Privacy Notice

Verix Advisory Limited is committed to protecting the privacy, confidentiality and security of personal information.

This Privacy Notice explains:

• what personal information we collect;
• how and why we use it;
• the lawful bases on which we rely;
• who we may share it with;
• how long we retain it;
• how we protect it;
• whether it may be transferred outside the United Kingdom; and
• the rights available to individuals under UK data-protection law.

This Privacy Notice applies to personal information obtained through our website, professional-services activities and business operations.

It applies to information relating to:

• website visitors;
• clients and prospective clients;
• individuals associated with corporate clients;
• business contacts;
• suppliers, subcontractors and professional advisers;
• event and forum participants;
• employment, consultancy and associate applicants;
• current and former employees, workers, consultants and associates;
• individuals whose information we receive while delivering professional services;
• individuals who contact us or make enquiries; and
• other people with whom Verix has a professional or business relationship.

Additional privacy information may be provided where a particular service, investigation, recruitment exercise, event, digital platform or data-processing activity requires more specific information.

Verix Advisory Limited ("Verix", "we", "us" or "our") is a private limited company registered in England and Wales under company number 17232940.

Our registered office is:

Verix Advisory Limited is registered as a data controller with the Information Commissioner’s Office (ICO), registration number ZC199640.

For the processing described in this Privacy Notice, Verix will normally act as the data controller. This means that we determine why and how personal information is processed.

In some professional engagements, Verix may act as a data processor on behalf of a client. Where that applies, the client will generally remain responsible for determining the purposes and means of processing, and our processing will be governed by the relevant engagement terms and data-processing agreement.

Questions about this Privacy Notice or our use of personal information may be submitted through the contact form or contact details published on our website. Written correspondence may also be sent to our registered office and marked for the attention of the Data Protection Lead.

Personal information is information relating to an identified or identifiable living individual.

It may include information that identifies someone directly, such as their name or email address, as well as information that could identify them when combined with other information.

Certain information receives additional protection under data-protection law. This includes special-category information concerning matters such as health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric information, sex life or sexual orientation.

Information concerning criminal allegations, offences, convictions and related security measures is also subject to additional legal requirements.

We will only process special-category or criminal-offence information where it is necessary, proportionate and supported by an appropriate lawful basis and additional legal condition.

Depending on your relationship with Verix, we may collect and process the following categories of personal information.

We may obtain personal information:

• directly from you;
• from your employer or organisation;
• from our clients;
• from suppliers, subcontractors and professional advisers;
• from referees and recruitment agencies;
• from government, regulatory or law-enforcement bodies;
• from public registers and official records;
• from publicly available professional sources;
• from sanctions, compliance and due-diligence databases;
• through our website, forms and digital services;
• through correspondence, meetings and events;
• through cookies and similar technologies; and
• from other parties where disclosure is lawful and relevant to our activities.

Where we obtain information from someone other than the individual concerned, we will provide appropriate privacy information unless an applicable legal exemption applies.

We may use personal information for the following purposes.

Depending on the processing activity, we may rely on one or more of the following lawful bases:

Where we process special-category information, we will identify both:

• a lawful basis under UK GDPR Article 6; and
• an applicable condition under UK GDPR Article 9 and the Data Protection Act 2018.

Depending on the circumstances, this may include processing necessary for:

• employment and social-protection obligations;
• legal claims;
• substantial public-interest conditions;
• equality monitoring;
• safeguarding; or
• explicit consent.

Where we process criminal-offence information, we will do so only where authorised by law or where an appropriate condition under the Data Protection Act 2018 applies.

Where required, we will maintain an appropriate policy document governing such processing.

Where information is required to enter into or perform a contract, comply with a legal requirement, complete due diligence or deliver a service, failure to provide it may mean that we cannot:

• accept an instruction;
• provide the requested service;
• enter into a contract;
• make a payment;
• consider an application;
• permit participation in an event; or
• continue a business relationship.

We will explain where providing information is mandatory and the likely consequences of not providing it.

We may share personal information where necessary and lawful with:

• clients and organisations instructing us;
• individuals authorised by a client;
• employees, directors, workers, consultants and associates;
• suppliers and subcontractors supporting our services;
• website, hosting, cloud, communications and IT providers;
• payment, accounting and professional-services providers;
• lawyers, accountants, auditors, insurers and other advisers;
• recruitment agencies and referees;
• event venues and service providers;
• regulators and professional bodies;
• courts and tribunals;
• law-enforcement, government and public authorities;
• prospective purchasers, investors or advisers involved in a corporate transaction; and
• other recipients where you have authorised disclosure or the law permits or requires it.

