Skip to content
FRATRES
Data & privacy

Privacy Policy

How Fratres Limited collects, uses, shares and protects personal data, and the rights available to data subjects under the UK GDPR.
Document reference
FGL-LEG-04
Version date
1 July 2026
Applies to
Fratres Limited

1.Interpretation and definitions

1.1
In this Policy the following terms have the meanings given below. Defined terms appear with an initial capital letter. Words in the singular include the plural and words in the plural include the singular.
Company
Fratres Limited, a company registered in England and Wales, being the controller of the Personal Data described in this Policy.
Policy
this Privacy Policy, as amended and republished on the Website from time to time.
UK GDPR
the retained EU law version of Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland, read together with the DPA 2018.
DPA 2018
the Data Protection Act 2018.
Personal Data
has the meaning given in Article 4(1) UK GDPR: any information relating to an identified or identifiable natural person.
Processing
has the meaning given in Article 4(2) UK GDPR, and “process”, “processed” and “processes” are construed accordingly.
Data Subject
the identified or identifiable natural person to whom Personal Data relates.
Special Category Data
the categories of Personal Data listed in Article 9(1) UK GDPR, being data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data processed for the purpose of unique identification, data concerning health, and data concerning a person’s sex life or sexual orientation.
Criminal Offence Data
Personal Data relating to criminal convictions and offences or related security measures within Article 10 UK GDPR, including data relating to alleged offences, proceedings and their disposal.
Due Diligence Information
Personal Data obtained or generated in the course of client due diligence, beneficial ownership verification, sanctions and politically exposed person screening, adverse media review, and integrity assessment of counterparties.
Processor
a natural or legal person that processes Personal Data on behalf of the Company, as defined in Article 4(8) UK GDPR.
Website
the website published by the Company at fratresgroup.com, including all pages and functionality forming part of it.
Enquiry Form
the enquiry form published at fratresgroup.com/contact, which is the sole channel by which the Company accepts unsolicited approaches and requests under this Policy.
Commissioner
the Information Commissioner, being the supervisory authority for the United Kingdom for the purposes of Article 51 UK GDPR.
Business Day
a day other than a Saturday, Sunday or public holiday in England and Wales on which clearing banks are open for general business in London.
1.2
References to a statute or statutory provision are references to it as amended, extended or re-enacted from time to time, and include any subordinate legislation made under it.
1.3
Clause headings do not affect the interpretation of this Policy. Any phrase introduced by the words “including”, “in particular” or “for example” is illustrative and does not limit the sense of the words preceding it.
1.4
Where this Policy states an obligation of the Company, that obligation is undertaken as a matter of policy in addition to, and not in substitution for, the Company’s obligations under the UK GDPR and the DPA 2018. Nothing in this Policy restricts any right a Data Subject has under data protection law.

2.Controller, scope and contact

2.1
The Company is the controller of the Personal Data described in this Policy within the meaning of Article 4(7) UK GDPR. The Company determines the purposes and means of that Processing and is accountable for it under Article 5(2) UK GDPR.
2.2
The Company is registered in England and Wales and carries on strategic advisory and project facilitation activity in the United Kingdom and in the People’s Republic of Bangladesh. This Policy therefore addresses Processing that takes place in, and Personal Data that is transferred to, both jurisdictions.
2.3
This Policy applies to Personal Data relating to:
  • (a)visitors to and users of the Website;
  • (b)persons who submit an enquiry through the Enquiry Form, and persons named or described in such an enquiry;
  • (c)clients and prospective clients, and the directors, officers, employees, advisers and beneficial owners of client and prospective client organisations;
  • (d)counterparties, project sponsors, joint venture partners, introducers and their personnel;
  • (e)suppliers, subcontractors, professional advisers and their personnel; and
  • (f)applicants for engagement or employment with the Company.
2.4
This Policy does not apply to the processing of personal data by any third party, including the operator of any website to which the Website links. The Company does not control and is not responsible for the privacy practices of any third-party website, and Data Subjects should read the privacy notice published by any such operator before submitting information to it.
2.5
This Policy is to be read together with the Company’s Cookie Policy, Data Retention and Records Management Policy, and International Data Transfer Statement, each of which forms part of the Company’s data protection framework. Where there is an inconsistency between this Policy and any other document published by the Company on the subject of Personal Data, this Policy prevails.
2.6
The Company has designated a member of its senior management with day-to-day responsibility for data protection compliance, including maintenance of the records of processing activities required by Article 30 UK GDPR, oversight of data protection impact assessments under Article 35, and the handling of Data Subject requests. That person may be reached, and any question about this Policy raised, through the Enquiry Form.
2.7
The Company does not publish direct contact details. All requests, objections and enquiries under this Policy must be submitted through the Enquiry Form at fratresgroup.com/contact. A request submitted through that channel will be acknowledged within five Business Days and will be logged, allocated a reference and tracked to completion.
Requests under this Policy

Every right described in clause 13 is exercised through the same route: the Enquiry Form at fratresgroup.com/contact. A request does not need to cite this Policy, name a clause, or use any particular form of words to be valid. The Company treats any communication that in substance seeks to exercise a data protection right as a request under this Policy from the date it is received.

