PRIVACY NOTICE
This Privacy Notice applies to personal information held by THOMAS GRANT RECRUITMENT (“the Company”, “us”,
“we”) as data controllers and processors, as described below. It covers how we collect, use, store, share and
secure the data that you supply to us and your rights about data that we hold about you. It continues to
apply even if we have been disengaged to provide services.
Wherever we have said ‘you’ or ‘your’, this means you, any authorised person to handle your affairs or deals
with us for you such as tax agents and advisers, trustees or executors, attorneys under a Power of Attorney,
and other related people including authorised signatories, partners, members and assigns.
- What information we collect
1.1 We will only collect your information in line with relevant regulations and law. We may collect
it from a range of sources and it may relate to any of our services you consider engaging us for.
We may also collect information about you when you interact with us, e.g. visit our websites
or mobile channels, call us or visit one of our branches, or ask about any of our services.
1.2 Some of the information will come directly from you. It can also come from your financial
adviser, accountant, legal representative or other sources you have asked us to obtain
information from. We might also get some of it from publicly available sources. We will collect,
store and use the following data:
- Information that you provide to us, e.g.:
2.1 Personal details, e.g. name, previous names, gender, date and place of birth;
2.2 Contact details, e.g. address, email address, landline and mobile numbers;
2.3 Information concerning your identity e.g. photo ID, passport information, national ID card and
nationality;
2.4 National Insurance Number and/or Unique Tax Reference;
2.5 Tax code information;
2.6 Bank account details, source of funds and source of wealth data;
2.7 Employment and payroll records, salary, pension, expenses, travel logs and benefits
information and other financial records provided by you;
2.8 Information about your personal taxation;
2.9 Information about HMRC investigations, inquiries, notices, discovery assessments, APNs,
statutory reviews and appeals;
2.10Marketing and advertising responses and preferences; telematics data, GPS data;
2.11Results data from the services which may include other third party data;
2.12Any other data about you that you give us by filling in forms or by communicating with us,
whether face-to-face, by phone, email, online or otherwise.
- Information we collect or generate about you, e.g.:
3.1 Your financial information and information about your relationship with us, including the
services you are using, the channels you use and your ways of interacting with us, your
payment history, transactions records, and information concerning complaints and disputes;
3.2 Information we use to identify and authenticate you, e.g. your signature and KYC
documentation, and additional information that we receive from external sources that we need
for compliance purposes;
3.3 Information included in customer documentation, e.g. a record of advice that we may have
given you;
3.4 Marketing and sales information, e.g. details of the products and services you receive and your
preferences;
3.5 Cookies and similar technologies we use to recognise you, remember your preferences and
tailor the content we provide to you;
3.6 Investigations data, e.g. due diligence checks, sanctions watch list data and any other data
obtained pursuant to anti-money laundering checks; external intelligence reports, content and
metadata related to relevant exchanges of information between and among individuals,
organisations, including emails, voicemail, live chat;
3.7 Records of correspondence and other communications between us, including email, live chat,
instant messages and social media communications;
3.8 Information that we need to support our regulatory obligations, e.g. detection of any
suspicious and unusual activity and information about parties connected to you or these
activities.
- Information we collect from other sources, e.g.:
4.1 Information from third party providers, e.g. information that helps us to combat fraud or that
relates to your social interactions, including your communications via social media, between
individuals, organisations, prospects and other stakeholders acquired from companies that
collect combined information.
- How we will use your information
1.1 We will only use your information where we have your consent or we have another lawful
reason for using it. These reasons include where we:
1.1.1 Need to pursue our legitimate interests;
1.1.2 Need to process the information to enter into or carry out an agreement we have
with you;
1.1.3 Need to process the information to comply with a legal obligation;
1.1.4 Believe the use of your information as described is in the public interest, e.g. for the
purpose of preventing or detecting crime;
