Privacy Notice

1The personal data we collect about you

We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

• Identity Data — title; first name; last name; nationality; National Insurance number; copies of identity documents.
• Contact Data — address; email address; telephone number(s); social media and communications platform aliases; company or organisation; role.
• Technical Data — IP address; browser type and version; time zone setting and location; browser plug-in types and versions; operating system and platform; device used to access this site.
• Usage Data — information about how you use our website.
• Marketing and Communications Data — your preferences in receiving marketing from us and our third-party partners; topics of interest; your opinions regarding our services; communications between us; your communication preferences.
• Contractual and Transactional Data — agreements between us; services you request and/or we provide to you.
• Financial and Payment Data — bank account; credit/debit card numbers; sort code; CVC code; expiry date; related billing information.
• Screening Data — identification and contact information concerning registered officers and individuals with significant control; information regarding criminal and regulatory investigations; expertise, professional qualifications and certifications of registered officers and staff.
• Education and Work Data — academic institutions; employers; qualifications; experience; references.

We do not collect any Special Categories of Personal Data about you (including details about race or ethnicity, religious beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, or genetic and biometric data). Nor do we collect information about criminal convictions and offences.

2How we collect your personal data

We may obtain your personal data directly from you; from individuals or entities acting on your behalf; from our clients; from your organisation; when you browse, complete a form or make an enquiry via our website, social media or other platforms; from search engine and web analytics providers; by referrals; from our professional advisers; from courts, law enforcement bodies, regulators, government departments or agencies; and from the public domain.

3How we use your personal data

We will only use your personal data when the law allows us to. Most commonly this will be under one of the following grounds:

• Performance of Contract — processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
• Legitimate Interest — the interest of our business in conducting and managing our business to enable us to give you the best service and the most secure experience, balanced against any potential impact on you.
• Comply with a legal or regulatory obligation — processing your personal data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending third-party direct marketing communications. You have the right to withdraw consent to marketing at any time by contacting us at [email protected].

4Who we share your personal data with

We may share your personal data with:

• Internal third parties: Rossnet Research Centre Limited and any subsidiaries of Rossnet Consultancy Limited
• Our clients; our professional advisers (including insurers, legal advisers, accountants)
• Our suppliers, business partners and sub-contractors
• Search engine and web analytics providers
• Courts, police, law enforcement bodies, regulators, government departments or agencies, lawyers or other parties
• Companies providing anti-money laundering and fraud prevention services, financial institutions, and related regulatory bodies
• Third parties to whom we may sell, transfer, or merge parts of our business or assets
• Other third parties to which you request that we disclose your data

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

5International transfers

When we process your personal data, we may process it in countries outside of the UK and the European Economic Area, for example when we engage third-party service providers based in other countries. We will only conduct such transfers where an adequate level of protection is assured — by explicit consent, contractual necessity, European Commission adequacy decisions, or standard contractual clauses.

6Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal data is limited to those with a business need to know, subject to a duty of confidentiality. We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where legally required to do so.

7Data retention

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected — typically for as long as you or your organisation is a client of ours or maintains an association with us, and for a period thereafter as necessary to comply with legal, accounting, taxation or regulatory requirements, or to establish, exercise or defend legal rights.

In practice, we will retain your personal data for a short period (up to 180 days) beyond the specified retention period to allow for review and necessary deletion. We will then securely destroy or anonymise it.

8Your legal rights

Unless subject to an exemption under data protection law, you have the following rights with respect to your personal data:

• Right to be informed — the right to know why we collect and process your personal data, met by this notice.
• Right of access — the right to know what personal data we hold and request a copy.
• Right of rectification — the right to correct inaccurate or incomplete personal data we hold about you.
• Right to be forgotten — in certain circumstances, the right to ask for your personal data to be erased from our records.
• Right to restriction of processing — where certain conditions apply, the right to ask us only to process your personal data for certain activities.
• Right of portability — the right to have your personal data transferred to another data controller.
• Right to object — the right to object to certain types of data processing, including marketing.
• Right to object to automated processing, including profiling — the right to object to the legal effects of automated processing or profiling.

To exercise any of these rights, contact us at [email protected]. You will not have to pay a fee to exercise your rights unless your request is clearly unfounded, repetitive or excessive. We try to respond to all legitimate requests within one month.

9Changes to this notice

This notice was last updated on 24 December 2025. Please keep us informed if your personal data changes during your relationship with us.

10Queries, requests or concerns

To exercise your rights or raise a query, please contact our Data Protection Officer at [email protected] or by post to 3 Palatine Close, Torquay, TQ1 1RD.

If we are unable to resolve your complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), contactable on 0303 123 1113 or at www.ico.org.uk.