This notice tells you what to expect when we collect information about individuals.
If you need further information or have any questions or complaints about our privacy notice or privacy practices, please contact our Data Protection Officer using the details below:
Data Protection Officer,
Stonewood Investment Management (Guernsey) Limited, Suite 3, 2 Grange Place, The Grange, St Peter Port, GY1 2QA, Guernsey
This notice describes:
- The personal information that we collect
- How we obtain personal information
- How we use personal information
- The basis upon which we use personal information
- How long we keep personal information
- Who we share personal information with
- Which countries we transfer personal information to
- How we protect personal information
- The legal rights of individuals whose personal information we process
The personal information that we collect
- Personal information (personal data) means any information relating to an identified or identifiable natural person.
- Because of the nature of our work, and the different reasons why we need to use personal information, what we collect is very varied and includes:
- Identity and contact data – including name, date of birth, email address, postal address, telephone numbers, passport details and information provided or collected as part of our client take on or employee recruitment processes
- Financial and transaction data – including bank account details and details of payments from and to individuals and connected entities
- Technical and usage data – including information about how individuals use our website
- Marketing data – including individuals’ preferences in receiving marketing from us and information provided to us for attending events such as dietary information and accessibility requirements
- Information used to provide our services – including information provided to us by or on behalf of our clients or otherwise provided to us or generated by us during providing services to our clients
- To comply with anti-money laundering legislation, we may collect special category data and personal data relating to criminal convictions and offences. Special category data that we may collect includes personal data which reveals racial or ethnic origin, religious or philosophical beliefs and data concerning health.
How we obtain personal information
- We obtain personal information in different ways, including through:
- Direct contact – individuals may give us their personal information by corresponding with us by post, email or telephone or otherwise.
- Clients – our clients may give us personal information of individuals (for example a client’s employees) to enable us to provide our services
- Third parties or publicly available sources – for example open source material published on the internet
How we use personal information
- We use personal information in a variety of ways including:
- To provide our services to our clients
- To recruit employees
- To manage and supervise our employees
- To promote our services
- To meet our legal and regulatory obligations
- To meet our audit and insurance obligations
The basis upon which we use personal information
- We will only use personal information (including special category data and data relating to criminal convictions and offences) when the law allows us to. Most commonly, we will use personal data in the following circumstances:
- Where we need to do so to enter into a contract and maintain the contract
- Where we are required to hold the data as a third-party service provider as required by regulation
- Where it is necessary for our legitimate interests
- Where it is necessary to comply with a legal or regulatory obligation
- Consent to receiving direct marketing communications can be withdrawn at any time
How long we keep personal information
We will keep personal information in accordance with our data retention policy, which apply appropriate retention periods for each category of personal information. In setting retention periods, we take account of the purposes for which the personal information was collected, legal and regulatory obligations on us to retain information.
Who we share personal information with
- We may share personal information with third parties including:
- While providing services to our clients
- When we outsource certain services
- Our professional advisers – for example our auditors, bankers and insurers
- To regulatory authorities, courts, tribunals, tax office and law enforcement agencies, where there are legal grounds to obtain the information
- Third parties to whom we transfer personal information are required to respect the security of the information and treat it in accordance with the law. We do not sell personal data to third parties.
Which countries we transfer personal information to
- While providing services to our clients we may need to transfer personal information outside of Guernsey or the EEA.
- Whenever we transfer personal information outside of Guernsey, we will ensure that the party handling the information does so to an equivalent standard.
How we protect personal information
- We have put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place appropriate measures to inform our staff about how we collect, handle and keep information secure.
- We have put in place measures to deal with any suspected personal information breach and will notify relevant individuals and the Guernsey Information Commissioner of a breach when we are legally required to do so.
The legal rights of individuals whose personal information we process
- Individuals have the rights set out below. If you wish to exercise any of these rights, please contact our Data Protection Officer using the contact details given above.
- Request access to their personal information (commonly known as a "data subject access request"). This enables individuals to receive a copy of the personal data we hold about them and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about them. This enables individuals to have any incomplete or inaccurate information we hold, though we will need to verify the accuracy of the new information provided to us.
- Request erasure of their personal information. This enables individuals to ask us to delete or remove personal information where there is no good reason for us continuing to process it. We may not always be able to comply with a request of erasure for specific legal reasons which will be notified to the individual, if applicable, at the time of their request.
- Request restriction of processing of their personal information. This enables individuals to ask us to suspend the processing of their personal information in the following scenarios:
- Withdraw consent at any time where we are relying on consent to process the personal information. However, this will not affect the lawfulness of any processing carried out before consent is withdrawn.
(a) if the individual wants us to establish the information's accuracy;
(b) where the individual needs us to hold the information even if we no longer require
- Individuals have a right to make a complaint at any time to the Guernsey Data Protection Commissioner, the Guernsey supervisory authority for data protection issues (odpc.gg). We would, however, appreciate the chance to deal with any concerns before the Commissioner is approached so please contact our Data Protection Officer, using the contact details given above.
Changes to this privacy notice
We keep our privacy notice under review.
This privacy notice was last updated on 18 October 2018.