3.Sources of personal data

3.1
The Company obtains Personal Data from the Data Subject directly, where the Data Subject submits the Enquiry Form, corresponds with the Company, attends a meeting or site visit, provides identification or verification documents, or supplies information in the course of an engagement.
3.2
The Company obtains Personal Data from the organisation a Data Subject represents, where that organisation identifies its directors, officers, authorised signatories, beneficial owners or project personnel to the Company in the course of an enquiry, engagement or due diligence exercise.
3.3
The Company obtains Personal Data from publicly available sources, including company registries and filings, registers of beneficial ownership, land and title registries, insolvency and court records, regulatory and disciplinary registers, official gazettes, tender and procurement notices, and published news and professional media.
3.4
The Company obtains Personal Data from commercial screening and intelligence providers, including providers of sanctions list data, politically exposed person data, adverse media data, corporate ownership data and identity verification services. Such providers act as independent controllers or as Processors according to the terms on which each service is supplied, and the Company records that characterisation for each provider it uses.
3.5
The Company obtains Personal Data from introducers, referees, professional advisers, banks and other institutions where a Data Subject has asked that they provide information, or where the provision of that information is necessary to complete a verification the Company is obliged to perform.
3.6
The Company obtains technical Personal Data automatically when a Data Subject uses the Website, as described in clause 4.5 and in the Cookie Policy.
3.7
Where Personal Data is obtained from a source other than the Data Subject, the Company complies with Article 14 UK GDPR. This Policy constitutes the notice required by that Article. Where the Company proposes to communicate with the Data Subject, the Company will draw this Policy to that person’s attention at the time of the first communication and in any event within one month of obtaining the data, unless an exemption in Article 14(5) applies — in particular where the provision of that information would prejudice the prevention or detection of crime, or would be prohibited by section 333A of the Proceeds of Crime Act 2002.
3.8
The Company does not purchase marketing lists and does not obtain Personal Data from data brokers for the purpose of unsolicited marketing.

4.Categories of personal data processed

4.1
Enquiry and correspondence data. Name; the organisation represented and the position held within it; the country or market of interest; the sector of interest; the email address and any telephone number volunteered; the content of the enquiry itself and of any subsequent correspondence, including attachments, meeting notes, call notes and calendar entries; and the date, time and channel of each communication.
4.2
Relationship and engagement data. Records of the mandate under negotiation or in progress; scope, terms and correspondence relating to an engagement; instructions given and advice provided; project documentation naming individuals; attendance records for meetings and site visits; and records of the Company’s assessment of an opportunity insofar as it identifies individuals.
4.3
Due Diligence Information. Full legal name and any former or alternative names; date and place of birth; nationality and country of residence; residential address; passport, national identity document or other government-issued identifier and its expiry; photographic likeness where an identity document is provided; shareholding and control information sufficient to identify beneficial owners at the applicable threshold; source of funds and source of wealth information; sanctions, politically exposed person and adverse media screening results, including false positives and the record of their dismissal; and details of the Company’s risk rating and approval decision.
4.4
Financial and administrative data. Bank account and payment reference details of a client or supplier; invoices, receipts and payment records; expense records naming individuals; and travel and accommodation booking details where the Company arranges attendance at a meeting or site visit.
4.5
Website and technical data. Internet protocol address; approximate location derived from that address at city or region level only; browser type and version; device type, operating system and screen configuration; language and time zone settings; referring page and exit page; pages viewed, the order in which they were viewed and the duration of each view; the date and time of access; server request and error logs; and cookie and similar identifier data as described in the Cookie Policy.
4.6
Recruitment data. Curriculum vitae and covering correspondence; employment and education history; professional qualifications and memberships; right to work information; references; interview notes and assessment records; and remuneration expectations.
4.7
The Company applies the principle of data minimisation in Article 5(1)(c) UK GDPR. It collects only the Personal Data that is adequate, relevant and limited to what is necessary for the purpose concerned, and the Enquiry Form is designed to require the minimum information needed to route and answer an enquiry. Where a Data Subject volunteers information that the Company does not need, that information is deleted from the Company’s systems.
4.8
The Website is not directed at children and the Company does not knowingly collect Personal Data relating to a person under the age of 18. Where the Company becomes aware that it holds such data other than as an incidental element of a due diligence record, it will erase it without undue delay.

