We may update our privacy policy from time to time. Any changes we make will be posted on this page and, where appropriate, and if we have an up-to-date email address for you on record, we will send you an email to confirm the changes as well.

Definitions

1. Grey Epoch, or “we”, “us” or “our” means the brand, logo, name, business concept and affairs and individuals associated with carrying on the business activities related to and sold under the name Grey Epoch;

2. “Service” or “Services” means Grey Epoch’s products, software and services, as accessed from time to time by the user, whether or not in connection with an account;

3. “Website” or “Site” means www.greyepoch.com

4. “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018;

5. “Data Protection Legislation” means the UK Data Protection Act 2018, and the UK GDPR.

Our Contact Details and About Us

Grey Epoch Portfolio Management

Name: Grey Epoch Portfolio Management Limited
Registered address: 40 Gracechurch Street, London, EC3V 0BT, UK
Phone Number: +44 20 7038 7691

Grey Epoch Portfolio Management Limited is registered with the UK Information Commissioner’s Office (registration number ZB297372). If you have any questions, you can contact our Data Protection Contact at dpo@greyepoch.com.

Data Controller

Grey Epoch Portfolio Management Limited is the data controller in relation to any personal data of UK data subjects that you provide to us. This means we decide how and why your personal data is processed, and we are responsible for processing and sharing it in line with the requirements of the applicable data protection laws. We only share personal data with third parties where there is a lawful basis to do so.

Personal Information We May Collect

Personal information is the term we use to describe information which we collect and which can be used to personally identify someone. For example, a name, a personal address or even an IP address.

Here is a list of the types of personal data we may collect:

• Identity and contact data: Name, former or alternative names, job title, role and seniority, employer and previous employers, business and personal postal address, email address, telephone and mobile numbers, and messaging or social media handles used for business contact.

• Identification and verification data: Date and place of birth, nationality and country of residence, passport, national identity card or driving licence details and images, national identification and tax reference numbers, specimen signature, proof of address documents, and photographs for identity verification.

• Client due diligence and beneficial ownership data: Information about your role in a corporate structure, shareholdings and voting rights, directorships and other appointments, source of funds and source of wealth information, ownership and control charts, corporate registry extracts, and certificates or confirmations provided by auditors, lawyers or company officers. This includes personal data about your directors, officers, shareholders, beneficial owners, authorised traders and authorised signatories, and about the individuals named in documents.

• Screening and regulatory status data: The results of checks against financial sanctions lists, adverse media, litigation and insolvency records, and politically exposed person and related or close associate databases, together with our assessment of those results.

• Transaction, order and account data: Details of enquiries, indications of interest, orders, quotes, executions, allocations, confirmations and settlement instructions, registry and account identifiers, and the personal identifiers of individuals required for transaction reporting or for registry transfers.

• Marketing and preference data: Subscription and distribution list membership, your marketing preferences and opt outs, engagement with our research, market letters and other publications, and event attendance.

• Physical access and security data: CCTV footage and visitor records at premises we occupy or visit, and building access records.

Special category and criminal offence data: We do not seek to collect special category data, but we may receive it incidentally, for example where an identity document reveals biometric data or your place of birth suggests ethnic origin, or where you disclose health information relevant to accessibility or vulnerability. Our sanctions, adverse media and politically exposed person screening may generate personal data relating to alleged or actual criminal offences, proceedings and convictions. You may also provide us with additional information in response to those checks.

Information you give to us

Most of the categories above come directly from you, for example through onboarding forms, your correspondence with us, and our website. You may also give us:

• Communications and recordings - Emails, letters, chat and instant messages, voice recordings and metadata of telephone and video calls, meeting notes, records of visits and hospitality, and the content of your correspondence with us.

• Responses to surveys or promotions

• Any updates to the information you provide to us

Where we are required by law to collect certain information - for example, identity and verification information needed for anti-money-laundering checks - providing it is a statutory requirement. If you do not provide it, we will not be able to take you on as a client or, in some cases, to continue providing services to you. For other information, providing it is a contractual requirement or is needed for us to respond to you; if you choose not to provide it, we may be unable to provide some or all of our services.

Information we receive from other sources

We may also receive your personal data from third parties - for example, from your employer or from identity-verification and screening providers we use for our compliance checks.

How do we use the information?

We use your information in line with Data Protection Regulation. In short, this means we only use it where we have a legal basis to do so. These are the general legal bases on which we use your information:

• Consent - you have given clear consent to us to process your personal information.

• Our contract - processing your personal information is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract.

• Legitimate interests - processing your personal information is necessary for our legitimate interests or those of a third party. Our legitimate interests include keeping our systems and our clients’ data secure, preventing fraud, recovering debts owed to us, developing our business, marketing our services, and operating our business efficiently. You have the right to object to processing based on legitimate interests - see Your choices and rights below.

• Legal obligation - processing your personal information is necessary for us to comply with the law and our regulatory obligations, including anti-money-laundering requirements.

We do not make any decisions about you based solely on automated processing which would produce legal or similarly significant effects on you - our staff review all significant decisions.

