Data protection Statement

Introduction

Personal data is data which by itself or with other data available to Nobu Ltd can be used to identify you. Nobu Ltd is the data controller and this statement set out how we will use your personal data.

If you have any questions you can contact your data protection officer (DPO) in writing to the Data Protection Officer, Nobu Limited, 28 Bridle Path, Brafield on the Green, Northampton, NN7 1BP.

The types of personal data that is collected and the use we make of it

Your personal data will be used for the reasons set out below. The data will be used to manage your business as an Associate of Nobu Limited. Most of the data will be collected as part of the onboarding process of your limited company. Other items of personal data are collected due to business requirements. The personal data we collect and use may include:

Providing your personal data

We only ask for data that is mandatory for the purpose of engaging your services as a director of your limited company. These are driven either by:

1. Nobu Limited (Contractual agreements and Ts&Cs, NDA, setting up payment regime, etc.

2. The client for their onboarding processes (e.g. consortium agreements, NDAs, security clearances and transfers, etc.)

3. HMRC (e.g. intermediaries reporting – regulatory compliance)

Therefore, you must provide the information to enable us to process and meet the business need. If you should choose not to provide the data requested, then you are exercising your right to not do business with Nobu Limited.

Other personal data

We do not collect biometric data

Monitoring of personal communications

Subject to applicable law, we will monitor and record your emails, text messages and other communications in relation to our dealings with you. We will do this for regulatory compliance, self-regulatory practices, crime prevention and detection, to protect the security of our communication systems and procedures, to check for obscene or profane content, for quality control.

Using your personal data – the legal basis and purpose

We will process your personal data:

1. As necessary to perform our contract with you

2. As necessary for our own legitimate interests or those of other persons or organisations.

a. For good governance
b. To monitor emails and other communications

3. As necessary to comply with legal obligations

a. When you exercise your right under data protection law and make requests
b. For compliance under legal and regulatory requirements and related disclosures
c. For establishment and defense of legal rights
d. For activities relating to the prevention, detection and investigation of crime
e. To verify your identity
f. To monitor emails and other communications

4. Based on your consent

a. When you request us to disclose any personal details we hold to other people or organisations

b. When we process any special category of personal data about yourself at your request (e.g. racial or ethnic origin, data concerning your health, etc.)

c. You are free to withdraw your consent at anytime. However, the consequence of removing your consent may be that we cannot do business together

Sharing your personal data

• Subject to applicable data protection law, we may share your data with:
• Sub-contractors and other persons who help us provide our products and services
• Companies and other persons providing services to us
• Our legal and professional advisors, including our auditors
• Fraud prevention agencies
• Government bodies and Agencies in the UK and overseas (e.g. HMRC, MoD, etc.)
• Courts, to comply with legal requirements and for the administration of justice
• In an emergency or to otherwise protect your assets
• To protect the security and integrity of our business operations
• When you restructure or sell your business or its assets or have a merger or reorganisation where it affects the legal relationship between your company and Nobu Limited
• Anyone else where we have your consent or as required by law
• We will not share your data with market research organisation

Retention periods

The following criteria is used to determine data retention periods for your personal data:

Retention in case of a query

We will retain your personal data as long as necessary to deal with your query. (e.g. if we are collecting data for the purpose of a client engagement, if the application is unsuccessful then we will delete all the data provided for the purpose of engaging with that client.

Retention in accordance with legal and regulatory requirements

We will retain your personal data after your engagement with a client or when our Associate contract between Nobu Limited and your company expires based on our legal and regulatory requirements. Date will be held for not longer than is absolutely necessary.

Your rights under applicable data protection law

Your rights are as follows (noting that these rights do not apply in all circumstances):

• The right to be informed about our processing of your personal data
• The right to have your personal data corrected if inaccurate and to have incomplete personal data completed
• The right to object to us processing your personal data
• The right to restrict processing of your personal data
• The right to have your personal data erased (the right to be forgotten)
• The right to request access to your personal data and information about how it is processed
• The right to move, copy or transfer your personal data (data portability)
• Rights in relation to automated decision making including profiling

You have the right to complain to the Information Commissioner’s Office (ICO). The ICO has enforcement powers and can investigate compliance with data protection law.

Data anonymisation and aggregation

Your personal data may be converted into statistical or aggregated data which cannot be used to identify you. This can then be used to produce statistical research and reports. The aggregated data may be shared and used in all the ways described above.