1. INTRODUCTION

This Privacy Notice explains how we, Key aspects , collect and use your personal data.

If you have questions about accessing, correcting or deleting your personal data then please refer to section 7 (Your rights) below.

2. OUR DETAILS

The data controller with conduct of your personal information is Key aspects of 71-75 Shelton Street, London.

3. HOW WE USE YOUR INFORMATION

We process your personal data differently depending on our relationship to you. Please read through the list below and then read the lettered sections of this Privacy Notice which apply to you. Section 4 (Anti-money laundering procedures) onwards will apply to everybody whose personal data we process so please be sure to read those sections afterwards.

4. ANTI-MONEY LAUNDERING PROCEDURES

We have a legal obligation to comply with anti-money laundering laws and regulations. Broadly, money laundering can arise if a person acquires, retains, transfers, uses or controls the proceeds of a crime for the benefit of a criminal activity. In this section, references to money laundering include references to similar financial offences committing in relation to terrorism.

In order to fulfil our legal obligations, we must verify the identity of new clients, and in certain circumstances existing clients. Additionally, from time to time our internal procedures may also require us to conduct background checks on new and existing clients.

This means that, if you are an individual client or prospective individual client of ours then we will need to verify your identity using a secure and confidential ID checking service operated by an external service provider. For individual clients, these identity and background checks may require us to take a copy of your photographic identification and a recent utility bill.

For clients or prospective clients which are not individuals, such as companies, we may need to verify the identity of directors, other officers, shareholders, beneficial owners and instructing employees or representatives of the organisation. The checks conducted on these persons are broadly the same as those we conduct on individual clients. We will therefore typically require a copy of the person’s photographic identification and a recent utility bill in order to complete the verification process. In the case of organisations having a different corporate structure, equivalent requirements will apply and we will notify you of these where applicable.

For both individuals and corporate clients (including prospective clients) we may require evidence of source of funds at the outset of our instruction and possibly from time to time throughout our relationship. We may request and/or obtain this information from third party sources. The sources for such verification may comprise documentation which we request from the client (or prospective client) and/or through the use of online sources.

In some circumstances we may decline to, or may not be permitted to, proceed to act until such procedures have been completed. In other circumstances we may agree to commence acting whilst these procedures are carried out. We reserve the right to decline to act or, if appropriate, cease to act should these procedures not be completed to our satisfaction. We may also be required to make detailed enquiries for any unusual transactions such as the transfer of large amounts of cash and such enquiries may result in us processing additional personal information.

Grounds for processing your data for anti-money laundering purposes

We process your information in the manner set out above on the following legal grounds:

• processing is necessary for the performance of a contract between you (as a private individual) and us, including where processing is necessary for us to take pre-contractual steps. This will be the case where we are legally prevented from acting for you until the relevant checks and procedures have been completed;
• where we have a contractual relationship with the organisation you work for or represent, because we have a legitimate interest to process your information to ensure that we are not involved in or otherwise facilitate money laundering activity and such interests do not outweigh your rights and freedoms as a data subject;
• processing is necessary for our compliance with our legal obligations under anti-money laundering laws and regulations; and/or
• should the processing we conduct in line with our anti-money laundering procedures exceed the minimum level of processing required by the relevant law and regulations, because we have a legitimate business interest in taking additional precautions to ensure that we are not involved in or otherwise facilitate money laundering activity. In accordance with data protection law, we have considered your fundamental rights and interests as a data subject and are satisfied that our processing is lawfully justified.

Disclosure of your information to third parties for anti-money laundering purposes

For the purposes of carrying out our electronic ID checks, we may share your information with our external ID check providers. Such providers are subject to strict contractual obligations to treat your personal information with the utmost sensitivity, to keep it confidential and to comply with data protection law at all times.

Your information may be transferred outside of the UK depending on which of our internal systems your information is stored within. However, any such transfers are carried with appropriate safeguards in place. These safeguards will typically involve the recipient signing an international data transfer agreement which upholds the level of protection given by UK data protection law.

In certain circumstances, we may process your personal information without further notification to you. This applies, for example, where we make a report in good faith under the Terrorism Act 2000 or Proceeds of Crime Act 2002. Such processing is justified under data protection law on the basis that it is in the substantial public interest.

Retention of personal data for anti-money laundering purposes

We are legally obliged to retain your personal information for anti-money laundering purposes for 5 years from the end of the business relationship or transaction between us. Please refer to our retention periods set out in the appropriate sections of this Privacy Notice, above.

5. AUTOMATED DECISION MAKING

We do not make automated decisions about you based on your information. Should this change then we will let you know.

6. CALL RECORDING

Occasionally we may need to record a telephone call we have with you. This may be in order to collect evidence, to protect our staff or otherwise to create a record of what is being said. We will inform you of our intention to record the call before we start recording. We process your personal information comprised in that call recording on the basis that we have a legitimate interest in doing so. Once recorded, your personal information will otherwise be processed in accordance with one or more of the preceding Sections A to F, depending on our relationship with you.

7. YOUR RIGHTS

Under data protection law you have the following rights:

• the right to be informed as to what we do with your information. This includes but is not limited to the right to know what information we gather, process and store, what we do with it, who we share it with and how long we keep it for. This information is setout out in this privacy notice. Please note that, as set out in the above section 4 (Anti-money laundering procedures), in certain circumstances we are legally obliged not to disclose certain processing information to you. If you have any questions then please contact our Data Protection Officer using the details set out at section 11 (Contact) below;
• if we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Depending on the context of our processing, consent can be withdrawn by:
  • notifying us using the information set out at section 11 (Contact) below;
  • clicking the opt-out/unsubscribe link in our email marketing communications; or
  • speaking to the lawyer who is working on your matter, please note that the lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent. Furthermore, we may have a legal obligation or right to retain your information on our files notwithstanding that you have withdrawn your consent to our processing. Should this be the case, we will notify you around the time we acknowledge your withdrawal of consent;
• the right to access a copy of your information which we hold. This is sometimes called a ‘subject access request’. Additional details on how to exercise this right are set out in section 9 (Access to information), below;
• the right to prevent us processing your information for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by leaving unticked certain boxes on the forms we use to collect your data or by contacting us using the details set out in section 11 (Contact) below;
• the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing;
• the right to object to us processing your personal information in certain other situations;
• the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate;
• the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law;
• enhanced rights to request that we erase, rectify cease processing and/or delete your information; and
• in certain circumstances, the right to request the information we hold on you in a machine readable format so that you can transfer it to other services. This right is called ‘data portability’. Additional details on how to exercise this right are set out in section 9 (Access to information), below.

For further information on your rights under data protection law and how to exercise them, you can contact Citizens advice Bureau or the Information Commissioner’s Office.

If you wish to complain about how we have handled your personal information then you have the general right to complain to us (in the first instance) and, if you are not satisfied by our response and depending on the nature of the complaint, to the Information Commissioner’s Office and/or the Legal Ombudsman (in the second instance). Our contact details are set out in section 11 (Contact) below and full details of our complaints procedure are available on request.

8. ACCESS TO INFORMATION

Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You may need to send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you.

Requests should be sent to your usual point of contact and copied to our Data Protection Officer by email or by post to The Data Protection Officer, Key aspects, 71-75 Shelton Street, London. We will initially respond to you to confirm the timeframe that is applicable to your request.

If you are requesting copies of documents you already possess, we may charge our reasonable administrative costs. We will also be allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are also entitled to refuse to comply with your request if it is particularly onerous.

In certain circumstances, you may be entitled to receive the information in a structured, commonly used and machine readable form.