Northern Gritstone is committed to ensuring that your privacy is protected and we comply with the General Data Protection Regulation and other applicable data protection rules (including the Data Protection Act 2018 and marketing and cookies laws, together with associated guidance) (the “Data Protection Laws“), including, but not limited to, the EU General Data Protection Regulation 2016/679 (the “GDPR”) (as incorporated into UK law under the UK European Union (Withdrawal) Act 2018) (the “UK GDPR”).

This privacy policy applies to your interaction with our internet site: https://northern-gritstone.com/ (Our “Website”). It also applies to the processing of personal data by Northern Gritstone which we may otherwise collect about you, including when you:

  • contact us or when we contact you;
  • apply for one of our job vacancies;
  • purchase services from us;
  • make an investment with us;
  • provide services or goods to us (where, for example, you are a sole trader, partnership or where you are providing services or goods on behalf of your employer/contractor);
  • visit our Website; and
  • which we may otherwise collect and process about you

A “controller” is a person or organisation who alone or jointly determines the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. The controller for personal data collected under this privacy policy is Northern Gritstone.

This policy explains how we use, store and share the information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy. This policy supplements any other fair processing or privacy notice that may be provided to you from time to time. Please contact us by email at enquiries@northern-gritstone.com  if you have any questions, comments or concerns about this policy or how we handle your personal information, or if such information changes at any time.

Who is this policy addressed to?

References in this notice to “you” or “your” are references to individuals whose personal data Northern Gritstone processes.

If you have provided your personal data to Northern Gritstone for recruitment activities (whether directly or through a third party) this policy is only designed to provide you with information about how we will process your personal data during the application and recruitment processes.

References in this notice to “Northern Gritstone”, “we”, “us” or “our” are references to Northern Gritstone Limited (12982592) whose registered office is at: 1 Park Row, Leeds, United Kingdom, LS1 5AB.

This policy applies to information relating to individuals (i.e. natural persons), sole traders and partnerships but not to information relating to corporations. It applies to representatives of corporations if those representatives are individual persons. This is because Data Protection Laws only apply to information relating to natural persons. Information relating to corporate bodies may still be protected by other laws such as confidentiality and we take those obligations seriously as well.

Please note: this policy does not cover third party websites that we may link to from our Website or the processing of personal data by third parties with whom we may share your data which shall in each case be governed by each third party’s own privacy notices, unless specifically mentioned in this policy.

We are not responsible for the privacy policies and practices (including use of cookies) of such third parties even if you accessed the third-party website using links from our Website. We recommend that you check the policy of each website you visit and contact the owner or operator of such website if you have concerns or questions.

The information we collect and how we use it
Under the Data Protection Laws, we are required to explain what information we collect from you and how and why we use your personal information (the “processing activity“). We are also required to have a “lawful basis” on which to process your personal information. This is summarised in the table below.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.   If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may also anonymize or aggregate any of the information we collect and use it for any purpose, including for research, training, product-development purposes, services and investment opportunities.  Such information will not identify you individually.

Processing activity: Why we use your information? What information is collected?Lawful basis of processingWhere is the information collected from?How long do we keep the information for?
To enter into and administer our contracts with investors, including setting up investor accounts, administering our services, collecting payments due to us and conducting KYC checks prior to investment and where required on an annual basis.• name;
• address (incl. postcode);
• telephone number;
• email address;
• nationality;
• passport or other identification documentation;
• proof of address;
• proof of legal entity, information on beneficial owners, shareholder information, names of authorised signatories;
• source of funds and wealth information;
• background check data;
• bank account details and/or payment card information;
• your unique investor reference number;
• other information that you volunteer to us when you engage with us or which we discover through intelligence reports or other information gathered as part of the KYC process.
We process this information as it is necessary for us to enter a contract with you and to perform that contract and to comply with our legal obligations in relation to KYC and to prevent money laundering.From you via our Website, via our contact form or when you call, email or otherwise send information to us.
From third parties including banks and background check providers.
The information collected is retained for the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each case for 6 years following the end of the agreement or the closure of your account.
To note, following completion of KYC checks we will continue to collect data to ensure that identification documents remain valid and accurate, that source of funds is document, to check against sanction/ PEP and adverse media screening on an annual basis and to monitor any risk profile given to an investor to ensure there is no negative change to such status. This
When you call or email us directly or contact us via our Website to generally enquire about our services• name;
• telephone number;
• email address;
• information that you volunteer to us when you make an enquiry.
The processing is necessary for our legitimate interest to promote our business and our products and services and to deal with your enquiry.

