Platform Privacy Policy
Overview
This privacy policy (“Privacy Policy”) explains how Titanbay Ireland Limited, a company incorporated in Ireland with registered office at 26/27 Pembroke Street Upper, D02 F5Y6, Dublin, Ireland (“Titanbay”, “we”, “us” or “our”), collects, uses, shares and otherwise processes your Personal Data (defined below) in connection with your relationship with us in accordance with applicable data privacy laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), the Irish Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011, as amended) (“Irish ePrivacy Regulations”). Unless you are otherwise advised via any other documentation or notification received from us or our affiliates, we shall be the data controller in respect of the Personal Data described in this Privacy Policy (the “Data Controller”). A Data Controller is the person or organisation that determines the purposes and means of the processing of Personal Data, and is responsible for that processing under the GDPR.
The information set out herein applies to the personal information (also known as “Personal Data”) that we collect about you when you access or use the Titanbay platform (the “Platform”).
The Platform is part of your relationship with Titanbay and, where applicable, with our affiliates, including Titanbay Ltd (our UK parent and technology provider) and Titanbay International GP S.à r.l. and Titanbay International GP II S.à r.l. (the general partners of certain fund vehicles established in Luxembourg) (together, the “Titanbay Group”), as well as any fund vehicle (each, a “Fund”) in which you may invest via the Platform. Where a Titanbay Group entity or a Fund processes your Personal Data as a separate data controller in its own right – for example, Titanbay International GP S.à r.l. acting in its capacity as general partner of a Fund in which you invest – that entity’s role and contact details are set out in the data protection notice contained in the relevant Fund documentation, which governs that processing instead of this Privacy Policy. In particular, where you invest in a Fund, the general partner of that Fund is the data controller in respect of your subscription for, and holding of, interests in that Fund, including the related investor due diligence. Our role in relation to that processing is described in that notice.
This Privacy Policy applies only to Personal Data we collect through the Platform. If you are visiting our website without accessing the Platform, please see the Website Privacy Policy.
What is Personal Data?
The term “Personal Data” as used in this Privacy Policy means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier. This definition provides for a wide range of personal identifiers which may constitute Personal Data, including name, date of birth, residential address, identification number, location data or online identifier. Personal Data does not include data from which you can no longer be identified such as anonymised aggregate data.
What are cookies and how do we use them?
Cookies are small text files that can be used by websites and online platforms to make a user's experience more efficient. The Platform uses cookies which are unique to your web browser. They will contain some information such as a unique identifier and some digits and numbers.
Certain cookies are strictly necessary for the Platform to operate and to provide the service you have requested; these are placed without your consent, as permitted under the Irish ePrivacy Regulations. All other cookies and similar technologies, including analytics and session replay technologies, are used only if you consent to them, and you may withdraw your consent at any time.
How do we collect personal data and what kind of information do we collect?
A detailed description of why and on what legal basis we process Personal Data, and the types of Personal Data we process for each purpose, is set out below (see “Detailed Description of Processing”).
In the event you open an account with us or otherwise correspond with us, the kinds of Personal Data we may collect include information such as:
- your contact details (such as your address, email address and telephone number) and other information such as your job title. In most cases, we will collect the Personal Data directly from you but may also obtain it from other sources, such as the private bank, wealth manager or other intermediary through which you access the Platform, identity verification and screening providers, and public registers and sanctions lists;
- personal details, such as your name, gender, date and place of birth, occupation, address, email address, phone numbers, identity documents, financial information and other contact details;
- other materials we may need for our identification and compliance obligations, as well as information from third-party providers who assist us to combat fraud, money laundering and other financial crime;
- complaints or disputes you may have had with us or other members of the Titanbay group and details of the underlying transaction (where applicable);
- sales and marketing information, including your marketing preferences and your engagement with our communications;
- financial information and transaction records;
- records of correspondence and other communications between you, your representatives and us;
- information that we need to support our regulatory and legal obligations; and
- any other information you asked and authorised us to collect for or about you.
