Privacy Policy
Northern Gritstone is committed to ensuring that your privacy is protected and we comply with data protection rules (including the Data Protection Act 2018, the UK General Data Protection Regulation and marketing and cookies laws, together with associated guidance) (herein the “Data Protection Laws“).
This privacy policy applies to your interaction with our internet site: northern-gritstone.com (Our “Website”). It also applies to the processing of personal data by Northern Gritstone Limited or any of its wholly-owned subsidiary entities, which we may otherwise collect about you, including when you:
contact us or when we contact you;
apply for one of our job vacancies;
purchase services from us;
make an investment with us;
raise funds for your business;
provide services or goods to us (where, for example, you are a sole trader, partnership or where you are providing services or goods on behalf of your employer/contractor);
visit our Website; and
which we may otherwise collect and process about you
A “controller” is a person or organisation who alone or jointly determines the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. The controller for personal data collected under this privacy policy is Northern Gritstone.
This policy explains how we use, store and share the information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy. This policy supplements any other fair processing or privacy notice that may be provided to you from time to time. Please contact us by email at enquiries@northern-gritstone.com if you have any questions, comments or concerns about this policy or how we handle your personal information, or if such information changes at any time.
Who is this policy addressed to?
References in this notice to “you” or “your” are references to individuals whose personal data Northern Gritstone processes.
If you have provided your personal data to Northern Gritstone for recruitment activities (whether directly or through a third party) this policy is only designed to provide you with information about how we will process your personal data during the application and recruitment processes.
References in this notice to “Northern Gritstone”, “we”, “us” or “our” are references to Northern Gritstone Limited (12982592) and its wholly-owned subsidiary entities Northern Gritstone Investment Management Limited (15186303) and Northern Gritstone Innovation Services Limited (15185155), each entity has its registered office at: No. 1 Circle Square, 3 Symphony Park, Manchester, M1 7FS.
This policy applies to information relating to individuals (i.e. natural persons), sole traders and partnerships but not to information relating to corporations. It applies to representatives of corporations if those representatives are individual persons. This is because Data Protection Laws only apply to information relating to natural persons. Information relating to corporate bodies may still be protected by other laws such as confidentiality and we take those obligations seriously as well.
Please note: this policy does not cover third party websites that we may link to from our Website or the processing of personal data by third parties with whom we may share your data which shall in each case be governed by each third party’s own privacy notices, unless specifically mentioned in this policy.
We are not responsible for the privacy policies and practices (including use of cookies) of such third parties even if you accessed the third-party website using links from our Website. We recommend that you check the policy of each website you visit and contact the owner or operator of such website if you have concerns or questions.
The information we collect and how we use it
Under the Data Protection Laws, we are required to explain what information we collect from you and how and why we use your personal information (the “processing activity”). We are also required to have a “lawful basis” on which to process your personal information. This is summarised in the table below.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so, which may include asking for your consent.
Please note that we may process your personal data without your knowledge or consent, but only where this is in compliance with the above rules and where this is required or permitted by law. We may also anonymize or aggregate any of the information we collect and use it for any purpose, including for research, training, product-development purposes, services reporting on our diversity and equality commitments and investment and funding opportunities. Such information will not identify you individually.
