Introduction
Mina Asset Management Limited (“we”, “our”, “us”) is committed to protecting your privacy and ensuring transparency about how we collect, use, and share your personal data when you engage with our services or visit our website.
This Privacy Notice describes how Personal Data must be collected, handled, stored, disclosed and otherwise “processed”. Personal data is any information which identifies an individual person. It does not include personal data where the identity has been removed, this is known as anonymous data.
This Privacy Notice explains our practices in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Irish data protection laws, and ePrivacy requirements.
References to “you” or “your”, within this Notice, are with regard to individuals whose personal data we process in connection with the provision of our services.
Scope of This Notice
This Privacy Notice applies to current or previous clients, prospective clients and/or any associated parties. It is important that you read this Privacy Notice and show it to anyone else who is named under your portfolio of investments as it also applies to them.
In relation to any information we collect about you and any information we process in relation to you as described herein, we are the data controller. There may also circumstances where we process your personal data as a data processor and such processing activities fall outside the scope of this Privacy Notice.
We shall process personal data lawfully, fairly and in a transparent manner.
How Do We Receive Your Information?
We may receive information about you from one or more of the following sources:
- directly from you:
- when you use our products and services;
- through your use of our website;
- when you make an enquiry;
- through our telephone calls or video calls with you, which may be recorded;
- from third party sources, including:
- our group companies;
- through companies which validate identity for financial crime purposes using tools such as the electoral register (this is not a credit check, but a record of the search may be retained);
- from publicly available sources, such as third party registers maintained by regulators;
- from a third party acting on your behalf;
- from other organisations such as your employer, an organisation that you are a director/partner/ member of and/or fund administrators or other service providers.
What Information Do We Collect From You?
We collect and maintain Personal Data about you, and about any person or entity on whose behalf you are acting, that you provide to us, such as when you obtain a product or service from us, request information or materials from us, or otherwise interact with us or our Website. The types of Personal Data we collect vary based on your particular interaction with us, but could include:
- Personal details: names; date of birth / age; nationality; identity card or passport;
- Contact details: address; telephone number; email address;
- Employment details: such as industry; role; business activities;
- Anti-money laundering (“AML”) data, such as documentation to verify identity (including identification documents, which may include photographic identification and signatures and other official and documentation on request), documentation to verify address (including bank statements, utility bills, other official documentation on request), source of wealth and source of funds, details for conducting politically exposed persons, adverse media reports and similar;
- Account number and other account information;
- Username, password, and other security credentials;
- Tax identification number/national insurance number, and bank account and payment method details, if such information is needed for the purpose of administering your accounts;
- Sensitive personal data (notably data on criminal and administrative proceedings and sanctions, screening against government, supranational bodies, including but not limited to the European Union and the United Nations Security Council, and/or law enforcement agency sanctions lists as well as internal sanctions lists and other legal restrictions) only where the processing is necessary for the purpose of complying with regulatory and/or legal obligations;
- Interactions with our website and mobile applications such as your Internet Protocol (IP) address which indicates the location of your computer, your browser type and language;
- Records of communications and correspondence including phone and video recordings;
- Opinions, comments and feedback which you choose to share with us; and
- Any other personal information that you choose to share with us during communications.
We will only collect information that is adequate, relevant, and limited to what is necessary in relation to the purposes identified within this Privacy Notice.
What Information Do We Collect About Third Parties?
We may collect information from you regarding other individuals related to your account. Where you disclose information about authorised signatories, employees, agents, or other representatives as outlined above, you warrant that you will only do so in accordance with applicable data protection laws; that you will ensure that before doing so, the individuals in question are provided with a copy of this Privacy Notice and made aware of the fact that we will hold information relating to them and may use it for any of the purposes set out in this Privacy Notice. Where necessary, you will obtain the other individuals’ consent to our collection, use, and disclosure of their information as described in this Privacy Notice. We may, where required under applicable law, notify those individuals that they have been provided with their Personal Data and provide a copy of this Notice to them.
Purposes for Processing
We set out below provides examples of the purposes for which we process personal data and the lawful basis we rely on under Article 6, Article 9 and Article 10 of GDPR and the Irish Data Protection Acts 1988 to 2018 as amended. Please note that this is an indicative, non-exhaustive list.
