New regulations concerning Data Protection are coming into force in the UK with effect from 25 May 2018. The new regulations are called the General Data Protection Regulation (GDPR). The aim of the GDPR is to give further protection to people whose personal data is controlled or processed by third parties, such as Arena Wealth Partners LLP or Arena Wealth Management Limited, of which you are a client.
What personal data do we collect and what do we use it for?
In order to do the work which you have contracted us to perform for you, we need to process certain personal data relating to you. This data could include some or all of the following:
- Date of birth
- Telephone numbers
- Email addresses
- Passport information
- Tax identification numbers
- National insurance or social security numbers
- Bank account details
- Investment account details
- Similar data relating to your spouse and children
Most of this data has been provided to us by you but occasionally we obtain it from third parties you put us in touch with.
We have a duty to treat this data carefully and only use it for the purposes intended. In most cases, we will only use the data for the purposes of the performance of our work for you, to comply with any legal requirements, to protect our legal position or to pursue our legitimate interest of administering our business. If we need to use the data for other purposes, we will notify you and explain the legal basis that allows us to do so.
We will not store your personal data for longer than is necessary. However, we are obliged to keep some of this data for periods of six years or even longer in some cases in order to comply with tax law, for example. Our general policy is to keep client records for six years, and this will include the data listed above. After this time, the records are destroyed, unless the records relate to investment work in which case they will be kept until six years after the relationship ends.
We have policies and procedures in place in order to protect your data from unauthorised access, loss or other forms of breach whether in physical or electronic form. The security measures we take are proportionate to the size of our business. Despite the security measures we implement, please be aware that the transmission of data via the internet is not completely secure. As such, we cannot guarantee that information transmitted to us via the internet will be completely secure and any transmission is at your own risk.
In order to do the work that you have asked us to do, we will from time to time need to pass some of your personal data to third parties. For example, if you need a tax return prepared in a foreign country, this will be done with the help of a professional in that country who will need to know your name and other items of personal data. We will only send data that is necessary for each job and we will ensure that access is limited on a strictly need to know basis and is subject to suitable obligations relating to confidentiality and security. In addition to the above, we may also be required to share your personal data with third parties if required by law or regulation. In such circumstances, we will make sure that the disclosure is only to the extent required by law or regulation.
We will not pass your personal data to any third parties for them to market their products/services to you.
The European Economic Area or “EEA” is deemed to have good standards when it comes to data privacy. As such, we consciously limit the occasions when we may need to transfer or handle your data outside of the EEA. Where we do, for example where a third party service provider is based outside of the EEA, we make sure that your data is still treated fairly and lawfully in all respects (including making sure we have a legal ground for sending your data outside the EEA and putting in place all necessary safeguards for such arrangement).
If you have a complaint about the use or mis-use of your personal data, you have the right to complain to Arena Wealth and also to the Information Commissioner’s Office. Our respective contact details are at the end of this privacy notice.
We would ask that if you are not clear about this subject or have a complaint or question, that you please contact us to discuss it in the first instance.
The GDPR includes the following rights for individuals:
- The right to be informed: The right to be informed encompasses our obligation to provide ‘fair processing information’, typically through a privacy notice (such as this document). It emphasises the need for transparency over how personal data is used.
- The right of access: Under the GDPR, individuals will have the right to obtain confirmation that their data is being processed, access to their personal data, and other supplementary information, such as the information that should be provided in a privacy notice.
- The right to rectification: Individuals are entitled to have personal data rectified if it is inaccurate or incomplete.
- The right to erasure: The right to erasure enables an individual to request the deletion or removal of personal data when there is no compelling reason for its continued processing.
- The right to restrict processing: When processing is restricted, it is permitted to store personal data, but not to further process it.
- The right to data portability: The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
- The right to object: Individuals have the right to object to processing based on legitimate interests.
- The right not to be subject to automated decision-making, including profiling: The GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, please contact us (details below). Note that your exercising certain of these rights (such as the right to erasure and the right to restrict processing) will likely mean that we are no longer able to provide services to you and you will cease to be a client.
You will not have to pay a fee to exercise your rights, unless your request is clearly unfounded, repetitive or excessive (in which case we can charge a reasonable fee). Alternatively, we may refuse to comply with your request in these circumstances. Where your request is legitimate, we will always respond within one month (unless there is a legal reason to take longer, such as where your request is particularly complex). We may also need you to confirm your identify before we proceed with your request if it is not clear to us who is making the request.
If you have any questions in relation to this privacy notice, please contact David Lumley on +44 20 8104 1010, firstname.lastname@example.org or at Arena Wealth Partners LLP, 3rd Floor Chiswick Gate, 598-608 Chiswick High Road, London W4 5RT.
Information Commissioner’s Office
Tel: 0303 123 1113 or 01625 545 745
Last updated: May 2018