| undefined | What information is collected? | Lawful basis of processing | Where is the information collected from? | How long do we keep the information for? |
|---|---|---|---|---|
| To enter into and administer our contracts with investors, including setting up investor accounts, administering our services, collecting payments due to us and conducting KYC checks prior to investment and where required on an annual basis. |
| We process this information as it is necessary for us to enter a contract with you and to perform that contract and to comply with our legal obligations in relation to KYC and to prevent money laundering. | From you via our Website, via our contact form or when you call, email or otherwise send information to us. From third parties including banks and background check providers. | The information collected is retained for the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each case for 6 years following the end of the agreement or the closure of your account. To note, following completion of KYC checks we will continue to collect data to ensure that identification documents remain valid and accurate, that source of funds is documented, to check against sanction/ PEP and adverse media screening on an annual basis and to monitor any risk profile given to an investor to ensure there is no negative change to such status. |
| When you call or email us directly or contact us via our Website to generally enquire about our services. |
| The processing is necessary for our legitimate interest to promote our business and our products and services and to deal with your enquiry. | From you when you call, email or otherwise send information to us via our online contact form. | Where a general enquiry is made but no services are engaged or investment made, we retain name, phone number and email address for such amount of time as is reasonable in order for us to provide our service and/or respond to on-going enquires. Such time shall not exceed 6 years. |
| When you call, email us directly or contact us via our Website regarding investment opportunities. |
| The processing is necessary for our legitimate interest to promote our business and our products and services and to deal with your enquiry. | From you when you call, email or otherwise send information to us via our online contact form. | Should you proceed to invest with us and/or engage our services, for the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account. |
| To enter into contracts with business representatives that enquire about our services on behalf of their employer/contractor, including setting up accounts, and making payments. |
| We process this information as it is necessary for us to enter a contract with you/ your employer for your services. | From you directly when you call, email or otherwise send information to us. | For the duration we have an agreement in place with you or your employer and for 6 years following the end of the agreement with you or the business you represent. |
| To manage our relationship with you which will include (where appropriate) notifying you about changes to our terms of business or privacy notice. |
| We process this information as it is necessary for the performance of our contract with you and to ensure that we can provide updated service information to you. | From you via our Website, contact form or when you call or email us. | For the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account. |
| To promote our products and services, including by sending you emails, newsletters or postal communications. |
| The processing is necessary for our legitimate interest to promote our business and our products and services. We will only send you marketing by email to a personally owned email address if you have given us your prior consent, which you are free to refuse. You have a right to stop us from sending you direct marketing at any time. You may do so by clicking the “unsubscribe” link in our marketing emails, or by contacting our Data Protection Officer using the details set out in this policy. | From you via our Websites or contact form or when you call, email, or otherwise send information to us. From public sources, such as social media sites. | For as long as required to promote our products and services to you and for no longer than 6 years. |
| To answer questions or comments via contact forms. |
| The processing is necessary for our legitimate interest to provide our services to you and/or provide Website visitors with a good level of service. | Directly from you via our Website or when you call or email us. | 6 years. |
| If you attend our premises. |
| The processing is necessary for our legitimate interest to provide our services to you. In relation to CCTV (where we are the operator), in order to protect our business, the local community, customers and colleagues. | From you when you visit our sites. | In relation to CCTV (where we are the operator), 30 days month after its creation. All other data once the purpose for processing has been fulfilled or where you have a contractual relationship with us/ or an account for the duration you have an agreement in place with us or the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account. |
| To comply with legal and regulatory obligations. |
| The processing is necessary for us to comply with our legal obligations. | From you via our Website, contact form or when you call, email or otherwise send information to us. | For the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account. |
| To prevent and detect unlawful activities such as fraud and money laundering. |
| The processing is necessary for our legitimate interests to protect our business and co-operate with law enforcement authorities. | From you via our Website, contact form or when you call, email or otherwise send information to us. From providers of technical and payment and delivery services. From the Police or other law enforcement authorities. | We hold this information for 6 years after the relevant issue arises or, if litigation is pursued, until the issue is finally resolved. |
| To process job applications of prospective employees of Northern Gritstone that contact us by email, telephone or in person. |
| The processing is necessary for our legitimate interest to review and interview job candidates. | From you via email or otherwise where you telephone us or you send information to us or which may be provided to us from a recruitment agent. | For unsuccessful job applicants: 12 months from the date on which we confirm no job will be offered. For those that to whom a job offer is made and accepted until the end of employment and 6 years thereafter. |
| To support the recruitment activities of our portfolio entities. |
| The processing is necessary for our legitimate interest to identify suitable candidates for roles with our portfolio entities. | From you via email or otherwise where you telephone us or you send information to us or which may be provided to us from a recruitment agent. | We hold this information for 6 years from receipt. |
| To reply to and deal with complaints and queries. |
| The processing is necessary for our legitimate interest to provide clients with a good service and to deal with any issue raised by you or your representative. | From you via our Website, contact form or when you call, email or otherwise send information to us. | If the data relates to a complaint, we will retain this information for 6 years from the date that the complaint was received. |
| To report to government bodies in respect of the gender and ethnic background of founders, Boards and employees of businesses in which we invest. This can include the information of businesses where they have sought investment, but this has been unsuccessful. |
| The processing is necessary for our legitimate interest to ensure that we are providing equal opportunities and werely on your explicit consent in order to share this information. | From you when you apply for investment from us. | For unsuccessful applicants: 12 months from the date on which we confirm no investment will be offered. For those that to whom an offer of investment is made and accepted for the duration for which we invest in your business and in each case for 6 years following the end of our investment in your business. |
Where we process personal data on the legal basis of ‘legitimate interests’ (as indicated in the above table), we have determined, acting reasonably and considering the circumstances, that we are able to do so after carrying out a balancing exercise to make sure that our legitimate interests are not overridden by your interests, rights and freedoms. Where we rely on this legal basis, (a) we process the data only to the extent that is necessary for the relevant purpose; and (b) the relevant processing activities can be reasonably expected. The legitimate interests we pursue are specified in the above table with respect to each relevant purpose.