| Process | Purpose of processing | Lawful basis for processing |
|---|---|---|
| Client onboarding and due diligence | If you are a client, a prospective client or a representative of a client, we process your personal data as part of our due diligence and on boarding processes. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (f) – Legitimate interests Article 6 (1) (c) – Compliance with a legal obligation |
| AML checks | If you are a client, a prospective client or a representative of a client, we process your personal data to comply with on-going legal obligations on anti-money laundering and counter terrorist financing, taxation, crime-detection, crime prevention, investigation, the prevention of fraud, bribery, anti-corruption, tax evasion. | Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Suitability assessments | If you are a client, and you share with us your circumstances and needs, we will use this to help support and tailor services to you. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Delivery of client services | If you are client, a prospective client or a representative of a client, we process your personal data for the purpose of delivering a service to you/the client, for the purpose of maintaining appropriate business records, including maintaining appropriate registers required under applicable law and regulation, for the purpose of quality control, business and statistical analysis, market research, for the purpose of tracking fees and costs, for the purposes of invoicing clients and updating client contact details and for the purpose of customer service, provision of regulatory updates, corporate updates, training, and related purposes. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Maintaining client relationships | If you are client, a prospective client or a representative of a client for the purpose of maintaining our ongoing relationship with you, such as via correspondence and calls, and in connection with the administration of our relationship with you. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Recording of telephone and video calls | Telephone and video calls with you may be recorded for the purposes of record keeping, security and training. Such recordings may be used as evidence in the event of a dispute or as evidence in court. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Regular Communications | We use your personal data to communicate with you and provide you with information. | Article 6 (1) (b) – Performance of a contract Article 6 (1) (c) – Compliance with a legal obligation Article 6 (1) (f) – Legitimate interests |
| Handling complaints, queries and legal claims | We use your personal data to respond to complaints, legal claims, data breaches or data protection rights requests. | Article 6 (1) (c) – Compliance with legal obligation Article 6 (1) (f) – Legitimate interests Article (9) (2) (f) – Legal claims or judicial acts |
| Regulatory and internal compliance | We process your data to comply with regulatory audit and reporting requirements, to monitor the use of our copyrighted materials and to comply with internal policies and procedures. | Article 6 (1) (c) – Compliance with legal obligation Article 6 (1) (f) – Legitimate interests |
| Cookies and technical data | If you are a user of our website, we collect, through our technology security services, traffic and security reports, information and activity logs on the usage of our systems and services. We also collect, analyse and report on technical information about the services that you interact with when visiting our websites, applications and online advertisement. For more information, please see our Cookie Notice. | Article 6 (1) (a) – Consent Article 6 (1) (f) – Legitimate interests |
Recipients of Data
We share your Personal Data with third parties (including our agents, service providers and other group companies) who are required to maintain the confidentiality of this information. Any transfer of personal data is based on a lawful basis, and we will only engage third parties that have appropriate technical and security measures in place.
We do not undertake marketing activities for third parties, nor do we provide information to third parties for their own marketing purposes.
The following categories of recipients may receive your personal information and process it for the purposes outlined in this Privacy Notice:
- Our group companies (for example, to satisfy our anti-money laundering requirements and account opening purposes);
- Third party companies, agents, contractors, service providers or related companies (including payment processors) if this is necessary to provide you with our products and services, respond to your enquiries or for any other related purposes;
- Our service providers who act only on our instructions (e.g. service and software providers, IT and hosted services, compliance monitoring services) including their sub-contractors;
- Our professional advisors (e.g. suppliers, professional advisors, solicitors, auditors, insurers);
- Analytics and search engine providers that may assist us in the improvement and optimisation of our website and mobile applications;
- Statistics and research providers;
- Third parties who support our information technology or handle mailings or events on our behalf;
- Parties to a complaint or internal investigation where required;
- Law enforcement agencies, other governmental agencies or third parties if we are required by law to do so, or in other limited circumstances (for example if required by a court order or regulatory authority, or if we believe that such action is necessary to prevent fraud or cyber-crime or to protect our website, our technology assets or the rights, property or personal safety of any person);
- Other business entities should we plan to merge with or be acquired by that business entity, or if we undergo a re-organisation with that entity;
- Any successor in interest, in the event of our liquidation or administration;
- Government departments, bodies or agencies, any court or tribunal or government, regulatory, law enforcement, fiscal or monetary authority or agency (for example, the Irish Revenue, the Gardai (Irish police), the Central Bank of Ireland and the Data Protection Commissioner’s Office);
- Prospective buyers or sellers.
Some of these third-party recipients will process your personal data on our behalf as data processors. Others will determine the purposes and means of processing of your personal data as data controller and may be permitted to disclose your personal data to other parties in accordance with applicable law.
International Transfers
Personal information in our possession may be transferred to countries and jurisdictions which are outside Ireland (such as the European Union, United Kingdom, and the United States). These may be where your investments are held, where transactions are effected, from where you receive or transmit information about your investments and where underlying managers conduct their activities.
These countries and jurisdictions may have differing (and potentially less stringent) laws relating to the protection of personal information. They may also have less stringent laws relating to the degree of confidentiality afforded to your information.
Information can become subject to the laws and disclosure requirements of such territories, including disclosure to governmental bodies, regulatory agencies and private persons as a result of applicable governmental or regulatory inquiries, court orders or other similar processes.