5.Purposes of processing and lawful bases

5.1
The Company shall not process Personal Data unless at least one condition in Article 6(1) UK GDPR is satisfied. Where the Processing involves Special Category Data, a further condition under Article 9(2) UK GDPR and, where that condition requires it, a condition in Schedule 1 to the DPA 2018 must also be satisfied. Where the Processing involves Criminal Offence Data, the Processing must additionally be authorised by section 10(5) of and Schedule 1 to the DPA 2018. The purposes for which the Company processes Personal Data, and the lawful basis relied upon for each, are set out in this clause 5.
5.2
Responding to enquiries. To receive, route, assess and answer an enquiry submitted through the Enquiry Form and to conduct the correspondence that follows. Where the enquirer is acting on their own behalf, the lawful basis is Article 6(1)(b) UK GDPR, the Processing being necessary in order to take steps at the request of the Data Subject prior to entering into a contract. Where the enquirer acts for an organisation, the lawful basis is Article 6(1)(f), the legitimate interests being those described in clause 7.2.
5.3
Delivering advisory and facilitation services. To perform an engagement, including market assessment, structuring advice, regulatory pathway mapping, partner identification, and the preparation and submission of applications to the relevant authorities on a client’s instructions. Where the client is an individual, the lawful basis is Article 6(1)(b). Where the client is a body corporate, the lawful basis for processing data about its personnel and representatives is Article 6(1)(f).
5.4
Client due diligence and financial crime prevention. To identify and verify clients, counterparties and their beneficial owners; to establish source of funds and source of wealth; to screen against sanctions lists and politically exposed person data; to conduct adverse media review; to apply enhanced due diligence where the risk assessment requires it; and to monitor the relationship for the duration of the engagement. The lawful basis is Article 6(1)(c), the Processing being necessary for compliance with legal obligations to which the Company is subject under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the Proceeds of Crime Act 2002, the Terrorism Act 2000, and the Sanctions and Anti-Money Laundering Act 2018 together with the regulations made under it. To the extent that the Company applies standards exceeding the strict statutory minimum, the lawful basis for that additional Processing is Article 6(1)(f).
5.5
Bribery and tax evasion prevention procedures. To operate the procedures by which the Company prevents bribery and the facilitation of tax evasion, including integrity screening of intermediaries, recording of hospitality and gifts, and the assessment of third-party risk. The lawful basis is Article 6(1)(f), the legitimate interest being the establishment and maintenance of procedures capable of constituting adequate procedures for the purposes of section 7 of the Bribery Act 2010 and reasonable prevention procedures for the purposes of sections 45 and 46 of the Criminal Finances Act 2017, and Article 6(1)(c) to the extent that a specific obligation applies.
5.6
Reporting and licensing obligations. To make a suspicious activity report to the National Crime Agency where the Company knows or suspects, or has reasonable grounds for knowing or suspecting, that a person is engaged in money laundering or terrorist financing; to seek a defence against money laundering where required; to report to the Office of Financial Sanctions Implementation and to apply for a licence where a sanctions measure requires it; and to respond to a lawful production order, court order or statutory information notice. The lawful basis is Article 6(1)(c).
5.7
Conflicts of interest management. To run conflicts checks before accepting an engagement and to maintain the conflicts register. The lawful basis is Article 6(1)(f), the legitimate interest being the protection of client confidentiality and the integrity of the Company’s advisory work.
5.8
Relationship management and internal administration. To maintain contact records and a customer relationship management system; to administer engagements, billing and collections; to maintain accounting records; to arrange insurance; to manage the Company’s premises, systems and information security; and to conduct internal reporting, audit and quality review. The lawful basis is Article 6(1)(f), and Article 6(1)(c) where the Processing is required by the Companies Act 2006, by taxation legislation or by another statutory obligation.
5.9
Insight publications and invitations. To send analysis, commentary and invitations to briefings to persons who have asked to receive them. The lawful basis is Article 6(1)(a), consent, where consent is required by the Privacy and Electronic Communications (EC Directive) Regulations 2003, and Article 6(1)(f) where those Regulations permit the communication to be sent to a corporate subscriber or under the exception described in clause 8.4.
5.10
Website operation, security and measurement. To serve the Website, to maintain its availability and integrity, to detect and prevent malicious activity and abuse, to record consent choices, and to understand in aggregate how the Website is used. For strictly necessary functions the lawful basis is Article 6(1)(f). For non-essential cookies and similar technologies the lawful basis is Article 6(1)(a), consent obtained in accordance with regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
5.11
Legal claims and regulatory defence. To establish, exercise or defend legal claims, to respond to a complaint or a regulatory enquiry, and to obtain legal advice. The lawful basis is Article 6(1)(f), and where Special Category Data is involved the further condition is Article 9(2)(f).
5.12
Recruitment. To assess an application for engagement or employment, to conduct interviews and take up references, and to verify right to work. The lawful basis is Article 6(1)(b) for steps taken at the request of the applicant prior to entering into a contract, Article 6(1)(c) for right to work verification, and Article 6(1)(f) for the retention of an unsuccessful application for the period stated in clause 11.3.
5.13
Protection of vital interests. To act on medical, accessibility or emergency information where that is necessary to protect the vital interests of a Data Subject or another person, in particular in connection with travel to and attendance at project sites. The lawful basis is Article 6(1)(d), and where Special Category Data is involved the further condition is Article 9(2)(c) where the Data Subject is physically or legally incapable of giving consent, and otherwise Article 9(2)(a).
5.14
Where the Company proposes to process Personal Data for a purpose other than that for which it was collected, and is not relying on consent or on a legal obligation, it shall first assess the compatibility of the new purpose in accordance with Article 6(4) UK GDPR and shall inform the Data Subject of the new purpose before that Processing begins.