From you when you call, email or otherwise send information to us via our online contact form.Where a general enquiry is made but no services are engaged or investment made, we retain name, phone number and email address for such amount of time as is reasonable in order for us to provide our service and/or respond to on-going enquires. Such time shall not exceed 2 years.

When you call, email us directly or contact us via our Website regarding investment opportunities• name;
• telephone number;
• email address;
• information that you volunteer to us when you make an enquiry.
The processing is necessary for our legitimate interest to promote our business and our products and services and to deal with your enquiry.

From you when you call, email or otherwise send information to us via our online contact form.Should you proceed to invest with us and/or engage our services, for the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account.
To enter into contracts with business representatives that enquire about our services on behalf of their employer/contractor), including setting up accounts, and making payments.• name;
• telephone number;
• email address;
• job title;
• job location;
• billing information including: signature, transaction, bank account details and/or payment card information; and
• information that you volunteer to us when we engage your services.
We process this information as it is necessary for us to enter a contract with you/ your employer for your services.From you directly when you call, email or otherwise send information to us.For the duration we have an agreement in place with you or your employer and for 6 years following the end of the agreement with you or the business you represent.
To manage our relationship with you which will include (where appropriate) notifying you about changes to our terms of business or privacy notice.• name;
• email address;
• telephone number.
We process this information as it is necessary for the performance of our contract with you and to ensure that we can provide updated service information to you. From you via our Website, contact form or when you call or email us.For the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account.
To promote our products and services, including by sending you emails, newsletters or postal communications.• name;
• e-mail address;
• additional information such as your job role; and
• what market you work in.
The processing is necessary for our legitimate interest to promote our business and our products and services.
We will only send you marketing by email to a personally owned email address if you have given us your prior consent, which you are free to refuse.
You have a right to stop us from sending you direct marketing at any time. You may do so by clicking the "unsubscribe" link in our marketing emails, or by contacting our Data Protection Officer using the details set out in this policy.
From you via our Websites or contact form or when you call, email, or otherwise send information to us.
From public sources, such as social media sites.
For as long as required to promote our products and services to you and for no longer than 2 years.
To answer questions or comments via contact forms.• name;
• email address;
• telephone number; and
• company name.
The processing is necessary for our legitimate interest to provide our services to you and/or provide Website visitors with a good level of service.Directly from you via our Website or when you call or email us.2 years
if you attend our premises.• name;
• email address;
• telephone number;
• footage of you may be recorded on CCTV systems.
To note the premises in which we may operate from time to time may be owned and managed by a third party. In these circumstances it may be the operator and controller of CCTV and collect your contact details for the purposes of its own visitor access purposes.
The processing is necessary for our legitimate interest to provide our services to you.
In relation to CCTV (where we are the operator), in order to protect our business, the local community, customers and colleagues.
From you when you visit our sites.In relation to CCTV (where we are the operator), 30 days month after its creation.
All other data once the purpose for processing has been fulfilled or where you have a contractual relationship with us/ or an account for the duration you have an agreement in place with us or the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account.
To comply with legal and regulatory obligations.• all data provided by you;

The processing is necessary for us to comply with our legal obligations.From you via our Website, contact form or when you call, email or otherwise send information to us.

For the duration you have an agreement in place with us or where you have an account for the duration for which you hold an account with us and in each for 6 years following the end of the agreement or the closure of your account.
To prevent and detect unlawful activities such as fraud and money laundering.• name;
• account number;
• information relating to your use of our services;
• payment transaction reference;
• transaction data including transaction history.
The processing is necessary for our legitimate interests to protect our business and co-operate with law enforcement authorities.From you via our Website, contact form or when you call, email or otherwise send information to us.
From providers of technical and payment and delivery services.
From the Police or other law enforcement authorities.
We hold this information for 6 years after the relevant issue arises or, if litigation is pursued, until the issue is finally resolved.
To process job applications of prospective employees of Northern Gritstone that contact us by email, telephone or in person.• name;
• email address
• telephone number;
• references;
• correspondence with you relating to any application;
• information collected by a third party providing DBS checking service.
The processing is necessary for our legitimate interest to review and interview job candidates.From you via email or otherwise where you telephone us or you send information to us or which may be provided to us from a recruitment agent.For unsuccessful job applicants:6 months from the date on which we confirm no job will be offered.
For those that to whom a job offer is made and accepted until the end of employment and 6 years thereafter.
To reply to and deal with complaints and queries.• name;
• email address;
• telephone number; and
• account number.