1.1.5 Need to establish, exercise or defend our legal rights; or
1.1.6 Where you are a customer, we need to use your information for insurance purposes.
- The reasons we use your information include to:
2.1 Deliver our services;
2.2 Carry out your instructions;
2.3 Carry out due diligence checks, including know-your-customer, source of funds and source of
wealth checks;
2.4 Manage our relationship with you, including (unless you tell us otherwise) telling you about
products and services we think may be relevant for you;
2.5 Understand how you use our services;
2.6 Support operations of the services we provide you;
2.7 Prevent or detect crime, including fraud and financial crime, e.g. financing for terrorism and
human trafficking;
2.8 Investigate and resolve complaints;
2.9 Ensure security and business continuity;
2.10 Risk management;
2.11 Provide online services and other online product platforms;
2.12 Implement product and service improvement;
2.13 Undertake data analytics to better understand your circumstances and preferences so we can
make sure we can provide you with the best service and offer you a tailored service;
2.14 Protect our legal rights and comply with our legal obligations;
2.15 Correspond with introducers, advisers and third party intermediaries;
2.16 Undertake system or product development and planning, audit and administrative purposes.
- Tracking or recording what you say or do
3.1 We may record details of your interactions with us. We may record and keep track of
conversations you have with us, including phone calls, face-to-face meetings, letters, emails,
live chats, video chats and any other kinds of communication. We may use these recordings
to check your instructions to us, assess, analyse and improve our service, train our people,
manage risk or to prevent and detect fraud and other crimes. We may also capture additional
information about these interactions, e.g. telephone numbers that you call us from and
information about the devices or software that you use.
- Marketing and market research
4.1 We may use your information to provide you with details about other products and services
from relevant third parties. We may send you marketing messages by post, email, telephone,
text or secure messages. You can change your mind on how you receive marketing messages
or choose to stop receiving them at any time. To make that change, please contact us.
4.2 If you ask us not to send you marketing information, it may take us a short period of time to
update our systems and records to reflect your request, during which time you may continue
to receive marketing messages. Even if you tell us not to send you marketing messages, we
will continue to use your contact details to provide you with important information, such as
changes to your terms and conditions or if we need to tell you something to comply with our
regulatory obligations.
- Data controlling, processing and sharing.
5.1 By the virtue of your employment with us, you expressly consent to the engagement of
another data controller and processor unilaterally chosen by us for the processing of your
personal data. This may be needed where activities are carried out by third-party service
providers (including contractors and designated agents) including but not limited to general
administration, legal and tax advisory, insurance, IT services or where we have a legitimate
business reason for doing so such as change in ownership or business restructure.
5.2 Where we engage another controller and processor for carrying out specific controlling and
processing activities of your personal data, the same data protection obligations shall be
imposed on that other controller and processor by way of a contract or other legal act under
UK and/or EU or governing Member State law, in particular providing sufficient guarantees
to implement appropriate technical and organisational measures in such a manner that the
processing will meet the requirements of the Data Protection legislation.
- Who we might share your information with
6.1 We may share your information with others where lawful to do so, including where we or
they:
6.1.1 Need to in order to provide you with products or services you have requested;
6.1.2 Have a public or legal duty to do so, e.g. to assist with detecting and preventing fraud,
tax evasion and financial crime;
6.1.3 Need to in connection with regulatory reporting, litigation or asserting or defending
legal rights and interests;
6.1.4 Have a legitimate business reason for doing so, e.g. change in ownership, to manage
risk, verify your identity, enable another company to provide you with services you have requested, or assess your suitability for products and services.
- We may share your information for these purposes with others, including:
7.1 Any sub-controllers and processors of data subject information;
7.2 Sub-contractors, agents sub-contractors, agents or service providers who work for us or
provide services to us (including their employees, sub-contractors, service providers,
directors and officers);
7.3 Any trustees, beneficiaries, administrators or executors;
7.4 People you make payments to and receive payments from;
7.5 Your beneficiaries, intermediaries, correspondent and agent banks, clearing houses,
clearing or settlement systems, market counterparties;
7.6 Any brokers who introduce you to us or deal with us for you;
7.7 Any entity that has an interest in the products or services that we provide to you, including
if they take on the risk related to them;
7.8 Any people or companies where required in connection with potential or actual corporate
restructuring, merger, acquisition or takeover, including any transfer or potential transfer
of any of our rights or duties under our agreement with you;
7.9 Law enforcement, government, courts, dispute resolution bodies, our regulators, auditors
and any party appointed or requested by our regulators to carry out investigations or audits
of our activities;
7.10 Other parties involved in any disputes, including disputed transactions;
7.11 Fraud prevention agencies who will also use it to detect and prevent fraud and other
financial crime and to verify your identity;
7.12 Anyone who provides instructions or operates on your behalf, e.g. Power of Attorney,
solicitors, intermediaries;
7.13 Anybody else that we have been instructed to share your information with by either you, or
operates any of your accounts on your behalf.