6.Special category and criminal offence data

6.1
The Company does not seek Special Category Data or Criminal Offence Data as a routine matter and does not process such data for any commercial, marketing or profiling purpose. Such data is processed only where it arises in the circumstances described in this clause 6 and only to the extent necessary for the purpose identified.
6.2
Special Category Data may arise in the course of Due Diligence Information where a screening result, corporate record or media report discloses political opinions, including a person’s political exposure or affiliation; racial or ethnic origin; religious or philosophical beliefs; trade union membership; or data concerning health. Such data is received incidentally as part of a screening result and is not separately sought.
6.3
Special Category Data may also arise where a Data Subject provides dietary, accessibility, mobility or medical information in connection with attendance at a meeting, a site visit or travel arranged by the Company.
6.4
The Article 9(2) conditions relied upon by the Company are:
  • (a)Article 9(2)(a), explicit consent, for dietary, accessibility and comparable information volunteered in connection with a meeting, site visit or travel;
  • (b)Article 9(2)(b), obligations in the field of employment law, in connection with the Company’s own personnel and the exercise of rights under the Equality Act 2010;
  • (c)Article 9(2)(f), the establishment, exercise or defence of legal claims, where the Processing is necessary for that purpose; and
  • (d)Article 9(2)(g), substantial public interest, in connection with due diligence, screening and financial crime prevention.
6.5
Where the Company relies on Article 9(2)(g), the conditions in Part 2 of Schedule 1 to the DPA 2018 on which it relies are paragraph 10 (preventing or detecting unlawful acts), paragraph 14 (preventing fraud) and paragraph 15 (suspicion of terrorist financing or money laundering). Where the Company relies on Article 9(2)(b) it relies on paragraph 1 of Part 1 of that Schedule.
6.6
Criminal Offence Data is processed only in connection with the purposes described in clauses 5.4 to 5.7 and 5.11. Such Processing is authorised by section 10(5) of the DPA 2018 and by the conditions in Schedule 1 to that Act, in particular the conditions relating to the prevention or detection of unlawful acts, the prevention of fraud, suspicion of terrorist financing or money laundering, and the establishment, exercise or defence of legal claims. The Company does not maintain a comprehensive register of criminal convictions.
6.7
Where the Company relies on a condition in Part 1, 2 or 3 of Schedule 1 to the DPA 2018 that requires it, the Company maintains the appropriate policy document required by paragraph 5 of Part 4 of that Schedule. That document explains the Company’s procedures for securing compliance with the principles in Article 5 UK GDPR and its policies as regards the retention and erasure of the data concerned. It is reviewed and where necessary updated while the Processing continues, is retained until six months after the Processing ceases, and is made available to the Commissioner on request without charge. A copy is available to a Data Subject on request through the Enquiry Form.
6.8
Access to Special Category Data and Criminal Offence Data is restricted to those personnel with a defined compliance role who require access in order to discharge that role. Access is logged. Such data is not disclosed to a client, counterparty or other third party except where disclosure is required by law, is necessary for the establishment, exercise or defence of legal claims, or is made with the explicit consent of the Data Subject.
6.9
Screening results that the Company determines to be false positives are recorded as such, together with the reason for that determination, and are retained only so that the same match is not repeatedly re-examined. They are not treated as findings about the Data Subject.

7.Legitimate interests

7.1
Where the Company relies on Article 6(1)(f) UK GDPR it carries out and records a legitimate interests assessment before the Processing begins. That assessment addresses three questions in turn: whether the interest pursued is legitimate; whether the Processing is necessary to achieve it; and whether the interest is overridden by the interests or fundamental rights and freedoms of the Data Subject.
7.2
The legitimate interests pursued by the Company are:
  • answering and properly assessing approaches made to it, so that an enquirer receives a considered response and the Company commits resource only where a mandate is capable of being delivered lawfully;
  • understanding who it is dealing with, so that it does not facilitate investment by or for a person whose funds or conduct would expose the Company, its clients or the projects concerned to legal, financial or reputational harm;
  • protecting the confidentiality of client information and identifying conflicts before they arise;
  • operating, securing and improving the Website and the Company’s systems, and preventing fraud, unauthorised access and abuse;
  • maintaining accurate business records, administering engagements and collecting fees properly due;
  • establishing, exercising and defending legal claims and responding to complaints and regulatory enquiries; and
  • communicating analysis and commentary to professionals who have indicated that they wish to receive it.
7.3
In each case the Company has concluded that the purpose cannot reasonably be achieved by less intrusive means. In particular, integrity screening cannot be performed without processing identifying data about the individuals who own or control a counterparty, and a conflicts check cannot be performed without holding the names of the parties to prior and current engagements.
7.4
In conducting the balancing test the Company takes into account that the Data Subjects concerned are in the great majority of cases acting in a professional capacity; that the Processing is of a kind that a person engaging with an advisory firm in regulated markets would reasonably expect; and that the following safeguards apply in every case:
  • (a)collection is limited to what is necessary for the identified purpose;
  • (b)access is restricted by role and is logged where the data is sensitive;
  • (c)retention is limited to the periods stated in clause 11;
  • (d)Personal Data is not sold, licensed or disclosed for the marketing purposes of any third party;
  • (e)the right to object under Article 21 UK GDPR is available and is drawn to the Data Subject’s attention in this Policy; and
  • (f)no legitimate interests assessment is used to justify the processing of data relating to a person known to be under 18.
7.5
Where the balancing test does not favour the Company, the Processing does not proceed on that basis. The Company will either not carry out the Processing, or will identify and rely on a different lawful basis and inform the Data Subject accordingly.
7.6
A summary of the legitimate interests assessment relating to any Processing described in this Policy is available to a Data Subject on request through the Enquiry Form.