Where we process personal data on the legal basis of ‘consent’ (as indicated in the above table), you may refuse to consent to our processing and you may also withdraw your consent at any time, by emailing us at: enquiries@northern-gritstone.com. This would not affect your ability to use any features of our Websites or to receive our Services. Withdrawing consent does not affect any processing carried out without your consent.
Marketing and promotional materials
We may use your personal information to provide you with marketing and promotional materials (as stated above). We do so for our own purposes and will never sell AND/OR share your personal information with third parties for marketing purposes.
You may opt-out of receiving marketing and promotional materials from us at any time by emailing us at enquiries@northern-gritstone.com.
Security
We have in place appropriate procedures which provide technical and organisational measures to protect your personal information from unauthorised or unlawful processing, and against accidental loss, destruction or damage.
We also have procedures in place to deal with any data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.
However, the Internet and email are not secure. Your communications may route through a number of countries before being delivered, may be intercepted by third parties and may not always reach the intended recipient – this is the nature of the World Wide Web/Internet. We cannot accept responsibility for any such unauthorised access or loss of personal information that is beyond our control.
You are responsible for protecting your username and password and must not share it with, or disclose it, to anyone.
If you want you to learn more about how to protect your data and your devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.
Sharing your personal information
We will only disclose your personal information to:
our professional advisors (including without limitation tax, legal or other corporate advisors who provide professional services to us);
other third party suppliers, business partners and sub-contractors for business administration, support, processing, services, or IT purposes;
analytics or search engines, that enable us to optimise and improve your Website experience (for example Google);
other third party suppliers for marketing purposes (including without limitation checking marketing permissions previously elected by you);
third parties that you approve (including without limitation, social media sites and third party payment providers);
third parties engaged to assist with verification prior to being accepted for an investment such as banks and background check providers;
Our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters;
Government bodies for the purposes of reporting on diversity in the context of our investments; and
HMRC or other tax bodies or agencies to comply with our legal and regulatory obligations.
We will disclose your personal information to third parties:
in the event that we consider selling or buying any business or assets, in which case we will disclose your personal information to any prospective sellers or buyers of such business or assets;
in the event we are the subject of any insolvency situation (e.g. the administration or liquidation);
if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us about our customers will be one of the transferred assets;
in order to enforce or apply our terms and conditions;
to protect our rights, property, or safety, or that of our staff, our customers, or others. This includes exchanging information with other companies and organisations (including without limitation HMRC, the local police or other local law enforcement agencies) for the purposes of staff and customer safety, crime prevention, fraud protection and credit risk reduction; and
if we are under a duty to disclose or share your personal information in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime.
International transfers of your personal information
We may transfer personal information to countries other than the country in which the data was originally collected (for example, outside the UK) in order to provide you with our services. These countries may not have the same data protection laws as the country in which you initially provided the information, however we will ensure that adequate protection is provided equivalent to that in the UK to ensure your personal data is protected.
Your rights
| Right | Description |
|---|---|
| To be informed | You have the right to be informed about the personal information we hold about you. |
| Of access | You have the right to request confirmation that your personal data is being processed, access to your personal data (through us providing a copy) and other information about how we process your personal data |
| To rectification | You have the right to request that we rectify your personal data if it is not accurate or not complete. |
| To erasure | You have the right to ask us to delete the personal information we hold about you. This right will only apply where (for example):
|
| To restrict processing | In certain circumstances, you have the right to restrict our processing of the personal information we hold about you. This right will only apply where (for example):
|
| To data portability | In certain circumstances, you have the right to receive the personal information you have given us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal information to another organisation, at your request. |
| To object | You have the right to object to our processing of the personal information we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process the personal information which override your rights or which are for the establishment, exercise or defence of legal claims. |
| In relation to automated decision making and profiling | You have the right not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you. We do not carry out any automated processing or profiling. |
| To withdraw | You have the right to withdraw your consent, where we are relying on it to use your personal information (for example, to provide you with brochures and newsletters). |
We welcome your views about our Websites and this policy. If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please email us at: enquiries@northern-gritstone.com.
