Ithaka Group Privacy Notice

This Notice is issued by Ithaka Trust Company Limited and applies to all companies and other entities, whether or not incorporated, that may form part of Ithaka Group from time to time, including but not limited to Ithaka Trust Company Limited, a company incorporated in Jersey under registration number 149900, and any other affiliated company or Subsidiary of Ithaka Trust Company Limited (“Ithaka Group”).

Ithaka Group is committed to protecting and respecting your privacy at all times.  Therefore, we respect and protect your right to privacy and will process your personal data in accordance with the provisions of the Data Protection (Jersey) Law 2018, the Data Protection Authority (Jersey) Law 2018 and the European General Data Protection Regulation (the “GDPR”, together the “Data Protection Legislation“)) and any other applicable privacy laws.

The Data Protection Legislation and any other applicable privacy laws apply to this Privacy Notice and anything not specifically mentioned in this notice shall be governed by the Data Protection Legislation and any other applicable privacy laws.

This Privacy Notice explains how we may use, process and store your personal data.

In accordance with the Data Protection Legislation, all organisations established in Jersey who process personal data are required to be registered with the Jersey Office of the Information Commissioner (“JOIC”).

Each registered entity for which Ithaka Group provides services and holds personal data is also required to be registered with the JOIC.

The registration fee payable under the Data Protection Legislation is payable by each registered entity in accordance with section 11 of the Ithaka Group Terms and Conditions of Business regarding Data Protection: “11.15 All reasonable costs and expenses incurred by Ithaka in the performance of its obligations under Clause 11 shall be paid for by the Customer”.

What is personal data?

Personal data is information that can identify a living individual from the information we hold on them.  This includes their name, address and contact details and may include individual’s IP addresses and online identifiers.  This is data which identifies an individual, even without a name associated with it, where it is processed to learn or record something about that individual.  Data may ‘relate to’ an individual in several different ways, such as

  • Information processed or held in electronic form – on a computer;
  • Information processed in a non-automated manner – paper records held in a filing system; and
  • Information that forms part of any accessible record – certain health records, educational records etc.

 

What kind of personal data do we collect?                                                           

We collect the following types of personal data:

  • names and contact information;
  • general demographic information (such as gender, age, date of birth, marital status, nationality, employment details, residence, utility bills, etc.);
  • personal identification documentation and related information such as passport numbers, national ID Card, driver’s licence and employee identification numbers;
  • source of wealth;
  • financial and payment data such as bank account numbers, bank statements and transaction information;
  • tax residency; and
  • information related to the provision of the services performed under the Letter of Engagement or per the services provided by the Customer to such individuals.

 

The list above is not exhaustive and Ithaka Group may also collect and process personal data to the extent this is useful or necessary for the provision of our services.

What is sensitive/special category data?

Under the Data Protection Legislation some data may be considered ‘sensitive’/’special category’ – this could be racial or ethnic origin, political opinion, religion, a membership of a trade union, health, genetic/biometric data or criminal activity.

How does Ithaka Group collect personal data?

Ithaka obtains and processes personal data in different ways.

  • Personal data provided to Ithaka Group directly:

 

We will collect personal data directly from all Customers including prospective Customers, and intermediaries for the purposes of entering into a contract or service agreement and/or to meet certain legal requirements.

  • Personal data obtained from third parties:

 

We will collect and process personal data from publicly accessible sources such as internal, social networks, compliance screening tool or commercial registers.  We may also receive personal data from third parties as part of the service we provide to you or in connection with legal requirements that are applicable to us.

How does Ithaka Group use personal data?

The majority of the personal data processed by Ithaka Group is necessary for the performance of a contract to which the data subject is a party or to comply with the request of the data subject prior to entering into a contract. Ithaka Group also processes personal data in order to comply with our legal and regulatory obligations.

We may furthermore process personal data for the purposes of the legitimate business interests pursued by Ithaka Group. Such legitimate interests include general research and development (including statistical research or as a basis to analyse our current security measures) or to develop and improve our services or to strengthen our relationship with you. We may provide you with communications or information regarding our service offering which we think will be interesting for you. When we process your personal data for our legitimate business interests, we will consider any potential impact on you and your rights under the relevant data protection and any other relevant law. Whenever we process personal data for these purposes you have the right to object to this way of processing.

Who does Ithaka Group provide personal data to?

