How the company collects, uses and protects personal data.
1. Who we are
1.1 This notice explains how Aubert & Merian Ltd, a private limited company registered in England and Wales under company number 17433550, collects and uses personal data as a data controller. Our registered office is at 13 Quex Road, Westgate-on-Sea, Kent CT8 8AT, and questions concerning this notice or your personal data should be addressed to [the data protection contact] at office@aubertmerian.com.
1.2 We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
2. The personal data we collect
2.1 In the course of serving our clients we collect identity and contact details, dates of birth, nationality and residence information, identification documents, financial and taxation information, details of family circumstances relevant to an engagement, information concerning source of funds and source of wealth, and correspondence with us. Because of the nature of our work, this may include information about family members, beneficiaries, settlors, officers and others connected with a client or a structure upon which we advise, and where you provide such information you confirm that you are entitled to do so.
2.2 Visitors to our website provide us with such information as they choose to send by email or telephone. Our website itself collects only the limited technical information described in our cookies policy.
3. Why we use personal data, and on what basis
3.1 We use personal data to provide our services under our engagements, which is processing necessary for the performance of a contract; to satisfy our legal and regulatory obligations, including client identification, the prevention of financial crime, taxation reporting, automatic exchange of information and the maintenance of statutory registers, which is processing necessary for compliance with legal obligations; and to administer the company, maintain records, protect our legal position and communicate with clients and contacts, which we undertake in pursuit of our legitimate interests, having weighed those interests against the rights of the individuals concerned.
3.2 We do not use personal data for marketing to persons who are not clients or professional contacts of the company, we do not sell personal data, and we do not make decisions producing legal effects concerning individuals by automated means.
4. Who we share personal data with
4.1 We share personal data, where necessary for an engagement and under appropriate duties of confidence, with the lawyers, tax counsel, banks, investment managers, independent providers of trust and company administration, and other professional advisers engaged on your matters; with our own professional advisers, insurers and auditors; with providers of information technology and administrative services to the company under contracts restricting their use of the data; and with courts, tax authorities, regulators and law enforcement agencies where disclosure is required by law.
5. International transfers
5.1 Personal data is held and processed in the United Kingdom. Where a provider of information technology or administrative services to the company stores or processes data outside the United Kingdom, we rely on adequacy regulations or on appropriate safeguards, including the International Data Transfer Agreement, and details of the safeguards applicable to a particular transfer are available on request.
6. How long we keep personal data
6.1 We retain personal data for the duration of the client relationship and thereafter for the periods required by law and by our professional obligations. Records maintained for the purposes of financial crime prevention are ordinarily retained for at least five years after the end of the relationship, accounting and taxation records for the periods prescribed in the relevant jurisdictions, and engagement files for [period], after which they are securely destroyed.
7. How we protect personal data
7.1 We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including access restriction, encryption of data in transit, secure storage and the confidentiality obligations of everyone who works with the company. No transmission or storage of data can be guaranteed absolutely secure, and we ask clients to take equivalent care in their communications with us.
8. Your rights
8.1 Subject to the conditions and exemptions of applicable law, you have the right to request access to the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to particular processing, and to receive certain data in portable form. Some of these rights are qualified in the context of our work; in particular, legal and regulatory obligations may require us to retain data notwithstanding a request for erasure, and professional confidentiality may limit what can be disclosed concerning third parties.
8.2 Requests should be addressed to the contact given in clause 1.1. You also have the right to complain to the Information Commissioner's Office, though we would welcome the opportunity to address any concern directly first.
9. Changes to this notice
9.1 We review this notice periodically and publish the current version on this page, showing the date from which it has effect. Where a change materially affects existing clients, we will draw it to their attention.