Privacy Policy

Our policy on your privacy

This policy outlines how, why, and when we, Flagstone Investment Management Ltd (Flagstone), use your personal information, how we may use and share that information, and how you can correct or change information.

Who collects and uses your information?

Flagstone Investment Management Limited is the company which collects, processes and stores the data in the ways outlined in this statement. Flagstone is registered as a data controller with the Information Commissioner’s Office under the Data Protection Act 1998, registration number ZA033774.

What information do we collect and hold?

The types of information we may collect (directly from you or from Third Parties) will depend on the relationship you have with Flagstone.

Information we may collect and store could include:

  • Personal information such as your name, address, contact details, and date of birth.
  • Information about your work or profession, including salary details and your nationality.
  • Details of the accounts you hold and/or previously held with us, including transaction history.
  • Information about your financial position and history, which may include the source of funds and source of wealth.
  • Details of activity on your account including payments made and received.
  • Information on your location and how you use our website and online services, gathered from your mobile phone or other devices, where you access the internet to use our services.
  • Details you make public on social media, e.g., LinkedIn.
  • Information about you that is available in the public domain.
  • Information about your interactions with Flagstone, online, or by telephone.
  • Information about your employment status and history when you apply for a job with us.
  • Other information that you supply to us or that we obtain from our relationship/interactions with you. 

We will endeavour only to collect information that is relevant for the purposes we are using it for.

Where do we collect information from?

Information we collect directly from you

Most of the information we hold about you comes directly from you. This includes information that you may give us when: 

  • You express interest in our products or services.
  • You update your information (e.g. when you change your address details).
  • You speak to us on the phone (our calls maybe recorded for training and quality purposes).
  • You visit our office.
  • You visit an event held by us.
  • You use our websites or web chat services.
  • You send us emails, or other electronic communications.
  • You send us letters or other documents.
  • You apply for a job with Flagstone.
  • You wish to enter into a business relationship with Flagstone. 

Where you have provided us with information, you are responsible for making sure this information is accurate and up to date.

Information we collect from third parties

We also might collect or receive information about you from third parties, who may or may not have a direct relationship with you. This includes: 

  • Organisations that introduce you to us, including Financial advisers.
  • Comparison websites.
  • Credit reference agencies.
  • HMRC and other government authorities.
  • Law enforcement agencies.
  • The Electoral Roll and other sources of publicly available information (e.g. Sanctions lists, media).
  • Social Media sites which you have made your information publicly available on (e.g. LinkedIn, Facebook)
  • Recruitment agencies. 

Where we receive information from a third party we will ensure that there is always a legal basis for us to do so.

Information we collect from people acting on your behalf

There maybe cases where we may collect information from people acting on your behalf. This could be from a joint applicant on an account you hold, a trustee, or someone who holds a Power of Attorney for you. It could also be someone working on your behalf like your financial advisor. Where we receive information from someone acting on your behalf, we will record who we obtained this information from.

If you are providing information about someone else, we’ll accept the information on the basis that you have told them that you are sharing their information, they have agreed to you providing this information to Flagstone and you have advised them where they can find more information on how we may process their information, including this Privacy Statement.

How do we use your information?

We collect and use your information for a number of purposes. This includes opening and managing your accounts, providing other services to you and to operate our business. Examples of how we use your information include:

  • to verify your identity.
  • to manage your account or provide you with services.
  • to carry our your instructions.
  • to confirm your source of funds or wealth.
  • to prevent and detect fraud and financial crime.
  • to improve our products and services.
  • to share relevant marketing and information about our products and services.
  • to share relevant marketing information about products and services of selected third parties or share your information with a selected third party (including a company which referred or introduced you to Flagstone) to enable them to carry out lawful marketing.
  • to meet our legal and regulatory obligations.
  • to assess if you are suitable to work with or for us.
  • to test our operational processes.

We’re able to use your information for the purposes outlined above, where one of the following applies:

  • to carry out legal obligations to you.
  • to enter into or as part of an agreement between you and Flagstone.
  • to comply with the law or in the public interest.
  • to carry out our legitimate interests or the legitimate interests of a third party.
  • when you have given us consent to use the information for a specific purpose.

Who may we share your information with?

Your information maybe shared with:

  • Partners and suppliers that we use to support our operations.
  • Banks you place deposits with using our platform.
  • With specific third parties that you’ve authorised us to deal with (e.g., financial advisors). 

We may also share information with other organisations including:

  • HMRC and other tax authorities.
  • UK Financial Services Compensation Scheme.
  • Regulators (e.g., FCA.)
  • Financial Ombudsman Scheme.
  • Law enforcement agencies.
  • Organisations that introduce you to us, including Financial Advisors.
  • Payment processors (e.g., BACS).
  • Comparison websites.

In addition, we may share your information in the event that we transfer, sell or merge parts of our business. If this happens we will endeavour to ensure that the data is continued to be used in-line with this Privacy Statement.

Where do we keep your information?

Flagstone stores information on secure servers located within the EU. However, we may transfer personal information to countries outside the EU when:

  • You or someone acting on your behalf asks us to do so.
  • We're required or permitted to by law.
  • We’re sharing data with a third party to support our operations.

When transferring information to countries outside the UK, we take appropriate steps to ensure that there is adequate protection in place to meet relevant data protection legislation.

How long do we keep your information?

We will keep information as long as is necessary for the purpose we have collected it for. When you have a relationship with Flagstone, most information will be kept as long as you have a relationship with Flagstone and for 6 years after you cease to have a relationship with Flagstone.
In some circumstances, we will keep data longer if we need to and/or if we are required to by law. However, there is some information we may not keep for the lifecycle of your account, e.g., call recordings.

