Last modified: July 16, 2020
1.2 This policy applies where we are acting as a data controller concerning the personal data of our website visitors and service users; in other words, where we determine the purposes and means of the processing of that personal data.
1.4 Our website incorporates privacy controls which affect how we will process your personal data. By using the privacy controls, you can specify how you would like to receive direct marketing communications and limit the publication of your information.
1.5 In this policy, “we” and “us” refer to Shadow Foundr Limited. For more information about us, see Section 15.
2 How Shadow Foundr uses your personal data
2.1 In this Section 2 we have set out:
(a) the general categories of personal data that we may process;
(b) in the case of personal data that we did not obtain directly from you, the source and specific categories of that data;
(c) the purposes for which we may process personal data; and
(d) the legal bases of the processing.
2.2 We may process data about your use of our website and services (“usage data”). The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use.
2.3 We will also use your personal data, such as full name, bank detail information to process your payment and be FCA-compliant.
2.4 We will also use and pass on the documents for Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures, which are mandatory under FCA regulation. In this case, we will also pass on your details to our chosen data-processing providers:
Global Currency Exchange Network Limited (“GCEN”) (a Company incorporated in England and Wales under Company Number: 04675786, having its registered office situated at The Old Barn, Oasts Business Village, Red Hill, Wateringbury, Kent, England ME18 5NN and which is authorised and regulated by the United Kingdom’s Financial Conduct Authority under the Payment Services Regulations (FRN: 504346);
Global Custodial Services Ltd (“GCS”) (a Company incorporated in England and Wales under Company Number: 08321940, having its registered office situated at The Old Barn, Oasts Business Village, Red Hill, Wateringbury, Kent, England ME18 5NN and which is authorised under the Financial Conduct Authority (FRN: 595875);
Goji Financial Services Limited (“Goji”), Company incorporated in England and Wales under Company Number: 10234133, having its registered office situated at 133 Whitechapel High Street, London, E1 7QA, which is authorised and regulated by the Financial Conduct Authority (FRN: 805323).;
SmartCredit Limited T/As SmartSearch (“SmartSearch”), Company incorporated in England and Wales under Company Number: 05534508, having its registered office situated at Mayfield House, Lower Railway Road, Ilkley, Leeds, England LS29 8FL.
We have ensured to the best of our knowledge that their data-handling procedures are GDPR compliant & follow the best data practice approach; we do not accept liability for data mismanagement by any 3rd party provider which the website user has opted in to pass on their details to. The source of the usage data is our analytics tracking system. This usage data may be processed to analyse the use of the website and services. The legal basis for this processing is consent OR our legitimate interests, namely monitoring and improving our website and services OR to fulfil our Contract OR Legal Obligations (in most cases, it would be FCA requiring us to collect & store investment data).
2.5 We may process your account data (“account data”). The account data may include your name and email address. The source of the account data is you or your employer. The account data may be processed to operate our website, providing our services, ensuring the security of our website and services, maintaining back-ups of our databases & communicating with you. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and business and the performance of a contract between you and us or taking steps, at your request, to enter into such a contract.
2.6 We may process your information included in your personal profile on our website (“profile data”). The profile data may include your name, address, telephone number, email address, profile pictures, gender, date of birth, relationship status, interests and hobbies, educational details and employment details. The profile data may be processed to enable and monitor your use of our website and services. The legal basis for this processing is consent OR our legitimate interests, namely the proper administration of our website and business OR the performance of a contract between you and us and taking steps, at your request, to enter into such a contract.
2.7 We may process your personal data that are provided in the course of the use of our services (“service data”). The source of the service data is you or your employer. The service data may be processed to operate our website, providing our services, ensuring the security of our website and services, maintaining back-ups of our databases and communicating with you. The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract OR Legal obligation to store a record for the FCA & to conduct KYC/AML checks OR our legitimate interests, namely the proper administration of our website and business.
2.8 We may process information that you post for publication on our website or through our services (“publication data”). The publication data may be processed to enable such publication and administering our website and services. The legal basis for this processing is consent OR our legitimate interests, namely the proper administration of our website and business OR the performance of a contract between you and us or taking steps, at your request, to enter into such a contract.