As part of our identity verification, anti-money laundering and sanctions screening, we may process information relating to criminal convictions and offences, and information indicating whether you are a politically exposed person, which may reveal political opinions. We process this information only where necessary to comply with our legal obligations, including under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, and as permitted by the Data Protection Act 2018.
What do we do with your data?
We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or which similarly significantly affect you. We may assess certain characteristics on the basis of Personal Data processed automatically (profiling), in particular to provide you with information on our products and services or those of our affiliates and business partners. Where this profiling relies on our legitimate interests, you have the right to object to it at any time, including where it is carried out for direct marketing purposes.
We may aggregate or anonymise information collected through the Platform so that it no longer relates to an identified or identifiable individual and is therefore no longer Personal Data within the meaning of the GDPR. We apply aggregation and anonymisation in a manner intended to be irreversible, and we do not attempt to re-identify individuals from data that has been anonymised. We may use such aggregated or anonymised data for research, reporting and marketing purposes. We do not sell your Personal Data.
We will process your Personal Data if and to the extent applicable law provides us with a lawful basis to do so. Therefore, we will only process your Personal Data on the following grounds:
- Consent — you have consented to us using your data;
- Contract — we need it to perform the contract we have entered into with you, or to take steps at your request before entering into a contract;
- Legal Obligation — we need it to comply with a legal obligation; or
- Legitimate Interest — we (or a third party with whom we work) have a legitimate interest which is not overridden by your interests or fundamental rights and freedoms. Legitimate interest may include the provision of services by us, administrative or operational processes within Titanbay, and certain direct marketing activities. We will use your Personal Data to deliver services to you and/or to work or act for you. We may also use your Personal Data to inform you about us and our services or otherwise communicate with you.
Where we rely on our legitimate interests, we have carried out an assessment to satisfy ourselves that those interests are not overridden by your interests, rights and freedoms. You may request further information about that assessment using the contact details set out below.
Where we send you direct marketing by electronic mail, we will do so in accordance with the Irish ePrivacy Regulations. Where you are an existing customer, we may send you marketing about similar products or services in reliance on the “soft opt-in”, provided you were given a simple means of refusing such marketing at the point your details were collected and in every subsequent communication. In all other cases we will send you marketing by electronic mail only where you have consented to receive it. You may opt out of marketing communications at any time by using the unsubscribe link in any communication or by contacting us using the details set out below.
Please note that we may use or disclose Personal Data if we are required by law to do so or if we reasonably believe that use or disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.
Detailed Description of Processing
| Purpose of Processing | Categories of Personal Data Processed | Legal Basis for Processing |
|---|---|---|
| To communicate with, keep records for, contract with, and provide services to investors (including prospective investors, together “Investors”), vendors, partners, or other contacts; to perform marketing and research services for Investors; and to meet relevant regulatory requirements. | Contact Information including name, telephone number, address, email address, and signature | Legitimate interests – communicating with and marketing to Investors; Performance of a contract; Legal compliance – meeting relevant regulatory requirements; Consent (where applicable) |
| To understand the institution you represent and your role within it, and to perform background screening of Investors and investment partners (including for anti-money laundering and sanctions purposes); and to meet relevant regulatory requirements. | Employment Information including title/role, institution/company, location, compensation, work history, and qualification/training | Legitimate interests – understanding the organisation you represent and screening the investment relationship; Legal compliance – meeting relevant regulatory requirements |
