Overview
Protecting your privacy is a fundamental component of our service. We have been committed to maintaining the confidentiality, integrity and security of Personal Information entrusted to us by you.
Article 5 of the GDPR States that Personal Data must be processed lawfully fairly and in a transparent manner. This Privacy Notice explains why and how we collect, process and destroy your data. Please read the following carefully to understand our views and practices and do not hesitate to reach out if you have any questions. After Brexit Laven Group is subject to two regulatory regimes: the UK and the EEA ones. The UK GDPR one applies when we process Personal Data of individuals in the UK and GDPR applies when we process Personal Data of individuals in Europe. This document refers to both pieces of regulation to reassure our UK and EEA users. To clarify, the UK GDPR means the GDPR is form which was applicable in the EEA on 31 December 2020- the last day of the Brexit transition period.
For purposes of this Privacy Notice, the following terms will be defined as follows:
“Personal Data” or “Personal Information” means any information about an individual from which that person can be identified. Personal Data and/or Personal Information does not include data where the identity has been removed (i.e., anonymous data).
“Special Categories” means more sensitive personal data which require a higher level of protection, such as information about a person’s health, sexual orientation, political views etc. For the full list please refer to Article 9 of the GDPR&UK GDPR.
“Data Subject” refers to any individual person who can be identified, directly or indirectly, via an identifier such as name, ID number or location data.
What types of Personal Data do we collect, for what purpose and on what lawful basis?
Please refer to the table in Schedule 1 below.
Identity of the Firm
This policy applies to Laven Hosting Limited, Laven Advisors LLP and Lumen Asset Management (“Laven or Laven Group”).
11 Old Jewry,
London EC2R 8DU
United Kingdom
If you are Laven’s employee, service provider, appointed representative or direct client, for the purposes of the GDPR we are data controller what means that we determine the means and purposes of processing of your Personal Data. Please note that our employees are subject to a privacy notice provided to them upon the commencement of the employment.
If you are a client of one of Laven’s appointed representatives, we are data processor in relation to your Personal Information which we process on written instructions issued by the appointed representative.
Data inquires and updates
If you want to review, change or update your Personal Information that you have provided to us; request to be removed from our mailing list or address any other privacy concerns , please contact us at [email protected].
Who we share our information with
We will not share your Personal Information unless we are required to do so by law; for the purposes of carrying out a contract with you but in all cases we would use services providers checked for their compliance with the privacy regulations.
The service providers that we share your personal data with are:
- Cloud service provider with servers in the EEA
- IT Infrastructure US company with servers in the EEA
- IT Support including backups a UK company with servers in the UK
- Analytics provider: US company which anonymises data in the UK, prior processing it in the UK
- Client Relationship Management Software (CRM): US company with servers in the EEA
- Accountancy Advisor: UK company
- Telephone system provider: UK company
- Project Management tool for client servicing: US company with servers in the US
- Background checks provider with servers in the Netherlands
- Background checks for AML purposes: provider with servers in the UK
- Bloomberg terminal
- Yahoo Finance
International transfer outside the EEA
The Firm does not transfer your personal information outside of the European Economic Area (EEA)
Retention
We will keep your Personal Data for no longer than reasonably necessary, i.e. . We will retain your personal information in accordance with legal and regulatory requirements as set out in our Data retention policy.
Personal data within our CRM system is stored indefinitely for the reason of legitimate interest of Laven business advancement, it is stored securely and with limited employee access.
Your rights and your Personal Data
You have a right:
RIGHT OF ACCESS: you have the right to access whether or not personal data concerning you is being processed.
RIGHT TO RECTIFICATION: you have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
RIGHT OF ERASURE: You have the right to ask us to erase your personal information if we no longer need your data for the original reason the data was collected for, or if you are withdrawing your consent if the processing relied on your consent as legal basis, or we process your data unlawfully, or we have a legal obligation to erase the data or the data was collected from you as a child
RIGHT TO RESTRICTION OF PROCESSING: You have the right to ask us to restrict the processing of your information to temporarily limit the use of your data when we are considering:
- a challenge you have made to the accuracy of your data, or
- an objection you have made to the use of your data.
- You may also ask us to limit the use of your data rather than delete it if:
- we processed your data unlawfully but you do not want it deleted, or
- we no longer need your data but you want the organisation to keep it in order to create, exercise or defend legal claims.
RIGHT TO OBJECT TO PROCESSING: you have the right to object to processing if we process your information:
- for a task carried out in the public interest;
- for the exercise of official authority;
- for their legitimate interests;
- for scientific or historical research, or statistical purposes; or
- for direct marketing purposes.
- Note that we may not need to stop the processing if we can give strong and legitimate reasons to continue using your data.
RIGHT TO DATA PORTABILITY: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
To lodge a complaint with the Information Commissioners Office (the UK Supervisory Authority) or your local data protection regulator if you are in the EEA.
