Privacy Policy

1. Who we are and who this Privacy Notice applies to

This Privacy Notice is provided by your financial adviser who gave you access to the Application ('we' 'our', or 'us'). We are a 'controller' for the purposes of the General Data Protection Regulation (EU) 2016/679 and the UK's Data Protection Act 2018 (collectively referred to as the "Data Protection Laws"). We take your privacy very seriously. We ask that you read this Privacy Notice carefully, as it contains important information about our processing and your rights.

This Privacy Notice applies to the individuals ("you" and "your") to whom we send a questionnaire to complete via the 'EnlightenESG Profiler' application ("Application") developed by Enlighten ESG Limited ("Enlighten"), which can be accessed via the website at profiler.enlightenesg.com ("Website"). This Privacy Notice applies to our processing of your personal data as a result of your use of the functionality within the Application. The Website privacy policy (https://profiler.enlightenesg.com/privacy-policy) applies to the processing of your personal data as a result of your use of the Website (excluding your use of the functionality within the Application).

2. How to contact us

If you have any questions about this Privacy Notice, how we handle your personal data, or would like to exercise any of your rights, please contact Enlighten via their contact details set out below who will pass on details of your query, complaint or issue to us:

Addressee Privacy Officer Registered address/principal place of business: 1 Portland Place, London, England W1B 1PN Telephone number: 020 3970 3100 Email: [email protected]

3. Changes to the Privacy Notice

The latest version of the Privacy Notice can be found at enlightenesg.com/profiler-privacy-policy-end-user. We may change this Privacy Notice from time to time. We will alert you by e-mail when changes are made to the Privacy Notice.

4. What personal data we collect and why we process your personal data

We process the following types of personal data: Identity data: (i) full name; (ii) email address; (iii) age; and (iv) gender. Special categories of data: none. We need this personal data in order to: • invite you to use the Application and receive the reports generated by the Application on your investment preferences; and • manage and administer your use of the Application, including managing your profile, security checks and responding to queries or complaints. We collect details of your age and gender when we invite you to use the Application. This data is separated from your name and email address and is anonymised. We pass on the anonymised data to Enlighten who uses the anonymised data for statistical analysis purposes.

5. How we are legally permitted to process your personal data

We are allowed to process your personal data based on our legitimate interests to carry out the purposes set out at paragraph 4 (what personal data we collect and why we process your personal data). You can object to processing that we carry out on the grounds of legitimate interests. See paragraph 9 (Your rights) to find out how.

6. How we keep your personal data secure

We implement appropriate technical and organisational measures in order to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other unlawful forms of processing. We aim to ensure that the level of security and the measures adopted to protect your personal data are appropriate for the risks presented by the nature and use of your personal data.

7. How long we keep your personal data

We only retain your personal data for as long as required by law. That means that we will keep your personal data for no longer than 36 months.

8. Organisations that we may share your personal data with

Enlighten will have access to your personal data as the provider of the Application. We also share details of your age, gender and ethnicity (if provided) with Enlighten as set out at paragraph 4 (what personal data we collect and why we process your personal data), but on an anonymised basis (so Enlighten will not be able to link these details to your user account or profile). We take steps to ensure that Enlighten treats your data in accordance with the law, only uses it in accordance with our contract with Enlighten, and keeps it secure.

9. Transfer of Personal Data

We will not transfer, store or process your personal data outside of the United Kingdom.

10. Your rights

As a data subject, you have the following legal rights under the Data Protection Laws (set out in the table below) in relation to your personal data. You can exercise these rights free of charge by contacting us (please see paragraph 2 (how to contact us)). We will respond to any rights that you exercise within a month of receiving the request unless the request is particularly complex (in which case, we will respond within three months). We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. Please be aware that there are exceptions and exemptions that apply to some of these rights, which we will apply in accordance with the Data Protection Laws. YOUR DATA PROTECTION RIGHTS WHAT DOES THIS MEAN?

  1. Right to be informed You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data (and what your rights are). This is why we are providing you with this Privacy Notice.

  2. Right of access You have the right to obtain access to your personal data processed by us, and certain other information (similar to that provided in this Privacy Notice).

    This is so you are aware, and can check that we are using your information in accordance with Data Protection Laws.

    You may ask for:

    • a copy of your information;
    • details of the purpose for which it is being processed;
    • details of the recipients or classes of recipients to whom it is or could be disclosed (including if they are overseas and what protections they have in place);
    • the period for which it is held (or the criteria which determines the period for which it is held);
    • any information available about the source of the personal data; and
    • whether we carry out any automated decision-making or profiling, and where we do, information about the logic involved and the outcome or consequences of that decision or profiling.

    To help us find the information, please give us as much information as possible about the type of personal data you would like to see.

  3. Right to rectification You are entitled to have your information corrected if it is inaccurate or incomplete. If you would like us to do this, please contact us (see paragraph 2 (how to contact us)).

  4. Rights to ask us to stop contact you with direct marketing You can ask us to stop contacting you for direct marketing purposes. If you would like to do so, please contact us (see paragraph 2 (how to contact us)).

  5. Right to erasure This is also known as the 'right to be forgotten' and, in simple terms, enables you to request the deletion or removal of your information where:

    • you do not believe that we need your personal data in order to process it for the purposes set out in this Privacy Notice;
    • if you gave us consent to process your personal data, you have withdrawn that consent and we cannot otherwise legally process your personal data;
    • you object to our processing and we do not have any legitimate interests that mean we can continue to process your personal data; or
    • your personal data has been processed unlawfully or have not been erased when it should have been.

  6. Right to restrict processing You have rights to 'block' or suppress further use of your information. When processing is restricted, we can still store your information (but cannot use it further). You may request that we stop processing your personal data temporarily if:

    • you do not think your personal data is accurate. We will start processing again once we have checked whether or not the personal data is accurate;
    • the processing is unlawful but you do not want to erase your personal data;
    • we no longer need the personal data for our processing, but you need the personal data to establish, exercise or defend legal claims; or
    • you have objected to the processing because you believe that your interests should override our legitimate interests.

  7. Right to data portability You have rights in certain circumstances to obtain and reuse your personal data for your own purposes across different services.

  8. Right to object to processing You have the right to object to certain types of processing (including processing based on our legitimate interests and processing for direct marketing).

  9. Right to withdraw consent If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do withdraw consent, that does not mean that anything we have done with your personal data with your consent up to that point is unlawful.)

    We make this withdrawal easy for you. Please e-mail [email protected] if you wish to withdraw your consent at any time.

    We will also contact you via email to allow you to assess the consent which you have given us.

    You may be entitled to compensation for damage caused by contravention of the Data Protection Laws.

  10. Complaints to the regulator It is important that you ensure you have read this Privacy Notice in its entirety. If you do not think that we have processed your data in accordance with this Privacy Notice, you should let us know as soon as possible. You also have the right to complain to the Information Commissioner's Office (ICO). Information about how to do this is available on its website at www.ico.org.uk.

Terms of Service Privacy Policy Cookie Policy