Data Protection & Privacy Policy

Introduction

The UK Data Protection Act (DPA) 2018, was enacted into UK Law to encompass the European Union’s General Data Protection Regulation 2018 (GDPR). Both the act and the regulation applies to ‘personal data’ with a core principle of giving individuals more control of their personal data. Personal data includes (but is not limited to) such details as name, address, telephone number, date of birth, etc. This policy applies to data held in both electronic/digital or paper format and provides information about the way Platform One manages, shares and protects personal data. Throughout this policy ‘personal data’ means any information relating to an identified or identifiable natural person (a ‘data subject’) and the term ‘individual’ will be used in place of the more formal ‘data subject’. In this policy, it is our aim to present the information using clear and plain language and in a manner that is concise, transparent, easily accessible and intelligible. We aim to keep our policy under regular review and we’ll place any updates on our website (www.platform1online.com) and our internal Policy Library.

Who are we?

Platform One Limited T/A Platform One (Companies House Number: 6993268) is registered at Peartree Business Centre, Cobham Road, Wimborne, Dorset. This policy applies across all areas our business including internal policies and procedure, and our website www.platform1online.com. This policy has been adopted both by our parent entity, Platform One Group Limited and any subsidiaries of Platform One Limited.

Who regulates us?

Platform One Limited is authorised and regulated by the Financial Conduct Authority (FCA). Our registration details can be found on the FCA Financial Services Register at https://register.fca.org.uk. Our registration Number is 542059. Platform One Limited, its subsidiaries and its parent are all registered with the Information Commissions Office as a Data Controller. Our Data Protection Registration Licenses are as follows:
Platform One Limited – ZA647333
Platform One Group Limited (Parent) – ZA647319
Platform Nominees Limited (Subsidiary) – ZA647315
PLATO Nominee Limited (Subsidiary) – ZA647301

Our data protection principles

Platform One applies all principles of the GDPR and DPA in managing and protecting personal data. These principles are:

• Lawfulness, fairness and transparency
  Platform One will only collect and process data where we have legal grounds to do so. We will only collect and process personal data in ways that individuals would reasonably expect and not use it in ways that have unjustified and adverse effects on them. Platform One will always be transparent about the way we collect and process data.
• Purpose limitation
  Platform One will always be clear about the purpose for collecting and processing data at the point of data collection.
• Data minimisation
  Platform One will only collect data that is adequate and be sufficient to properly fulfil our stated purpose. The data collected must be relevant and have a rational link to purpose and be limited to what is necessary.
• Accuracy
  Platform One will take all reasonable steps to ensure that personal data is not incorrect or misleading. We will ensure that personal data is kept update and in the event that we identify that data is incorrect or misleading, we will take steps to correct or erase it as soon as possible.
• Storage limitation
  Platform One will not keep data for longer than is required. We have established processes to ensure that data is deleted where it is no longer required to mitigate the risk of it becoming irrelevant, excessive, inaccurate or out of date.
• Integrity and confidentiality (security)
  Platform One implements the strongest and appropriate controls to protect data from unauthorised access and theft.
• Accountability
  Platform One is required by law to take responsibility for what we do with personal data and how we comply with the above principles.

Roles & responsibilities

There are three important roles enacted into law with defined responsibilities:
·     ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
·     ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
·     ‘Sub-Processors’ or ‘Third Party Processors’ mean a natural or legal person, public authority, agency or other body who, under the direct authority of the Controller or Processor, are authorised to process personal data.

This distinction is important because there are specific legal responsibilities that apply to those roles. The DPA & GDPR places specific legal obligations on Processors and Sub-Processors; for example, they are required to maintain records of personal data and processing activities and they will have legal liability if they are responsible for a personal data breach. They place other obligations on Controllers, such as:
·     ensuring that contracts with Processors comply with the law;
·     providing information to individuals about the processing of their personal data;
·     facilitating the exercise of individuals’ rights.

In most cases Platform One will act as a ‘Controller’. Where the relationship of an individual is shared with a third party, Platform One will act in the capacity as a ‘Joint Controller’.

Personal data collected

Due to the nature of our business and of our partners’ businesses, the personal data required will typically relate in some way to individuals’ personal and financial circumstances. In the case where a new client is being introduced, the personal data would need to be sufficient to facilitate anti-money laundering and identity verification requirements. In some cases, personal data may also include special categories, such as data about an individual’s health if this is necessary for the provision of the service(s).

