Know your customer privacy notice
Scope of this privacy notice
This notice explains how and why we collect, use and share personal data in connection with our Know Your Customer (KYC), anti-money laundering (AML), sanctions, fraud prevention and other financial crime compliance obligations.
If you would like information on how we process personal data as a website visitor, or as an external party who may make an enquiry to us, please see our privacy and cookies notice.
Typically, our processing of personal data for the above purposes is for one of the following:
- ‘KYC’ onboarding checks: These checks are conducted when your employer (typically our client, investment partner or other business counterparty) first enters into a business relationship with us. They may include identity verification, beneficial ownership assessment, sanctions screening, politically exposed person (PEP) checks, adverse media searches and other financial crime due diligence required by law and our internal policies.
- Periodic reviews and ‘trigger events’: Where a business relationship already exists, we may periodically review and update previously collected information to ensure that it remains accurate and complete. We may also conduct further checks following a significant change in circumstances (a "trigger event"), such as changes to ownership, control, senior management, legal structure, jurisdiction of operation or risk profile.
- Escalations and financial crime investigations: Where our due diligence, monitoring activities or screening processes identify potential concerns, we may conduct additional enquiries, review relevant personal data and escalate matters internally for consideration by appropriate governance, compliance or senior management functions. In certain circumstances, we may also be required by law to make disclosures to regulatory, supervisory or law enforcement authorities.
- Regulatory reporting and legal obligations: We may process personal data where necessary to comply with applicable laws, regulations, regulatory requests and internal governance requirements. This may include responding to requests from regulators, law enforcement agencies and other competent authorities, and maintaining records required by law.
How we obtain your personal data
In most cases we collect personal data directly from you. However, sometimes it may be provided to us by your employer or from the designated person coordinated the provision of documents.
We may also obtain your personal data from publicly available sources, including:
- Companies House
- Public news articles (if applicable)
- Social media
- Company annual reports
- Company websites
What information we process:
| Category of data | Type of data |
|---|---|
| Identity and biographical data | Full legal name, including middle name; previous names; date of birth; nationality; country of residence; job title, position, office or role; director, senior manager, authorised signatory, fund manager or beneficial owner status |
| Contact and address data | Business and personal email addresses; business and personal telephone numbers; residential and correspondence addresses; proof of address documents, such as a council tax statement or utility bill |
| Identity verification data | Passport or driving licence details and copies; verification status, outcome and exception information; short video or biometric verification data where processed through the relevant service; identity assurance or matching results received by NWF |
| Ownership and corporate relationship data | Shareholdings, beneficial ownership percentages and control interests; ownership or control structure charts and cap tables; relationships to companies, funds, general partners, limited partners, co-investors and counterparties; company numbers and jurisdictions linked to individuals |
| Employment and professional data | Employment history and CV information; professional biography, qualifications and experience; current salary, where enhanced due diligence applies - founder background and role information |
| Financial and source-of-wealth data | Individual estimated net worth; sources, locations and history of wealth generation; income, investments, dividends, rental income and business interests; bank statements, tax returns or filings, investment portfolios and inheritance records where supplied; asset holdings, market values, acquisition dates, secured lending, loan and collateral information where attributable to an individual |
| Compliance and due diligence data | AML and KYC information; PEP, sanctions and adverse-media screening information or results; fraud risk and due diligence information; regulatory investigation and inquiry disclosures; criminal proceedings, convictions, civil actions, enforcement proceedings and sanctions disclosures; due diligence notes, red flags, decisions and supporting evidence |
Which individuals we process personal data about:
- Directors, officers, senior managers, founders and authorised signatories of client or prospective client organisations
- Politically Exposed Persons (PEPs)
- Individual beneficial owners, shareholders and people exercising ownership or control
- Client representatives, applicants, counterparties, co-investors and syndicate participants
- Fund managers, directors of general partners, investment personnel and other key fund individuals
- Suppliers, customers, business partners, subcontractor contacts and other individuals named in due diligence material
- Individuals subject to identity verification, KYC, AML, sanctions, fraud or enhanced due diligence checks
Our purposes (and lawful basis)
| Purpose | Lawful basis |
|---|---|
| To verify your identity | UK GDPR Article 6 (1) (e) - Public interest |
| To perform KYC and Customer Due Diligence checks | UK GDPR Article 6 (1) (c) - Legal obligation |
| To identify the ultimate beneficial ownership of a company | UK GDPR Article 6 (1) (e) - Public interest |
| To perform sanctions screening against UK and international sanctions lists | UK GDPR Article 6 (1) (e) - Public interest |
| To determine whether you are a PEP | UK GDPR Article 6 (1) (e) - Public interest |
| To meet legal and regulatory anti-money laundering regulations, including bribery, corruption and fraud | UK GDPR Article 6 (1) (c) - Legal obligation |
| To conduct adverse media and any reputational risk checks | UK GDPR Article 6 (1) (e) - Public interest |
| To assess the legitimacy of the source of funds | UK GDPR Article 6 (1) (c) - Legal obligation |
Special category and criminal offence data:
Special category data are as follows: health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, sex life and sexual orientation.