2.9 We may process information contained in any enquiry you submit to us regarding goods and/or services (“enquiry data”). The enquiry data may be processed for the purposes of offering, marketing and selling relevant goods and/or services to you. The legal basis for this processing is consent.
2.10 We may process information relating to transactions, including purchases of goods and services, that you enter into with us and/or through our website (“transaction data”). The transaction data may include your contact details and the transaction details, but we do not process your credit card details – it is done via our 3rd party providers: GCEN, Goji or Stripe. The transaction data may be processed for the purpose of supplying the purchased goods and services and keeping proper records of those transactions. The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and our legitimate interests, namely our interest in the proper administration of our website and business.
2.11 We may process information that you provide to us for the purpose of subscribing to our email notifications and/or newsletters (“notification data”). The notification data may be processed for the purposes of sending you the relevant notifications and/or newsletters. The legal basis for this processing is consent for marketing newsletters and the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract for non-marketing information.
2.12 We may process information contained in or relating to any communication that you send to us (“correspondence data”). The correspondence data may include the communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the website contact forms. The correspondence data may be processed for the purposes of communicating with you and record-keeping. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and business and communications with users.
2.13 We may process any of your personal data identified in this policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.
2.14 We may process any of your personal data identified in this policy where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.
2.15 In addition to the specific purposes for which we may process your personal data set out in this Section 3, we may also process any of your personal data where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
Please do not supply any other person’s personal data to us, unless we prompt you to do so.
As is true of most websites, we gather specific information automatically and store it in log files. This information includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data. We use this information, to analyse trends, to administer Our Site, to track users’ movements around Our Site and to gather demographic information about our user base as a whole.
For Marketing & admin notification purposes, we may from time to time use your personal information to send you automated email messages or marketing materials regarding our services and the services of third party suppliers, in each case with your prior consent. These email messages may contain features that help us make sure you received and were able to open the message. You may opt out of receiving such marketing email messages at any time, free of charge, by replying to the message with “unsubscribe” in the subject line, or by following the instructions in any marketing communication.
When you contact us, we may intercept, record or monitor any communication(s) (including telephone calls or other electronic communications) between you and us. We may do so to resolve queries in the future and to ensure security, staff training and complying with our regulatory and legal responsibilities. For legitimate interest bases, e.g. for staff training purposes, you will be notified beforehand that the data will be used such way. In the case of communications by email you should note that, as emails are not encrypted outside of Shadow Foundr (and may, therefore, be intercepted by third parties) and as the identity of the sender cannot be confirmed, you must NOT provide your security details by email and should avoid providing any Personal Data to us by email.
3. Providing your personal data to others
We may also disclose your personal information if, in our opinion, a disclosure is required by law.
3.2 We may disclose your personal data to our insurers or professional advisers insofar as reasonably necessary to obtain or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims, whether in court proceedings or an administrative or out-of-court procedure.
3.4 In addition to the specific disclosures of personal data set out in this Section 4, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or an administrative or out-of-court procedure.
4 International transfers by Shadow Foundr of your personal data
4.1 In this Section 4, we provide information about the circumstances in which your personal data may be transferred to countries outside the European Economic Area (EEA).
4.2 Our other group companies and we have offices and facilities in the UK and EU. The European Commission has made an “adequacy decision” concerning the data protection laws of each of these countries. Transfers to each of these countries will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission, a copy of which can be obtained from email@example.com.
4.3 The hosting facilities for our website are situated in the EU West. The European Commission has made an “adequacy decision” concerning the data protection laws of each of these countries. Transfers to each of these countries will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission, a copy of which you can obtain from firstname.lastname@example.org.
4.4 You acknowledge that personal data that you submit for publication through our website or services may be available, via the internet, around the world. We cannot prevent the use (or misuse) of such personal data by others.
5 Retaining and deleting personal data
5.1 This Section 5 sets out our data retention policies and procedure, which are designed to help ensure that Shadow Foundr complies with our legal obligations concerning the retention and deletion of personal data.
5.2 Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
5.3 We will retain your personal data as follows:
personal data category or categories will be retained for a minimum period of 1 year following the date of when you supply us with your personal data, and for a maximum period of 5 years following the end date of commercial engagement with you. That timeframe is mostly made to comply with regulatory obligations we have for record-keeping.
