided such interests are not overridden by your privacy interests.
To the extent GILBERT ALLEN & CO has obtained your consent to process ordinary personal data in the past in any product-specific terms and conditions for the purposes of data protection law only, GILBERT ALLEN & CO will no longer rely on such consent, but instead will rely on lawful grounds of compliance with a legal obligation, contractual necessity or legitimate interests (as specified in this notice), and GILBERT ALLEN & CO’ ability to rely on that consent is hereby waived or extinguished. For the avoidance of doubt, any consent given for any other reason, for instance (and if applicable) e-Privacy (including direct marketing) or banking secrecy, remains unaffected by this paragraph.

Where the personal data we collect from you is needed to meet our legal or regulatory obligations or enter into an agreement with you, if we cannot collect this personal data there is a possibility we may be unable to on-board you as a client or provide products or services to you (in which case we will inform you accordingly).

3.2 Purposes of processing

We always process your personal data for a specific purpose and only process the personal data which is relevant to achieve that purpose. In particular, we process personal data for the following purposes:

• client on-boarding processes, including to verify your identity and to conduct legal and other regulatory compliance checks (for example, to comply with anti-money laundering regulations, and prevent fraud);
• providing services to you and ensuring their proper execution, for instance by ensuring that we can identify you.
• managing our relationship with you, including communicating with you in relation to the services you obtain from us, handling customer service-related queries and complaints, making decisions regarding your identity, tracing your whereabouts.
• taking steps to improve our products and services and our use of technology, including testing and upgrading of systems and processes.
• meeting our on-going regulatory and compliance obligations (e.g. anti-money-laundering and tax laws), including in relation to recording and monitoring communications, disclosures to tax authorities, financial service regulators and other regulatory and governmental bodies, and investigating or preventing crime;
• ensuring the safety of our customers, employees;

4. Who has access to personal data and with whom are they shared?

4.1 Third Parties

When providing products and services to you, we might share personal data with persons acting on your behalf or otherwise involved in the transaction (depending on the type of service you receive from us).

4.4 Public or regulatory authorities

If required from time to time, we disclose personal data to public authorities, regulators or governmental bodies, including when required by law or regulation, under a code of practice or conduct, or when these authorities or bodies require us to do so.

4.5 Others

• If our business is sold to another organisation or if it is re-organised, personal data will be shared so that you can continue to receive products and services. We will usually also share personal data with prospective purchasers when we consider selling or transferring part or all of a business. We take steps to ensure such potential purchasers keep the data secure.
• If you exercise your right to data portability, we will usually disclose your personal data to an intermediary that facilitates data portability in accordance with applicable law and regulations.
• We will disclose personal data where required to exercise or protect legal rights, including ours and those of our employees or other stakeholders, or in response to requests from individuals or their representatives who seek to protect their legal rights or such rights of others.

5. International transfers of personal data

The Recipients referred to in section 4 above can be located outside the European Economic Area. In those cases, except where the relevant country has been determined by the European Commission to provide an adequate level of protection, GILBERT ALLEN & CO requires such recipients to comply with appropriate measures designed to protect personal data contained within a binding legal agreement. A copy of these measures can be obtained by contacting the Data Protection Officer (“DPO”) at the address at the end of this notice.
A list of the countries in which GILBERT ALLEN & CO operates (inside and outside the EEA) can be found here: www.Gilbert Allen & Co.com/privacy-statement. Details of other countries to which GILBERT ALLEN & CO may transfer your data from your country, and the reasons for those transfers, are set out in section 11 below.

6. How long do we store your data?

We will only retain personal data for as long as necessary to fulfil the purpose for which it was collected or to comply with legal and regulatory requirements. To help us do this, we apply criteria to determine the appropriate periods for retaining your personal data depending on its purpose, such as advising on future transactions, tax planning and responding to legal claims or regulatory requests. In most cases this will mean holding your data indefinitely unless you request otherwise.

7. Your rights

You have a right to ask GILBERT ALLEN & CO to rectify inaccurate personal data we collect and process and the right to request restriction of your personal data pending such a request being considered.

Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Please also note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

You have a right to ask us to stop processing your personal data, or to request deletion of your personal data (known as the ‘right to be forgotten’) – these rights are not absolute under the EU GDPR (as sometimes there may be overriding interests that require the processing to continue, for example), but we will consider your request and respond to you with the outcome. When personal data are processed for direct marketing purposes, your right to object extends to direct marketing, including profiling to the extent it is related to such marketing. You may object to direct marketing by clicking the “unsubscribe” link in any of our emails to you, or by emailing us at j.d@gilbert-allen.co.uk at any time.

Where we process your personal data on the basis of your consent, or where such processing is necessary for entering into or performing our obligations under a contract with you, you may have the right to request your personal data be transferred to you or to another controller (known as the ‘data portability’ right). You also have the right to ask GILBERT ALLEN & CO for a copy of some or all of the personal data we collect and process about you.

In certain circumstances GILBERT ALLEN & CO may process your personal data through automated decision-making, including profiling. Where this takes place, you will be informed of such automated decision-making that uses your personal data, be given information on the logic involved, and be informed of the possible consequences of such processing. In certain circumstances, you can request not to be subject to automated decision-making, including profiling.

You can exercise the rights set out above using the details in section 8 of this notice.

8. Exercising your rights, and complaints

If you are not satisfied with any aspect of the processing of your personal data by GILBERT ALLEN & CO, we would like to discuss it with you to understand how we can rectify the issue. If you would like to speak to us about our use of your personal data, you can do this:

by contacting John Duncan on 01732 770100 or emailing j.d@gilbert-allen.co.uk
If you are not satisfied with GILBERT ALLEN & CO’s response, you have the right to make a complaint to the data protection authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen.

9. Security Note

We have in place appropriate technical and organisational measures to prevent unauthorised or unlawful access to the personal data you have provided to us. As complete data security cannot be guaranteed for communication via e-mails, instant messaging, and similar means of communication, we would recommend sending any particularly confidential information by an alternative secure means.

10. Changes to personal data

We are committed to keeping your personal data accurate and up to date. Therefore, if your personal data changes, please inform us of the change as soon as possible.

12. Status of this privacy notice

This privacy notice was updated in May 2018. It is a notice explaining what GILBERT ALLEN & CO does, rather than a document that binds GILBERT ALLEN & CO or any other party contractually. We reserve the right to amend it from time to time. If the notice has been updated, we will take steps to inform you of the update by appropriate means, depending on how we normally communicate with you, such as through your account statement.