Privacy Policy

TISA UNIVERSAL REPORTING NETWORK LIMITED

Last Updated: 23 July 2024

1. INTRODUCTION

1.1 TISA Universal Reporting Network (“TURN”) collects your information. “you” and “your” means any natural or legal person who uses the website and each entity on whose behalf they act.

1.1.1 This privacy policy (the “Privacy Policy”) sets out the Personal Data which TURN will collect in relation to a User’s Representatives (defined in paragraph 1.3) and how TURN will use, store and Process that Personal Data. It also explains a User Representative’s rights in relation to their Personal Data and how to contact TURN or the relevant Regulator in the event a User’s Representative has a complaint. It is to be read in conjunction with the Participation Agreement available on the TURN website. In this Privacy Policy:

1.1.2 the terms “Controller”, “Data Subject“, “Personal Data“, “Processor“, and ”Processing“ will have the meanings given in the Data Protection Laws (and “Process” and ”Processed“ shall be construed accordingly);

1.1.3 “Criminal Convictions Data” means Personal Data relating to the commission (or alleged commission) of any offence or proceedings for any offence committed (or alleged to have been committed) or the disposal of such proceedings or sentence in such proceedings;

1.1.4 “Data Protection Laws” shall be defined as: (a) any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) which relates to the protection of individuals with regards to the Processing of Personal Data to which a party is subject, including (i) EU Regulation 2016/679 (General Data Protection Regulation (the “GDPR“)) or, after the implementation period within the meaning of the European Union (Withdrawal Agreement) Act 2020, all legislation enacted in the UK in respect of the protection of Personal Data, and (ii) Member State laws or regulations relating to the Processing and protection of Personal Data implementing GDPR, including the UK Data Protection Act 2018; and (b) any code of practice or guidance published by the UK Information Commissioner’s Office (or equivalent regulatory body from time to time); and

1.1.5 “Special Category Personal Data” means any Personal Data revealing: (i) racial or ethnic origin; (ii) political opinions; (iii) religious or philosophical beliefs; (iv) trade union membership; (v) health related information; or (vi) sexual orientation or providing details concerning a natural person’s sex life. It also covers any information in relation to the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person.

1.2. TURN will notify Users of any changes to this Privacy Policy by email to the User where:

1.2.1 TURN are making substantial changes to the Policy: or

1.2.2 TURN are processing Personal Data in a way which might not be expected based on what is set out in this Privacy Policy.

Otherwise, any updates to this Privacy Policy will be notified to Users by posting details on the TURN Website with a clearly highlighted banner on the homepage of the TURN website.

1.3 In this Privacy Policy “User Representatives” in relation to each User means:

1.3.1 a person nominated by User to have access to the TURN platform under the terms of the Participation Agreement;

1.3.2 the representatives of such User’s operational team and senior management to whom disputes will be;

1.3.3 any other individual representative of such User, whether nominated as a second contact and/or responsible for any day-to day technical or other issues in relation to TURN; and

1.3.4 any individual agent for such User with whom TURN, or any other User is expected to deal.

1.4 For the purposes of the Data Protection Laws, TURN is both the Controller and the Processer of the Personal Data as defined by this Privacy Policy. However, each User is a Controller in its own right of the Personal Data relating to their respective User Representatives and such Processing by the User will be governed by that User’s privacy policy.

2. COLLECTION OF PERSONAL DATA

2.1 TURN will collect User Personal Data, such as the name, address, telephone, job title and business email contact details for each User Representative, for use by TURN and/or other Users for the TURN Purposes (as defined in Paragraph 3.1). Each User will promptly update TURN on any changes to the Personal Data in relation to its User Representatives in writing.

2.2 Each User must obtain all necessary authority from each of its User Representatives for the communication of the relevant User Personal Data to TURN for use in accordance with this Privacy Policy (as amended from time to time in accordance with its terms) and undertakes to keep each of its User Representatives informed as to how their Personal Data may be used.

2.3 TURN does not require any Special Category Personal Data or Criminal Convictions Data for the TURN Purposes (together referred to as “Sensitive Personal Data”). TURN requests Users do not communicate (and to procure that none of its User Representatives communicate) to TURN any “Sensitive Personal Data”. If any User (or any of its User Representatives) nevertheless communicates any such Sensitive Personal Data to TURN, such User agrees (and will procure that its relevant User Representative agrees) that TURN may Process such User Personal Data for the TURN Purposes.

2.4 TURN may monitor or record any communications with any User Representative to improve its services and/or for security and/or regulatory purposes.

2.5 If any person’s application to participate in TURN is rejected, TURN may retain for not more than six months, or such longer period as is necessary any Personal Data relating to any individual who would have been a User Representative had the application been successful.

3. TURN’S USE OF PERSONAL DATA AND LEGAL BASIS FOR PROCESSING

3.1 Data Protection Laws require that TURN meet certain conditions before TURN is allowed to collect and process any Personal Data. For Personal Data which is not Sensitive Personal Data under Data Protection Laws, unless otherwise notified, TURN may rely on a condition known as “legitimate interests” in order to Process the User Representatives Personal Data for the above specified purposes. For example, it is in TURN’s legitimate interests to Process User Representatives Personal Data where it is required by TURN in connection with the following purposes (together the “TURN Purposes”):

3.1.1 maintenance of details of each User Representative;

3.1.2 giving notice to each User of notices required or permitted to be given pursuant to the Participation Agreement;

3.1.3 as otherwise required for the proper operation of TURN in accordance with the Participation Agreement; and

3.1.4 meeting legal obligations under Data Protection Laws to hold necessary information as part of our data protection impact assessments and compliance programme record-keeping obligations, and, except as provided in Paragraphs 4 and 5, will not use any User Personal Data for any other reason without the prior consent of such User Representative.