9.Recipients, processors and disclosure

9.1
Personal Data is disclosed within the Company only to those personnel who require access in order to perform their role. Access rights are defined by role, are reviewed periodically, and are withdrawn when a person changes role or leaves.
9.2
The categories of recipient outside the Company are:
  • (a)professional advisers, including solicitors, counsel, accountants, auditors and insurers, engaged by the Company and bound by professional duties of confidentiality;
  • (b)providers of information technology services, including hosting, electronic mail, document management, customer relationship management, backup and security monitoring;
  • (c)providers of identity verification, sanctions and politically exposed person screening, corporate ownership data and adverse media data;
  • (d)banks, payment service providers and accounting service providers, for the administration of fees and expenses;
  • (e)a client, counterparty or authority to whom disclosure is necessary in order to progress an application or transaction on the instructions of the Data Subject or the organisation they represent;
  • (f)law enforcement, tax and regulatory authorities, including the National Crime Agency, the Office of Financial Sanctions Implementation, HM Revenue & Customs and the Commissioner, where disclosure is required or permitted by law; and
  • (g)a court, tribunal or party to legal proceedings, where disclosure is required by an order of the court or by a rule of procedure.

Naming the principal Processor specifically: this website and the enquiry form on it are hosted and operated by Netlify, Inc. When an enquiry is submitted, the information in that form is transmitted to and stored on Netlify’s infrastructure, and a notification containing it is sent to the Company. Netlify acts as a Processor on the Company’s instructions under a written data processing agreement, and processes the data in the United States and in other territories in which it operates. The safeguards applied to that transfer are described in the International Data Transfer Statement.

9.3
Where the Company engages a Processor it does so only where that Processor provides sufficient guarantees to implement appropriate technical and organisational measures, and only under a written contract complying with Article 28(3) UK GDPR. That contract requires the Processor to process Personal Data only on the Company’s documented instructions; to ensure that persons authorised to process the data are under a duty of confidence; to implement the measures required by Article 32; not to engage a sub-processor without the Company’s prior written authorisation; to assist the Company in responding to Data Subject requests and in complying with Articles 32 to 36; to delete or return the data at the end of the services; and to make available the information necessary to demonstrate compliance and submit to audit.
9.4
The Company does not sell Personal Data. It does not licence, rent or otherwise make Personal Data available to any third party for that third party’s own marketing purposes, and it does not participate in real-time bidding or comparable advertising exchanges.
9.5
Where the Company is disclosing Personal Data in connection with an application submitted to an authority in Bangladesh or the United Kingdom, it discloses only the data that the authority requires and, so far as the process permits, informs the Data Subject of the disclosure before it is made.
9.6
If the Company is party to a merger, acquisition, reorganisation or transfer of business, Personal Data may be disclosed to the prospective transferee and its advisers. Such disclosure is made under a confidentiality agreement, is limited to what is necessary for the purpose, and is made in redacted or aggregated form wherever the purpose can be achieved that way. Data Subjects will be informed of any change of controller before their Personal Data is processed by the transferee.
9.7
Where the Company has made, or has considered making, a disclosure to the National Crime Agency, section 333A of the Proceeds of Crime Act 2002 and section 21D of the Terrorism Act 2000 may prohibit the Company from disclosing that fact, or any information likely to prejudice an investigation. In such a case the Company will not confirm or deny that any report has been made, and will apply the relevant exemption in Schedule 2 to the DPA 2018 to any request under clause 13. This restriction is imposed by statute and is not a matter of the Company’s discretion.

