PRIVACY STATEMENT
Intoduction
Thompson Lane & Co Limited (the Company), needs to keep and process information about you for normal business purposes.
The Company is registered with the UK’s Information Commissioners Office.
Following the UK’s exit from the European Union, the previous GDPR provisions form part of retained law as well as amendments made by DP exit regulations under the European Union (Withdrawal) Act 2018.
The DPA 2018 and Privacy and Electronic Communications Regulations (PECR) continue to apply.
The statement is relevant to all aspects of the Company’s business activities including the establishment
and management of customer relationships, retention of data and the processing of transactions.
You have several rights regarding your personal data and this document explains the types of data that the Company holds, the reasons for requesting it, and the purposes for which data is used.
The Company will keep and use data to enable it to run the business and manage the relationship with you effectively, lawfully, and appropriately, during the account on-boarding process, whilst you are a client, and when your relationship with the Company ends.
This includes using information to enable the Company to comply with its regulatory and statutory obligations and to execute the Company’s contract with the client.
The Company’s lawful basis for collecting and processing of client data are: Contractual, Legal Obligation (regulatory and statutory), Legitimate Interest, and Consensual.
The Company may sometimes need to process a client’s data to pursue legitimate business interests, for example to prevent fraud, administrative purposes, or reporting potential crimes and to protect the Company’s legal position in the event of legal proceedings.
If a client does not provide this data, the Company may be unable, in some circumstances, to comply with its obligations and the client will be informed about the implications of that decision.
Much of the information that the Company holds will have been provided by the client, but some may come from other sources, such as identity verification services.
The type of information the Company holds includes:
• Application forms and supporting documents
• Contracts and any amendments
• Correspondence with or about you (e.g., e-mails)
• Information needed for executing services
• Contact details
• Records of transactions
• Information needed for compliance monitoring
• Audit trails
• Complaints records
• Clients will inevitably be referred to in Company documents and records that are produced by Company personnel while carrying out their duties and the business of the company.
The Company holds its records, primarily in electronic form, however some records may be kept in paper or retrievable media format
When and how the company shares personal data and locations of processing
Thompson Lane & Co Limited (the Company) will only share personal data with others when legally permitted to do so. When data is shared with others, contractual arrangements and security mechanisms are put in place to protect the data and to comply with the Company’s data protection, confidentiality, and security standards. In common with other payments and foreign exchange service providers, the Company uses third parties (including banks and currency providers), some of whom are in other countries, to help us to deliver the services for clients.
As a result, personal data may be transferred to and from other than countries where the Company and its clients are located. This may include countries within, and outside of, the EEA, and include countries that do not have laws that provide specific protection for personal data.
The Company takes steps to ensure that all personal data is provided with adequate protection and that all transfers of personal data outside the UK are done lawfully. If the Company transfers personal data outside
of the UK to a country not determined as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the UK requirements for the transfer of personal data outside the UK, such as the ICO approved Standard Contractual Clauses (SSCs).
Personal data held by the Company may be transferred to:
• Other associates and associate firms of the Company. The Company may share personal data with other firms where necessary for administrative purposes and to provide professional services to clients
• Third party organisations that provide applications, functionality, data processing, or ICT services to the Company. Third parties support the Company in providing services and infrastructure to help provide, run, and manage the Company’s internal ICT systems and on-line platform. For example, providers of information technology, cloud-based software, identity verification, website hosting and management, data analysis, data back-up, security, and storage services. The servers powering and facilitating the cloud infrastructure, and in which personal data is stored, are in secure data centres in Europe.
• Third party organisations that otherwise assist in providing goods, services, or information
• Auditors and other professional advisers
• Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation. Occasionally, requests may be received from third parties with authority to obtain disclosure of personal data, such as to check compliance with applicable law and regulation, to investigate an alleged crime, to establish, and / or to exercise, or defend, legal rights.
Requests for personal data are only fulfilled if the Company is permitted to do so in accordance with applicable law or regulation If the Company is processing data based on your explicit consent (e.g., for marketing purposes), you have the right to withdraw that consent at any time, however, there may be certain circumstances where data must be retained. Opting out of marketing activity is not one of these criteria.
Other than as mentioned below, the Company will only disclose information about you to third parties if legally obliged to do so or where the Company needs to comply with its contractual duties to you. In limited, and necessary, circumstances, your information may be transferred to, or from, outside of the
UK, including the EEA, or to an entity in another jurisdiction to comply with legal or contractual requirements. The Company puts in place safeguards including service level agreements, and, if appropriate SSCs, to ensure the security of your data.
Your personal data will be retained following your last transaction with the Company, or termination of your contract with the Company, for a period in accordance with the Company’s legal obligations and the purpose for which it was originally collected. If in the future, the Company intends to process your personal data for a purpose other than that for which it was collected, you will be provided with information on that purpose and any other relevant information.
Your Rights
Under the UK’s data protection rules you have several rights regarding your personal data:
• You have the right to request from the Company, access to, and rectification or erasure of, your personal data
• The right to restrict processing, and object to processing
• In certain circumstances, the right to data portability
If it has been necessary for you to provide consent for the processing of your data, you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.
You have the right to lodge a complaint to the Information Commissioner’s Office (ICO) if you believe that the Company has not complied with the requirements of the UK’s data protection legislation regarding your
personal data.
Identity and Contact Details of Controller and Data Protection Officer
Thompson Lane & Co Limited is the controller and processor of data for the purposes of the UK’s data protection legislation.
If you have any concerns as to how your data is processed, you can contact:
The Company’s Data Protection Officer is Paul Thompson who can be contacted at
paul.thompson@thompsonlane.co.uk or by post at the address of the Company.
Changes to this Privacy Policy
The Company recognises that transparency is an ongoing responsibility, so this privacy statement is kept under regular review and will be updated when affected by material changes in data protection legislation or the Company’s activities or processes
Data Controller and Contact Information
The data controller is Thompson Lane & Co Limited with its registration address at
If you have any questions about this privacy statement or how and why the Company processes personal data, please contact the data protection officer at: info@currencymatters.co.uk, by telephone on +44 (0)1695 581669, or in writing to Thompson Lane & Co Limited, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