3.2 It is in TURN’s “legitimate interests” to Process the User Personal Data in connection with the TURN Purposes as it allows TURN to operate TURN in an effective and efficient manner.

3.3 Where TURN is relying on “legitimate interests”, TURN will ensure that the collection and Processing of User Personal Data:

3.3.1 is kept to a minimum with regards to the amount of data collected and the extent of any Processing;

3.3.2 will not be overly intrusive; and

3.3.3 will be proportionate in order to meet TURN’s legitimate interests, as above.

3.3.4 by pursuing its legitimate interests, the rights and freedoms of those individuals are not seriously impacted

3.4 Consent; where we send direct marketing material via email to non-Users of TURN, we have applied the legal basis of consent to also comply with direct marketing regulations as set out in the Privacy and Electronic Communications Regulations (PECR). Consent can be withdrawn at any time, by opting out of marketing communications via the TURN Website.

3.5 This website is hosted by Digital Ocean managed by our service provider Makilo in the UK.

Our site may contain links to websites of various third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these

4. SHARING OF PERSONAL DATA

4.1 Each User acknowledges and agrees that the other Users will have the right to access and use for the purposes of the operation of TURN (including resolution of disputes, and to give notice to any other User in accordance with the Participation Agreement) any and all data relating to its User Representatives.

4.2 TURN will not share any User Personal Data with anyone except that TURN may disclose such Personal Data:

4.2.1 to other Users in accordance with the Participation Agreement;

4.2.2 to third parties for administrative reasons, for example TURN’s advisers and third parties providing services to TURN (including, in particular FundAdminChain) Before sharing Personal Data with any such third party, TURN will require such third party to undertake to Process such Personal Data only in accordance with TURN’s instructions and to provide guarantees in respect of the technical and organisational security measures protecting its data Processing activities; and/or

4.2.3 where there is a legitimate reason for disclosure or obligation to disclose, such as a Court order or to a Regulator, or to bring or defend legal proceedings.

4.2.4 Other third-party providers that your data will be processed in are:

Workbooks https://www.workbooks.com/wp-content/uploads/privacy-notice.pdf

Sage https://www.sage.com/en-gb/legal/privacy-and-cookies/

Microsoft https://privacy.microsoft.com/en-gb/privacystatement

5. SALE OF TURN’S BUSINESS

5.1 In the unlikely event that any or all of the operations of TURN are sold or otherwise transferred to another entity (the “Transferee“), the Personal Data relating to each User Representative may be transferred to the Transferee for its continued use, storage and Processing in accordance with this Privacy Policy.

6. WHERE USER PERSONAL DATA IS HELD

6.1 User Personal Data may be held at TURN offices and those of TURN’s group companies, third party agencies, service providers (including, in particular FundAdminChain) representatives and agents as described above in Paragraph 4.

6.2 Some of these third parties may be based outside the UK and/ or European Economic Area. For more information, including on how TURN safeguards the User Personal Data when this occurs, see Paragraph 7.

7. TRANSFER OUTSIDE THE UK AND/ OR EUROPEAN ECONOMIC AREA

7.1 TURN will not transfer, Process or store (or permit the transfer, Processing or store of) User Personal Data in a country outside the UK and/ or EEA unless:

7.1.1 there has been a finding by the European Commission that such country ensures an adequate level of protection for the rights and freedoms of Data Subjects in relation to the Processing of Personal Data transferred to such country;

7.1.2 TURN has first put in place the EU Standard Contractual Clauses for the transfer of Personal Data to Controllers or Processors (as appropriate) established outside the UK and/ or EEA and has put in place any additional safeguards that are required; or

7.1.3 TURN has first put in place appropriate measures to ensure that such Personal Data is adequately protected by such other method as may be agreed from time to time by the Users affected by the proposed transfer (each User acting on behalf of its User Representatives) and TURN.

8. RIGHTS OF DATA SUBJECTS

8.1 Under Data Protection Laws, User Representatives have the following rights in relation to their Personal Data:

8.1.1 right to have Personal Data rectified if inaccurate/incomplete;

8.1.2 right to object to direct marketing;

8.1.3 in certain circumstances, the right:

(a) to have personal data erased or removed, and where the Personal Data has been made public, that other Controllers Processing the Personal Data also erase links to, or copy or replication of, such Personal Data;

(b) to restrict the Processing of Personal Data;

(d) to not be subjected to automated decision making (including profiling) where it produces a legal effect or a similarly significant effect; and

(e) the right to bring a civil action if there is a breach of the Data Protection Laws.

8.2 Each User Representative has the right to request access to the Personal Data held about him. As a Data Subject, each User Representative has the right to ask TURN for a copy of the Personal Data about such User Representative held by TURN.

8.3 To exercise a Data Subject right under the Data Protection Laws, each User Representative should make a request in writing to TURN at enquiries@tisaturn.com.

9. CONTACT TURN AND COMPLAINTS

9.1 If any User, or any User Representative, has any queries in relation to this Privacy Policy, such User or such User Representative (as appropriate) should contact TURN at enquiries@tisaturn.com.

9.2 If any User, or any User Representative, is not happy with the way in which Personal Data is held or Processed by TURN, or if any User, or any User Representative is not satisfied with TURN’s handling of any request in relation to the rights of Data Subjects, TURN requests that in the first instance a complaint is made to the TURN Company Secretary at the contact details set out above. However, any User, or User Representative, always has the right to complain regarding data protection matters to the ICO at: https://ico.org.uk/make-a-complaint/. The ICO is the UK’s independent body set up to uphold information rights. More about the ICO can be found on its website (https://ico.org.uk/).