Contents

1. Who We Are

2. The Information We Process

3. How We Obtain Information

4. Your Rights

5. Sharing with Third Parties

6. Transferring Information Overseas

7. Promotional Communications

8. How Long We Keep Your Information

9. Security

Schedule A – Schedule of Purposes of Processing

A. Contractual necessity

B. Legal obligation

C. Legitimate interests

1. Who We Are

1.1 This privacy notice (the “Privacy Notice”) applies to all personal information processing activities carried out by Vickers Information.

1.2 Vickers Information is a data controller in respect of personal information that we process in connection with our business and in order to provide you with our services. In this notice, references to “we”, “us” or “our” are references to Vickers Information.

1.3 Our principal address is 1 High Street Mews, Wimbledon Village, London SW19 7RG and our contact details can be located at www.vickersinformation.co.uk/ Our registration number with The Information Commissioner is ZA439513.

1.4 We respect individuals’ rights to privacy and to the protection of personal information. The purpose of this Privacy Notice is to explain how we collect, store, use and share your personal information in connection with our business.

1.5 “Personal information” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information). We may update our Privacy Notice from time to time and will inform you usually by writing or by publishing updated content on our website.

1.6 The Data Protection Officer is Brian Payne.

2. The Information We Process

2.1 We collect and process various categories of personal information at the start of, and for the duration of, your relationship with us. We will limit the collection and processing of information to information necessary to achieve one or more legitimate purposes as identified in this notice. Personal information may include:

a) basic personal information, including name and address, date of birth and contact details;

b) organisation or business name and address;

c) financial information including invoice and billing details;

d) identification documents to verify your identity, visual images and personal appearance (such as copies of passports);

e) information relating to the matter in which you are seeking our advice or representation;

f) your employment status and details (including your salary, benefits and pension arrangements) and employment records if you instruct us on an employment related issue or where such information is relevant to the matters on which you seek our services; and

g) online profile and social media information and activity, based on your interaction with us and our websites and applications, including, for example, your Internet Protocol (IP) address.

2.2 We may also process certain special categories of information for specific and limited purposes such as your racial or ethnic origin, or religious beliefs or health if this information is relevant to your legal issue(s) or claim. We will only process:

special categories of information where we’ve obtained your explicit consent or are otherwise lawfully permitted to do so (and then only for the particular purposes and activities set out at Schedule A for which the information is provided).

2.3 Where permitted by law, we may process information about criminal convictions or offences and alleged offences for specific and limited activities and purposes, such as to perform checks to prevent and detect crime and to comply with laws relating to money laundering, fraud, bribery and corruption, and international sanctions. It may involve investigating and gathering intelligence on suspected financial crimes, fraud and threats and sharing data with law enforcement and regulatory bodies.

3. How We Obtain Information

3.1 In the provision of our services, it is likely that information will be provided by you. Your information is made up of all the personal information we collect and hold about you/your business and the proprietors, officers and beneficial owners of that business and your transactions. However, from time to time and depending on the nature of our engagement, information may be collected via another party. Such information will only be processed in order to provide our services or where applicable for the purpose of complying with our professional obligations, Court orders, co-operation with investigations by the Information Commissioner’s Office or any other statutory regulator. Personal information held about you may include therefore:

a) information you give to us;

b) information that we receive from third parties – including third parties who provide services to you or us;

c) information that we learn about you through our relationship with you;

d) information that we gather from the technology which you use to access our services (for example an IP address or telephone number); and

e) information that we gather from publicly available sources, such as the press, Companies House, HM Land Registry and online search engines.

4. Your Rights

4.1 Under the General Data Protection Regulation, individuals (or ‘data subjects’) have a number of important rights regarding their personal information. In summary, these rights are as follows and include the right to:

a) Request access to personal information;

b) Request that inaccurate information is corrected;

c) Request that processing of personal information is restricted;

d) Request the personal information you provided to us in a portable format;

e) Request that personal information that we hold is erased in certain circumstances;

f) Object to the processing of personal information or the continued processing of personal information;

g) Request not to be subject to automated decision making which produces legal effects that concern or affect data subjects in a significantly similar way.

4.2 Further information regarding rights under the General Data Protection Regulation can be found by visiting www.ico.org.uk . These rights are subject to the conditions and restrictions set out in the General Data Protection Regulation and the Data Protection Act 2018.

4.3 Should you wish to make a request to exercise any of the above rights you should contact us at www.vickersinformation.co.uk When contacting us, please ensure that you provide relevant information to allow us to identify you and state the right or rights that you wish to exercise. We may need to contact you to request further information to verify your identity. We will respond to you within one month from when we receive a valid request.

5. Sharing with Third Parties

5.1 We will not share your information with anyone outside Vickers Information except and as necessary:

a) where we have your permission;

b) where required to provide our services for example with third parties such as professional advisors who we instruct on your behalf or refer you to such as barristers, medical professionals, accountants, tax advisors or other experts;

c) where necessary to carry out your instructions e.g. HM Land Registry or

Companies House;

d) where we provide our services with third parties acting as agents or sub-contractors acting on our behalf such as typing and copying services;

e) where we need to enforce our contractual rights;

f) where we are under a legal or regulatory duty to do so;

g) where we are required to lawfully assist the police or security services with prevention and detection of crime;

h) where disclosure is necessary to protect the safety or security of any person(s);

i) where required for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business; or

j) where otherwise permitted by law, it is necessary for our legitimate interests or those of a third party and it is not inconsistent with the purposes listed above.

