Flagstone Client Privacy Notice

This notice outlines:

Who collects and uses your information? 

Flagstone collects, processes, and stores your information in the ways outlined in this notice. Flagstone is registered as a data controller with the Information Commissioner’s Office under the Data Protection Act 2018 (registration number ZA033774). 

What information do we collect and hold? 

The information we may collect (directly from you or from third parties) and store includes: 

We’ll only collect and store your information where necessary.  

Where do we collect information from? 

Information we collect from you 

Most of the information we hold about you comes directly from you. This includes information you may give us when you:  

You’re responsible for making sure the information you’ve provided is accurate and up to date. 

We might also collect or receive information about you from third parties, who may or may not have a direct relationship with you. This includes:  

We'll only ever receive information from third parties when it's legal for us to do so. 

Information we collect from people acting on your behalf 

There may be cases where we collect information from people acting on your behalf. This could be from a joint applicant on an account you hold, a trustee, or someone who holds a Power of Attorney for you. It could also be someone working on your behalf, like your financial adviser. If we receive information from someone acting on your behalf, we’ll record who we received this information from. 

If you’re providing information about someone else, we’ll accept the information on the basis that: 

How do we use your information? 

We collect and use your information for several purposes, including to:  

Why do we use your information? 

We use your information lawfully for the purposes we’ve outlined above, where one of the following applies: 

To meet our legal obligations. For example: 

Performance of contract. For example: 

To carry out our legitimate interests or the legitimate interests of a third party. For example:  


'Special category' and sensitive personal data 

Some of the information we collect is sensitive information, and may include information about your: 

We’ll only ask for this information when necessary, for example to: 

Where we’re required to, we’ll ask for your consent when collecting sensitive information. If someone acting on your behalf provides this information, we’ll record what they provide, as well as who provided it.  

Who may we share your information with? 

We may share your information with: 

We may also share your information if we transfer, sell or merge parts of our business. If this happens, we’ll let you know, and we’ll endeavour to ensure the data is used in line with this Client Privacy Notice. 

We only share your data where it’s lawful to do so, and only for the reasons listed above. Some third parties we share your data with process it as independent controllers, in line with their own privacy notices.

Where do we keep your information? 

Flagstone stores your information on secure servers in the UK. But, we may transfer personal information to countries outside the UK when: 

When transferring information to countries outside the UK, we take appropriate steps to ensure your information is protected.  

How long do we keep your information? 

We’ll keep your information as long as is necessary for the purpose we’ve collected it for. When you have a relationship with Flagstone, we’ll usually keep your information for as long as you maintain that relationship, and then for six years after you end that relationship. 

In some circumstances, we’ll keep data longer if we need to and/or if we’re required to by law. But there’s some information we may not keep for the full lifetime of your relationship with Flagstone – for example, call recordings. 

Your rights 

You have rights when it comes to your personal information, and there are several requests you can make to exercise these rights. 

The right to be informed how we're using your information

You can ask us to tell you who we share your information with and how we store your information and so on. 

The right to access your information 

You can ask us for a copy of any information we hold on you.  

The right to rectify your information 

You have the right to ask us to correct information you feel is inaccurate, incomplete, or both. 

The right to restrict how we use your information 

In some cases, you have the right to restrict us from processing or deleting your information. There are some things we need to use your information for – for example, to help protect you from fraud and to fulfil legal and contractual obligations. This may mean we’re unable to restrict how we use your information. 

The right to object to how we use your information 

In some cases, you have the right to object to the way we process your information. For example, when we’re processing your information for direct marketing. There are some situations where we will not stop processing your information despite your objection – for example, to meet legal or regulatory obligations, or to continue to have a relationship with you. 

The right to erasure 

In some cases, you have the right to have your information erased. We may not be able to agree to your request if it affects our ability to meet our legal or regulatory obligations, or to continue to have a relationship with you. 

The right to data portability 

You have the right to ask us to transfer a copy of some of your information to you or to a new data controller – for example, another financial provider. This applies when you’ve shared your information with us, it’s been collected with your consent, or where collecting it was necessary for the agreement between us. 

The right to human intervention 

You have the right not to be subject to a decision that's based solely on automated processing, if the decision affects your legal rights (for example, if we automatically reject your application for a Flagstone account). However, we do not make automated decisions right now, so this isn't applicable. 

The right to withdraw your consent 

Where we’re relying on your consent to process any of your information, you have a right to withdraw that consent at any time.  

Exercising your rights 

If you wish to exercise any of these rights, please contact the Client Services Team at clientservices@flagstoneim.com or 0203 745 8130. We’ll review your request, and get back to you within one month. We may at the time of your request ask you for further information, including proof of id, before we can act on your request. 


If you’re concerned with how we've handled your information, please contact our Data Protection Officer at data.protection@flagstoneim.com.   
You also have the right to complain to the Jersey Office of the Information Commissioner: jerseyoic.org.


You can read our Cookie Notice to learn more about the different types of cookies, and how we use them. 

Other important information 

Links to third party websites 

Our website may contain links to other websites for your convenience and information. Flagstone does not control third-party websites or their privacy practices, which may differ from those set out in this Client Privacy Notice. We encourage you to review the privacy notice of any company or website you reach via Flagstone's website before you provide any personal information. 

Data Protection Officer 

Flagstone has a nominated Data Protection Officer (DPO). You can contact the DPO about your personal information by writing to: 

Data Protection Officer 

Flagstone Group Limited 

1st Floor 

Clareville House 

26-27 Oxendon Street 


        SW1Y 4EL 

Email: data.protection@flagstoneim.com 

Changes to this notice 

We may update this Client Privacy Notice from time to time. We’ll post any changes we make to this notice on our website, becoming effective immediately. If the changes are material changes, and you’re a client or a business partner of Flagstone, we’ll let you know by email. 

Last updated: December 2023