- Transfers of data to and outside of the EU
8.1 Your information may be transferred to and stored in locations inside and outside of the
European Economic Area (EEA), including countries that may not have the same level of
protection for personal information as the UK and EEA do. When we do this, we will ensure it
has an appropriate level of protection and that the transfer is lawful. We may need to transfer
your information in this way to carry out our contract with you, to fulfil a legal obligation, to
protect the public interest and/or for our legitimate interests. In some countries the law might
compel us to share certain information, e.g. with tax authorities.
8.2 We will ensure that, to the extent that any personal data originating from the United Kingdom
(UK) or European Economic Area (EEA) is transferred by us to another controller and/or
processor in a country or territory outside the UK or EEA that has not received a binding
adequacy decision by the European Commission or competent national data protection
authority, such transfer will be subject to an appropriate transfer mechanism that provides
an adequate level of protection in accordance with the Data Protection legislation.
- Data Retention
9.1 We keep your information in line with our data retention policy. We will normally keep your
personal and financial data for a period of six years from the end of our relationship with you.
This enables us to comply with legal and regulatory requirements or use it where we need to
for our legitimate purposes, such as disputes or concerns that may arise.
9.2 We may need to retain your information for a longer period, where we need the information
to comply with regulatory or legal requirements or where we may need it for our legitimate
purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime,
responding to requests from regulators, etc.
9.3 If we do not need to retain information for this period of time, we may destroy, delete or
anonymise it more promptly.
- Your Rights
10.1 Under certain circumstances, by law you have the right to:
10.1.1 Request access to your personal information (commonly known as a “data subject
access request”). This enables you to receive a copy of the personal information we
hold about you and to check that we are lawfully processing it. Please refer to our DSAR Procedure for more information.
10.1.2 Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
10.1.3 Request erasure of your personal information. This enables you to ask us to delete
or remove personal information where there is no good reason for us continuing to
process it. You also have the right to ask us to delete or remove your personal
information where you have exercised your right to object to processing (see below).
10.1.4 Object to processing of your personal information where we are relying on a
legitimate interest (or those of a third party) and there is something about your
particular situation which makes you want to object to processing on this ground.
You also have the right to object where we are processing your personal information
for direct marketing purposes.
10.1.5 Request the restriction of processing of your personal information. This enables
you to ask us to suspend the processing of personal information about you, for
example if you want us to establish its accuracy or the reason for processing it.
10.1.6 Request the transfer of your personal information to another party.
- Right to withdraw consent
11.1 In the limited circumstances where you may have provided your consent to the collection,
processing and transfer of your personal information for a specific purpose, you have the right
to withdraw your consent for that specific processing at any time. You can exercise your rights
by contacting us.
- What we need from you
12.1 You are responsible for making sure the information you give us is accurate and up to date,
and you must tell us if anything changes as soon as possible. If you provide information for
another person, you will need to direct them to this Privacy Notice. If we need that person’s
consent, we will ask you to confirm that you have obtained such consent.
- How we keep your information secure
13.1 We use a range of measures to keep your information safe and secure, which may include
encryption and other forms of security. We require our staff and any third parties who carry
out any work on our behalf to comply with appropriate compliance standards, including
obligations to protect any information and applying appropriate measures for the use and
transfer of information.
- Complaints and queries
14.1 If you have any questions about this Privacy Notice or how we handle your personal
information, please contact us. If you are not satisfied by our response you also have the right
to make a complaint at any time to the Information Commissioner’s Office (ICO).
- Changes to this Privacy Notice
15.1 We reserve the right to update this Privacy Notice at any time, and we will provide you with
a new Privacy Notice when we make any material updates. We may also notify you in other
ways from time to time about the processing of your personal data.