Zanaga Iron Ore Company Limited (the “Company“), or any third party service provider, functionary, or agent appointed by the Company acting on its behalf (together the “Fund“, “we“, “us“, “our“) are committed to protecting your personal data and are required, by Data Protection Legislation (as defined below), to provide individuals with certain information about how we use your personal information.
- your information is sometimes called “personal data”;
- we may also sometimes collectively refer to handling, collecting, protecting and storing your personal data as “processing” such personal data; and
- the term “Data Protection Legislation” means the EU General Data Protection Regulation 2016/679; together with all other applicable legislation relating to privacy or data protection.
For the purposes of Data Protection Legislation the data controller is the Company.
1. What information we collect about you
The personal data we collect and process may include:
- information obtained from identification documentation (including your name, contact details, nationality and national identify numbers (where applicable));
- your professional title and occupation;
- your age and marital status;
- financial information, tax status, account details and evidence of ownership of financial assets;
- personal identifiers such as your social security number, national insurance number, tax file number, IP address or our internal electronic identifiers;
- information which we or our service providers need to conduct ‘know your client’ checks such as details relating to your passport and credit history; and
- other information you provide in the course of your dealings with us or which we require to provide you with products and services.
In certain circumstances, we also collect and process what are known as ‘special categories’ of personal data (as defined by Data Protection Legislation). Money laundering, sanctions, financial crime and fraud prevention checks sometimes result in the Company obtaining information about actual or alleged criminal convictions and offences.
You are not obliged to provide us with your personal data where it is requested but we may be unable to provide certain products and services or proceed with your business relationship with the Company if you do not do so.
2. How we collect your information
The information we collect comes from:
- application forms or other materials you or your authorised representative submits to us during the course of your relationship with the Fund;
- you or your authorised representative’s interactions with the Fund, transactions and use of our products and services (including the use of our website);
- you or your authorised representative’s business dealings with the Fund, including via email, telephone or as stated in contracts with you;
- depending on the products or services you or your authorised representative requires, third parties (including for credit and money laundering checks, among other things); and
- recording and monitoring tools that we use for compliance or security purposes (e.g. recording of telephone calls, monitoring emails, etc.).
3. How we use your information
Our primary purpose in collecting your personal information is to facilitate and record the holding of shares in the Company, the management and administration of your holdings in the Company and any related administration on an on-going basis.
Additionally, we use your information for the following specific purposes:
- to process transactions and to improve the quality of the service that we provide to you;
- to disclose information to other third parties such as service providers of the Company, auditors, regulatory authorities and technology providers (as set out in more detail below);
- to communicate with you as necessary in connection with the proper running of the Fund;
- to update and maintain records and carry out fee calculations;
- to monitor and record calls and electronic communications;
- in connection with the Company’s internal management and reporting;
- to report regulatory and tax related information to regulatory and tax authorities in order to comply with a legal obligation, including any obligation arising under legislation implementing the U.S. Foreign Account Tax Compliance Act of 2010, as amended, and the Organisation for Economic Co-operation and Development’s Common Reporting Standard;
- to permit, administer and record your investment in the Company;
- verifying the identity of the prospective investor to comply with statutory and regulatory requirements in relation to anti-money laundering procedures;
- in order to carry out anti-money laundering checks and related actions which are necessary to comply with legal obligations, in relation to, the prevention of fraud, money laundering, terrorist financing, bribery, corruption, tax evasion and to prevent the provision of financial and other services to persons who may be subject to economic or trade sanctions, on an on-going basis;
- for prudential and risk management purposes;
- to provide you with any products and services that you request from us; and
- other reasons compatible with the primary purpose.
If it is necessary to use it for another reason and that reason is compatible with the original purpose.
4. Legal grounds for using your personal information
Data Protection Legislation permits us to process your personal data in the way that we do because the processing is:
- necessary for the purposes of the legitimate interests that we pursue, which are to run and administer the Fund, to discharge our legal obligations, to store and disclose information where necessary and to evaluate, develop and improve our services; or
- necessary for the performance of a contract with you; or
- necessary in order to comply with a legal obligation to which we are subject.
To the extent that we process any special categories of data relating to you for any of the purposes outlined above, we will do so because either: (i) you have given us your explicit consent to process that personal data; (ii) you have made the personal data manifestly public; or (iii) the processing is necessary for the establishment, exercise or defence of legal claims.
5. Providing your information to third parties
- third parties such as auditors, regulatory authorities and technology providers, agents, contractors, service providers or related companies (including payment processors) if this is necessary to administer your investment in the Company, respond to your enquiries or for any other related purposes;
- any regulatory, supervisory or governmental authorities to the extent we are required by law to do so, or in other limited circumstances (for example if required by a court order or regulatory authority, or if we believe that such action is necessary to prevent fraud; and
- tax authorities.
The Fund does not undertake marketing activities for third parties, nor does it provide information to third parties for their own marketing purposes.
6. Transferring data outside of the EEA
Personal data may be transferred to, and stored at, a destination outside the European Economic Area (“EEA“) or to countries not regarded by the European Commission as providing an adequate level of data protection. When we, or our permitted third parties, transfer personal information in this manner we will ensure that the transfer is subject to appropriate safeguards in accordance with Data Protection Legislation.
7. Automated processing
We do not carry out automated decision-making or profiling.
8. Your rights
At any time, you have the right:
- to be informed about the processing of your personal data (i.e. for what purposes, what types, to what recipients it is disclosed, storage periods, any third party sources from where it was obtained, confirmation of whether we undertake automated decision-making, including profiling, and the logic, significance and envisaged consequences);
- to request access to or a copy of any personal data which we hold about you;
- to rectify your personal data, if you consider that it is inaccurate;
- to ask us to delete your personal data, if you consider that we do not have the right to hold it;
- to withdraw consent to our processing of your personal data (to the extent such processing is based on previously obtained consent);
- to restrict processing of your personal data;
- to data portability (moving some of your personal data elsewhere) in certain circumstances;
- to object to your personal data being processed in certain circumstances; and
- not to be subject to a decision based on automated processing and to have safeguards put in place if you are being profiled based on your personal data.
Any request for access to or a copy of your personal data must be in writing and we will endeavour to respond within a reasonable period and in any event within one month in compliance with Data Protection Legislation. We will comply with our legal obligations as regards your rights as a data subject.
We will correct any incorrect or incomplete information and will stop processing your personal data, or erase it, where there is no legal reason for us to continue to hold or use that information.
We aim to ensure that the information we hold about you is accurate at all times. To assist us in ensuring that your information is up to date, do let us know if any of your personal details change.
9. How long we keep your information
- a minimum of six years;
- as long as is necessary for the relevant activity or as long as is set out in any relevant agreement you enter into with the Company;
- the length of time it is reasonable to keep records to demonstrate compliance with professional or legal obligations;
- any retention period that is required by law; or
- the end of the period in which litigation or investigations might arise in respect of an investment in the Company.
This will involve us regularly reviewing our files to check that information is accurate, up-to-date and still required.
10. How we protect your information
We ensure that there are appropriate technical, physical, electronic, and administrative safeguards in place to protect your personal details from unauthorised access.
You may also use these contact details if you wish to make a complaint to us relating to your privacy.
If you have any concerns about our use of your information, you also have the right to make a complaint to the Guernsey Data Protection Commissioner, which regulates and supervises the use of personal data in Guernsey, via their helpline on +44 (0) 1481 742074 or email firstname.lastname@example.org.
Version: May 2018