WEBSITE PRIVACY, COOKIE AND DATA USE POLICY
Date last revised: 27th May 2019
PLEASE READ THIS POLICY CAREFULLY
Simple Crowdfunding (a trading name for Focus 2020 Limited and
Simple Property Ltd) (we/us/our) are committed to protecting and respecting
your personal data and your privacy. We recognise that your personal data is
your property and that you have provided it to us for specific purposes.
Unless otherwise required by law, the Information Commissioner’s
Office (ICO) guidance or best practice, or in order to perform our contract
with you, we will only process your personal data in the way we tell you or in
the way you ask us to, and we will give it back to you at any time.
1. THIS POLICY
1.1 This policy, together with our Website Terms & Conditions, explains how any personal data we collect about you, whether
from you, from a third party or that you provide to us, will be processed by us
or any processor on our behalf. 1.2 This policy applies to our legal relationship with
you. You are therefore advised to read it carefully. Terms used within it shall
have the meaning(s) given in the Data Protection Act 2018 (Act) and/or the
General Data Protection Regulation (Regulation), as applicable.
1.3 By visiting our Website located at www.SimpleCrowdfunding.co.uk
(our Website), or by registering for an account with us, whether as an Investor
(Investor Terms & Conditions) or as a Fundraiser you accept and consent to the practices
described in this policy.
1.4 Any changes we make to this policy will be posted on
this page. For any changes that we consider important or which may affect your
rights we will also email you using the most recent email contact address you
have provided to us. You are advised to check back frequently as any changes
will be binding on you when you continue to use the Website or our services
after the date of the relevant change.
1.5 For more information relating to your rights under
this policy, please see section 12.
1.6 If you have any queries relating to this policy,
including exercising your rights under section 10, please contact Simple
Crowdfunding at contact@simplecrowdfunding.co.uk
1.7 You can opt-out of receiving marketing communications
at any time by using the opt-out link at the bottom of any marketing
communication you may receive from us, by updating your Communications
Preferences settings if you are registered user (you must be logged
in to your account), or by emailing us at contact@simplecrowdfunding.co.uk
2.
WHO WE ARE
2.1 We are Focus 2020 Limited, registered office at HQS
Wellington, Victoria Embankment, London, England, WC2R 2PN and Simple Property Ltd, registered office
at 28 Spinis, Bracknell, RG12 8XA. We jointly operate the Website and we are
the joint data controllers for the purposes of the Act and the Regulation.
2.2 We are registered with the ICO to process your
personal data. The registration number of Focus 2020 Limited is ZA015199 and
the registration number of Simple Property Ltd is ZA013578.
2.3 Your data may be processed on our behalf by various
data processors including, but not limited to the following:
2.3.1
Terrasoft Global Limited, a company registered in
England (number 06648693) (Bpm online), who provide Cloud services and are a
data processor for the purposes of the Act and the Regulation
2.3.2
Sharein Limited, a company registered in Scotland
(number SC408803) (ShareIn), who host our Website and are a data processor for
the purposes of the Act and the Regulation.
2.3.3
Your data will be held on secure servers located
within the UK and EU. Your data may also
be transferred to locations outside the EU where the safeguarding criteria set
out in Articles 44-50 of the GDPR
are satisfied.
2.3.4
We operate on the terms of a written agreement with
our data processors relating to your personal data.
2.3.5
A full list of the organisations we may use to process
your data is available on request from contact@simplecrowdfunding.co.uk.
2.4 Any payment transactions you make through our Website
will be made through our approved third party payment provider MANGOPAY. MANGOPAY are a joint controller in respect of any personal data
provided to them and any of your personal data they hold will be subject to
their Privacy Policy.
3.
LEGAL BASIS
3.1 In accordance with our legal obligations and your
legal rights under UK data protection legislation and under GDPR we will ensure
that your personal data is processed lawfully, fairly, and transparently,
without adversely affecting your rights. We will only process your personal
data if at least one of the following bases applies:
3.1.1
You have given consent to the processing of your
personal data for one or more specific purposes;
3.1.2
Processing is necessary for the performance of a
contract to which you are a party or in order to take steps at the request of
you prior to entering into a contract;
3.1.3
Processing is necessary for compliance with a legal
obligation to which we are subject;
3.1.4
Processing is necessary to protect the vital interests
of you or of another natural person;
3.1.5
Processing is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority
vested in the controller; and/or
3.1.6
Processing is necessary for the purposes of the
legitimate interests pursued by us or by a third party, except where such
interests are overridden by the fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data
subject is a child.
