WEBSITE PRIVACY, COOKIE AND DATA USE POLICY

• This policy, together with Website Terms & Conditions ,explains how any personal data we collect about you, whether from you, from a third party or that you provide to us, will be processed by us or any processor on our behalf.
• This policy applies to our legal relationship with you. You are therefore advised to read it carefully. Terms used within it shall have the meaning(s) given in the Data Protection Act 2018 (Act) and/or the General Data Protection Regulation (Regulation), as applicable.
• By visiting our Website located at www.SimpleCrowdfunding.co.uk (our Website), or by registering for an account with us, whether as an Investor (Investor Terms & Conditions) or as a Fundraiser you accept and consent to the practices described in this policy.
• Any changes we make to this policy will be posted on this page. For any changes that we consider important or which may affect your rights we will also email you using the most recent email contact address you have provided to us. You are advised to check back frequently as any changes will be binding on you when you continue to use the Website or our services after the date of the relevant change.
• For more information relating to your rights under this policy, please see section 12.
• If you have any queries relating to this policy, including exercising your rights under section 10, please contact Simple Crowdfunding at [email protected]
• You can opt-out of receiving marketing communications at any time by using the opt-out link at the bottom of any marketing communication you may receive from us, by updating your Communications Preferences settings if you are registered user (you must be logged in to your account), or by emailing us at [email protected]

• We are Focus 2020 Limited and Simple Property Ltd, whose registered office is at 128 City Road, London, EC1V 2NX. We jointly operate the Website and we are the joint data controllers for the purposes of the Act and the Regulation.
• We are registered with the ICO to process your data.  Our ICO registration numbers are: Simple Property Ltd, ZA013578 and Focus 2020 Ltd. ZA015199
• Your data may be processed on our behalf by various data processors including, but not limited to the following:
  • Terrasoft Global Limited, a company registered in England (number 06648693) (Bpm online), who provide Cloud services and are a data processor for the purposes of the Act and the Regulation
  • Sharein Limited, a company registered in Scotland (number SC408803) (ShareIn), who host our Website and are a data processor for the purposes of the Act and the Regulation.
  • Your data will be held on secure servers located within the UK and EU. Your data may also be transferred to locations outside the EU where the safeguarding criteria set out in Articles 44-50 of the GDPR are satisfied.
  • We operate on the terms of a written agreement with our data processors relating to your personal data.
    
  • A full list of the organisations we may use to process your data is available on request from [email protected].
• Any payment transactions you make through our Website will be made through ShareIn. ShareIn are a joint controller in respect of any personal data provided to them and any of your personal data they hold will be subject to their Privacy Policy.

• In accordance with our legal obligations and your legal rights under UK data protection legislation and under GDPR we will ensure that your personal data is processed lawfully, fairly, and transparently, without adversely affecting your rights. We will only process your personal data if at least one of the following bases applies:
  • You have given consent to the processing of your personal data for one or more specific purposes;
  • Processing is necessary for the performance of a contract to which you are a party or in order to take steps at the request of you prior to entering into a contract;
  • Processing is necessary for compliance with a legal obligation to which we are subject;
  • Processing is necessary to protect the vital interests of you or of another natural person;
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and/or
  • Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
• Unless required to do so by law, we will not otherwise share, sell or distribute any of the information you provide to us without your consent.

• We may collect all or some of the following categories of data from or about you:
  
• If you provide information about other people (for example, if you are acting on behalf of a Fundraiser and you provide information about directors, partners, members, shareholders or beneficial owners other than yourself) then you must provide a copy of this Privacy Policy to those persons and ensure that they are aware of and understand its contents. In addition, when providing information about other people, you must ensure that you have all relevant permissions and authority:
  • to make all those disclosures;
  • to act on their behalf; and
  • in relation to partners, members, shareholders or beneficial owners of Fundraisers, to allow us to make credit checks at credit reference agencies in respect of those persons.
• In addition to the above, where you register with us, other than as a Fundraiser, we will also provide you with your Account Details, which includes your username which is either created by, or assigned to, you. The Account Details should be remembered by you but will be stored by us in case you forget them.
• If you provide a video, photo or testimonial to us, we will consider this as consent. You may revoke your permission for any or all of these by emailing us at [email protected]. Where you revoke consent, we will not use your image, video or testimonial in any new publication, nor will we include this in any re-issued publication.