| To perform fund/subscription processes, accounts, records, and onboarding services for Investors; to perform background screening of Investors and investment partners; and to meet relevant regulatory requirements. | Account/Financial Information including Contact Information, date of birth, bank account information, wire transfer information, expense details, beneficiary designation, Investor commitments, ledgers, positions, balances, percentages of fund, credit information, investment history, net worth, source of wealth, personal financial portfolio and share or option numbers, values, and vesting | Legitimate interests; Performance of a contract; Legal compliance |
| To perform background screening of Investors and investment partners; to meet relevant regulatory and legal requirements; to comply with tax requirements; and to accept/process funds from, pay funds to, keep records for, contract with, and provide services to Investors and partners. | Government Identification Information including taxpayer identification number, date of birth, driver's licence, passport, other official government identification and numbers, legal work status, and Know Your Client (“KYC”) details | Legitimate interests; Performance of a contract; Legal compliance |
| To meet relevant regulatory requirements; and to perform background screening of Investors and investment partners. | Certification Information including business partner certification/accreditation details, conflicts information, approvals, registrations, licences, and consents | Legitimate interests; Legal compliance |
Information Collected Automatically
As is true of most digital platforms, we may gather certain information automatically when you use the Platform. This information may include browser, device, cookie and similar data that we collect as follows:
| Purposes of Processing | Categories of Personal Data Processed | Legal Basis for Processing |
|---|---|---|
| To maintain the security of the Platform, for fraud detection, and to protect Titanbay's rights. | Internet or other electronic network activity including IP addresses, browser type, internet service provider, referring/exit pages, operating system, date/time stamp, and clickstream data | Legitimate interests |
| To manage the Platform and email messages, and to collect and track information about user activities online over time to personalise content. | Cookies, Analytics and Related Technologies | Consent, obtained in accordance with Regulation 5(3) of the Irish ePrivacy Regulations, for analytics and session replay technologies (including Mixpanel and the session replay feature of Sentry). Strictly necessary technologies are placed without consent, as permitted under Regulation 5(5) of the Irish ePrivacy Regulations, and the resulting processing relies on our legitimate interests under Article 6(1)(f) GDPR. |
| To conduct analytics to improve the Platform. | Location Information including approximate location derived from your IP address, together with date and time (the precision of this data varies and is determined by factors controlled by your device or internet service provider) | Legitimate interests; providing location-based functionality on the Platform and conducting analytics to improve it, using only approximate location derived from your IP address rather than precise device-level location. |
Information we may need from you
What might we need from you?
We may need to request specific information from you to help us confirm your identity and ensure your right of access to your Personal Data (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.
Accuracy of information
It is important that the Personal Data we hold about you is accurate and current. Please let us know promptly if your Personal Data changes during your relationship with us.
What if you do not provide the Personal Data we request?
It is in your sole discretion to provide Personal Data to us. If you do not provide us with all or some of the Personal Data we request, we may not be able to accept an engagement from you to provide all or some of our services, or enter into a contract with you.
Change of purpose and anonymisation
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
In some circumstances we may anonymise your Personal Data so that it can no longer be associated with you, in which case it is no longer Personal Data.
With whom will we share your information?
When using your Personal Data for the purposes and on the legal basis described above we may share your Personal Data with other service providers we work with. This includes but may not be limited to, other entities within the Titanbay group of companies. We may also have to share your Personal Data with regulators, public institutions, courts or other third parties.