3.2 Unless required to do so by law, we will not otherwise
share, sell or distribute any of the information you provide to us without your
consent.
4. WHAT WE COLLECT
4.1 We may collect all or some of the following categories
of data from or about you:
4.2 If you provide information about other people
(for example, if you are acting on
behalf of a Fundraiser and you provide information about directors, partners,
members, shareholders or beneficial owners other than yourself) then you must
provide a copy of this Privacy Policy to those persons and ensure that they are
aware of and understand its contents.
In addition, when providing information about other people, you must
ensure that you have all relevant permissions and authority: (a) to make all
those disclosures; (b) to act on their behalf; and (c) in relation to partners,
members, shareholders or beneficial owners of Fundraisers, to allow us to make
credit checks at credit reference agencies in respect of those persons.
4.3 In addition to the above, where you register with us,
other than as a Fundraiser, we will also provide you with your Account Details,
which includes your username which is either created by, or assigned to, you.
The Account Details should be remembered by you but will be stored by us in
case you forget them.
4.4 If you provide a video, photo or testimonial to us, we
will consider this as consent. You may
revoke your permission for any or all of these by emailing us at contact@simplecrowdfunding.co.uk. Where you revoke consent,
we will not use your image, video or testimonial in any new publication, nor
will we include this in any re-issued publication.
5. HOW WE COLLECT YOUR DATA
The data listed in section 4 is collected in the following ways:
5.1 By you registering for an Account – this is any
information you give to us that we request from you when signing-up for an
Account to use our Website as an Investor or when applying to be a Fundraiser.
5.2 Information collected – each time you visit our
Website, whether through your home, work or a public network, your own computer
or mobile device, we will automatically collect:
5.2.1
Technical information – your IP address (used by your
computer or device to connect to the internet), and any internet browser type
and version details; and
5.2.2
Visit-specific information – your URLs, Projects and
Properties you viewed or searched for, your clickstream through the Website.
5.3 Received from third parties – we work closely with a
number of third party providers such as:
5.3.1
Our authorised payment gateway, Mangopay SA.;
5.3.2
External credit reference agencies and teams;
5.3.3
Land Registry; and
5.3.4
Companies House
5.4 Received through your interaction with us on social
media such as Twitter, Facebook, Instagram etc.
6. COOKIES
6.1 When you use and access our Website we may place a
number of cookie files in your web browser.
6.2 Some of the cookies are essential for proper operation
of the site (essential cookies). If
these cookies are disabled then the site will not function as intended and you
will be unable to login as a registered user.
6.3 In addition to these essential cookies, we may place cookies to record
your preferences, statistical analysis of site usage and for marketing
purposes. While we believe that these
cookies all enhance your experience we can offer you as being a part of the
Simple Crowdfunding community, you can disable any of these classes of cookies
using this link, which also sets out the expiry times for each cookie.
7. WHAT WE DO WITH YOUR DATA
7.1 Your data is primarily necessary to verify who you are
when accessing your Account and to ensure you meet our eligibility requirements
in order to submit an Application and make an Investment.
7.2 Additionally, we will use all of your data you provide
us to notify you about:
7.2.1
Projects or properties listed on our Website; or
7.2.2
Changes to our Website or our services.
7.3 We use any data we collect about you (as a result of
your visit to our Website) to:
7.3.1
Personalise and improve our services (including the
Website and its security);
7.3.2
Deal with your inquiries and requests;
7.3.3
Administer and monitor traffic and behaviours on our
Website for analysis, troubleshooting, testing, research, statistical and
survey purposes;
7.3.4
Ensure that any part of our Website (including any
Content) is presented in the most effective manner for you and your computer or
device, and to make improvements (where necessary); and
7.3.5
Keep our Website safe and secure.
7.4 Where we make a significant change to our services, or
any applicable terms and conditions, we will contact you.