We will implement appropriate measures to ensure that your personal data remains protected and secure when it is transferred outside of the EEA, in accordance with applicable data protection and privacy laws. These measures include:
- Adequacy Decisions: We will ensure that the specific country provides an adequate level of protection to data privacy as approved by the Irish EU data protection authorities; or
- Standard Contractual Clauses: We will put in place a data transfer agreement with the recipient of the information using the contractual wording as approved by the Irish and EU data protection authorities; or
- Other transfer mechanism: We will utilise any other transfer mechanism approved by the European Commission (e.g. a EU-US data privacy framework).
For further information about any such transfers, please contact us using the details outlined in this Notice.
Data Retention
The duration for which we retain your personal data will vary depending on the type of personal data and our reason for collection and processing. We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. To determine the appropriate retention period for personal data, we consider the following:
- the volume of personal data
- the nature, and sensitivity of the personal data
- our obligations and legal requirements to retain your personal data
- the purpose of processing your personal data
- the risk of unauthorised use or disclosure of your personal data
In addition, we will retain your data as long as legal claims arising from our relationship are enforceable (typically six years, inter alia as per Ireland’s Statute of Limitations Act 1957). This retention will occur only if litigation becomes apparent or until the final resolution of an incident or court proceedings. Such processing is based on our legitimate interests in establishing, exercising, or defending legal claims.
Where We Share Data with Our Group Companies
Our group companies may retain the information we share with them for such period as may be required from time to time under relevant laws and regulations, including those relating to record keeping and prescription periods. Such information may be retained after your account has been closed, and for customer identification purposes in accordance with their record keeping policy.
Security of Personal Data
We will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, we will contact you in line with our legal obligations. Access to your personal data will be restricted to those who need to use it for legitimate legal and business purposes.
We follow several industry good practices to ensure this protection is fully effective and the appropriate technical and organisational measures are in place. All personal data is provided protection in line with security and data protection policies.
All our employees and contractors receive mandatory information security and data protection training on being hired and subsequently on at least a yearly basis to ensure that they are aware of the security policies and their specific information security responsibilities. This also ensures that they are properly equipped to perform their duties in maintaining our security posture.
Consent
We sometimes need your consent to do certain things, in order to provide you suitable investment and portfolio management services.
When you consent, we will: (a) be clear when we are asking for your consent; (b) only use your information if you have freely given us your consent to use it; (c) not have any pre-ticked boxes on our forms; and (d) keep a record of your consent and how we got it.
You have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us in writing (see contact details below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
If you choose to withdraw your consent, we may not be able to provide you with certain products and services.
Data Protection Rights
GDPR and the Irish Data Protection Acts 1988 to 2018 as amended provide you, the data subject, with a number of rights when it comes to your personal data. On receipt of a valid request to invoke one of your rights, we will do our best to adhere to your request as promptly as reasonably possible.
Access: You have the right to request a copy of the personal data that we hold about you. There are exceptions to this right so that access may be denied if, for example, making the information available to you would reveal personal data about another person or if we are legally prevented from disclosing such information.
Accuracy: We aim to keep your personal data accurate, current, and complete. We encourage you to contact us to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up to date.
Objection: You have an absolute right to object to the processing of your personal data for direct marketing. Opting out of receiving marketing communications will not affect the processing of personal data for the provision of our services.
In other cases where the right to object applies, the right is not absolute and only applies in certain circumstances.
Restriction: You have the right to ask us to block or restrict the use of your personal data. The right is not absolute and only applies in certain circumstances.
Portability: You have the right to request to move, copy or transfer personal data from one IT environment to another in a safe and secure way, without affecting its usability.
Erasure: You have the right to ask us to erase personal data we hold about you. The right is not absolute and only applies in certain circumstances.
Right to Withdraw Consent: If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing. If you withdraw your consent, this will not invalidate the lawfulness of any processing carried out on the basis of consent before you withdrew it.
Data Protection Complaints: If you believe that your data protection rights may have been breached, you have the right to lodge a complaint with the applicable supervisory authority or to seek a remedy through the courts. Details of how to make a data protection rights request, query or to opt-out of marketing are below.
Contact Us
If you have any questions about this notice or how we handle your personal data, please contact us at:
Mina Asset Management Limited – Attention: Data Protection Officer
Watch Tower House, Blackditch, Newcastle, Co. Wicklow, A63 RF61, Ireland
You have the right to lodge a data protection complaint with the Irish Data Protection Commissioner’s Office. However, we would be grateful for an opportunity to resolve matters with you in the first instance.
Changes to This Privacy Notice
This Privacy Notice may be updated from time to time. Please check here for the most recent information on how we process your personal data.