Privacy Notice
Who We Are
Cronos Investment Management Limited ("Cronos", "we", "us", "our") is a discretionary investment manager registered in England and Wales. Our registered office is East Wing, The Stables, Whinchat Hall, Skipwith Road, Escrick, York YO19 6EJ.
Cronos is authorised and regulated by the Financial Conduct Authority. Our FCA firm reference number is 1046308, and our permissions can be checked on the FCA Register at www.register.fca.org.uk.
For the purposes of data protection law, Cronos is the data controller in respect of the personal data we hold about you. We are registered with the Information Commissioner's Office under registration number [ICO number to be inserted].
If you have any questions about how we use your personal data, or wish to exercise any of your rights, please contact our Data Protection Contact at the registered office address above, or by email to compliance@cronos-im.com.
What this notice covers
what personal data we collect about you;
why we collect it and the legal basis on which we do so;
how long we keep it;
who we share it with;
your rights in relation to your personal data; and
how to contact us or complain.
This notice applies to clients, prospective clients, representatives of adviser firms, and visitors to our website. It should be read alongside our Terms of Business and, where applicable, your Client Agreement.
The personal data we collect
Category
Legal Basis
Records of instructions given, trades executed and transactions carried out on your behalf.
Transaction data
We may also hold information about your health or personal circumstances where you tell us about a characteristic of vulnerability, so that we can adapt our service appropriately. We treat that information as special category data and only process it where we have your explicit consent or another lawful basis, and we will explain this to you at the time.
Why we use your personal data and our legal basis
Carrying out Know Your Client and anti money laundering checks
Legal obligation, Article 6(1)(c)
Assessing whether our services are suitable for you
Performance of a contract and legal obligation
Maintaining records required by the FCA
Legal obligation, Article 6(1)(c)
Providing periodic portfolio reports and required communications
Performance of a contract and legal obligation
Improving our services and internal risk management
Legitimate interests, Article 6(1)(f)
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms, and you may object to that processing at any time. Where we rely on consent, you may withdraw it at any time, which will not affect the lawfulness of processing carried out before withdrawal.
How long we keep your personal data
Type of record
Retention period
Suitability records and investment management records
Five years from the date of the record, under FCA requirements
Transaction and order records
Five years from the date of the transaction
Telephone and electronic communications relating to orders
Five years from the date of the recording
General correspondence
Six years
Recipient
Why
Full name, date of birth, nationality, and copies of identity documents such as a passport or driving licence, collected as part of our Know Your Client and anti money laundering obligations.
Identity information
Address, email address and telephone number.
Contact information
Details of your portfolio, asset values, income, tax status, bank account details and financial objectives.
Financial information
Investment experience and knowledge, attitude to risk, capacity for loss, financial circumstances, investment time horizon and any other information relevant to assessing whether our services are suitable for you.
Suitability information
Information gathered in connection with anti money laundering and counter terrorist financing checks.
Source of funds and wealth
Records of telephone calls, emails and written correspondence between you and Cronos.
Communications
Where you interact with our website or digital communications, standard technical data such as IP address, browser type and visit information.
Technical data
Legal basis under UK GDPR
Purpose
Performance of a contract, Article 6(1)(b)
Entering into and performing our agreement with you
Legal obligation, and our legitimate interests, Article 6(1)(f)
Handling complaints and enquiries
Legal obligation, Article 6(1)(c)
Complying with court orders or requests from regulators
Consent, or legitimate interests where permitted
Sending you updates about our services
Five years from the end of the client relationship, under the Money Laundering Regulations 2017
Client identity and Know Your Client records
Three years from the date the complaint was received, under FCA requirements
Complaints records
Indefinitely, reflecting the long term nature of the advice and the absence of a limitation period for certain claims
Pension related advice records
Where a record is subject to more than one retention period, we apply the longer. At the end of the applicable period, personal data is securely deleted or anonymised.
Who we share your personal data with
We share your personal data only where it is necessary to provide our services, where we are required to do so by law, or where you have consented.
To open and administer your account and to hold your assets. Depending on the service you receive this may include AJ Bell Investcentre, Transact or Third Platform Services Limited.
Custodians and platforms
Where you have been introduced to us by an authorised adviser firm, to the extent necessary to manage the relationship.
Adviser firms
Including the FCA, HMRC and other competent authorities, where required by law.
Regulators and law enforcement
Auditors, legal advisers and compliance consultants, subject to confidentiality obligations.
Professional advisers
Third parties who process personal data on our behalf as data processors under written data processing agreements.
Technology and operational providers
We do not sell your personal data to third parties.
International transfers
We aim to keep personal data within the United Kingdom. Where a transfer outside the UK is necessary, we ensure appropriate safeguards are in place under UK GDPR, including the UK International Data Transfer Agreement or an equivalent mechanism.
Your rights
Access. You may request a copy of the personal data we hold about you.
Rectification. You may ask us to correct data that is inaccurate or incomplete.
Erasure. In certain circumstances you may ask us to delete your data. This right is limited by our legal and regulatory obligations to retain records.
Restriction. You may ask us to restrict how we use your data in certain circumstances.
Portability. Where processing is based on consent or a contract, you may ask us to transfer your data in a structured, commonly used, machine readable format.
Objection. You may object at any time to processing based on legitimate interests, including direct marketing.
Automated decision making. We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects.
To exercise any of these rights, please contact us using the details above. We will respond within one calendar month. There is no fee, although we may charge a reasonable fee where a request is manifestly unfounded, repetitive or excessive.
Cookies and website use
Our website may use cookies and similar technologies. Where we use non essential cookies we will ask for your consent, in accordance with the Privacy and Electronic Communications Regulations 2003. Further detail is set out in our Cookie Policy.
Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it and, where the risk is high, inform you directly.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first so that we have the opportunity to put things right. You also have the right to complain to the Information Commissioner's Office.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website www.ico.org.uk.
Changes to this notice
We may update this notice from time to time. Where changes are significant we will tell you by email or by a prominent notice on our website.