The processing is necessary for our legitimate interest to provide clients with a good service and to deal with any issue raised by you or your representative.From you via our Website, contact form or when you call, email or otherwise send information to us.If the data relates to a complaint, we will retain this information for 6 years from the date that the complaint was received.

Where we process personal data on the legal basis of ‘legitimate interests’ (as indicated in the above table), we have determined, acting reasonably and considering the circumstances, that we are able to do so after carrying out a balancing exercise to make sure that our legitimate interests are not overridden by your interests, rights and freedoms. Where we rely on this legal basis, (a) we process the data only to the extent that is necessary for the relevant purpose; and (b) the relevant processing activities can be reasonably expected. The legitimate interests we pursue are specified in the above table with respect to each relevant purpose.

Where we process personal data on the legal basis of ‘consent’ (as indicated in the above table), you may refuse to consent to our processing and you may also withdraw your consent at any time, by emailing us at: enquiries@northern-gritstone.com. This would not affect your ability to use any features of our Websites or to receive our Services. Withdrawing consent does not affect any processing carried out without your consent.

Marketing and promotional materials
We may use your personal information to provide you with marketing and promotional materials (as stated above). We do so for our own purposes and will never sell AND/OR share your personal information with third parties for marketing purposes.

You may opt-out of receiving marketing and promotional materials from us at any time by emailing us at enquiries@northern-gritstone.com .

Security
We have in place appropriate procedures which provide technical and organisational measures to protect your personal information from unauthorised or unlawful processing, and against accidental loss, destruction or damage.

We also have procedures in place to deal with any data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.

However, the Internet and email are not secure. Your communications may route through a number of countries before being delivered, may be intercepted by third parties and may not always reach the intended recipient – this is the nature of the World Wide Web/Internet. We cannot accept responsibility for any such unauthorised access or loss of personal information that is beyond our control.

You are responsible for protecting your username and password and must not share it with, or disclose it, to anyone.

If you want you to learn more about how to protect your data and your devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Sharing your personal information
We will only disclose your personal information to:

  • our professional advisors (including without limitation tax, legal or other corporate advisors who provide professional services to us);
  • other third party suppliers, business partners and sub-contractors for business administration, support, processing, services, or IT purposes;
  • analytics or search engines, that enable us to optimise and improve your Website experience (for example Google);
  • other third party suppliers for marketing purposes (including without limitation checking marketing permissions previously elected by you);
  • third parties that you approve (including without limitation, social media sites and third party payment providers);
  • third parties engaged to assist with verification prior to being accepted for an investment such as banks and background check providers;
  • Our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters; and
  • HMRC or other tax bodies or agencies to comply with our legal and regulatory obligations.

We will disclose your personal information to third parties:

  • in the event that we consider selling or buying any business or assets, in which case we will disclose your personal information to any prospective sellers or buyers of such business or assets;
  • in the event we are the subject of any insolvency situation (e.g. the administration or liquidation);
  • if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us about our customers will be one of the transferred assets;
  • in order to enforce or apply our terms and conditions;
  • to protect our rights, property, or safety, or that of our staff, our customers, or others. This includes exchanging information with other companies and organisations (including without limitation HMRC, the local police or other local law enforcement agencies) for the purposes of staff and customer safety, crime prevention, fraud protection and credit risk reduction; and
  • if we are under a duty to disclose or share your personal information in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime.

International transfers of your personal information
We may transfer personal information to countries other than the country in which the data was originally collected (for example, outside the UK/EEA) in order to provide you with our services. These countries may not have the same data protection laws as the country in which you initially provided the information and may not provide the same level of protection.

 

Your rights

 

Right

 

Description

 

To be informed

You have the right to be informed about the personal information we hold about you.

Of access

You have the right to request confirmation that your personal data is being processed, access to your personal data (through us providing a copy) and other information about how we process your personal data.

