Privacy policy

The Site and our Services are made available by various companies in the TreasurySpring group of
companies (each a “Group Company”).

Where this Privacy Notice refers to “TreasurySpring”, “we”, “us, “our”, this means one or more of the
particular Group Companies that provide the particular Site or Services to you. For more information about
our Group Companies, including their location and respective roles and responsibilities, please see below.

Except as stated otherwise, each Group Company is an independent controller of your personal data.

Location: England and Wales
TreasurySpring Advisors Limited (company no: 11641312) is a company established under the laws of
England and Wales with its registered office at 25 Market Mews, London, United
Kingdom, W1J 7BZ.

TreasurySpring Limited (company no: 10373508) is a company established under the laws of England and
Wales with its registered office at 25 Market Mews, London, England, W1J 7BZ.

Location: Jersey
TreasurySpring Management (Jersey) Limited (company no: 125257) is a company established under the
laws of Jersey with its registered office at Ordnance House, 31 Pier Road, St. Helier, JE4 8PW, Jersey.

TreasurySpring Investments (Jersey) ICC (registered no: 125392) is a private incorporated cell company
established under the laws of Jersey with its registered office at Ordnance House, 31 Pier Road, St. Helier,
JE4 8PW, Jersey, and each of its incorporated cells from time to time.

If you have any questions about this Privacy Notice or want to exercise your rights as a data subject, you can contact us using the following methods:

Email – Send us an email at: legal@treasuryspring.com.

Post – Write to us at: TreasurySpring Advisors Limited, 25 Market Mews, London, W1J 7BZ for the attention of the Head of Legal.

We collect and process personal data from the following people:

Site visitors If you browse our Site or request a demo through our Site, we will collect and process your personal data in connection with your interaction with us and our Site.

Clients If you use our Services or we communicate with you in respect of you potentially using our Services, we may collect and process your personal data in connection with the onboarding
or supply of our Services to you.

People who contact us with enquiries If you contact us with an enquiry through our Site, submit a complaint through our Site or provide any feedback to us in our surveys and feedback forms, we will collect and process
your personal data in connection with your interaction with us and our Site.

People who work for our clients, partners, service providers and issuers If you work for one of our clients, partners, service providers or issuers and have
responsibility in relation to the use or provision of our Services with your organisation, we will process your personal data in connection with your organisation’s relationship with us.

Visitors to our physical locations If you attend one of our offices or other locations, we may process personal data that you volunteer in connection with your visit and any enquiries you make. For example, you may volunteer personal data when signing in as a guest. CCTV footage may also be collected for security purposes.

Event attendees If you attend one of our events or a conference we represented at, we will process personal data about you in connection with your attendance at the event. For example, we may ask you to complete a registration or feedback form, or other document relating to the event.

Job applicants If you apply for a job with us, whether through the Site or otherwise, we will collect and
process your personal data in connection with your application.

We process your personal data, which is any information relating to you including by reference to identifiers associated with you (such as your name or email address), your online activity or any device that you use to access our Site, for the following purposes:

•to provide you with our Site;

• to provide you with our Services;

• to deal with client services and enquiries, carry out surveys and obtain feedback;

• to carry out insight and analysis; • to carry out our promotional and marketing practices; and

• for business administration (including recruitment) and legal compliance purposes.

We collect and receive personal data using different methods:

Personal data you provide to us You may give us your personal data directly, for example, when you use our Services, contact us with enquiries, use or complete forms on our Site, subscribe to receive our marketing communications or provide feedback to us.

Personal data we collect using cookies and other similar technologies When you access and use our Site, we will collect certain Behavioural Data and Technical Data. We collect this personal data by using cookies and other similar technologies (see the Insight & analysis through cookies and other similar tracking technologies section).

Personal data received from third parties We may receive personal data about you from third parties. Such third parties may include your employer if your employer receives our Services or provides services to us, analytics providers, third party directories and third parties that provide technical services to us so that we can provide our Site and our Services.

Where we are required by law to collect your personal data, or we need to collect your personal data under the terms of a contract we have with you, and you fail to provide that personal data when we request it, we may not be able to perform the contract we have or are trying to enter into with you. This may apply where you do not provide the personal data we need in order to provide the Services you have requested from us or to process an application to register for our Services. In these circumstances, we may have to cancel your application or the provision of the relevant Services to you, in which case we will notify you.

This Privacy Notice only applies to personal data processed by us through your use of our Site and/or in connection with our business operations. However, from time to time, our Site may contain links to third-party websites and services. We have no control over these websites and services and this Privacy Notice does not apply to your interaction with the relevant third parties.

When you use a link to go from our Site to another website (even if you don’t leave our Site) or you request a service from a third party, your browsing and interactions on any other websites, or your dealings with any other third-party service provider, is subject to that website’s or third-party service provider’s own rules and policies. For example, our Site invites you to connect with us on social media platforms. When you click on the links we provide to such third-party platforms, you will be transferred from our Site to the relevant third-party platform and the privacy notice (and other terms and conditions) of that platform will apply to you.

We do not monitor, control or endorse the privacy practices of any third parties. We encourage you to become familiar with the privacy practices of every website you visit or third-party service provider that you use in connection with your interaction with us and to contact them if you have any questions about their respective privacy notices and practices.

We only share personal data with others when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements and security mechanisms in place to protect the personal data shared and to comply with our data protection, confidentiality and security standards and obligations. When processing your personal data, we may need to share it with third parties (including other entities within our group of companies), as set out in the table below. This list is non-exhaustive and there may be circumstances where we need to share personal data with other third parties.