If you would like this notice in another format (for example audio, large print, braille) please contact us using the details above.
We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your personal information. However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to our supervisory authority, which is the UK’s Information Commissioner’s Office. Their address is: First Contact Team, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Cookies
We use cookies and similar tracking technologies, such as tags and pixels (“cookies”), to personalise and improve your customer experience as you use our Websites. The below provides more information about cookies, including how we use them and how you can exercise your choices about our use of cookies.
What are cookies?
Cookies are small text files that may be stored on your computer (or other internet enabled devices, such as a smartphone or tablet) when you visit our Website, or open our emails or click on any links in our emails or on our Website. They are used by us on our Website to help remember information about your visit, like your country, language and other settings and on our emails and communications to help us confirm if you open the email and collect information about your interactions with the communication which helps us set preferences and improve the delivery of our services.
Our use of cookies
We use cookies on our Website to:
recognise you whenever you visit this Website (this speeds up your access to the Website as you do not have to log in each time);
obtain information about your preferences and use of our Website; and
make your online experience more efficient and enjoyable.
Information about our use of cookies
We use the following cookies:
| Name | Purpose | Type | Duration |
|---|---|---|---|
| _dd_cookie_test | Tests if cookies are supported. | Cookie | Expires instantly |
| _dd_s | Tracks browser errors. | Cookie | 4 hours |
| _dd_site_test | Tests if cookies are supported. | Cookie | Expires instantly |
| _grecaptcha | Helps reduce spam. | Local storage | No expiry |
| RecentRedirect | Prevents redirect loops if a site has custom URL redirects. Redirect loops are bad for SEO. | Cookie | 30 minutes |
| squarespace-announcement-bar | Prevents the announcement bar from displaying if a visitor dismisses it. | Local storage | Persistent |
| squarespace-popup-overlay | Prevents the promotional pop-up from displaying if a visitor dismisses it. | Local storage | Persistent |
| squarespace-video-player-options | Remembers video player selected preferences (volume, playback speed, and quality) for videos uploaded directly to Squarespace. | Local storage | Persistent |
| ss_cookieAllowed | Remembers if a visitor agreed to placing analytics cookies on their browser if a site is restricting the placement of cookies. | Cookie | 30 days |
| Test | Investigates if the browser supports cookies and prevents errors. | Cookie | Session |
Analytics and performance:
| undefined | Purpose | Duration |
|---|---|---|
| ss_cid | Identifies unique visitors and tracks a visitor’s sessions on a site. | 2 years |
| ss_cpvisit | Identifies unique visitors and tracks a visitor’s sessions on a site | 2 years |
| ss_cvisit | Identifies unique visitors and tracks a visitor’s sessions on a site. | 30 minutes |
| ss_cvr | Identifies unique visitors and tracks a visitor’s sessions on a site | 2 years |
| ss_cvt | Identifies unique visitors and tracks a visitor’s sessions on a site. | 30 minutes |
How can I manage cookies?
You have the right to decide whether to accept or reject certain cookies. You can exercise your cookie rights by setting your preferences in the Cookie Consent Manager. If you wish to disable all cookies, you can opt-out by setting your browser to remove or reject browser cookies. You can also delete cookies that have already been set through your browser settings.
The Cookie Consent Manager can be found in the notification banner and on our Website. If you choose to reject cookies, you may still use our Website though your access to some functionality and areas of our Website may be restricted. Most browsers have cookies enabled by default. However, if you don’t want to enable cookies, you’ll still be able to browse the site. More information about cookies, including how to block them or delete them, can be found at aboutcookies.org. If you have any further questions, comments or requests regarding our cookies policy or how we use cookies on our site, then you can contact us at enquiries@northern-gritstone.com.
Changes to this policy
We will take reasonable measures to communicate any changes to this policy to you and will post any updated privacy policies on this page.
This policy was last reviewed and updated on 15 April 2024.