Privacy and Cookies

Data controller and scope

In this Privacy Notice, CTCL is the data controller of your personal data and is subject to the EU General Data Protection Regulation 2016/679 (the "GDPR") and any locally applicable data protection laws, primarily the Data Protection Act 2002 and subsequent legislation in the Isle of Man.

This Privacy Notice supersedes any previous Privacy Notice or equivalent which you may have been provided with or seen prior to the effective date stated below.

Definitions

• Cavendish Trust Company Limited means CTCL and any subsidiary of CTCL.
• Personal Data means any information that can identify, directly or indirectly, a living individual.
• Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purpose of this notice, CTCL is the Data Controller.
• Processing means any operation or set of operations which is performed on personal data or on sets of personal data.

Your rights

Under the GDPR you have the following rights:

• To obtain access to, and copies of, the personal data that we hold about you.
• To require that we cease processing your personal data if the processing is causing you damage or distress.
• To require us not to send you marketing communications.
• To require us to erase your personal data.
• To require us to restrict our data processing activities.
• To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller (data portability).
• To require us to correct the personal data we hold about you if it is incorrect.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. You can find out more about your rights at www.inforights.im.

How we collect your data

We collect your personal data in a number of ways, including:

• From the information you provide to us when you meet us.
• From information about you provided to us by your company or an intermediary.
• When you communicate with us in writing, by telephone, email or other forms of electronic communication. We may monitor, record and store any such communication.
• When you complete (or we complete on your behalf) client onboarding, application, or other forms.
• From other companies affiliated to CTCL.
• From your agents, advisers, intermediaries, and custodians of your assets.
• From publicly available sources or from third parties, most commonly where we need to conduct background checks about you.

The categories of personal data we collect

• Your name and contact information such as your home or business address, job title, email address and telephone number.
• Biographical information which may confirm your identity including your date of birth, tax identification number and your passport number or national identity card details, country of domicile and nationality.
• Information relating to your financial situation such as income, expenditure, assets and liabilities, sources of wealth, and your bank account details.
• An understanding of your goals and objectives in procuring our services.
• Information about your employment, education, family or personal circumstances, and interests, where relevant.
• Information to assess whether you may represent a politically exposed person or money laundering risk.

Legal basis for processing and how we use your data

We need to have a lawful basis each time we use, share or otherwise process your personal data. Providing your personal data is necessary for us to deliver our services and comply with legal obligations. If you choose not to provide the information we request, we may be unable to offer or continue providing some or all of our services to you.

We may rely on one or more of the following lawful bases: performance of a contract; our legitimate interest in the effective delivery of information and services to you; legal obligation; or where you have provided your consent.

(i) Performance of a contract with you

We process your personal data because it is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data to prepare proposals, provide services, deal with complaints or feedback, and for any other purpose for which you provide us with your personal data.

We may share your personal data with your agents, advisers, intermediaries and custodians; third parties we engage to assist in delivering services (including subsidiaries and affiliates of CTCL); our professional advisers; debt collection agencies where necessary; intermediaries we introduce to you; and our data storage providers.

(ii) Legitimate interests

We also process your personal data where it is necessary for our legitimate interests, or sometimes for the legitimate interests of another person. This includes marketing to you (see Marketing below), training and monitoring our staff, administration and management of our business, and seeking advice on our rights and obligations. In this respect we may share your personal data with our advisers or agents, and with third parties considering acquiring all or part of our business.

(iii) Legal obligations

We process your personal data to meet our compliance and regulatory obligations, such as compliance with anti-money laundering laws, and as required by tax authorities or any competent court or legal authority. We may share your personal data with our advisers, our auditors, third parties who assist us in conducting background checks, and with relevant regulators or law enforcement agencies where required.

Automated decision making

CTCL does not use any automated decision-making, including profiling, in any of its engagements.

Marketing

We will send you marketing about services we provide which may be of interest to you, as well as alerts, newsletters and invitations to events or functions. We will communicate this by post, telephone, email or other digital channels. If you have given consent and you wish to withdraw it at any time, please contact our Data Protection Officer.

Transfer and processing of your personal data outside the European Union

When we transfer any part of your personal data outside the EEA or adequate jurisdictions we will take reasonable steps to ensure that it is treated as securely as it is within the EEA. These steps include binding corporate rules, model contracts, and other applicable transfer mechanisms. CTCL transfers personal data within its network of subsidiaries and affiliates who are subject to the General Data Protection Regulation. Any further international transfers will be undertaken in accordance with our Terms of Business or with express consent.

Retention of your data

We will only retain your personal data for as long as we have a lawful reason to do so. In particular:

• Where we have collected your personal data as required by anti-money laundering legislation, we will retain it for between five and seven years after the termination of our relationship, unless required to retain it longer by another law or for the purposes of court proceedings.
• Otherwise, we will in most cases retain your personal data for a minimum period of five years after the termination of our contractual or other relationship with you.

How we use cookies

This website uses cookies that are specific to the host site. The cookies used on this site are listed in the table below. This site does not use WordPress or Google Analytics cookies.

Name	Usage	Description	Duration
cav_ok	Functional	Records that you have acknowledged our cookie notice. Without this cookie the notice would appear on every page visit. No personal data is stored.	1 year

For more information about how to control cookies, please visit www.aboutcookies.org.

Your right to access your information

Please email CTCL's Data Protection Officer at dpo@cavendishtrust.com if you wish to request a Subject Access Request showing all information we hold about you. This information will be provided to you within one month of your request.

Governing law and jurisdiction

These terms are governed by and construed in accordance with Isle of Man law. By accessing and using this website you agree that disputes arising in connection with this privacy notice shall be subject to the exclusive jurisdiction of the Isle of Man courts.

Contact

If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please contact us:

You have the right to complain to the Information Commissioner if you feel that CTCL has not responded appropriately to your requests. Contact details: www.inforights.im.

Effective date: 25 May 2018