| Category of Recipients | Personal Data Shared | Purposes for which the Personal Data is Shared |
|---|---|---|
| Customers, Suppliers, Service Providers, Vendors, Other Commercial Entities | Contact Information, Account/Financial Information, and Government Identification Information | To enable us to carry out the obligations under and enforce our contracts with our customers, suppliers, service providers, vendors and other commercial entities. |
| Service Providers, Agents | Contact Information, Account/Financial Information, Government Identification Information, and Certification Information | To anyone providing a service to us or acting as our agent, as data processors, or for the purposes of providing services to us and on the understanding that they will keep the Personal Data confidential and only process it in accordance with our instructions and the GDPR. |
| Auditors, Legal Advisors, Other Advisors | Contact Information, Account/Financial Information, and Certification Information | Where we need to share Personal Data with our auditors, legal and other advisors. |
| Regulatory bodies, law enforcement, courts and other public authorities | Government Identification Information and Certification Information | Where we are required or requested to share information with a regulatory or oversight body, or where disclosure is necessary to comply with a legal obligation, court order or other legal process. |
| Funds and their general partners | Contact Information, Account/Financial Information, and Government Identification Information | To process your subscription for, and holding of, interests in a Fund, as described in the data protection notice in the relevant Fund documentation. |
| Fund administrators, registrars, transfer agents and depositaries | Contact Information, Account/Financial Information, and Government Identification Information | To administer the Funds and your investment, including investor due diligence, maintaining registers of investors and processing payments. |
| Distribution partners and introducing intermediaries | Contact Information and Account/Financial Information | Where you access the Platform through, or were introduced by, a private bank, wealth manager or other intermediary, to administer that relationship. |
| Identity verification, anti-money laundering and sanctions screening providers | Contact Information, Government Identification Information, and Certification Information | To verify your identity and to carry out anti-money laundering, counter-terrorist financing and sanctions screening. |
| Tax authorities | Contact Information, Account/Financial Information, and Government Identification Information | To meet reporting obligations under the Common Reporting Standard, FATCA and other applicable tax laws, which may involve onward exchange of information with tax authorities in other jurisdictions, including outside the EEA. |
| Titanbay Ltd | Contact Information, Account/Financial Information, Government Identification Information, and Certification Information | As the provider of the technology underlying the Platform. |
Some of our service providers are located outside the EEA. Titanbay Ltd, which provides the technology underlying the Platform, is located in the United Kingdom, which is the subject of an adequacy decision of the European Commission. Sentry and Mixpanel are provided by companies located in the United States, which is the subject of an adequacy decision of the European Commission in respect of organisations certified under the EU-U.S. Data Privacy Framework; we rely on that decision or, where it does not apply, on the European Commission's Standard Contractual Clauses. Tax authorities may also exchange information about you with tax authorities in other jurisdictions, including outside the EEA, under applicable tax laws. For the purposes described above, from time to time, we may have to transfer your Personal Data from the European Economic Area (EEA) to a third party outside of the EEA in a jurisdiction which is not the subject of an adequacy decision of the European Commission. Details of any such jurisdictions are set out in the Appendix hereto, which may be updated from time to time. In such cases, we will always ensure that there is a legal basis and a relevant safeguard method for such data transfer – such as the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment – so that your Personal Data is treated in a manner that is consistent with and respects EU law and other applicable laws and regulations on data protection. You may request a copy of the safeguards we have put in place by contacting us using the details set out below.
Disclosure of Personal Information to Affiliates
Titanbay may share Personal Data with other entities within the Titanbay group of companies, including our UK and Luxembourg group entities, to the extent necessary or appropriate for those entities to perform services for your benefit or to support the operation and administration of our business. Those entities are required to keep such Personal Data confidential to the same extent as Titanbay and to process it in accordance with this Privacy Policy and applicable data protection law.
Third Parties
The Platform may, from time to time, include links to third-party websites or enable individuals the opportunity to disclose information directly to third parties. This Privacy Policy does not apply to such third-party websites or organisations. For a description of the privacy protections associated with providing information to third parties, you should refer to the privacy statements, if any, provided by those third parties.
Third Parties: Analytics and Error Monitoring
The Platform uses Sentry, an error-monitoring and session-replay tool provided by Functional Software, Inc. (d/b/a Sentry), San Francisco, California, USA, to help us identify and fix technical issues. Session replay is configured to mask user inputs and other personal data, such as your name, to minimise the personal data captured within replayed sessions. Sentry is configured to use servers in the EU. Session replay is used only where you have consented to it.
The Platform uses Mixpanel, a product analytics tool provided by Mixpanel, Inc., San Francisco, California, USA, to understand how the Platform is used and to help us identify and fix errors, so we can improve performance. Our Mixpanel account is configured with EU data residency. Mixpanel is configured to use servers in the EU. Mixpanel is used only where you have consented to it.