The data listed in section 4 is collected in the following ways:

• By you registering for an Account – this is any information you give to us that we request from you when signing-up for an Account to use our Website as an Investor or when applying to be a Fundraiser.
• Information collected – each time you visit our Website, whether through your home, work or a public network, your own computer or mobile device, we will automatically collect:
  • Technical information – your IP address (used by your computer or device to connect to the internet), and any internet browser type and version details; and
  • Visit-specific information – your URLs, Projects and Properties you viewed or searched for, your clickstream through the Website.
• Received from third parties – we work closely with a number of third party providers such as:
  • ShareIn, the party that holds client monies in segregated client bank accounts in connection with investments;
  • External credit reference agencies and teams;
  • Land Registry; and
  • Companies House
• Received through your interaction with us on social media such as Twitter, Facebook, Instagram etc.

• When you use and access our Website we may place a number of cookie files in your web browser.
• Some of the cookies are essential for proper operation of the site (essential cookies). If these cookies are disabled then the site will not function as intended and you will be unable to login as a registered user.
• In addition to these essential cookies, we may place cookies to record your preferences, statistical analysis of site usage and for marketing purposes. While we believe that these cookies all enhance your experience we can offer you as being a part of the Simple Crowdfunding community, you can disable any of these classes of cookies using this link, which also sets out the expiry times for each cookie.

• Your data is primarily necessary to verify who you are when accessing your Account and to ensure you meet our eligibility requirements in order to submit an Application and make an Investment.
• Additionally, we will use all of your data you provide us to notify you about:
  • Projects or properties listed on our Website; or
  • Changes to our Website or our services.
• We use any data we collect about you (as a result of your visit to our Website) to:
  • Personalise and improve our services (including the Website and its security);
  • Deal with your inquiries and requests;
  • Administer and monitor traffic and behaviours on our Website for analysis, troubleshooting, testing, research, statistical and survey purposes;
  • Ensure that any part of our Website (including any Content) is presented in the most effective manner for you and your computer or device, and to make improvements (where necessary); and
  • Keep our Website safe and secure.
• Where we make a significant change to our services, or any applicable terms and conditions, we will contact you.
• Any data we obtain about you from third parties are used for the purposes of verifying your eligibility to submit an application for fundraising or to make an investment through our Website, and are acquired only to the extent we are unable to do so as a result of the information you provide to us.
• Once collected, we may retain your data for up to six years, or as legally required following the date of your last Investment or the date you close your Account (whichever is the later). This is to enable us to refer back to any transactions or records you are involved in (should we be required to do so). In the event that we are required by UK legislation or by our Regulators to hold your data for longer period of time, we will advise you accordingly.

• We may disclose your personal data to other registered users of the Simple Crowdfunding Platform, including:
  • To operate our platform and seek to match Investors and Fundraisers;
  • In the investment contract and when Investors and Fundraisers are matched;
  • To provide transactional and performance information;
  • To provide updates (including if and when there are late payments or other potential or actual default events; and
  • If required to enforce (or make preparations to enforce) any loan or debt instrument contract.
    In this context, Investors may mean Individual Retail Investors, Corporate Investors, Trusts or Institutional Investors.
• If you, as a user of our platform, receive information about another user, then you must only:
  • Use that information to communicate with us about your investment contract with that user; and / or
  • Only use that information for the purpose for which it has been supplied. You acknowledge that we are not responsible for misuse of transactional or other information by other users, but you must inform us promptly if you are the victim of any misuse of that information.
• We may disclose your personal data:
  • To companies in our group and our affiliates;
  • To our suppliers, sub-contractors and third party data processors (including marketing and data analytics service providers, collection agents, tracing agents, insurers, insolvency practitioners, professional advisers and persons who provide us with the following services from time to time: identification and fraud check; marketing; technology; marketplace support; and back-up and business continuity);
  • With Fundraisers where you have made a pledge or investment into their project or business;
  • With any third party you have asked us to share your personal data with, including social media sites if you have asked us to connect with your social media account;
  • To credit reference and fraud prevention agencies (see sections 10 and 11 below for more information on this);
  • To a third party if it acquires all or part of our business or assets in connection with the acquisition, or to a successor in interest in the unlikely event of our insolvency, winding up or liquidation;
  • If we are required to do so by applicable law and regulation or by any governmental, tax, regulatory body or law enforcement agency;
  • If you are represented by an Agent, to your Agent; and
  • To any other person with your prior consent to do so.
• Third parties who process your personal data on our behalf are only permitted to process your personal data in accordance with our instructions and we take steps to ensure that the transfer and any on-going processing by those third parties is carried out securely and in accordance with applicable privacy laws.
• Save as expressly provided above, or otherwise without your consent, we will not share your personal data with any third party.
• Any websites which are linked from the Website are outside of our control and not covered by this policy. If you access those websites using the links provided, the website operators may collect information from you which will be used by them in accordance with their own privacy policies (if any). These policies may differ from ours, and we cannot accept any responsibility or liability in respect of these.