Where special category data is required, Platform One should have obtained explicit consent to collect and process that data from the individual.

Why does Platform One collect personal data?

The primary legal basis that Platform One has for the collection and processing of personal data is for the performance of a contract we have with an individual or with another company such as an adviser firm. Collection of personal data is essential for us to be able to carry out the services that are expected of us effectively. Without the personal data described, Platform One and the other companies we work with would be unable to fulfill our contractual, legal and regulatory obligations.

Who we might share personal data with?

We share personal data with a custodian, depending upon the service involved. A different custodian is used for each service (i.e. our Imperial Service and Platinum Service, International Service, International Plus Service and our Global Service each use a different custodian). We will provide individual investors with specific details at an appropriate point in time (typically at the time of new client application or specific product application).
‍
We will ensure that the companies we share and control data with have appropriate measures and controls in place to comply with the DPA and GDPR.

We will also ensure that the nature and purpose of the processing is clear, that they are subject to a duty of confidence in collecting and processing personal data and that they’ll only act in accordance with appropriate instructions.
‍
When it is necessary for personal data to be sent to or collected by another party (such as a Product Provider), we’ll use appropriate security measures to protect the personal data.
‍
To fulfill our obligations in respect of prevention of money-laundering and other financial crime we may send personal data to third party agencies for identity and anti-money laundering verification purposes. We will not share personal data with companies outside the Platform One Group of companies without seeking prior consent.
‍
To comply with legal and financial regulations (including audit), we may need to share personal data with HMRC, Regulatory Authorities and/or law enforcement agencies.

Period of personal data retention

In principle, Platform One shouldn’t hold personal data for longer than is required. Platform One has a regulatory and legal requirement to maintain data for a minimum period. We will keep personal data for as long as an individuals is a client of Platform One. Following the termination of the relationship between Platform One and an individual, we will retain personal data for a maximum period of 7 years. This will enable us to deal with any questions or complaints, to demonstrate compliance with regulatory requirements or for legal reasons. All data will be held securely in an encrypted format.

Platform One undertakes a review of personal data in line with our data retention period. Data that is no longer required by us is destroyed and/or deleted inline with the principles set within the DPA and GDPR. Once data has been deleted or destroyed, Platform One will be unable to restore it.

Rights of an individual

The personal data of individuals are protected by legal rights, including:

• Risk of access
  ‍Individuals have the right to request the personal information that Platform One hold about them (Subject Access Request). Individuals may provide a request in any format (written or verbal). Platform One must respond to any such request within a maximum of 30 days.
• Right to object
  Depending on the legal basis for which Platform One are using their information, individuals may be entitled to object if they believe there are lawful grounds to do so.
• Right to ensure
  In certain circumstances, individuals can ask Platform One to erase personal data, unless there is a legal obligation for Platform One to object to such request. Platform One will provided a written justification in the event that we are unable to adhere to a request enacting this right.
• Right to retification
  Individuals can ask Platform One to correct personal data we hold about them, if they are able to evidence that the data we hold is inaccurate.
• Right to restrict processing
  ‍In certain circumstances, individuals may ask to restrict the use of their personal data.
• Right to data portability
  ‍Individual may ask Platform One to provide a copy of personal data in a commonly used electronic format in order that they can transfer it to other businesses or legal entities.
• Right to be informed
  ‍Individuals have the right to be informed if Platform One process personal data that relates to them. Platform One must inform individuals of what we are processing, what we use the data for, who we disclose the data to and how long we will keep it for. This is normally provided in the form of written policies available on our website.

Other obligations: Breach notification

A ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. Platform is required to make notification where a data breach is likely to “result in a risk for the rights and freedoms of individuals”. This must be done within 72 hours of first having become aware of the breach.

Complaints & Communication

If individuals have any questions or wish to raise a complaint with regard to how personal data is collect and/or processed by Platform One, they can do so by contacting our Data Protection Officer:
Michelle Martin
Peartree Business Centre
Cobham Road
Wimborne
Dorset
BH21 7PT 
Tel: 01202 402767
Email: compliance@platform1online.com

A complainant may also have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

For any further information regarding this policy please contact the Platform One Data Protection Office listed above.