10.International transfers of personal data

10.1
The Company’s operations require Personal Data to be transferred outside the United Kingdom, principally to Bangladesh and, where a service provider is established or hosts data there, to other jurisdictions. Every such transfer is made in accordance with Chapter V of the UK GDPR.
10.2
Bangladesh is not the subject of adequacy regulations made under section 17A of the DPA 2018. Personal Data is therefore not transferred to Bangladesh in reliance on Article 45 UK GDPR.
10.3
Transfers to a country that is the subject of adequacy regulations are made in reliance on Article 45 UK GDPR. Transfers to any other country are made only where one of the following applies:
  • (a)the International Data Transfer Agreement issued by the Commissioner under section 119A of the DPA 2018 has been entered into with the recipient;
  • (b)the Addendum issued by the Commissioner under that section has been entered into together with the relevant standard contractual clauses;
  • (c)binding corporate rules approved under Article 47 UK GDPR apply to the recipient; or
  • (d)a derogation in Article 49 UK GDPR applies, as described in clause 10.6.
10.4
Before making a transfer in reliance on Article 46 UK GDPR the Company carries out and documents a transfer risk assessment. That assessment considers the nature and sensitivity of the data, the circumstances of the transfer, the law and practice of the destination country including the powers of public authorities to obtain access to data, and whether the protections in the transfer mechanism would be effective in practice in that country.
10.5
Where the transfer risk assessment identifies a residual risk, the Company applies supplementary measures before the transfer proceeds. These include encryption in transit and at rest with keys retained in the United Kingdom; pseudonymisation or redaction of identifying elements where the purpose permits; minimisation of the data set transferred; contractual restrictions on onward transfer; a contractual obligation on the recipient to notify the Company of any request for access by a public authority so far as the law permits, and to challenge any request that is unlawful or disproportionate; and a right for the Company to suspend the transfer and require return or deletion.
10.6
The Company relies on a derogation in Article 49 UK GDPR only where no adequacy regulation and no appropriate safeguard is available, and only where the transfer is occasional and not repetitive. The derogations relied on are Article 49(1)(a), explicit consent given after the Data Subject has been informed of the possible risks; Article 49(1)(b) and (c), necessity for the performance of a contract with or in the interest of the Data Subject; and Article 49(1)(e), necessity for the establishment, exercise or defence of legal claims.
10.7
A Data Subject may obtain information about the safeguards applied to a transfer of their Personal Data, and a copy of the relevant transfer mechanism with commercially confidential terms redacted, by making a request through the Enquiry Form. Further detail is set out in the Company’s International Data Transfer Statement.

11.Retention and disposal

11.1
In accordance with Article 5(1)(e) UK GDPR, Personal Data is kept in a form permitting identification of Data Subjects for no longer than is necessary for the purposes for which it is processed. Retention periods are set by reference to the purpose of the Processing, any statutory minimum or maximum period, the limitation periods applicable to potential claims under the Limitation Act 1980, and the Company’s need to demonstrate compliance.
11.2
The Company applies the following periods:
  • enquiry and correspondence data where no engagement follows — 24 months from the date of the last substantive communication;
  • engagement records, including advice given and project documentation — six years from the end of the engagement, or twelve years where the engagement was entered into as a deed;
  • client due diligence records, including identification and verification documents and screening results — five years from the date the business relationship ends or the transaction is completed, in accordance with regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;
  • records relating to a suspicious activity report — five years from the date of the report, or such longer period as the National Crime Agency or a law enforcement authority requires in a given case;
  • accounting and taxation records — six years from the end of the accounting period to which they relate;
  • statutory registers and records required by the Companies Act 2006 — for the period specified by that Act;
  • unsuccessful recruitment applications — 12 months from the date the decision is communicated, unless the applicant asks to be considered for future opportunities, in which case 24 months;
  • website server and security logs — 12 months from creation; and
  • consent and suppression records — for as long as the Company processes data for the purpose to which the consent or objection relates, and for two years thereafter to evidence compliance.
11.3
Where regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires the deletion of records at the end of the five-year period, the Company shall delete them, unless it is required to retain them by another enactment, they are required for court proceedings, or the Data Subject has given consent to their retention.
11.4
At the end of a retention period Personal Data is securely destroyed. Electronic records are deleted in a manner designed to prevent reconstruction; physical records are cross-cut shredded or destroyed by a confidential waste contractor engaged under a written contract. Records of destruction are maintained.
11.5
Personal Data deleted from live systems may persist in encrypted backups for a limited period. Such backups are not accessed for any operational purpose, are overwritten in the ordinary backup cycle, and where a backup is restored, data that was subject to deletion or erasure is deleted again before the restored system is returned to use.
11.6
Where Personal Data is retained beyond the periods above because it is necessary for the establishment, exercise or defence of a legal claim, it is restricted so that it is used only for that purpose, and is destroyed once the claim and any appeal is concluded and the applicable limitation period has expired.
11.7
Full detail is set out in the Company’s Data Retention and Records Management Policy.

