This Privacy Notice explains how Theseus Guernsey Limited collects, uses and discloses your personal data, and your rights in relation to the personal data it holds. Theseus Guernsey Limited is a member of the Stonehage Fleming Group of companies (Group).
In this Privacy Notice, “us”, “we” and “our” refers to Theseus Guernsey Limited.
As a result of contracting with Theseus Guernsey Limited your personal data will be processed in Guernsey and is subject to the Data Protection (Bailiwick of Guernsey) Law 2017. If you are a natural person connected to an entity which is contracting with Theseus Guernsey Limited then this notice may apply to you.
If you are a natural person resident in the European Union contracting and/or connected to an entity with Theseus Guernsey Limited this notice may apply to you and our processing may be subject to the General Data Protection Regulation (GDPR) and local privacy laws.
If you are a natural person resident in the United Kingdom contracting and/or connected to an entity with Theseus Guernsey Limited this notice may apply to you and our processing may be subject to the UK GDPR and local privacy laws.
We may amend this Privacy Notice from time to time to reflect any changes in the way that we process your personal data. This Privacy Notice supersedes any previous version of this notice with which you may have been provided or had sight of before the date stated at the end of this notice, as well as anything to the contrary contained in any agreement with us.
Please refer to this Privacy Notice to understand our processing of your personal data.
Personal data is information relating to a living individual who can be identified from that data or data that makes you identifiable. Settlors, Protectors, Beneficiaries (minors and adults), Directors, Trustees, Protectors, Politically Exposed Persons and their families and associates, Controlling Persons of Entities, Business contacts, Staff (current and former), Suppliers, and associates, employees and consultants of client entities are all included where they are natural living persons.
When we collect, store, use in any way for any purpose or delete your personal data we are processing it.
Personal data includes, among other data, your name(s), address(es), email address(es), telephone number(s), bank account number(s) and passport number(s).
Theseus Guernsey Limited is the Data Controller of your personal data. The Data Controller is responsible for ensuring that your personal data is processed in compliance with data protection laws and to provide you with this privacy notice. If you have any questions or concerns about personal data or this privacy notice or you wish to make a complaint about how we have processed your personal data, or you wish to exercise any of your rights as a data subject please contact us by email at email@example.com or by post at the following address:
Theseus Guernsey Limited
1 Le Truchot
St Peter Port
Alternatively, please feel free to discuss with your Account Manager.
If you are a natural person who is a client of the Group, directly or indirectly – for example as a shareholder or a director or officer of a corporate entity to which we provide regulated services in Guernsey, then we may collect and use your data to enable us to meet our contractual obligations.
We also have regulatory obligations, including compliance with anti-money laundering regulations which necessitate processing of your personal data.
We may also process your personal data because it is necessary for our legitimate interests, such as growing our business.
Depending on the services you require of us we process your personal data:
For the avoidance of doubt, you may refuse to provide us with your personal data. In that case, we would likely not be able to provide you with our services.
We may process items of data such as: your name, address, place and date of birth, photograph/ID card/proof of identity, proof of address, Tax identification numbers, bank details, signature, contact information, social security details, ID/passports and FATCA/CRS details. This may be provided directly by you or by your representative such as a lawyer, accountant or financial intermediary. We may also collate and hold data found from the results of Google or other internet searches and other sources in the public domain as well as third party service providers in the course of our client due diligence and client review process, and in providing the services that we are engaged to provide. We generate an internal number specific to you and our accounting software will also produce a reference number for you.
We process the following documents and information that may also contain your personal data: Employment history, bank references, register of members, register of directors, financial statements, controlling persons list, authorised signatories list, minutes and resolutions. Information regarding source of funds and source of wealth may also contain your personal data. We may also undertake sanction screening, credit and fraud checks with third parties and checks to ascertain any convictions, court cases, criminal records or proceedings of any person connected with our client. In the course of your dealings with us you may provide further information to us, where we seek additional information, all of this information will be kept securely by Theseus Guernsey Limited and the Group. Failure to provide the necessary Personal Data may mean that we are unable to establish or continue a business relationship with you (if we require this information to satisfy our regulatory obligations) or that we are unable to fulfil our services to you where we depend on the information requested.
The Group’s business and the services you request of us require transfers to many third parties, often at your request, and at other times transferring data to a third party is necessary to perform our contract with you (for example if you ask us to open a bank account for a legal entity or where other advisors or service providers are engaged) or for Legal/Regulatory reasons, such as completion of a corporate annual return of a Company. A non-exhaustive list of potential transfers include:
Brokers, Banks, Custodians, Advisors, Auditors and Portfolio Managers may require information on you for their own due diligence to comply with regulations. We share the information you provide to us with them for this purpose.
Your personal data will be processed in Guernsey and is subject to the Data Protection (Bailiwick of Guernsey) Law 2017. In sharing your personal data for the reasons set out elsewhere in this Privacy Notice, we may need to transfer it to other Group companies located in Switzerland, the United Kingdom, Israel, Jersey, Liechtenstein, Luxembourg, Malta, Isle of Man or Canada, which are countries which are viewed as providing the same or a similarly adequate level of protection for your personal data as is provided within Guernsey.
We may also share your personal data with Group companies located in the United States of America, South Africa, the British Virgin Islands, Bahamas, Cayman Islands, Monaco and Mauritius, which currently do not have laws which provide the same level of protection for your personal data as provided within Guernsey. We will use Standard Contractual Clauses, as a safeguard, when making transfers to these countries or will do so with your explicit consent.
We may also transfer your personal data to other companies or service providers that we have engaged to assist us in providing services to you. These companies may be located in jurisdictions which currently do not have laws which provide the same level of protection to your personal data as are provided within Guernsey. Where we share your personal data with a company or service provider in a non-adequate jurisdiction we will do this using either a contractual data sharing arrangement, another available safeguard or with your explicit consent.
Additionally your data may be entered into our accounting and/or billing systems, and our document management systems and your data may be processed by our sub-processors including our retail investment technology and third party administration solution providers or outsourcing technology companies, including cloud services providers. In such cases, where data is processed in a third country, an appropriate safeguard is used. Your data may also be provided externally to banks, regulators, auditors, advisors (including, but not limited to, legal advisors), supervisory or governmental bodies as well as those appointed as directors, shareholders, and/or beneficiaries, settlors or protectors to the trust.
Your personal data will be kept securely by Theseus Guernsey Limited and the Group. This information will be held in accordance with our Record Retention Policy and applicable laws, after which it will be securely destroyed. We may keep it longer where:
You have the following data protection rights:
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please contact us using the following email address: firstname.lastname@example.org
If you are not satisfied with how we are processing your personal data, you can make a complaint to the Office of the Data Protection Authority (www.odpa.gg), or where applicable, the relevant Supervisory Authority if you reside outside of Guernsey.
Version: 22 March 2022