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Please note that Laven does not conduct automated individual decision making about you.
If we rely on consent in processing of your information, you can withdraw it at any time.
To exercise any of the above rights please contact us at [email protected].
Further Processing
Where we may seek to further process your data other than for the original purpose for which it was collected, the Firm shall only further process such data where the new Processing is compatible with the original purpose or if personal data is anonymised and cannot be reidentified.
Safeguarding measures
Maintaining data security means guaranteeing the confidentiality, integrity and availability (for authorized purposes) of the Personal Data.
Laven has put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties on a ‘need to know’ basis. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
Laven will only transfer Personal Data to a third party if they agree to comply with those procedures and policies, or put in place adequate measures prior to receiving it.
We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Special Categories of Data
Owing to the products and services that we offer, such as performance of KYC/AML and other background checks, we sometimes need to process special categories of data which are deemed to be more sensitive in nature. Where we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so. .
Legitimate Interests
We occasionally process your personal information under the Legitimate Interests’ legal basis. Where this is the case, we have carried out a Legitimate Interests’ Assessment (LIA) to ensure that we have weighed your interests and any risk posed to you against our own and that such interests are proportionate and appropriate such as for the purposes of HR, marketing and day-to-day operations.
Marketing
When sending marketing materials to customers, we may have the option to rely on your consent or legitimate interest.
We only use legitimate interests for marketing if we have assessed that the information being sent is beneficial to the customer and have weighed our interests against your own and there is little to no risk posed, the method and content is non-intrusive, and the material being sent is something you would usually expect to receive.
Cookies, analytics and traffic data
Cookies are small text files which are transferred from our website, applications or services and stored on your device. We use cookies to help us provide you with a personalised service, and to help make our website, applications and services better for you.
We provide the following information with some explanations to ensure transparency to our users:
- what types of cookies are set;
- how long they persist on your user’s browser;
- what data they track;
- for what purpose (functionality, performance, statistics, marketing, etc.;
- where the data is sent and with whom it is shared;
- how to reject cookies, and how to subsequently change the status regarding the cookies.
Should you wish to change your preferences regarding cookies, please visit our cookie management page via the button below.
The information related to the type of cookies can be accessed at the following location:
Changes to our Privacy Policy
Any changes we may make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email.
SCHEDULE 1
What types of Personal Data do we collect, for what purpose and on what lawful basis?
|
PURPOSE FOR WHICH PERSONAL DATA WAS COLLECTED |
TYPES OF PERSONAL DATA COLLECTED |
LEGAL BASIS FOR PROCESING OF PERSONAL DATA |
|
Marketing |
Name, email address, direct phone numbers, associate company, IP addresses
|
Legitimate interest: advancement of Laven’s business by targeting well researched audience who would benefit from the services offered
|
|
Client relations |
Name, email address, direct phone numbers, associate company names based on legitimate interests, IP addresses, marriage status, interests, content of emails.
|
Legitimate interest: Communication with and client relationship management proportionate to the services provided |
|
Credit control |
Name, email, residential address, outcome of credit control
|
Legitimate interest: Contracting with credit worthy businesses not to expose Laven to credit risks |
|
Recruitment |
Name, residential address, contact details, interviews notes, CV contents, salary expectations, D.O.B., nationality, mother’s maiden name
|
Legitimate interest: Talent acquisition and management of the recruitment process in relation to individuals interested in working with Laven
|
|
Invoicing |
Name and contact details at an associated company
|
Legitimate interest: Charging fees, including final invoices after the contract termination
|
|
Provision of Laven’s services |
Log in details, name, contact number, roles and names, email addresses, phone numbers, addresses associated with the BCP; name, previous names, position within firm, other directorships, references number for FCA, email address, NIN, home address, history of residential addresses, certified copies of: passport, proof of address; CV; criminal proceedings information; civil proceedings information; other relevant matters; disciplinary matters; potential complaints against person; potential disqualification or reprimand by the FCA or other regulatory body; nationality, shareholding, country of residence; names, address, PEP status of PSCs and clients complaints; training records, financial information, personal background. |
Legitimate interest: Processing of personal data necessary for the provision of the services, including post contract termination but accordingly to contractual provisions |
|
Prospecting |
Name, email address, direct phone numbers, associate company names based on legitimate interests, IP addresses, marriage status, interests
|
Legitimate interest: advancement of Laven’s business by targeting well researched audience who would benefit from the services offered and entering into prospecting processes with individuals interested in Laven services
|
|
Third party management |
Name, contact details, associated company |
Legitimate interest: Management of Laven’s business relationships with third parties like suppliers and strategic partners |
|
Meeting HMRC and AML requirements |
Name and associated accounting data |
Legal obligation |