12.Security and personal data breaches

12.1
The Company implements appropriate technical and organisational measures under Article 32 UK GDPR to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing.
12.2
Those measures include encryption of Personal Data in transit and at rest; multi-factor authentication for access to systems holding Personal Data; access control by role with periodic review; segregation of due diligence records from general correspondence; logging and monitoring of access to sensitive records; patch and vulnerability management; secure configuration of devices, with remote wipe capability; tested backup and restoration procedures; and a documented process for restoring availability and access to Personal Data in a timely manner after an incident.
12.3
Personnel are subject to contractual duties of confidentiality that survive the end of their engagement, receive data protection and information security training on appointment and at regular intervals thereafter, and are subject to disciplinary action for breach of this Policy.
12.4
Where the Company becomes aware of a personal data breach it shall assess the risk without delay and, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, shall notify the Commissioner in accordance with Article 33 UK GDPR without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Where notification is made later than 72 hours it shall be accompanied by reasons for the delay.
12.5
Where a personal data breach is likely to result in a high risk to the rights and freedoms of a Data Subject, the Company shall communicate the breach to that Data Subject without undue delay in accordance with Article 34 UK GDPR, in clear and plain language, describing the likely consequences and the measures taken or proposed to address the breach and mitigate its effects.
12.6
The Company documents every personal data breach, including the facts, its effects and the remedial action taken, in the register required by Article 33(5) UK GDPR, whether or not the breach is notifiable. Each Processor is required by contract to notify the Company without undue delay after becoming aware of a personal data breach, as required by Article 33(2).
12.7
Transmission of information over the internet is not inherently secure. Data Subjects should not send identity documents, financial details or other sensitive material to the Company by unsecured electronic mail. A secure transfer route will be provided on request through the Enquiry Form, and the Company will provide one as a matter of course whenever it asks for verification documents.

13.Rights of data subjects

13.1
Subject to the conditions and restrictions in the UK GDPR and the DPA 2018, a Data Subject has the following rights in relation to their Personal Data.
13.2
Right of access — Article 15. To obtain confirmation of whether their Personal Data is being processed and, if so, access to that data and to information about the purposes, the categories of data, the recipients, the envisaged retention period, their rights, the source of the data where it was not collected from them, and the existence of automated decision-making. The Company shall provide a copy of the Personal Data undergoing Processing, provided that the right to obtain a copy shall not adversely affect the rights and freedoms of others, as Article 15(4) requires.
13.3
Right to rectification — Article 16. To have inaccurate Personal Data corrected without undue delay and to have incomplete data completed, including by means of a supplementary statement. Where a Data Subject disputes the accuracy of a screening result, the Company shall record the dispute against the record and shall re-examine the underlying source.
13.4
Right to erasure — Article 17. To have Personal Data erased where it is no longer necessary for the purpose for which it was collected, where consent is withdrawn and no other basis applies, where the Data Subject objects and there is no overriding legitimate ground, or where the data has been unlawfully processed. This right does not apply to the extent that Processing is necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.
13.5
Right to restriction of processing — Article 18. To require the Company to restrict Processing where accuracy is contested, for a period enabling verification; where Processing is unlawful and the Data Subject opposes erasure; where the Company no longer needs the data but the Data Subject requires it for legal claims; or pending verification of an objection made under Article 21. Restricted data is stored but not otherwise processed except with consent or for legal claims.
13.6
Notification to recipients — Article 19. The Company shall communicate any rectification, erasure or restriction to each recipient to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort, and shall inform the Data Subject about those recipients if they request it.
13.7
Right to data portability — Article 20. To receive Personal Data which the Data Subject has provided to the Company, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible. This right applies only where the Processing is based on consent or on a contract and is carried out by automated means.
13.8
Right to object — Article 21. To object at any time, on grounds relating to their particular situation, to Processing based on Article 6(1)(e) or 6(1)(f). Where such an objection is made the Company shall cease the Processing unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, or the Processing is for the establishment, exercise or defence of legal claims. The right to object to direct marketing under Article 21(2) is absolute and is dealt with in clause 8.5.
13.9
Rights in relation to automated decisions — Article 22. Not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them. The Company’s position is set out in clause 15.
13.10
Right to withdraw consent — Article 7(3). To withdraw consent at any time where Processing is based on consent, as described in clause 8.2.
13.11
Right to complain — Article 77 and section 165 DPA 2018. To lodge a complaint with the Commissioner, as described in clause 16.

14.Exercising rights and permitted restrictions

14.1
A request to exercise any right under clause 13 should be submitted through the Enquiry Form at fratresgroup.com/contact. A request need not use any particular form of words. It assists the Company if the request identifies the right being exercised and the period or subject matter concerned, but a failure to do so does not invalidate the request.
14.2
The Company shall acknowledge a request within five Business Days. Where the Company has reasonable doubts as to the identity of the person making the request it may request additional information necessary to confirm identity, as Article 12(6) UK GDPR permits. Any identity document provided for that purpose is used only for verification, is not added to any other record, and is deleted once the request is closed.
14.3
The Company shall provide information on action taken without undue delay and in any event within one month of receipt of the request, in accordance with Article 12(3) UK GDPR. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests. Where the period is extended the Company shall inform the Data Subject within one month of receipt, together with the reasons for the delay.
14.4
No fee is charged for responding to a request. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may charge a reasonable fee reflecting the administrative costs of responding, or refuse to act on the request. Where the Company refuses to act it shall inform the Data Subject of the reasons, of the right to lodge a complaint with the Commissioner and of the right to a judicial remedy, without delay and at the latest within one month. The Company bears the burden of demonstrating that a request is manifestly unfounded or excessive.
14.5
Certain rights are restricted by Schedule 2 to the DPA 2018. The exemptions the Company may need to apply are those relating to crime and taxation; information required to be disclosed by law or in connection with legal proceedings; legal professional privilege; confidential references; management forecasts and negotiations; and corporate finance. Where an exemption is applied the Company shall apply it only to the extent necessary, shall record the reason, and shall tell the Data Subject that an exemption has been applied unless doing so would itself defeat the purpose of the exemption or would contravene section 333A of the Proceeds of Crime Act 2002.
14.6
Where a request would require the disclosure of information relating to another individual, the Company shall not comply except where that other individual has consented or where it is reasonable to comply without that consent, taking into account the matters set out in the DPA 2018. Where the Company withholds material on that ground it shall provide as much of the remaining information as it properly can, in redacted form where necessary.
14.7
Where a request is made by an agent on behalf of a Data Subject, the Company shall require evidence of the agent’s authority before responding, and shall respond to the agent only to the extent of that authority.
If a response is unsatisfactory

