This policy outlines how, why, and when we, Flagstone Group Ltd (Flagstone), use your personal information, how we may use and share that information, and how you can correct or change information.

Who collects and uses your information?

Flagstone Group Limited is the company which collects, processes and stores the data in the ways outlined in this statement. Flagstone is registered as a data controller with the Information Commissioner’s Office under the Data Protection Act 2018, registration number ZA033774.

What information do we collect and hold?

The types of information we may collect (directly from you or from Third Parties) will depend on the relationship you have with Flagstone.

Information we may collect and store could include:

• Personal information such as your name, address history, contact details, date of birth and nationality.
• Identification data including passport details, driving license or other identification documents.
• Bank account details.
• National Insurance Number and / or any other tax reference number
• Information about your work or profession, including salary details.
• Information about your financial position and history, which may include the source of funds and source of wealth.
• Details of the accounts you hold and/or previously held with us, including transaction history.
• Details of activity on your account including payments made and received.
• Information on your location and how you use our website and online services, gathered from your mobile phone or other devices, where you access the internet to use our services.
• Information about you that is available in the public domain.
• Information about your interactions with Flagstone, online, or by telephone.
• Other information that you supply to us or that we obtain from our relationship/interactions with you. 

We will only collect information that is relevant for the purposes we are using it for.

Where do we collect information from?

Information we collect directly from you

Most of the information we hold about you comes directly from you. This includes information that you may give us when: 

• You express interest in our products or services.
• You open an account with us.
• You update your information (e.g. when you change your address details).
• You speak to us on the phone (our calls maybe recorded for training and quality purposes).
• You visit our office.
• You attend an event held by us.
• You use our websites or web chat services.
• You send us emails, or other electronic communications.
• You send us letters or other documents.
• You wish to enter into a business relationship with Flagstone. 

Where you have provided us with information, you are responsible for making sure this information is accurate and up to date.

Information we collect from third parties

We also might collect or receive information about you from third parties, who may or may not have a direct relationship with you. This includes: 

• Organisations that introduce you to us, including Financial advisers.
• Credit reference agencies.
• HMRC and other government authorities.
• Law enforcement agencies.
• The Electoral Roll and other sources of publicly available information (e.g. Sanctions lists, media).
• Social Media sites which you have made your information publicly available on (e.g. LinkedIn)
• Recruitment agencies.

Where we receive information from a third party we will ensure that there is always a legal basis for us to do so.

Information we collect from people acting on your behalf

There may be cases where we may collect information from people acting on your behalf. This could be from a joint applicant on an account you hold, a trustee, or someone who holds a Power of Attorney for you. It could also be someone working on your behalf like your financial advisor. Where we receive information from someone acting on your behalf, we will record who we obtained this information from.

If you are providing information about someone else, we’ll accept the information on the basis that you have told them that you are sharing their information, they have agreed to you providing this information to Flagstone and you have advised them where they can find more information on how we may process their information, including this Privacy Statement.

How do we use your information?

We collect and use your information for a number of purposes. This includes opening and managing your accounts, providing other services to you and to operate our business. Examples of how we use your information include:

• to verify your identity.
• to manage your account or provide you with services.
• to carry out your instructions.
• to confirm your source of funds or wealth.
• to prevent and detect fraud and financial crime.
• to improve our products and services.
• to share relevant marketing and information about our products and services.
• to share relevant marketing information about products and services of selected third parties or share your information with a selected third party (including a company which referred or introduced you to Flagstone) to enable them to carry out lawful marketing.
• to meet our legal and regulatory obligations.
• to test our operational processes.

Why do we use your information?

We use your information lawfully for the purposes outlined above, where one of the following applies:

1. To meet our legal obligations.
   For example:

• Complying with laws and regulatory requirements that apply to us and the services we provide
• Carrying out anti-money laundering checks

2. Performance of contract.
   For example:

• Providing services as part of an agreement between you and Flagstone.
• Administering and managing your account
• Responding to your queries and communicating with you about the services provided

3. To carry out our legitimate interests or the legitimate interests of a third party.
   For example:

• Developing new products and services
• Internal reporting
• External reporting (for compliance with any legal or regulatory obligation)

4. when you have given us consent to use the information for a specific purpose.
   For example:

• Marketing purposes (where you have opted in to receive marketing from us)

Who may we share your information with?

Your information may be shared with:

• Partners and suppliers that we use to support our operations.
• Banks you place deposits with using our platform.
• With specific third parties that you’ve authorised us to deal with (e.g., financial advisors). 