Ithaka Group may disclose or transfer personal data collected by Ithaka Group to our group companies and/or Fairway Group insofar as reasonably necessary for the purposes of our service offering or for bona fide compliance purposes as well as on the legal basis as set out in this Privacy Notice.

Except as described in this paragraph, Ithaka Group will not disclose, transfer or sell your personal data to any third party unless you have consented to this.

The following is a list of potential recipients of data (in each case including respective employees, directors and officers):

  • Other members of the Ithaka Group;
  • Members of the Fairway Group;
  • Other providers of services (legal, governance or otherwise, including any bank or

financial institution providing services in relation to any matter on which the Ithaka Group is instructed) where disclosure to that provider of services is considered necessary to fulfil the purposes set out above;

  • Any sub-contractors, agents or service providers of the Ithaka Group;
  • Courts or tribunals;
  • Third parties with whom the Ithaka Group engages for the hosting of events or other

marketing initiatives;

  • Law enforcement agencies where considered necessary for the Ithaka Group to fulfil

legal obligations applicable to it;

  • Regulators or other governmental or supervisory bodies with a legal right to the material or a legitimate interest in any material;
  • Any registrar of a public register where the data is to be included in a public registry;
  • Potential parties with whom the Ithaka Group intends to merge or sell any part of the

Ithaka Group; and

  • Where the Ithaka Group is entering into an engagement with a third party pursuant to which data may be processed by that third party, we will seek to enter into an agreement with that third party setting out the respective obligations of each party and will seek to be reasonably satisfied that the third party has measures in place to protect data against unauthorised or accidental use, access, disclosure, damage, loss or destruction.

 

Ithaka Group may disclose or transfer personal data to subcontractors for the purpose of the proper performance of the services we provide to our Customers. It may, for example, disclose or transfer such personal data to third party service providers who provide administrative, computer, payment, data processing, screening debt collecting or other services. We enter into data processing agreements with such subcontractors to ensure that they process your data, on our behalf, with the same level of security and confidentiality as applied by Ithaka Group. Ithaka Group may furthermore disclose or transfer personal data when we received your consent to do so.

Ithaka Group may also disclose or transfer personal data collected by Ithaka Group, on a confidential basis, to a prospective assignee or transferee in accordance with the Terms and Conditions.

In addition, Ithaka Group may disclose or transfer personal data to protect our rights or those of our Customers and/or to prevent fraud. Ithaka Group can also be obliged to disclose or transfer personal data to competent authorities in order to comply with our legal and/or regulatory obligations.

International transfers and data storage

Ithaka Group may disclose or transfer personal data to other companies of the Ithaka Group that are located in countries that are outside the European Economic Area (“EEA”) in connection with the above purposes.

The personal data Ithaka Group processes is stored by Ithaka Group on our servers, and/ or on the servers of the cloud-based database management services Ithaka Group engages.

If disclosure or transfer of personal data is undertaken in a country that does not ensure an adequate level of protection of your personal data, Ithaka Group will make sure additional safeguards are put in place.

Record Retention

Ithaka Group will process and store the relevant personal data for the duration of our services or for the duration of the business relationship. Ithaka Group may also continue to store the data for as long as it is necessary or required in order to fulfil legal, regulatory, contractual or statutory obligations and, or for the establishment, exercise or defence of legal claims, and in general where it has a legitimate interest for doing so.

Your rights

You have the following rights:

  • Access to your information

You have the right to access the personal information that Ithaka Group holds about you at any time.

  • Data portability

You may ask Ithaka Group to provide you with a copy of the personal information that Ithaka Group holds about you.

  • Correction of your personal information

You have the right to ask Ithaka Group to update and correct any out-of-date or incorrect personal information that we hold about you.

  • Deletion of your personal information (the right to be forgotten)

You have the right to ask Ithaka Group to delete your personal information, to the extent that Ithaka Group has no legal and/or regulatory obligations to keep such personal information.

  • Restriction of processing of your personal information

You have the right to ask Ithaka Group to restrict the processing of your personal information in case:

  1. You contested the accuracy of the personal information held by Ithaka Group;
  2. The processing is unlawful but you objected to the deletion of the personal data and requests the restriction of the use instead;
  3. Ithaka Group no longer needs the personal data for the purposes of the processing, but you require them for legal reasons; and
  4. You objected to processing and Ithaka Group is investigating whether there are legitimate grounds to override your objection.