A Data Subject who is dissatisfied with the Company’s handling of a request may ask for it to be reviewed by the member of senior management responsible for data protection, again through the Enquiry Form. That review does not affect, delay or replace the right to complain to the Commissioner under clause 16.2, which may be exercised at any time.

15.Automated decision-making and profiling

15.1
The Company does not take decisions based solely on automated Processing, including profiling, which produce legal effects concerning a Data Subject or similarly significantly affect them within the meaning of Article 22(1) UK GDPR.
15.2
The Company uses automated tools in the course of due diligence. Sanctions, politically exposed person and adverse media screening operate by automated matching against third-party datasets, and the risk rating applied to a relationship is informed by automated indicators. That activity constitutes profiling within Article 4(4) UK GDPR.
15.3
No decision to decline, suspend or terminate a relationship, and no decision to escalate a matter, is taken on the output of an automated tool alone. Every match, indicator and risk rating is reviewed by a member of the Company’s compliance personnel who has the authority, competence and information necessary to disregard the automated output and to reach a different conclusion. The human review is recorded, with reasons. Article 22(1) is therefore not engaged by that Processing.
15.4
Website analytics are used only to understand in aggregate how the Website is used. They are not used to evaluate personal aspects of an individual and are not used to inform any decision about an individual.
15.5
Should the Company at any time introduce Processing that falls within Article 22(1) UK GDPR, it shall do so only where one of the conditions in Article 22(2) is satisfied, shall inform the Data Subject before the Processing begins, and shall implement the safeguards required by Article 22(3), being at minimum the right to obtain human intervention, to express a point of view and to contest the decision.
15.6
A Data Subject may ask, through the Enquiry Form, what automated tools have been applied to their Personal Data, what the logic of that Processing is, and what the significance and envisaged consequences of it are. Where a screening match is disputed, the Data Subject may require the matter to be reviewed by a person other than the person who conducted the original review.

16.Complaints, supervision and changes

16.1
A Data Subject who is concerned about the Company’s handling of their Personal Data should raise the matter through the Enquiry Form. The Company shall acknowledge the concern within five Business Days and shall provide a substantive response within 30 calendar days. The Company’s Complaints Handling Procedure sets out the process, the escalation route and the records kept.
16.2
A Data Subject has the right to lodge a complaint with the Information Commissioner under Article 77 UK GDPR and section 165 of the DPA 2018. The Commissioner is the supervisory authority for the United Kingdom and publishes her current contact details and online complaints process at ico.org.uk. It is not necessary to complain to the Company first, and complaining to the Company does not affect or postpone the right to complain to the Commissioner.
16.3
A Data Subject also has the right to an effective judicial remedy against the Company under Article 79 UK GDPR, and the right to compensation for material or non-material damage suffered as a result of an infringement, under Article 82 UK GDPR and section 168 of the DPA 2018. Sections 166 and 167 of the DPA 2018 provide for orders of the court in relation to the Commissioner’s handling of a complaint and in relation to compliance with data protection legislation.
16.4
This Policy is reviewed at least annually, and additionally whenever there is a material change to the Company’s Processing, to the categories of Personal Data it holds, to the recipients of that data, to the transfer mechanisms it relies upon, or to the applicable law. The version date shown at the head of this document is the date from which the current version takes effect.
16.5
The version of this Policy published on the Website is the version in force. Where the Company makes a change that materially affects a Data Subject — including a change to the purposes of Processing, the lawful bases relied upon, the categories of recipient, or the retention periods — it shall notify affected Data Subjects directly where it holds contact details for them, before the change takes effect. The Company does not treat continued use of the Website as consent to any change.
16.6
Superseded versions of this Policy are retained. A Data Subject may obtain a copy of the version in force at any given date by making a request through the Enquiry Form.
16.7
This Policy and any dispute arising out of or in connection with it are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction. This provision does not deprive a Data Subject of any right to bring proceedings, or to complain to a supervisory authority, which the UK GDPR or the DPA 2018 confers.
16.8
This Policy does not form part of any contract of engagement or of employment and does not create contractual rights. It does not limit any right conferred on a Data Subject by data protection law, and to the extent that any provision of this Policy would do so, that provision does not apply.
Related policies
Cookie PolicyFGL-LEG-05Data Retention & Records Management PolicyFGL-LEG-06International Data Transfer StatementFGL-LEG-07
Full legal register