Where we process this type of data, we need to identify an additional lawful basis for this processing. We rely on the following basis for the processing of special category data within our KYC/CDD process:
| Special category data | Lawful basis |
|---|---|
| Biometric data (as part of our identity verification processing) | UK GDPR Article 9 (2) (g) - Substantial public interest Data Protection Act 2018, Schedule 1, Part 2 (10) - preventing or detecting unlawful acts |
We do however collect criminal offence data, which includes ongoing criminal proceedings, convictions, allegations, enforcement information and related explanations or evidence.
Please note that ‘criminal offence data’ under UK data protection law also includes the absence of any criminal convictions. ‘Criminal offence data’ we typically process includes information obtained through sanctions screening, adverse media searches, regulatory and law enforcement disclosures, court judgments, official registers, and information relating to actual or alleged criminal offences identified during our KYC, AML and financial crime due diligence activities.
For ‘criminal offence data’ specifically, our purpose and lawful basis is:
| Purpose | Lawful basis |
|---|---|
| To establish any criminal convictions | Data Protection Act 2018 Schedule 1, Part 2 - regulatory requirements relating to unlawful acts and dishonesty |
Who do we share your data with?
We screen your details against the databases offered by our third-party providers.
Whilst we are not collecting information from these databases routinely, they could return information about you, if it is held on the respective database.
Some of these third parties act as our processor; these companies perform services on our behalf to fulfil some of the purposes described above. Where we instruct a processor to act on our behalf, they are contractually bound to only process your personal data as instructed by us.
For our KYC, onboarding, annual reviews and trigger events.
The following entities act as our processor:
- GovForms – We use GovForms as a secure platform for the collection and transfer of documentation and information required for our KYC, onboarding and due diligence processes.
- Moodys (Compliance Catalyst, Sanctions 360 & GRID) – We use Moody's as part of our customer due diligence and financial crime compliance processes to verify information relating to individuals and organisations, assess ownership and control structures, identify beneficial owners and associated parties, and screen for potential financial crime, sanctions and reputational risks. We also use it to conduct sanctions, Politically Exposed Person (PEP) and adverse media screening as part of our financial crime due diligence processes.
- Onfido – We use Onfido to verify the identity of individuals as part of our onboarding and due diligence processes. Individuals provide identity information through the Onfido platform, which is used to validate their identity and help prevent fraud and impersonation
The following organisation’s don’t process personal data on our behalf, but we do have agreements with them to share data:
CIFAS - The personal data we have collected from you will be shared with CIFAS, where it will searched against their database to detect any fraud, or other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found here: www.cifas.org.uk/fpn
For Suspicious Activity Reporting
We may share your personal data with the following external parties:
- National Crime Agency
- The relevant law enforcement authority
We will share your personal data internally within NWF, but only to individuals who have a need to access this information.
This will typically be NWF employees who are working on the investment, as well as our staff involved in carrying out our KYC/CDD process and identifying any financial crime implications.
International transfers
Where your personal data is processed within one of the Moodys platforms, it may be transferred to the United States. Moodys ensure that the UK Addendum (to the EU Standard Contractual Clauses) is used to transfer data outside of the UK.
How long do we keep your data?
As a rule, we will only retain your data for as long as we have a purpose to process it. Once we no longer have a purpose to continue processing it, we will securely erase it.
The following periods apply to our processing:
| Activity | Retention period |
|---|---|
| Know Your Customer/Customer Due Diligence | 5 years (from the end of our business relationship) |
| Suspicious Activity Reports | 5 years (from the point where the report was made) |
For GovForms specifically, we keep a copy of the data you upload to the platform for a period of 3 months, after which it is permanently deleted.
Your data protection rights
You have the following rights under data protection law. These rights are not absolute and would depend on our purposes for processing. Some of them apply in limited circumstances:
The following rights always apply:
Right of access – you have the right to request copies of the personal data we hold about you.
Right to rectification – you can ask us to amend any inaccurate information, or to complete any information as required.
The following rights apply in certain circumstances:
Right to be informed – you have the right to be informed about why we are collecting your personal data and the purposes for which we will use it for. This privacy notice provides the transparency around our processing, however there may be situations when we cannot provide you with this information; this may be where an exemption applies, such as the prevention or detection of crime.
Right to erasure – you have the right to request that we erase your personal data in certain circumstances.
Right to restrict processing – you have the right to ask us to put a temporary hold on the processing of your personal data. This is likely to apply where you have made another request and we need to investigate.
How to contact us
If you would like further information on how your personal data is processed, or anything mentioned in this notice please contact our Data Protection Officer at: DPO@nationalwealthfund.org.uk.
If you are not happy with our response or still have concerns about the way in which we use your personal data, you can make a data protection complaint directly to us at Complaints@nationalwealthfund.org.uk. We’ll acknowledge your complaint within 30 days and issue you with our final response as soon as practicable.
You can also separately make a complaint to the Information Commission, who is an independent regulator, at:
The Information Commission's Office (ICO)
4th Floor, No 3 Circle Square
Hawkshaw Street
Manchester
M1 7BL
Make a complaint via the ICO website