7.5 Any data we obtain about you from third parties are
used for the purposes of verifying your eligibility to submit an application for
fundraising or to make an investment through our Website, and are acquired only
to the extent we are unable to do so as a result of the information you provide
to us.
7.6 Once collected, we may retain your data for up to six
years, or as legally required following the date of your last Investment or the
date you close your Account (whichever is the later). This is to enable us to
refer back to any transactions or records you are involved in (should we be
required to do so). In the event that
we are required by UK legislation or by our Regulators to hold your data for
longer period of time, we will advise you accordingly.
8. HOW AND WHY WE DISCLOSE YOUR DATA
8.1 We may disclose your personal data to other registered
users of the Simple Crowdfunding Platform, including:
8.1.1
To operate our platform and seek to match Investors
and Fundraisers;
8.1.2
In the investment contract and when Investors and Fundraisers
are matched;
8.1.3
To provide transactional and performance information;
8.1.4
To provide updates (including if and when there are
late payments or other potential or actual default events; and
8.1.5
If required to enforce (or make preparations to
enforce) any loan or debt instrument contract.
In this context, Investors may mean
Individual Retail Investors, Corporate Investors, Trusts or Institutional Investors.
8.2 If you, as a user of our platform, receive information
about another user, then you must only:
8.2.1
Use that information to communicate with us about your
investment contract with that user; and / or
8.2.2
Only use that information for the purpose for which it
has been supplied.
You acknowledge that we are not responsible
for misuse of transactional or other information by other users, but you must
inform us promptly if you are the victim of any misuse of that information.
8.3 We may disclose your personal data:
8.3.1
To companies in our group and our affiliates;
8.3.2
To our suppliers, sub-contractors and third party data
processors (including card payment and direct debit payment processors,
marketing and data analytics service providers, collection agents, tracing
agents, insolvency practitioners, professional advisers and persons who provide
us with the following services from time to time: identification and fraud
check; marketing; technology; marketplace support; and back-up and business
continuity);
8.3.3
With Fundraisers where you have made a pledge or
investment into their project or business;
8.3.4
With any third party you have asked us to share your
personal data with, including social media sites if you have asked us to
connect with your social media account;
8.3.5
To credit reference and fraud prevention agencies (see
sections 10 and 11 below for more information on this);
8.3.6
To a third party if it acquires all or part of our
business or assets in connection with the acquisition, or to a successor in
interest in the unlikely event of our insolvency, winding up or liquidation;
8.3.7
If we are required to do so by applicable law and
regulation or by any governmental, tax, regulatory body or law enforcement
agency;
8.3.8
If you are represented by an Agent, to your Agent; and
8.3.9
To any other person with your prior consent to do so.
8.4 Third parties who process your personal data on our
behalf are only permitted to process your personal data in accordance with our
instructions and we take steps to ensure that the transfer and any on-going
processing by those third parties is carried out securely and in accordance
with applicable privacy laws.
8.5 Save as expressly provided above, or otherwise without
your consent, we will not share your personal data with any third party.
8.6 Any websites which are linked from the Website are
outside of our control and not covered by this policy. If you access those
websites using the links provided, the website operators may collect
information from you which will be used by them in accordance with their own
privacy policies (if any). These policies may differ from ours, and we cannot
accept any responsibility or liability in respect of these.
9. SECURITY
9.1 We have put in place appropriate technical and
organisational measures to help protect your personal information from
unauthorised access, use, disclosure, alteration or destruction consistent with
applicable Data Protection Laws.
9.2 Each member of staff has unique log-in details and
authentication software requires these to access the systems. Staff have access
to personal data only for the purposes of performing their roles.
9.3 We have put in place procedures to deal with any
suspected personal data breach and will notify you and any applicable regulator
of a breach where we are legally required to do so.
10. CREDIT REFERENCE AGENCIES
10.1 Where we consider it appropriate we will undertake credit
reference checks against Fundraisers and Investors (and against directors,
partners, members, shareholders and beneficial owners of Fundraisers and Investors),
guarantors and Agents:
10.1.1
As part of the application process, to assess
creditworthiness and product suitability;
10.1.2
For general credit management, account management and
identity/know-your-customer (KYC) checks during the term of an investment;
10.1.3
To trace and recover debts if there are late
repayments or default; and
10.1.4
To prevent criminal activity.
