Privacy notice

Who we are

Bondsmith International Limited ("Bondsmith International", "we", "us") is a company registered in Jersey, company number 132559, with its registered office at 3rd Floor, IFC5, Castle Street, St Helier, Jersey JE2 3BY. We are regulated by the Jersey Financial Services Commission, JFSC registration number 132559. Our registration with the Jersey Office of the Information Commissioner is 71013.

We are the controller of the personal data described in this notice. That means we decide why and how it is processed. Bondsmith Savings Ltd, a company registered in England and Wales (No 13223331), provides some of the systems we use and acts as our processor for the data held in those systems. It processes that data only on our instructions.

For anything to do with your personal data, contact our data protection team by email at dpo@bondsmith.co.uk or by post, marked for the attention of the data protection team, at the registered office above. We have appointed a Data Protection Officer, who can be reached through the same contact details.

Who this notice covers

This notice applies to you if you are:

• a visitor to the international pages of our website
• a prospective client who contacts us, for example through the contact form
• an authorised user of the Bondsmith International platform
• a person connected to one of our clients, such as a director, beneficial owner, trustee, signatory or authorised representative, whose details we process to onboard and monitor that client

Our clients are firms, not individuals. Where a client gives us personal data about its directors, owners or signatories, the client is responsible for telling those people that it has done so and for pointing them to this notice.

What we collect and where it comes from

Depending on how you deal with us, we may collect:

• identity and contact details: name, job title, employer, work email address, telephone number and business address
• identification and verification details for onboarding and anti-money laundering checks: date of birth, nationality, residential address, identity documents, proof of address, source of wealth and source of funds information, and the results of screening checks
• details of your role at the client and your relationship to it, including ownership and control information
• platform account details: login credentials, user role and permissions, the instructions you give and approve, and logs of your activity on the platform
• correspondence with us, including anything you send through the contact form
• technical data when you use the website: IP address, browser and device type, and pages visited

We obtain this data:

• directly from you, when you contact us, are onboarded or use the platform
• from the client firm you are connected to, when it provides details of its people as part of onboarding
• from the specialist providers we use for identity verification and for anti-money laundering, sanctions and politically exposed person screening
• from the partner banks on our panel, in the course of opening and operating accounts
• from public registers and other public sources, such as company registries

Why we use your data and the lawful basis for doing so

The Data Protection (Jersey) Law 2018 (the DPJL) requires us to have a lawful basis, set out in Schedule 2 to the DPJL, for each purpose. Those we rely on are: performance of a contract (including steps taken at a client's request before entering into one); compliance with a legal obligation; our legitimate interests, where these are not overridden by your interests and rights; and your consent.

Our legal obligations arise mainly under the Proceeds of Crime (Jersey) Law 1999, the Money Laundering (Jersey) Order 2008 and the requirements of the JFSC Handbook for the prevention and detection of money laundering and the financing of terrorism. Our legitimate interests are: responding to enquiries; keeping our systems and clients' deposits secure; administering and improving our service; keeping proper business records; and establishing, exercising or defending legal claims.

We do not use your data for marketing unless you have asked us to keep in touch, and you can stop that at any time by telling us.

Special category and criminal records data

Anti-money laundering and sanctions screening can return information about criminal convictions or allegations, and occasionally other special category data, for example political opinions where a person is identified as politically exposed. The DPJL treats criminal records data as special category data. We process it only for screening and monitoring required by Jersey anti-money laundering law, and we rely on the conditions in Schedule 2, Part 2 of the DPJL that allow special category data to be processed where this is necessary to comply with a legal obligation and to prevent or detect unlawful acts. We do not use it for any other purpose.

Who we share your data with

We share personal data only where it is needed for the purposes above, with:

• the partner banks on our panel, so that accounts can be opened and operated for the client
• Bondsmith Savings Ltd, which provides systems we use and acts as our processor
• the specialist providers we use for identity verification and for anti-money laundering, sanctions and politically exposed person screening
• the providers that host our systems and supply our IT and communications services
• our auditors and professional advisers, including lawyers and accountants
• the Jersey Financial Services Commission, law enforcement and other authorities where we are required to, and a court or other party where necessary to establish, exercise or defend legal claims

Providers that act on our instructions are bound by contract to use your data only for the service they provide to us and to keep it secure. We do not sell personal data.

Transfers outside Jersey

Some of the organisations above are in the United Kingdom or the European Economic Area, so your data may be transferred there. Jersey recognises both the United Kingdom and the EEA as providing adequate protection for personal data, so no additional safeguard is needed for those transfers.

If we ever transfer personal data anywhere else, we will do so only where the DPJL permits it, for example to a jurisdiction Jersey recognises as adequate or under appropriate contractual safeguards, and you can ask us for details of the safeguard used.

How long we keep your data

• Onboarding, identity verification and transaction records required by Jersey anti-money laundering law: at least five years after the client relationship ends, or after the transaction where that is later
• Platform account details and activity logs: for the life of the client relationship and five years afterwards
• Enquiries that do not lead to a client relationship: five years
• Correspondence and records needed for legal claims: five years, or longer where a claim is in progress or a longer limitation period applies
• Website technical data: five years

When data is no longer needed we delete it or anonymise it so that it no longer identifies you.

How we keep your data secure

Our information security management system is certified to ISO/IEC 27001:2022, and access to personal data is limited to the people who need it for their role.

Your rights

Under the DPJL you have the right to:

• access the personal data we hold about you and receive a copy
• have inaccurate data corrected and incomplete data completed
• have your data erased, where we have no lawful reason to keep it
• restrict how we use your data while a question about it is resolved
• receive the data you gave us in a portable format, and have it sent to another organisation, where we process it under contract or consent
• object to processing based on our legitimate interests, and to any direct marketing
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, and to ask for human review of such a decision
• withdraw consent at any time where consent is the basis for processing, without affecting what was done before

Some of these rights are limited by law. In particular, we cannot erase records we are required to keep under Jersey anti-money laundering law, and we may not be able to tell you about screening results where the law prevents it.

To exercise any right, contact us using the details under "Who we are". We may need to confirm your identity first. We will respond without undue delay and within four weeks of receiving your request, and will tell you if a complex request needs longer.

If you are unhappy with how we have handled your data, you can raise a concern with the Jersey Office of the Information Commissioner: online at jerseyoic.org/raise-a-concern, by email to enquiries@jerseyoic.org, by telephone on +44 1534 716530, or by post to 2nd Floor, Ritz House, 5 Castle Street, St Helier, Jersey JE2 3BT. The Commissioner will usually ask that you give us the chance to resolve the matter first, so please contact us before you do.

Do you have to provide your data?

Where we collect data for identity verification and anti-money laundering checks, providing it is a legal requirement, and where we collect it to set up and run the platform for a client, it is a contractual requirement. If it is not provided, onboarding cannot be completed and we cannot open or operate accounts for the client. Providing data through the contact form or the website is voluntary.

Cookies

The website uses cookies as described in our cookie policy, which explains what each cookie does and how to change your preferences. Analytics cookies are set only with your consent.

Changes to this notice

We will update this notice when our processing or the law changes. The date at the top shows when it was last updated, and we will tell clients directly about any change that materially affects how we use personal data.