5.4 In some cases it is not possible for us to specify in advance the periods for which your personal data will be retained. In such cases, we will determine the period of retention based on the following criteria:
the period of retention of personal data will be determined based on investment interest.
5.5 Notwithstanding the other provisions of this Section 6, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or to protect your vital interests or the vital interests of another natural person.
6.1 Shadow Foundr may update this policy from time to time by publishing a new version on our website. You will be notified of any significant changes to this policy via email and website notifications.
6.2 You should check this page occasionally to ensure you are happy with any changes to this policy.
6.3 We may notify you of changes to this policy by email or through the website notifications system for any major changes.
7 Your rights
7.1 You may instruct us to provide you with any personal information we hold about you; provision of such information will be subject to:
(a) the zero-payment fee, which may become £20 per enquiry, if the requests are considered to be manifestly unfounded or excessive, in particular because they are repetitive (see the ICO guidance for the explanation) and
(b) the supply of appropriate evidence of your identity (for this purpose, we will usually accept a photocopy of your passport certified by a solicitor or bank plus an original copy of a utility bill showing your current address).
7.2 We may withhold personal information that you request to the extent permitted by law.
7.3 You may instruct us at any time not to process your personal information for marketing purposes. This can be done via the subscription centre (accessed via any of our marketing newsletter communications) or in your profile settings & preferences on our website. You can also email email@example.com with such a request – although using the website or subscription centre would imply more quicker results.
7.4 In practice, you will usually either expressly agree in advance to our use of your personal information for marketing purposes, or we will provide you with an opportunity to opt out of the use of your personal information for marketing purposes. You would have used a positive opt-in to give us consent to contact you for the marketing content you have agreed to, via communication channels you have agreed to.
8 Your rights
8.1 In this Section 8, Shadow Foundr has summarized the rights that you have under the GDPR. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights (If you are UK based, you should review the guidance provided by the ICO: https://ico.org.uk).
8.2 Your principal rights under data protection law are, as defined by the ICO:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
Rights in relation to automated decision making and profiling.
8.3 You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee. You can access your personal data by visiting www.shadowfoundr.com when logged into our website.
8.4 You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.
8.5 In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.
8.6 In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful, but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.
8.7 You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
8.8 You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.
8.9 You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
8.10 To the extent that the legal basis for our processing of your personal data is:
(a) consent; or
(b) that the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.
8.11 SF seeks to avoid complaints by providing good service in a fair and clear way. SF always seek to resolve your queries or dissatisfaction promptly and amicably without recourse to formal complaints and SF respectfully requests to be given a fair opportunity to do so before making any formal complaint to SF and before entering any formal external complaint process. SF would be pleased to meet with you by appointment and at your convenience to discuss your distress, where possible; please contact firstname.lastname@example.org or call our office number (advertised on our website), so we can consult you on any issue and resolve it to the best of our ability.
8.12 In making any complaint or raising any matter prior to making a formal complaint, you agree to provide SF with all evidence that we request in support of your claim so that we can try to resolve the matter promptly. You agree to properly consider the agreement between the two parties (including these T&Cs) and relevant regulations.8.13 If having followed the above procedures you remain dissatisfied and would like to make a formal complaint, please write to:
Data Protection Officer, Shadow Foundr Ltd, 23-25 Montagu Street, London, W1H 7EZ
8.14 SF may contact you directly to discuss the complaint and you accepts that to co-operate and attempt to resolve matters in a reasonable and amicable way.
8.15. Complaints must be made by you only in case you are a client of SF or directly affected by the issue. SF will not accept complaints on your behalf made by a third party or adviser. Full details of our complaints procedures will be made available on request.
8.16 SF will deal with issues raised expeditiously and where necessary, call upon evidence and take such action as it deems appropriate in the circumstances.
8.17 If you are still dissatisfied in the matter in which the complaint is addressed, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection, if you are unsatisfied with how we processed your enquiry. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
More information on the Information Commissioner Officer (ICO) can be found https://ico.org.uk.
8.18 To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
8.19 You may exercise any of your rights in relation to your personal data by written notice to us, sending us an email to email@example.com, calling our main office number & asking to speak to our Data Security Officer or in person. When using the latter two channels of contact, please ensure that your request has been lodged by our staff member & staff member is acknowledged of your enquiry as a lawful request.