Your rights

You have rights when it comes to your personal information, and there are a number of requests you can make to excercise these rights.

The right to access your information

You can ask us for a copy of any information we hold on you. This is called a Data Subject Access Request (DSAR).

The right to rectify your information

You have the right to ask us to correct information that you feel is inaccurate or incomplete or both.

The right to restrict how we use your information

In some cases, you have the right to restrict us from processing your information any further or deleting it. Please note that there are some things that we need to use your information for, for example, to help protect you from fraud and to fulfil legal and contractual obligations. This may mean that we are unable to restrict how we use your information.

The right to object to how we use your information

In some cases, you have the right to object to the way we process your information. For example, when we’re processing your information for direct marketing. Please note there are some situations where we won't stop processing your information despite your objection, for example to meet legal or regulatory oblgiations or to continue to have a relationship with you.

The right to erasure

In some cases, you have the right to have your information erased. Please note that we may not be able to agree to your request if we cannot delete your information to meet our legal or regulatory obligations, or to continue to have a relationship with you.

The right to data portability

You have the right to ask us to transfer a copy of some of your information to you or to a new data controller (e.g. another financial provider). This applies when you’ve shared your information with us, it’s been collected with your consent or where collecting it was necessary for the agreement between us.

The right to human intervention

In certain circumstances, you have the right to ask for an automated decision to be reviewed.

The right to withdraw your consent

Where we are relying on your consent to process any of your information, you have a right to withdraw that consent at any time. This will not affect any use of information before you withdrew your consent. If you're a Flagstone Client and you’ve consented to marketing, you can change your marketing preferences at any time on the client portal, email or phone.

Exercising your rights

If you wish to exercise any of these rights, in the first instance please contact Client Services at or 0203 745 8130. We’ll review your request and get back to you within one month. We may at the time of your request ask you for further information, including proof of identification before we can action your request.


In addition to the above you also have the right to complain to the regulator. You can make a complaint by calling us, sending a message or writing to us. More information about how to make a complaint can be found here If you still have unresolved concerns, you also have the right to complain to data protection authorities. The authority overseeing data protection in the UK is the Information Commissioner’s Office.

  • Information Commissioner Office
  • Wycliffe HouseWater Lane
  • Wilmslow
  • Cheshire
  • SK9 5AF
  • Telephone: 0303 123 1113


Website Cookies

A cookie is a small text file that is stored on your computer or device when you visit a website. Cookies are used on websites and have several different functions. At a basic level cookies will:

  • Allow the site to work properly, and help keep it secure
  • Help us understand how people use the website
  • Make the site easier to use by remembering information that you've entered
  • Improve your experience by showing you information that's relevant to you

Email Cookies

We may use cookies in some of our emails. They help us to understand about how you interact with our us, and are used to improve our future email communications. Our process for delivering emails may cause cookies to be set, when you download images or when you click on a link.

If you don't want to accept cookies from any one of our emails, close the email before downloading any images or clicking on any links. You can also set your browser to restrict cookies or to reject them entirely. These settings will apply to all cookies whether included on websites or in emails.

Depending on your email or browser settings, cookies in an email may be automatically accepted. Please refer to your email browser or device settings for more information.

Other important information

'Special Category' and Sensitive Personal Data

Some of the information we collect is sensitive personal data (also known as special categories of data), and includes information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or biometric or genetic data. We’ll only ask for this information when we need to for the purposes of:

  • Undertaking checks to verify your identity.
  • Verifying your Source of Wealth or Source of Funds
  • Carrying out any searches, as part of regulatory obligations that require us to identify if someone has or might have a criminal conviction.

Where possible we’ll ask for your consent when collecting special category data. If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

Automated decision making

We sometimes use technology to make automated decisions about our customers. This could be when you’re applying to open an account with us, or as part of our ongoing relationship with you. We may use automated decision making to:

  • Assess your application to check that we can enter into an agreement with you, and also carry out our legal and regulatory obligations.
  • Check if someone’s making a fraudulent application or if there’s activity on your account that needs further review.
  • Decide if you are, or continue to be, eligible for the product or service you’ve chosen.

For automated decision making, we use information that we’ve collected or hold about you from your application or interactions with us. We may also use information from other sources such as credit reference agencies.

Using your information when you do not have a relationship with Flagstone

We might collect or use personal information from individuals who aren’t customers of Flagstone. This could be when they:

  • Have a Power of Attorney to act a customers behalf.
  • Are the Personal Representative registering the death of a customer.
  • Are acting as the donor for the deposit.
  • Are acting on behalf of a customer, either in a professional capacity or a personal capacity.
  • Applying for a joint account with another person.
  • Visit our website or fill in a webform expressing interest in our products.

If you are providing information about someone else, we’ll accept the information on the basis that you have told them that you are sharing their information, they have agreed to you providing this information to Flagstone and you have advised them where they can find more information on how we may process their information, including this Privacy Statement.

Links to third party Websites

Please note that our website may contain links to other websites for your convenience and information. Flagstone does not control Third-Party websites or their privacy practices, which may differ from those set out in this Privacy Statement. We encourage you to review the Privacy Statement of any company or website that you reach via Flagstone's website before submitting Personal Information.

Changes to this Statement

This Privacy Statement may be updated from time to time. We will post any changes we make to this statement on our website, becoming effective immediately. If the changes are material changes, and you are a client or a business partner of Flagstone we’ll let you know by email.

Last updated September 2019