• We have put in place appropriate technical and organisational measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable Data Protection Laws.
• Each member of staff has unique log-in details and authentication software requires these to access the systems. Staff have access to personal data only for the purposes of performing their roles.
• We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

• Where we consider it appropriate we will undertake credit reference checks against Fundraisers and Investors (and against directors, partners, members, shareholders and beneficial owners of Fundraisers and Investors), guarantors and Agents:
  • As part of the application process, to assess creditworthiness and product suitability;
  • For general credit management, account management and identity/know-your-customer (KYC) checks during the term of an investment;
  • To trace and recover debts if there are late repayments or default; and
  • To prevent criminal activity.
• To do this, we will supply your personal information to CRAs and they will give us information about you, such as about your financial history. When CRAs receive a search request from us they will:
  • Place a credit search “footprint” on your business credit file following each credit application, whether or not your application proceeds. If the search was for a credit application the record of that search may be seen by other organisations when your business applies for credit in the future;
  • Place an enquiry or organisational search on the personal credit files of directors, partners, members, beneficial owners and shareholders that have been searched, as well as an associate enquiry search on your personal financial partner’s credit file, if they are a director;
  • Link together the previous and subsequent names advised by you of anyone that is a party to the account;
  • Place an enquiry or identification search on the record of any shareholder or beneficial owner and who we have checked; and
  • Create a record of the name and address of your business and its proprietors (if there is not one already).
• We may provide details of loans or debt instruments effected through our platform and how they are managed to the CRAs. Other organisations may see these updates, and this may affect your ability to obtain.
• Any records shared with CRAs will remain on file with them for six years after your account is closed, whether any outstanding sums have been settled by you or following a default. You can contact the CRAs currently operating in the UK. The information they hold may not be the same so you may consider contacting them all. They will charge you a small statutory fee.

• Should we suspect or identify fraud we may record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention including law enforcement agencies. We and FPAs may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• We and fraud prevention agencies process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify your identity in order to comply with our legal and regulatory obligations and to protect us and users of our marketplace and services. Such processing is a legal requirement if you request to invest or fundraise through our platform.
• We and other organisations may access and use this information in order to prevent fraud, money laundering or other criminal activity (for example, by checking details on credit applications, for managing credit and recovering debt). We may also use fraud prevention agencies to screen job applicants and employees.
• Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
• If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services you have requested, or we may stop providing existing services to you.
• A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you.
• Whenever fraud prevention agencies transfer your personal data outside the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to “international frameworks” intended to enable data sharing.

• In relation to all of your personal data, you have the following rights to ask us (in addition to any rights you may have under the Act or the Regulation):
  • Not to process your personal data for marketing purposes;
  • To clarify what data we hold about you, how it was obtained, to whom it has been disclosed and for how long it will be stored;
  • To amend any inaccurate data we hold about you;
  • To delete any of your data (where you no longer think we need to hold it or you think we have obtained it or processed it without your consent at any time); and
  • To only process your personal data in limited circumstances or for limited purposes.
• If you wish to exercise any of your rights at any time, please contact us on the details contained at the beginning of this policy in the first instance. We will require you to verify your identity to us before we provide any personal data, and reserve the right to ask you to specify the types of personal data to which your request relates.
• Where you wish to exercise any of your rights, they may be subject to payment of a nominal administration fee (to cover our costs incurred in processing your request) and any clarification we may reasonably require in relation to your request. Such fees may be charged where we consider (acting reasonably) that your request is excessive, unfounded or repetitive.
• Any data provided to you in accordance with your rights will be in a structured and machine-readable form.