8.20 Your statutory and regulatory rights remain unaffected.
9 About cookies and tracking
9.1 A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
9.2 Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
9.3 Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
10 Cookies and tracking that Shadow Foundr use
10.2 Technologies such as: cookies, beacons, tags and scripts are used by Shadow Foundr Limited and our partners, including marketing partners affiliates, or analytics service providers and business process service providers. These technologies are used in analysing trends, administering Our Site, tracking users’ movements around Our Site and to gather demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis.
10.5 Local Storage Objects (Flash/HTML5): Third parties with whom we partner to provide specific features on Our Site or to display advertising based upon your Web browsing activity use LSOs such as HTML 5 or Flash to collect and store information.
Various browsers may offer their management tools for removing HTML5 LSOs. To manage Flash LSOs, please click here:
11 Cookies used Shadow Foundrs’ service providers
12 Managing cookies
12.1 Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can, however, obtain up-to-date information about blocking and deleting cookies via these links:
(a) https://support.google.com/chrome/answer/95647?hl=en (Chrome);
(b) https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
(c) http://www.opera.com/help/tutorials/security/cookies/ (Opera);
(d) https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
(e) https://support.apple.com/kb/PH21411 (Safari); and
(f) https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).
12.2 Blocking all cookies will have a negative impact upon the usability of many websites, including Shadow Foundr. If you want to opt out of marketing-only & tracking cookies, we suggest that you opt out of non-essential cookies only.
12.3 If you block all cookies, you will not be able to use all the features on our website.
13.1 All information you provide to us via email or Our Site is stored on our secure servers.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of Our Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
13.2 The security of your data is important to us. When you enter sensitive information (such as bank account information) on our order forms, we encrypt the transmission of that information using secure socket layer technology (SSL).
We follow generally accepted standards to protect the personal data submitted to us, both during transmission and once we receive it. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. Our website is scanned on a regular basis for security holes and known vulnerabilities to make your visit to our site as safe as possible. We use regular Malware Scanning. All transactions are processed through a gateway provider and are not stored or processed on our servers. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, we cannot guarantee its absolute security. If you have any questions about security on Our Site, you can contact us at firstname.lastname@example.org.
14 ADDITIONAL PRIVACY INFORMATION
14.1 Our Site offers a publicly accessible blog and community discussions. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. To request removal of your personal data from our blog or community discussions, contact us at email@example.com. In some cases, we may not be able to remove your personal data, in which case we will let you know if we are unable to do so and why.
14.2 If you choose to use our referral service to tell a contact about Our Site, we will ask you for your contact’s name and email address. You must have consent from your contact to provide this information to us. We will automatically send your contact a one-time email inviting him or her to visit the site. Shadow Foundr store this information for the sole purpose of sending this one-time email and tracking the success of our referral program.
Your contact may contact us at firstname.lastname@example.org to request that we remove this information from our database.
14.3 Our Site may, from time to time, contain links to and from the websites of our suppliers, partner networks, advertisers, affiliates and other third parties. If you follow a link to any of these websites, please note that these websites should have their privacy policies and we do not accept any responsibility or liability for these policies or the content or operation of these websites. Please check these policies and the terms of the websites before you submit any personal data to these websites.
14.4 We may list you in our publicly accessible member directory. If you wish to request removal of your information or the deletion of an unauthorised profile from our directory, you can contact us at email@example.com.
14.6 You can log in to Our Site using the sign-in service such as LinkedIn, Facebook and Google (“Single Sign-On”). These services will authenticate your identity and provide you with the option to share certain personal data with us such as your name and email address to pre-populate our sign up form. Services like LinkedIn, Facebook and Google may give you the option to post information about your activities on Our Site to your profile page to share with others within your network.
15 Our details:
15.1 This website is owned and operated by Shadow Foundr Limited.
15.2 We are registered in England and Wales under Company Registration Number: 09496687, and our registered office is at 2 Appletree Close, Redlynch, Salisbury, England SP5 2JG.
15.3 Our principal place of business is at 23-25 Montagu Street, London, W1H 7EZ.
(a) by email, using the email address published on our website from time to time: firstname.lastname@example.org.
(b) using our website contact form; or
(d) by post, to the principal place of the postal business address given above.