 

Automatic decision making

Ithaka Group generally does not make decisions by purely automatic means, but if we do, you have the right to object.

Your right to object to the processing of your personal data

You have the right to object at any time to the processing of your personal data for any direct marketing (and related profiling) by Ithaka Group.

If you wish to exercise the above right, you can contact Ithaka Group using the below contact details.

In addition, you have the right to make a complaint to the local supervisory authority with respect to the way Ithaka Group is processing your personal data or the way Ithaka Group is handling your rights.

Navigations and Cookies

We may collect information about your computer, including your IP address, operating system and browser type, for system administration and in order to create reports. This is statistical data about our users’ browsing actions and patterns and does not identify any individual.

We use Google Analytics, a web analytics tool that helps website owners understand how visitors engage with their website. Google Analytics customers can view a variety of reports about how visitors interact with their website so that they can improve it.

Like many services, Google Analytics uses first-party cookies to track visitor interactions as in our case, where they are used to collect information about how visitors use our site. We then use the information to compile reports and to help us improve our site.

Cookies contain information that is transferred to your computer’s hard drive. These cookies are used to store information, such as the time that the current visit occurred, whether the visitor has been to the site before and what site referred the visitor to the web page

Google Analytics collects information anonymously. It reports website trends without identifying individual visitors. You can opt out of Google Analytics without affecting how you visit our site – for more information on opting out of being tracked by Google Analytics across all websites you use, visit this Google page.

 

We use HubSpot, a web analytics service provided by HubSpot Ltd. HubSpot uses cookies to help website operators analyse data about how users use the website and to track and report on any leads that have been generated through the website. Any information created by the cookie about your use on the website (including your IP address) will be transmitted to and stored by HubSpot on servers in the European Union. HubSpot will use this information to evaluate your use on the website, social media activity, compile reports as well as providing other services relating to website activity.

HubSpot may transfer this information to third parties where required to do so by law, or where such third parties process the information on Ithaka’s behalf. HubSpot will not associate your IP address with any other data held by Ithaka. By using Ithaka’s website, you consent to the processing of data about you by HubSpot for the purposes set out above.

You may block cookies by selecting the setting on your browser that allows you to refuse the setting of all / some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Children

Ithaka Group’s website is not directed at, nor do we knowingly collect personal data from people under the age of 18 years old.

How we protect personal data

Ithaka Group is committed to ensuring the security of your personal data. Ithaka Group takes appropriate commercially reasonable technical, physical and organisational measures to prevent unauthorised or unlawful processing of your personal data or accidental loss or destruction of your personal data. Ithaka Group will ensure a level of security suitable to the identified risks and pursuant to the Data Protection Legislation and any other applicable privacy laws and, where the Processing concerns personal data of EU residents, shall take measures required pursuant to Article 32 GDPR.

Employees of Ithaka Group are trained to handle personal data securely and with utmost respect and they will treat your personal data as strictly confidential. Staff members shall be authorised to access personal data only to the extent necessary to serve the applicable legitimate purposes for which the data is held and processed for by Ithaka Group.

Ithaka Group will not divulge Customer information to a third party, other than Fairway, unless we have received explicit Customer authorisation to do so or we are required to do so by law.

Changes to this notice

Ithaka Group may update this Privacy Notice from time to time. We advise you to periodically review this Privacy Notice to be informed of how Ithaka Group is protecting your privacy.

Contact Ithaka Group

If you have any questions, concerns or complaints with respect to this Privacy Notice, the way Ithaka Group is handling your privacy or you wish to exercise any of your rights please contact: enquiries@ithakatrust.com

Please note that Ithaka Group is not always required to provide details of all data held and may charge a fee (where permitted by law) to cover reasonable costs of retrieval.

Consent

By consenting to this privacy notice you are giving us permission to process your personal data specifically for the purposes identified above.  Consent is required for Ithaka Group to process both types of personal data, but it must be explicitly given.  Where we are asking you for sensitive/special category personal data we will always tell you why and how the information will be used.

You may withdraw consent at any time by contacting Ithaka Group, as detailed above.

The sources of data may include intermediaries, Customers, data subjects directly, third parties connected to the data subject (for example, their employer or another service provider who provides services to the data subject).

January 2024