10.2 To do this, we will supply your personal information
to CRAs and they will give us information about you, such as about your
financial history. When CRAs receive a search request from us they will:
10.2.1
Place a credit search “footprint” on your business
credit file following each credit application, whether or not your application
proceeds. If the search was for a credit application the record of that search
may be seen by other organisations when your business applies for credit in the
future;
10.2.2
Place an enquiry or organisational search on the
personal credit files of directors, partners, members, beneficial owners and
shareholders that have been searched, as well as an associate enquiry search on
your personal financial partner’s credit file, if they are a director;
10.2.3
Link together the previous and subsequent names
advised by you of anyone that is a party to the account;
10.2.4
Place an enquiry or identification search on the
record of any shareholder or beneficial owner and who we have checked; and
10.2.5
Create a record of the name and address of your
business and its proprietors (if there is not one already).
10.3 We may provide details of loans or debt instruments
effected through our platform and how they are managed to the CRAs. Other
organisations may see these updates, and this may affect your ability to obtain
10.4 Any records shared with CRAs will remain on file with them for six
years after your account is closed, whether any outstanding sums have been
settled by you or following a default. You can contact the CRAs currently
operating in the UK. The information they hold may not be the same so you may
consider contacting them all. They will
charge you a small statutory fee.
11. FALSE INFORMATION AND FRAUD PREVENTION
11.1 Should we suspect or identify fraud we may record this
and may also pass this information to fraud prevention agencies and other
organisations involved in crime and fraud prevention including law enforcement
agencies. We and FPAs may also enable law enforcement agencies to access and
use your personal data to detect, investigate and prevent crime.
11.2 We and fraud prevention agencies process your personal
data on the basis that we have a legitimate interest in preventing fraud and
money laundering, and to verify your identity in order to comply with our legal
and regulatory obligations and to protect us and users of our marketplace and
services. Such processing is a legal requirement if you request to invest or
fundraise through our platform.
11.3 We and other organisations may access and use this
information in order to prevent fraud, money laundering or other criminal
activity (for example, by checking details on credit applications, for managing
credit and recovering debt). We may also use fraud prevention agencies to screen
job applicants and employees.
11.4 Fraud prevention agencies can hold your personal data
for different periods of time, and if you are considered to pose a fraud or
money laundering risk, your data can be held for up to six years.
11.5 If we, or a fraud prevention agency, determine that
you pose a fraud or money laundering risk, we may refuse to provide the
services you have requested, or we may stop providing existing services to you.
11.6 A record of any fraud or money laundering risk will be
retained by the fraud prevention agencies, and may result in others refusing to
provide services, financing or employment to you.
11.7 Whenever fraud prevention agencies transfer your
personal data outside the European Economic Area, they impose contractual
obligations on the recipients of that data to protect your personal data to the
standard required in the European Economic Area. They may also require the
recipient to subscribe to “international frameworks” intended to enable data
sharing.
12. YOUR RIGHTS
12.1 In relation to all of your personal data, you have the
following rights to ask us (in addition to any rights you may have under the
Act or the Regulation):
12.1.1
Not to process your personal data for marketing
purposes;
12.1.2
To clarify what data we hold about you, how it was
obtained, to whom it has been disclosed and for how long it will be stored;
12.1.3
To amend any inaccurate data we hold about you;
12.1.4
To delete any of your data (where you no longer think
we need to hold it or you think we have obtained it or processed it without
your consent at any time); and
12.1.5
To only process your personal data in limited
circumstances or for limited purposes.
12.2 If you wish to exercise any of your rights at any
time, please contact us on the details contained at the beginning of this
policy in the first instance. We will require you to verify your identity to us
before we provide any personal data, and reserve the right to ask you to
specify the types of personal data to which your request relates.
12.3 Where you wish to exercise any of your rights, they
may be subject to payment of a nominal administration fee (to cover our costs
incurred in processing your request) and any clarification we may reasonably
require in relation to your request. Such fees may be charged where we consider
(acting reasonably) that your request is excessive, unfounded or repetitive.
12.4 Any data provided to you in accordance with your
rights will be in a structured and machine-readable form.