We may also share information with other organisations including:

• HMRC and other tax authorities.
• UK Financial Services Compensation Scheme.
• Regulators (e.g., FCA.)
• Financial Ombudsman Service.
• Law enforcement agencies.
• Organisations that introduce you to us, including Financial Advisors.
• Payment processors (e.g., BACS).

In addition, we may share your information in the event that we transfer, sell or merge parts of our business. If this happens, we will notify you, and we will endeavour to ensure that the data is continued to be used in-line with this Privacy Statement.

Where do we keep your information?

Flagstone stores information on secure servers located within the EU. However, we may transfer personal information to countries outside the EU when:

• You or someone acting on your behalf asks us to do so.
• We're required or permitted to by law.
• We’re sharing data with a third party to support our operations.

When transferring information to countries outside the UK, we take appropriate steps to ensure that there is adequate protection in place to meet relevant data protection legislation.

How long do we keep your information?

We will keep information as long as is necessary for the purpose we have collected it for. When you have a relationship with Flagstone, most information will be kept as long as you have a relationship with Flagstone and for 6 years after you cease to have a relationship with Flagstone.
In some circumstances, we will keep data longer if we need to and/or if we are required to by law. However, there is some information we may not keep for the lifecycle of your account, e.g., call recordings.

Your rights

You have rights when it comes to your personal information, and there are a number of requests you can make to exercise these rights.

The right to access your information

You can ask us for a copy of any information we hold on you. This is called a Data Subject Access Request (DSAR).

The right to rectify your information

You have the right to ask us to correct information that you feel is inaccurate or incomplete or both.

The right to restrict how we use your information

In some cases, you have the right to restrict us from processing your information any further or deleting it. Please note that there are some things that we need to use your information for, for example, to help protect you from fraud and to fulfil legal and contractual obligations. This may mean that we are unable to restrict how we use your information.

The right to object to how we use your information

In some cases, you have the right to object to the way we process your information. For example, when we’re processing your information for direct marketing. Please note there are some situations where we won't stop processing your information despite your objection, for example to meet legal or regulatory obligations or to continue to have a relationship with you.

The right to erasure

In some cases, you have the right to have your information erased. Please note that we may not be able to agree to your request if we cannot delete your information to meet our legal or regulatory obligations, or to continue to have a relationship with you.

The right to data portability

You have the right to ask us to transfer a copy of some of your information to you or to a new data controller (e.g. another financial provider). This applies when you’ve shared your information with us, it’s been collected with your consent or where collecting it was necessary for the agreement between us.

The right to human intervention

In certain circumstances, you have the right to ask for an automated decision to be reviewed.

The right to withdraw your consent

Where we are relying on your consent to process any of your information, you have a right to withdraw that consent at any time. This will not affect any use of information before you withdrew your consent. If you're a Flagstone Client and you’ve consented to marketing, you can change your marketing preferences at any time on the client portal, email or phone.

Exercising your rights

If you wish to exercise any of these rights, in the first instance please contact Client Services at clientservices@flagstoneim.com or 0203 745 8130. We’ll review your request and get back to you within one month. We may at the time of your request ask you for further information, including proof of identification before we can action your request.

Complaints

In addition to the above you also have the right to complain to the regulator. You can make a complaint by calling us, sending a message or writing to us. More information about how to make a complaint can be found here https://www.flagstoneim.com/complaints. If you still have unresolved concerns, you also have the right to complain to data protection authorities. The authority overseeing data protection in the UK is the Information Commissioner’s Office.

Information Commissioner Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Cookies

Website Cookies

A cookie is a small text file that is stored on your computer or device when you visit a website. Cookies are used on websites and have several different functions. At a basic level cookies will:

• Allow the site to work properly, and help keep it secure
• Help us understand how people use the website
• Make the site easier to use by storing information that you've entered
• Improve your experience by showing you information that's relevant to you

By using our website, you're consenting to our use of cookies. You can change your cookie settings at any time through your browser.

We use the following types of cookies on our website.

Persistent cookies: these remain on a user’s device for a set period of time specified in the cookie. They are activated each time that a user visits the website that created that particular cookie.

Session cookies are temporary cookies which only exist during the time you use the website (or more strictly, until you close the browser after using the website). Session cookies help our website remember what you chose on the previous page, avoiding the need to re-enter information.