Third-party suppliers who provide applications/ functionality, data processing or IT services We share personal data with third parties who support us in providing our Site and help provide, run and manage our internal IT systems. Such third parties may also include, for example, providers of information technology, cloud-based software-as-a-service providers, identity management, website design, hosting and management, data analysis, data back-up, security and storage services. The servers powering and facilitating that cloud infrastructure are located in secure data centres around the world, and personal data may be stored in any one of them. We also share your personal data with third-party service providers to assist us with insight analytics. These providers are described in our Cookie Policy.

Payment providers and banks We share personal data with third parties who assist us with the processing of payments and refunds.

Advertising partners We share personal data with third party advertising partners, including those set out in our Cookie Policy [and/or our Cookie preference centre] when you use our Site. This data is used to provide you with, and measure the effectiveness of, online personalised advertising and for other advertising related activities.

Third-party post/email marketing and CRM specialists We share personal data with specialist suppliers who assist us in managing our marketing database and sending out our post and email marketing communications and account-related communications.

Event partners and suppliers When we run events, we will share your personal data with third-party service providers that are assisting us with the operation and administration of that event. If we are running an event in partnership with other organisations, we will share your personal data with such organisations for use in relation to the event.

Recruitment agencies and related organisations We share personal data with external recruiters, third-party providers that undertake background checks on our behalf and other entities within our group of companies.

Auditors, lawyers, accountants and other professional advisers We share personal data with professional services firms who advise and assist us in relation to the lawful and effective management of our organisation and in relation to any disputes we may become involved in.

Law enforcement or other government and regulatory agencies and bodies We share personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation.

Parties to a transaction We may share information with parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. Usually, information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

Other third parties Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.

Where necessary in order to provide our Site and our Services, we will transfer personal data to countries outside the UK and Jersey.

Non-UK/Jersey countries do not have the same data protection laws as the UK and Jersey. In particular, non-UK/Jersey countries may not provide the same degree of protection for your personal data, may not give you the same rights in relation to your personal data and may not have a data protection supervisory authority to help you if you have any concerns about the processing of your personal data. However, when transferring your personal data outside the UK and Jersey, we will comply with our legal and regulatory obligations in relation to your personal data, including having a lawful basis for transferring personal data and putting appropriate safeguards in place to ensure an adequate level of protection for the personal data. We will take reasonable steps to ensure the security of your personal data in accordance with applicable data protection laws.

When transferring your personal data outside the UK and Jersey, we will, where required by applicable law, implement at least one of the safeguards set out below. Please contact us if you would like further information on the specific mechanisms used by us when transferring your personal data outside the UK and Jersey.

Adequacy decisions We may transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Government (as applicable). Where applicable, this will include transfers based on the EU/US Data Protection Framework or UK equivalent.

Standard Contractual clauses Where we use certain service providers, we may use specific standard contractual clauses approved by the European Commission and/or the UK Government which give personal data the same protection it has in Europe and/or the UK.

Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected and in accordance with our data retention policies.

We may also retain your personal data for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

You have certain rights in relation to the personal data we hold about you. These rights include the right: (i) to obtain copies of your personal data; (ii) to have your personal data corrected or deleted; (iii) to limit the way in which your personal data is used; (iv) to object to our use of your personal data; (v) to transfer your personal data; (vi) not to be subject to decisions based on automated processing (including profiling); and (vii) to complain to a supervisory authority. If you would like to exercise any of these rights, please contact us using the details set out in the How to contact us section.

Your right of access If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.

Your right to rectification If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them.

Your right to erasure You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.

Your right to restrict processing You can ask us to “block” or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

Your right to data portability You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party.

Your right to object You can ask us to stop processing your personal data, and we will do so, if we are: (i) relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct marketing purposes.

Your rights in relation to automated decision-making and profiling You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract between you and us.

Your right to withdraw consent If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can exercise your right of withdrawal by contacting us using our contact details in the How to contact us section or by using any other opt-out mechanism we may provide, such as an unsubscribe link in an email.

Your right to lodge a complaint with the supervisory authority If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us using the contact details provided in the How to contact us section. As we are incorporated in the United Kingdom, our regulatory authority is the Information Commissioner’s Office (“ICO”). Contact details for the ICO can be found on its website at https://ico.org.uk.

In this schedule you can find detailed information about the personal data that we process and our reasons for processing it, including the lawful basis we rely on for doing so.

What personal data we process

Identity Data First name; middle name (where applicable / required); last name.

Contact Data Address; email address; telephone number.

Registration Data Date of birth; gender; country; nationality; username; any KYC information that we may collect; any other personal data that you may provide when you register for our Services.

Transaction Data Details about payments made between you and us; details of Services provided.

Profile Data Contact preferences; feedback and survey responses; the content of any messaging you send using any enquiry form on the Site.

Behavioural Data Data relating to your browsing activity or interaction with our emails, obtained through the use of cookies, and other similar technologies; information about when your current or previous sessions started; details about how you interacted with our Site.

Technical Data IP address; full web page URL; ad-click information in URL parameters; browser type, device type and operating system; geolocation; advertising identifiers (e.g. your IDFA) and any other unique numbers assigned to a device (including cookie identifiers).

Marketing and Communications Data Marketing preferences; service communication preferences.

Recruitment Data Date of birth; gender; country of residence; nationality; details of your eligibility to work (including documents and information that we may collect to verify this); your work preferences (including areas and dates where you are available for work); skills, qualifications, training and work history; any personal data which appears in your curriculum vitae or application; and any personal data that you volunteer during an interview or your interactions with us.