Your rights in relation to your information
You have rights as an individual which you can exercise under certain circumstances in relation to your Personal Data that we hold. These rights are to:
- request access to your Personal Data (commonly known as a “data subject access request”) and request certain information in relation to its processing;
- request rectification of your Personal Data;
- request the erasure of your Personal Data;
- request the restriction of processing of your Personal Data;
- object to the processing of your Personal Data where we are relying on our legitimate interest(s) (or those of a third party) as a lawful basis for such processing;
- object at any time to the processing of your Personal Data for direct marketing purposes;
- request the transfer of your Personal Data to another organisation, or directly to you, under certain conditions; and
- not be subject to a decision based solely on automated processing, including profiling, which produces a legal effect or other similarly significant effect on you. This right does not apply where the decision is (a) necessary for entering into or the performance of a contract with you, (b) authorised by EU or Irish law, or (c) based on your explicit consent; in each case subject to suitable safeguards, including the right to obtain human intervention and to contest the decision.
How to complain
If you are unhappy with how we have collected or used your Personal Data, you have the right to complain to us. You may do so by contacting us using the details set out under “Further information” below. We will accept your complaint however you choose to submit it, and you do not need to use any particular form or wording.
We will acknowledge receipt of your complaint within 30 days of receiving it, take appropriate steps to investigate it, and inform you of the outcome without undue delay. Where we need longer to complete our investigation, we will keep you updated on our progress.
You also have the right to make a complaint at any time to the Data Protection Commission, the Irish supervisory authority for data protection issues, using the contact form at https://forms.dataprotection.ie/contact, or to the supervisory authority of your own habitual residence, place of work, or the place of the alleged infringement. You do not need to complain to us before complaining to a supervisory authority, but we would welcome the opportunity to address your concerns first.
If you wish to receive a copy of the Personal Data we hold about you, this can be made available on request. We will respond as soon as we can and in any event within one calendar month. Where your request is complex or you have made a number of requests, we may extend that period by up to two further months, in which case we will tell you within one calendar month of receipt of your request and explain why the extension is necessary.
We will not charge you a fee for providing a copy of your Personal Data. However, where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may either charge a reasonable fee based on the administrative costs of complying with the request or refuse to act on the request.
Right to withdraw consent
In case you have provided your consent to the collection, processing and transfer of your Personal Data, you have the right to fully or partly withdraw your consent (which will not affect the lawfulness of any processing done before the consent was withdrawn). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. In case we processed your Personal Data for direct marketing purposes, you have the right to object at any time, in which case we will no longer process your Personal Data for such marketing purposes.
How long will we retain your information?
We will only retain your Personal Data for as long as is necessary to fulfil the purposes for which it was collected and processed, including for the purposes of satisfying any legal, regulatory, accounting or reporting requirements, or to enforce our terms and conditions or for the protection of our rights in the context of legal claims, litigation, arbitration or similar proceedings.
To determine the appropriate retention period for your Personal Data, we will consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances we may anonymise your Personal Data so that it can no longer be associated with you, in which case it is no longer Personal Data.
Upon expiry of the applicable retention period we will securely destroy your Personal Data in accordance with applicable laws and regulations.
Changes to this Privacy Policy
Titanbay reserves the right to update this Privacy Policy at any time, and we will make an updated copy available on the Platform. Where we make material changes to this Privacy Policy, we will notify you by appropriate means before those changes take effect – for example, by a notice within the Platform or, where we hold your contact details and it is appropriate to do so, by email. The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised.
Further information
In our capacity as Data Controller for the Platform, if you have any queries, questions, concerns or require any further information in relation to the Privacy Policy or you wish to exercise any of your rights, please do not hesitate to contact us at compliance@titanbay.com, or write to us at Titanbay Ireland Limited, 26/27 Pembroke Street Upper, D02 F5Y6, Dublin, Ireland.
We endeavour to respond to all legitimate requests within one calendar month. Where your request is complex or you have made a number of requests, we may extend that period by up to two further months. In that case, we will notify you within one calendar month of receiving your request, explain why the extension is necessary, and keep you updated.
Appendix
Jurisdictions outside of the EEA not being the subject of an adequacy decision of the European Commission to which your data may be transferred:
- None.