First Party cookies are set on the domain you are currently visiting. For example, if you were on www.flagstoneim.com, the cookie would be set on the flagstoneim.com domain if using first party cookies.

Third Party cookies are set on any domain other than the domain currently being visited. For example, if you were visiting www.flagstoneim.com and the cookie was set on the facebook.com domain, that would be considered a third party cookie. Third-party cookies you encounter on our website are likely to be analytical, performance or targeting cookies. These cookies are placed by the relevant third party and we have no control over these cookies (other than allowing them to be served).

How to restrict or delete cookies

Cookies help you get the most out of our website. For that reason, we recommend that you don’t change your cookie settings as it may affect the performance of the website.

However, you can change the settings on your browser to delete or refuse some or all cookies. The “help” function in your browser should tell you how to do this. Alternatively, you can visit https://ico.org.uk/your-data-matters/online/cookies/ which contains information on how to do this for a wide variety of browsers.

Email Cookies

We may use cookies in some of our emails. They help us to understand about how you interact with our us, and are used to improve our future email communications. Our process for delivering emails may cause cookies to be set, when you download images or when you click on a link.

If you don't want to accept cookies from any one of our emails, close the email before downloading any images or clicking on any links. You can also set your browser to restrict cookies or to reject them entirely. These settings will apply to all cookies whether included on websites or in emails.

Depending on your email or browser settings, cookies in an email may be automatically accepted. Please refer to your email browser or device settings for more information.

Analytics

We use analytics tools such as Hotjar to help us better understand our users’ needs and to optimise their experience when visiting out website. Hotjar does this by looking at user activity (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback.

Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymised user profile. Hotjar does not sell any of the data collected on our behalf.

For further details, please see the ‘Privacy’ section of Hotjar’s support site.

Other important information

'Special Category' and Sensitive Personal Data

Some of the information we collect is sensitive personal data (also known as special categories of data), and includes information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or biometric or genetic data. We’ll only ask for this information when we need to for the purposes of:

• Undertaking checks to verify your identity.
• Verifying your Source of Wealth or Source of Funds
• Carrying out any searches, as part of regulatory obligations that require us to identify if someone has or might have a criminal conviction.

Where possible we’ll ask for your consent when collecting special category data. If someone acting on your behalf provides this information, we’ll record what’s been provided and who gave it to us.

Automated decision making

We sometimes use technology to make automated decisions about our clients. This could be when you’re applying to open an account with us, or as part of our ongoing relationship with you. We may use automated decision making to:

• Assess your application to check that we can enter into an agreement with you, and also carry out our legal and regulatory obligations.
• Check if someone’s making a fraudulent application or if there’s activity on your account that needs further review.
• Decide if you are, or continue to be, eligible for the product or service you’ve chosen.

For automated decision making, we use information that we’ve collected or hold about you from your application or interactions with us. We may also use information from other sources such as credit reference agencies.

Using your information when you do not have a relationship with Flagstone

We might collect or use personal information from individuals who aren’t clients of Flagstone. This could be when they:

• Have a Power of Attorney to act a client's behalf.
• Are the Personal Representative registering the death of a client.
• Are acting as the donor for the deposit.
• Are acting on behalf of a customer, either in a professional capacity or a personal capacity.
• Applying for a joint account with another person.
• Visit our website or fill in a webform expressing interest in our products.

If you are providing information about someone else, we’ll accept the information on the basis that you have told them that you are sharing their information, they have agreed to you providing this information to Flagstone and you have advised them where they can find more information on how we may process their information, including this Privacy Statement.

Links to third party Websites

Please note that our website may contain links to other websites for your convenience and information. Flagstone does not control Third-Party websites or their privacy practices, which may differ from those set out in this Privacy Statement. We encourage you to review the Privacy Statement of any company or website that you reach via Flagstone's website before submitting Personal Information.

Data Protection Officer

Flagstone has a nominated Data Protection Officer. Should you wish to contact the DPO for any matter concerning your personal information you can do this in the following ways:

Write to: Data Protection Officer, Flagstone Group Limited, 1^st Floor, Clareville House, 26-27 Oxendon Street, London, SW1Y 4EL
Email: clientservices@flagstoneim.com and mark your email as being for the attention of the Data Protection Officer.

Changes to this Statement

This Privacy Statement may be updated from time to time. We will post any changes we make to this statement on our website, becoming effective immediately. If the changes are material changes, and you are a client or a business partner of Flagstone we’ll let you know by email.

Last updated July 2022