Privacy / Cookies

1. About us

This privacy notice explains how Stones & Co. of 63 Walter Road, Swansea, SA1 4PT collects, stores and uses your personal information. We are the data controller of your personal information, which means information that is about you or from which we can identify you.

If you have any queries about this privacy notice or wish to exercise any of the rights mentioned in it, please contact Gary Stones, either in writing at 63 Walter Road, Swansea, SA1 4PT or via email at info@stonesandco.co.uk.

2. Why do we need to collect your personal data?

We use personal information about you in the following ways:

• to provide you with our agreed services;
• to comply with legal and regulatory obligations and good practice;
• for operational reasons such as recording transactions, training and quality control;
• to gather information as part of investigations by regulatory bodies;
• to verify your identity where this is required;
• to ensure the confidentiality of commercially sensitive information;
• to update and enhance client records;
• to notify you about changes to our services; and
• to maintain our records in accordance with applicable legal and regulatory requirements.

3. What personal information do we collect?

We collect the following information:

• Your title, full name, your contact details, including for instance your email address, home and mobile telephone numbers;
• Your home address, correspondence address (where different from your home address) and address history;
• Your date of birth and/or age
• Your photo ID by means of a copy of your passport and/or photo driving licence.
• Your nationality, if this is necessary for us to comply with our legal and regulatory requirements.

4. Do you have to provide your personal information to us?

If you do not provide us with the personal information we need, we may be unable to provide you with our services. Your personal information is required before you enter into a contract with us, or it is required during the life of that contract, or it is required by laws that apply to us. If we already hold some of the personal information we need we may not need to collect it again.

5. What are our legal grounds for collecting and using your personal data?

Data protection laws require us to explain our legal grounds for processing your personal information. We use the term processing to describe everything we do with your personal information from its collection, right through to its destruction or deletion. This includes sharing your data with other organisations.

The legal grounds that are relevant to us are:

• Processing which is necessary to perform our contract with you or for taking steps prior to entering into it. We use this ground for:

1. administering and managing your matter and updating your records; and
2. providing you with our agreed services.

• Processing which is necessary to comply with our legal obligations. We use this ground for:

1. compliance with laws that apply to us;
2. establishment, defence and enforcement of our legal rights;
3. notifying you about any changes to our terms or our privacy notice;
4. carrying out identity checks and anti money laundering checks
5. dealing with requests from you to exercise your rights under data protection laws; and
6. communicating with you in response to any query, request or complaint you may have.
7. when we share your personal information with these other people or organisations:

• Law enforcement agencies and governmental and regulatory bodies such as HM Revenue & Customs, the Financial Conduct Authority, the Ombudsman, Companies House, The Insolvency Service and the Information Commissioner’s etc
• Courts and other organisations where it is necessary for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations.
• Processing which is necessary for our own legitimate interests where these interests are not outweighed by any prejudice to your rights and freedoms. We use this ground for:

1. administering and managing your matter and updating your records;
2. to adhere to guidance and best practice under the regimes of governmental and regulatory bodies;
3. to administer our good governance requirements such as internal reporting and compliance obligations or administration;
4. communicating with you in response to any query, request or complaint you may have; and
5. when we share your personal information with these other people or organisations:

• The referrer or other intermediary who introduced you to us
• Other professional advisers, auditors and actuaries
• Other organisations and businesses who provide services to us such as, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions
• Processing with your consent. We use this ground for:

6. when you request that we share your personal information with someone else and consent to that.
7. How and when can you withdraw your consent?

As we explain above, much of what we do with your personal information is not based on your consent. Instead, it is based on other legal grounds. For processing that is based on your consent, you have the right to withdraw your consent at any time. You can do this by contacting us using the details above.

7. Who do we share your personal information with?

We routinely share information referred to in paragraph 3 above with:

• Legal Advisors, Regulatory Bodies, Government Departments and Agencies, Courts and organisations where it is necessary for the administration of justice.
• Transunion – we may share information with Transunion for the purposes of complying with Money Laundering Regulations and to identify certain parties we deal with. More information about Transunion’s activites are available at https://www.transunion.co.uk/legal-information/privacy-centre. The relevant Privacy Notices are as follows:-

General Privacy Notice

TransUnion Bureau Privacy Notice

8. Is your personal information transferred outside the European Economic Area?

We are based in the UK and your personal information is stored within the European Economic Area (EEA). We do not transfer your personal information outside the EEA other than in exceptional circumstances.

 What should you do if your personal information changes?

You should tell us without delay so that we can update our records. The contact details for this purpose are: info@stonesandco.co.uk

If you were introduced to us by a referrer or other intermediary, you should contact them separately. In some cases where you exercise your rights against us under data protection laws, we may need to inform the referrer or other intermediary but this will not always be the case.

10. For how long is your personal information retained by us?

We will hold your information for the whole time that we are instructed to act on your behalf and for a period of 6 years after this time or for the period we are advised to retain this information by the applicable regulatory bodies.

In some circumstances we may keep your information for longer than this, for instance where we are required by law to do so, or where we need to retain your information to defend or exercise our legal rights. We may also retain transactional history for statistical research and reporting reasons.

11. Your rights

Under data protection laws, you have the rights listed below. If you wish to exercise any of these rights, please contact us by email on info@stonesandco.co.uk.  We will aim to respond within one month. There is no fee for making a request. Please note that not all of these rights will apply to all of your personal information.

• The right to be informed – we have to be transparent with you about the processing that we do with your personal information. This is why we have a privacy notice.
• The right to ask us to correct your personal information if it is inaccurate and to have incomplete personal information completed. If we have disclosed the personal information in question to other organisations, we must inform them of the correction where possible.
• The right to object to our processing of your personal information where it is based on our legitimate interests. Your right to object may be relevant if you wish to find out more about what legitimate interests we rely on (they are listed in our privacy notice).
• The right to restrict processing of your personal information in certain circumstances.
• The right to ask us to have your personal information erased. This right is not absolute – it applies only in particular circumstances and, where it does not apply, we will tell you. We will not be able to comply if we are required to keep your personal information in order to comply with a legal obligation or to exercise or defend legal claims.
• The right to request access to the personal information held about you. This is often described as a Subject Access Request.
• The right to ask for your personal information in a reusable format (known as the right to data portability). This right only applies where personal information is being processed based on your consent or for performance of a contract and is carried out by automated means. This is separate to a Subject Access Request.

When making a request please:

• let us have enough information to identify you eg. your full name, address and file reference number (if applicable).
• let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill less than 3 months old); and
• let us know the information to which your request relates, including reference numbers, if you have them.

12. Keeping your information secure

 We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

13. How to complain

If you are unhappy with the way that we are handling your personal information, please contact us on info@stonesandco.co.uk in the first instance and we will try to resolve your complaint. However, you do also have the right to complain to the Information Commissioner’s Office, which is the regulator for data protection laws: https://ico.org.uk/