We do not sell personal information.

Where a service provider processes information on our behalf, we will use appropriate contractual and security arrangements.

Where we act as a processor for a client, disclosures will be made in accordance with the client's lawful instructions and the applicable contractual arrangements.

Some suppliers or digital-service providers may process or make personal information accessible outside the United Kingdom.

Where this constitutes a restricted international transfer, we will use an appropriate transfer mechanism, which may include:

• transfer to a country covered by UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally recognised safeguard; or
• a relevant statutory exception where its conditions are met.

Where required, we will undertake an appropriate transfer-risk assessment and apply additional safeguards.

Information about relevant safeguards may be requested using the contact details in this Privacy Notice.

We use appropriate technical and organisational measures intended to protect personal information against:

• unauthorised or unlawful access;
• accidental loss;
• destruction;
• alteration;
• inappropriate disclosure; and
• other unlawful processing.

Measures may include:

• access controls;
• identity and authentication controls;
• encryption where appropriate;
• secure cloud and storage arrangements;
• device and endpoint protection;
• backup and recovery measures;
• supplier due diligence;
• confidentiality obligations;
• policies and procedures;
• staff and contractor training;
• incident-management arrangements; and
• periodic review of security controls.

Access is restricted to people who reasonably require the information for an authorised purpose.

No internet transmission or information system can be guaranteed to be completely secure. We will respond to suspected personal-data breaches in accordance with our legal obligations.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, contractual, accounting, insurance and professional requirements.

Retention periods vary according to:

• the nature and sensitivity of the information;
• the purpose of processing;
• the duration of the relationship or engagement;
• contractual obligations;
• limitation periods;
• legal and regulatory requirements;
• the likelihood of a complaint, claim or investigation; and
• the need to establish, exercise or defend legal rights.

Typical retention arrangements may include:

• unsuccessful recruitment records: normally up to 12 months after the recruitment process, unless a longer period is justified or agreed;
• marketing records: while the relationship or subscription remains active and for a reasonable period afterwards, with suppression records retained to respect opt-outs;
• website enquiries: for as long as needed to answer and administer the enquiry and maintain an appropriate business record;
• client and engagement records: normally for the engagement period and an appropriate period afterwards, commonly six years or longer where required by law, contract, insurance, security or the nature of the work;
• supplier and financial records: normally for the relationship and the applicable statutory accounting period; and
• investigation, legal or complaint records: for as long as necessary in light of the matter, relevant limitation periods and any continuing legal or regulatory requirement.

We may retain limited information for longer where necessary to preserve evidence, maintain a suppression record or comply with legal obligations.

When information is no longer required, it will be securely deleted, anonymised or placed beyond operational use in accordance with our retention arrangements.

Verix does not ordinarily make decisions producing legal or similarly significant effects about individuals solely through automated processing.

We may use data analytics or automated tools to assist research, risk assessment, due diligence or fraud detection. Such tools are intended to support, rather than replace, appropriately informed human judgement.

Where we introduce solely automated decision-making that produces legal or similarly significant effects, we will provide any additional information and safeguards required by law.

Depending on the circumstances, you may have the right to:

Some rights are subject to legal conditions, exemptions and the rights of other people.

Requests may be submitted through the contact details on our website or sent to our registered office for the attention of the Data Protection Lead.

Please provide sufficient information to enable us to understand and respond to your request.

We may ask for evidence of identity or authority where reasonably necessary to protect personal information.

We normally respond within one month. The period may be extended where a request is complex or numerous, in which case we will explain the extension.

We do not ordinarily charge a fee. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive.

We encourage you to contact us first so that we can consider and address your concern.

You also have the right to complain to the UK supervisory authority:

Current contact and complaint information is available through the Information Commissioner's Office website.

Our website and professional services are directed principally at organisations and adult professionals.

We do not knowingly use the website to collect personal information directly from children for marketing purposes.

We may process information relating to children where it is necessary and lawful in connection with a professional engagement, safeguarding matter, recruitment-related family information, event or other legitimate activity.

Where this occurs, we will apply appropriate safeguards reflecting the nature of the information and the interests of the child.

Our website may contain links to websites operated by third parties.

We do not control those websites and are not responsible for their privacy practices. You should read the privacy information provided by the relevant third party before supplying personal information.

We may update this Privacy Notice to reflect changes in:

• our services and operations;
• the information we process;
• legal or regulatory requirements;
• technology;
• guidance; or
• our policies and procedures.

The latest version will be published on our website with the date of the most recent update.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals.

Questions, concerns and rights requests may be submitted using the contact details or contact form published on the Verix website.

Written correspondence may be sent to: