Privacy Notice

1 Why are we providing this notice?

The General Data Protection Regulation (“GDPR”) applies to the collection, processing and storage of personal data undertaken by organisations within the European Economic Area (“EEA”), as well as to firms outside the EEA that handle personal data relating to the offering of goods or services to individuals in the EEA.

This Privacy Notice is intended to provide information to visitors to our website about how each of Columna Capital LLP, Columna Capital Luxembourg S.à r.l., Columna GP I S.à r.l., Columna GP II S.à r.l., CPL Guernsey Ltd (collectively, “we”, “us”, “our”) may process personal data in connection with our website, what we may use it for and with whom we may share it.

“Personal data” means any information relating to you, such as your name and contact details, but does not include data where you cannot be identified such as anonymised, aggregated data.

For the purposes of data privacy legislation, we are a ‘controller’ in respect of the personal data about you that you share with us in your correspondence with us. A data controller is responsible for deciding the ways in which and purposes for which personal data is processed. The specific entity that is the data controller in a given instance will depend on the entity to which your correspondence is addressed and the matters raised in your correspondence. Further information about our relevant entities is set out in the ‘Who are we?’ section below. We may process your personal data ourselves or through others acting as data processors on our behalf.

If you have any questions about this Privacy Notice, you can contact us using the details set out in the ‘Contact Us’ section below.

We may provide supplemental privacy notices on other occasions and in specific scenarios when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data. In particular, we have specific Privacy Notices for investors (available here) and prospective investors (available here).

2 What information may we process about you?

If you contact us through our website or otherwise, you may provide personal data to us in the course of your correspondence with us. This is likely to include your name and contact details together with other information contained in your correspondence. We may also generate personal data about you in connection with the correspondence, such as correspondence records and opinions.

3 How may we use your personal data?

The EU General Data Protection Regulation (“GDPR”) specifies certain ‘lawful bases’ for which we are allowed to use your personal data where that processing is subject to the GDPR.

We may use the personal data in your communications with us to correspond with you, respond to your enquiry or address matters raised by your correspondence, as well as to maintain our records. Our ‘lawful basis’ for using your personal data in this way is our legitimate interests in responding to or addressing your enquiry or otherwise communicating with you in the course of our business and maintaining necessary business records.

In particular, if you are contacting us in connection with a potential or proposed investment by us, we may use personal data that you supply to us to undertake pre-investment steps, including (but not limited to) assessing the prospects of the investment and undertaking due diligence. The lawful bases for such processing are compliance with our legal obligations and our legitimate interests in conducting our business in a proper manner.

Other uses

We may also process your personal data where required by law to do so or if we reasonably believe that it is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.

We may also process personal data for purposes other than those described above (provided that such new purposes are not incompatible with the original purposes). Where this is the case, we will provide you with information about that further processing.

Special categories of personal data

There are more limited bases for processing ‘special category’ personal data. This is personal data which reveals or contains racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual orientation.

You do not need to provide ‘special category’ personal data to us and we request that you refrain from doing so if at all possible. Whilst we will use reasonable efforts to limit our holding of such data, please be aware that we may hold such data incidentally. For example, where you volunteer special category data to us, such as if you send us an email containing special category data. By providing us with this data you expressly consent to its use.

4 With whom will we share your information?

We may share your personal data with a third party where this is required by law or where we have another legitimate interest in doing so.

We may need to share your personal data with:

other entities within our group in connection with or as part of our ordinary group-wide operations, in the context of a business reorganisation or group restructuring exercise or in connection with centralised services within our group;
professional advisers including lawyers, bankers, auditors and insurers to the extent such information is relevant to their performance of their services;
regulators; and
any of our service providers where such information is relevant to their performance of such services.

We may share your personal data with third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal data with a regulator or to otherwise comply with applicable law or judicial process or if we reasonably believe that disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.

5 Where your personal data may be processed.

We are established in the UK. Our group also has offices in Luxembourg and Switzerland. The GDPR applies in the UK and Luxembourg and the European Commission has recognised that Switzerland provides an adequate level of protection in respect of personal data.

Where required by the GDPR, we will (or will require a processor to) put in place appropriate safeguards such as the standard contractual clauses approved by the European Commission. If you require further information about this you can request it using the details set out in the ‘Contact Us’ section below.

6 How long will we retain your information?

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements and our legitimate interests in maintaining such personal information in our records. In doing this we will have regard to the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances your personal data may be anonymised so that it can no longer be associated with you, in which case it is no longer personal data.

Once we no longer require your personal data for the purposes for which it was collected, we will securely destroy your personal data in accordance with applicable laws and regulations.

7 Accuracy of information

It is important that the personal data we hold about you is accurate and current. Please let us know if your personal data which we hold changes during your relationship with us.

8 Your rights in relation to your information

Where the processing of your personal data is within the scope of the GDPR, you have rights as an individual which you can exercise in relation to the information we hold about you under certain circumstances. These rights are to:

request access to your personal data (commonly known as a “data subject access request”) and request certain information in relation to its processing;
request rectification of your personal data;
request the erasure of your personal data;
request the restriction of processing of your personal data;
object to the processing of your personal data;
request the transfer of your personal data to another party.

If you want to exercise one of these rights please use the contact details set out in the ‘Contact Us’ section below.

You also have the right to make a complaint at any time to a supervisory authority for data protection issues.

Fees

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

9 Right to withdraw consent

In the limited circumstances where we may require your consent to process your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us using the contact details listed below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless we now have an alternative legal basis for doing so.

10 Changes to this Privacy Notice

Our practices with respect to personal data may vary from time to time and we may update this Privacy Notice at any time. The latest version of this Privacy Notice will be made available on our website. If we intend to process your personal data for a purpose other than the purposes referred to above, we will provide you with additional information about that purpose.

11 Contact us

This Privacy Notice was written with brevity and clarity in mind and is not an exhaustive account of all aspects of our collection and use of personal data in connection with all issues that might arise in your correspondence. If you require any further information, please do not hesitate to contact us using the following contact details: GDPR@columnacapital.com.

12 Who are we?

Columna Capital LLP is a limited liability partnership, incorporated in England and Wales with number OC345976, whose registered office is 40 Queen Anne Street, London W1G 9EL.

Columna Capital Luxembourg S.à r.l. is a limited liability company (société à responsabilité limitée), incorporated in the Grand Duchy of Luxembourg with number B215783, whose registered office is 2-8, rue Julien Vesque, L-2668 Luxembourg.

Columna Capital Switzerland SaGL is a limited liability company (Società a Garanzia Limitata) incorporated in Switzerland with number CHE-466.246.597. Its registered office is Via San Salvatore 10, CH-6900 Lugano-Paradiso, Switzerland.

Columna GP I S.à r.l. is a limited liability company (société à responsabilité limitée), incorporated in the Grand Duchy of Luxembourg with number B204285, whose registered office is 2-8, rue Julien Vesque, L-2668 Luxembourg.

Columna GP II S.à r.l. is a limited liability company (société à responsabilité limitée), incorporated in the Grand Duchy of Luxembourg with number B218469, whose registered office is 2-8, rue Julien Vesque, L-2668 Luxembourg.

CPL Guernsey Ltd is a limited liability company, incorporated in Guernsey with number 52165, whose registered office is Ground Floor, Cambridge House, Le Truchot, St Peter Port, Guernsey, The Channel Islands GY1 1WD.