To rectification

You have the right to request that we rectify your personal data if it is not accurate or not complete.

To erasure

 

You have the right to ask us to delete the personal information we hold about you. This right will only apply where (for example):

·       we no longer need to use the personal information to achieve the purpose we collected it for;

·       where you withdraw your consent if we are using your personal information based on your consent; or

·       where you object to the way we process your data (in accordance with your right to object as detailed below).

To restrict processing

 

In certain circumstances, you have the right to restrict our processing of the personal information we hold about you. This right will only apply where (for example):

·       you dispute the accuracy of the personal information held by us;

·       where you would have the right to ask us to delete the personal information but would prefer that our processing is restricted instead; or

·       where we no longer need to use the personal information to achieve the purpose we collected it for, but you need the data for the purposes of establishing, exercising or defending legal claims. 

To data portability

 

In certain circumstances, you have the right to receive the personal information you have given us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal information to another organisation, at your request.

To object

 

You have the right to object to our processing of the personal information we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process the personal information which override your rights or which are for the establishment, exercise or defence of legal claims.

In relation to automated decision making and profiling

You have the right not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you. We do not carry out any automated processing or profiling.

To withdraw

You have the right to withdraw your consent, where we are relying on it to use your personal information (for example, to provide you with brochures and newsletters).

We welcome your views about our Websites and this policy. If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please email us at: enquiries@northern-gritstone.com .

If you would like this notice in another format (for example audio, large print, braille) please contact us using the details above.

We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your personal information. However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to our supervisory authority, which is the UK’s Information Commissioner’s Office. Their address is: First Contact Team, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

 

Cookies

We use cookies and similar tracking technologies, such as tags and pixels (“cookies”), to personalise and improve your customer experience as you use our Websites . The below provides more information about cookies, including how we use them and how you can exercise your choices about our use of cookies.

What are cookies?

Cookies are small text files that may be stored on your computer (or other internet enabled devices, such as a smartphone or tablet) when you visit our Website,  or open our emails or click on any links in our emails or on our Website. They are used by us on our Website to help remember information about your visit, like your country, language and other settings and on our emails and communications to help us confirm if you open the email and collect information about your interactions with the communication which helps us set preferences and improve the delivery of our services.

Our use of cookies

We use cookies on our Website to:

  • recognise you whenever you visit this Website (this speeds up your access to the Website as you do not have to log in each time);
  • obtain information about your preferences and use of our Website; and
  • make your online experience more efficient and enjoyable.

Information about our use of cookies

We use the following cookies:

Cookie requirementType of cookieExplanation:
Strictly necessary cookiesNecessaryThese are cookies that are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website. We do not require your consent to place these cookies. Nevertheless, you may be able to block these cookies yourself on your device/ browser, but restricting these cookies is likely to mean that our Website will not work as you would expect, and certain functionality may be inoperable.
Non-essential cookiesFunctionality cookiesThese are used to recognise you when you return to our site. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

You can find more specific information about the individual cookies we use and the purposes for which we use them in the table below:

CookieCookie DurationInformation processedWhat cookies do/purposeRequired or not
wordpress_test_cookieSessioncookie permissionTests whether or not the browser has cookies enabledYes
_GRECAPTCHASessionWebsite analyticsUsed by Google reCAPTCHA which protects the contact form against spamYes

How can I manage cookies?

You have the right to decide whether to accept or reject certain cookies. You can exercise your cookie rights by setting your preferences in the Cookie Consent Manager. If you wish to disable all cookies, you can opt-out by setting your browser to remove or reject browser cookies. You can also delete cookies that have already been set through your browser settings.

The Cookie Consent Manager can be found in the notification banner and on our Website. If you choose to reject cookies, you may still use our Website though your access to some functionality and areas of our Website may be restricted. Most browsers have cookies enabled by default. However, if you don’t want to enable cookies, you’ll still be able to browse the site. More information about cookies, including how to block them or delete them, can be found at http://www.aboutcookies.org .  If you have any further questions, comments or requests regarding our cookies policy or how we use cookies on our site, then you can contact us at enquiries@northern-gritstone.com.

Changes to this policy

We will take reasonable measures to communicate any changes to this policy to you, and you and will post any updated privacy policies on this page.

This policy was last reviewed and updated on 3 March 2022