5.2 We will not share your information with third parties for their own marketing purposes without your permission.

6. Transferring Information Overseas

Vickers Information does not transfer data outside of the European Economic Area (EEA) in general. There may however be a requirement from time to time to transfer some or all of your personal data outside of the EEA if so required in order to progress to provide our services e.g. if you are based outside the EEA or where there is an international dimension to the matter on which we are advising you. Where this happens, all necessary steps will be taken to ensure that data transferred outside of the EEA is afforded the same or similar safeguards and processes that we undertake within the EEA.

7. Promotional Communications

Vickers Information may engage in promotional communication with you via email, social media and other digital platforms. We may therefore collect your name, address, email address, name of your organisation (if applicable) and telephone number. Any personal data you provide to us will only be used to provide information about our services, or new services or legal developments. We will not use your data for purposes which are not clear when you provide your details. If you change your mind about how you would like us to contact you or you no longer wish to receive this information, you can tell us at any time by contacting us at www.vickersinformation.co.uk

8. How Long We Keep Your Information

8.1 Vickers Information will keep your personal data after we have finished advising or acting for you. We will do so for one of these reasons:

a) To respond to any questions, complaints or claims made by you or on your behalf;

b) To show that we treated you fairly;

c) To keep records required by law.

8.2 Vickers Information will retain personal information for no longer than is reasonably necessary for the provision of its services and personal information will not be retained indefinitely or for reasons incompatible with relevant data protection legislation including the General Data Protection Regulation and the requirements of other regulatory bodies.

8.3 Different retention periods apply for different types of data. Our standard retention period for personal information provided to us for the purposes of providing our services is 12 months (from the completion of the work and services) at which point the data will be securely deleted or destroyed unless the work remains outstanding in some material respect after that period has expired.

9. Security

9.1 Vickers Information takes the security of personal information seriously and it has appropriate measures, safeguards and protocols in place to ensure that data is kept secure, is only accessed by those individuals authorised to do so and where there is a legitimate need to access the data.

9.2 Appropriate and reasonable steps are in place to reduce the risk of unauthorised access to personal data held by Vickers Information and in line with its obligations under data protection legislation including the General Data Protection Regulation.

Schedule A - Purposes of Processing by Vickers Information

We will only use and share your information where it is necessary for us to carry out our lawful business activities. We want to ensure that you fully understand how your information may be used.

We have described the purposes for which your information may be used in detail in a table below:

A CONTRACTUAL NECESSITY

We may process your information where it is necessary to enter into a contract with you for the provision of our services or to perform our obligations under that contract.

Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to provide services to you.

a) provide and administer those services throughout your relationship with Vickers

Information, including collecting and issuing all necessary documentation; executing your

instructions; resolving any queries or discrepancies and administering any changes.

b) manage and maintain our relationships with you; and

c) communicate with you about services you receive from us.

B LEGAL OBLIGATION

When you engage our services (and throughout your relationship with us), we are required by law to collect and process certain personal information about you. Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you. This may include processing to: confirm your identity and perform checks to comply with laws relating to money laundering;

a) share data with police, law enforcement, tax authorities or other agencies where we have a legal obligation and complying with production and court orders;

b) investigate and resolve complaints;

c) conduct investigations into alleged breaches of conduct by our employees;

d) manage contentious investigations and litigation;

e) perform assessments for the purposes of managing, improving communications;

f) provide assurance that Vickers Information has effective processes to identify, manage, monitor and report the risks it is or might be exposed to;

g) investigate and report on incidents or emergencies on Vickers Information’s premises;

h) coordinate responses to business-disrupting incidents and to ensure facilities, systems and people are available to continue providing services.

C LEGITIMATE INTERESTS OF VICKERS INFORMATION

We may process your information where it is in our legitimate interests do so as an organisation and without prejudicing your interests or fundamental rights and freedoms.

a) We may process your information in the day-to-day running of our business, to manage our business and financial affairs and to protect our client, employees and property. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business. This may include processing your information to:

i monitor, maintain and improve internal business processes, information and data, technology and communications solutions and services;

ii ensure business continuity and disaster recovery and responding to information technology and business incidents and emergencies;

iii ensure network and information security, including for the purposes of preventing cyberattacks, unauthorised use of our telecommunications systems and websites, prevention or detection of crime and protection of your personal data;

iv perform general accounting and reporting; and to protect our legal rights and interests;

vi manage and monitor premises (for example with CCTV) for the purposes of crime prevention and prosecution of offenders, for identifying accidents and incidents and emergency situations and for internal training; and

vii enable a sale, reorganisation, transfer or other transaction relating to our business.

a) It is in our interest as a business to ensure that we provide you with the most services and that we continually develop and improve as an organisation. This may require processing your information to enable us to:

i identify new business opportunities and to develop enquiries and leads into applications or proposals for new business and to develop our relationship with you;

ii send you relevant marketing information which we believe may be of interest to you;

iii understand our clients’ preferences, expectations and feedback in order to improve our services, develop new services, and to improve the relevance of services;

iv monitor the performance and effectiveness of our services and to provide staff

training;

v perform analysis on any complaints for the purposes of preventing errors and

rectifying of any negative impacts.