At a glance: what we collect, why, and our lawful basis

As a business-to-business firm, the personal data we handle mainly consists of professional contact information about individuals at our clients, prospective clients and suppliers. Here are some reasons we process your personal information:

Sharing your information

We may share your personal information with the following categories of third parties, including:

• Professional service providers - firms that support the running of our business, such as our accountants, auditors, lawyers, payment processors, and HR and compliance consultants.

• Software and technology providers - the systems we use to operate, for example: Microsoft 365 (productivity and collaboration), Google Workspace (productivity and collaboration), Salesforce (CRM), Mailchimp, Zoom, Calendly and Global Relay (communications and record-keeping), Monday.com (workflow), Squarespace (website hosting), and Google and LinkedIn Analytics (website analytics). These providers may use their own subcontractors (for example, for hosting or email delivery).

• AI tools - we use artificial intelligence tools (including Anthropic, OpenAI) to assist our staff with business activities, and some of our software providers embed AI features in their products.

• Our affiliate companies

• Companies that assist with our marketing and promotional activities

Finally, we may also disclose your personal information to third parties in certain exceptional circumstances as follows:

• if we are required by any applicable law, regulation or law enforcement organisation to do so;

• in order to enforce or apply our terms of service or any other agreement or to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity;

• to protect the rights, property, or safety of Grey Epoch Portfolio Management Limited and its affiliated companies, our customers or other persons. This may include exchanging information with other organisations for the purposes of fraud protection and credit risk reduction;

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets; or

• if Grey Epoch Portfolio Management or substantially all its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.

We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 are of a particular gender, aged under 30 and have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to that target audience.

Transfer of Information

Our business may require us to transfer your personal data to countries outside of the European Economic Area (“EEA”), outside of the UK or your country of origin, including to countries that may not provide the same level of data protection as your home country. An example of this is the need to transfer your information to our parent company Grey Epoch LLC, which is based in the USA. This transfer would be made, for example, so that we can fulfil a contract with you, or in line with our legitimate interests.

We take reasonable steps to ensure that recipients of your personal data remain subject to the same standards as are set out in the Data Protection Regulation; however, there is no way for us to guarantee this in practice. Therefore, we cannot guarantee that if we transfer your data outside your country of origin, the UK or EEA, that it will be protected to equivalent standards as those inside your country of origin, the UK or EEA.

By doing business with us, you recognise that your personal data may be transferred outside your country of origin, and consent to such a transfer (including outside the EEA or UK), and you acknowledge that as a result you may not enjoy the same levels of protection of your data as if that data had not been transferred.

How long we store your data for

Recordings and electronic communications may be kept for at least 5 years after our business relationship ends - and up to 7 years where regulation requires. We retain other categories of personal data only for as long as necessary, with retention periods based on the purpose of the processing, our legal and regulatory obligations, and the limitation periods for legal claims. When personal data is no longer required, we securely delete or anonymise it.

Your choices and rights

Marketing - we will only send you direct marketing where the law allows - with your consent or, for business contacts, where we have a legitimate interest in telling you about our services, and you have not objected. You can opt out at any time. If you have given consent and change your mind, you can withdraw it at any time by using the unsubscribe link in any marketing email or by contacting us at dpo@greyepoch.com. Withdrawing consent does not affect any other processing described in this policy, or the lawfulness of anything done while your consent was in place.

Your rights - you can contact us at dpo@greyepoch.com at any time to ask us to:

• provide you with a copy of the personal data we hold about you, free of charge;

• correct any personal information that is out of date or inaccurate;

• delete personal information we hold about you;

• restrict the way we process your personal information;

• object to our processing, including processing based on our legitimate interests; or

• provide your personal information to you or another provider in a portable format.

How we handle requests - we will respond within one month. If your request is complex, or you have made several requests, we may extend this by up to two further months and will tell you why. If we reasonably need clarification to respond effectively, we may ask for it, and the time until we receive your answer does not count towards the response period. We may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded or excessive.

These rights are not absolute - in some cases the law allows or requires us to refuse a request. In particular, for compliance, we must keep certain records (such as telephone and electronic communications, identity verification and transaction records) for a minimum period, even if you ask us to delete them. Where this applies, we will tell you, explain which data we must keep and why, and delete anything we are not required to retain. If you ask us to stop holding or processing information we need to perform our contract with you, we may no longer be able to continue providing our services, and we will discuss what this means for our engagement with you before acting on your request.

Third-party websites

Our Services may, from time to time, contain links to websites operated by third parties. We do not accept any responsibility or liability for the policies of third-party websites that are linked to from our website.

Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We don’t endorse or accept any responsibility for the content of those third-party websites or third-party terms and conditions or policies.

Contact us

Questions, comments and requests about this privacy policy or how we handle your personal information should be emailed to our Data Protection Contact at dpo@greyepoch.com or sent in writing to the address in the “Our Contact Details” section above.

Complaints

If you have a concern about how we have handled your personal data, you can make a complaint by emailing dpo@greyepoch.com with “complaint” in the subject line. We will acknowledge your complaint within 30 days and respond without undue delay, taking appropriate steps to investigate and address it. If you are not satisfied with our response, or at any time, you have the right to complain to the Information Commissioner’s Office (the ‘ICO’) at https://ico.org.uk/.