1. Introduction 

We understand that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our clients and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

In this privacy notice, we explain how Vega processes the personal data of individuals and organisations who have registered to use our services. This privacy notice explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.

Vega Investment Technologies, Limited (Vega, we, our) is registered as a controller with the Information Commissioner’s Office (ICO) under registration number: C1325431. 

Vega can be contacted through postal mail on 22-25 Portman Close, W1H 6BS, London or through email on privacy@vega.investments. Usman Ahmed, our Data Protection Officer will be able to assist you with any questions.

2. What is Personal Data?

Personal data refers to information about an individual or, alternatively, information from which an individual can be identified. 

‍
Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

The personal data that we use is set out in section 4 below.

3. What Are Your Rights?

Under data protection legislation, you have the following rights, which we will always work to uphold:

1. The right to be informed about our collection and use of your personal data. This privacy notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in section 1 of this privacy notice. 

2. The right to access the personal data we hold about you. You are entitled to receive confirmation that we process your personal data and for a copy of such personal data to be sent to you. Section 9 of this privacy notice tells you how to request this information.

3. The right to have any of the personal data which we hold about you rectified if any of it is inaccurate or incomplete. Please contact us using the details in section 1 of this privacy notice to find out more.

4. The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have if there is no valid legal basis for processing to continue. Please contact us using the details in section 1 of this privacy notice to find out more.

5. The right to restrict the processing of your personal data. You have this right if any of the following apply: (i) the accuracy of the personal data is contested (this applies until such time as we have verified its accuracy); (ii) the processing is unlawful and you would rather restrict processing than have your personal data erased; (iii) we no longer need to process your personal data but you require us to retain it for the establishment, exercise or defence of a legal claim; or (iv) we are processing your personal data on the basis of legitimate interests, you have objected to processing and a decision on whether our or others’ legitimate interests override your interests is pending..

6. The right to object to us using your personal data if our processing is carried out on the basis of legitimate interests. Please note, however, that should we determine that our or others’ interests are so compelling as to override your objection we may continue to process your personal data. You also may object to receiving direct marketing at any time.

7. The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data in a structured, commonly used and machine-readable format to re-use with another service or business in many cases. This right extends to you being able to request that such data is sent to a third-party controller. 

8. Rights relating to automated decision-making and profiling. Depending on the Vega products or services you use, we may make automated decisions about you. This means that we may use technology that can evaluate your personal circumstances and other factors to predict risks or outcomes. This is sometimes known as profiling. We do this for the efficient running of our services and to ensure decisions are fair, consistent and based on the right information. Where we make an automated decision about you, you have the right to ask that it is manually reviewed by a person. For example, we may make automated decisions about you when it comes to opening accounts, such as KYC, anti-money laundering and sanctions checks, identity and address check, or for detecting fraud by  monitoring your account to detect fraud and financial crime  Our legal basis for automated decision making is that it is necessary to perform the services under the agreements between you and us and, authorisation under law. 

   
   

For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in section 1 of this privacy notice.

Further information about your rights can also be obtained from the ICO or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with a supervisory authority – in the UK, this is the ICO (https://ico.org.uk).

‍

4. What Personal Data Do We Collect and How?

We collect your personal data directly from you, including when you use our website and website-application, and when you create and use an account with us and when you contact us. 

In the future, we may also collect your personal data from third parties, for example, our business clients who might provide us with your contact details so that we can email you and ask you to create an account with us and/or information about any products or services you are receiving from them. We may also collect your personal data from other third parties, such as those listed in section 7 of this privacy notice.  

We may collect some or all of the personal data set out below:

• Contact details, for example, name, email address, telephone number

• Information relating to your Vega account, for example, username, password, geographic location, authentication codes, and links to reset your password.

• Any other information you voluntarily provide to Vega during your use of the product, for example, account number, sort-code, personal data included in any correspondence you have with Vega.

• other information such as your job title, salary or net worth.

• In most cases, we will collect the Personal Data directly from you but may also obtain it from other sources. Personal details, such as (e.g. name, gender, date and place of birth, occupation, address, email address, phone numbers, identity documents, financial information and other contact details).

• other materials we may need for our identification and compliance obligations as well as information from third party providers who assist us to combat fraud, money laundering and other crimes.

• complaints or disputes you may have had with us and details of the underlying transaction (where applicable).

• sales and marketing information.

• financial information and transactions records.

• records of correspondence and other communications between you and your representatives (where applicable).

• information that we need to support our regulatory obligations.

• Vega does not normally collect any special category personal data. In the event that special category personal data is provided to Vega, this will have been communicated to you.

If you have an account with Vega, you should regularly check your details in your account to ensure that any personal data provided remains up to date.

5. How Do We Use Your Personal Data?

We set out below the purposes for which Vega processes your personal data and the lawful bases for processing your personal data: 

1. Create and manage your Vega account: we need to do a few things with your personal data in order to create and manage your Vega account, which includes:

   1. Onboarding and due diligence: we will share your data with third parties for the purposes of undertaking due diligence and know your customer checks

   2. Transaction monitoring: we will share your data with third parties for the purposes of financial crime prevention and detection

   3. For private market investments, we will share your data with third party fund administrators in order to facilitate your investments

   4. For public market investments, we will share your data with third party brokers and custodians in order to facilitate your investments

   5. If you use our referral programme we may need to share your full name with the Vega Member who referred you in order to process the referral and continue with your account creation

   Lawful basis for processing: Consent

2. Respond to any query you may have

   Lawful basis for processing: Consent and legitimate interest in running our business and assisting you as best we can

3. Record and analyse any communications and complaints from you for product/service improvement and training

   Lawful basis for processing: Legitimate interest in improving our services

4. Sending you service updates
   Lawful basis for processing: Legitimate interest in ensuring you are able to use our services with as little disruption as possible 

5. To monitor and analyse your use of our website and services
   Lawful basis for processing: Legitimate interest in ensuring our website and services are as useful as possible for you

6. To administer and protect our business, website and services including troubleshooting, data analysis and system testing
   Lawful basis for processing: Legitimate interest in running and improving our business, provide IT and admin services, including network security

7. To send you product and service updates 

   Lawful basis for processing: Legitimate interest in growing our business and providing you with products or services you may find useful based on your use of our services 

8. To send you marketing communications:

   1. We may send you marketing communications via email to the email address you used to register with Vega

   2. We may send you marketing communications via physical post, requiring the processing of your full name and address

   3. We may send you marketing communications on special occasions, such as your birthday, and so will need to process your date of birth

   Lawful basis for processing: Consent

9. To share data with third party service providers which we may use
   Lawful basis for processing: Legitimate interest in using existing specialist providers to run our business as efficiently as possible whilst improving the Vega service offering

10. Day to day business operations

    Lawful basis for processing: Legitimate interest in running our business

11. To administer a sale or possible sale of the whole or part of our business or the restructuring of our business
    Lawful basis for processing: Legitimate interest in facilitating such a transaction or restructuring 

Other reasons we may process your personal data include:

• To comply with any legal obligation we are under.

• For additional purposes in the future, but only if such purposes are compatible with those listed above and if we believe that the same lawful basis applies.

In certain circumstances, failure to provide us with personal data about you may prevent us from performing any legal obligations to you. For example, if you make a data subject access request, we may need to verify who you are before providing personal data to you; if you do not provide the information we reasonably need to verify your identity, we may not be able to comply with the subject access request.

6. How Long Will We Keep Your Personal Data?

We will not keep your personal data for any longer than is necessary to process the personal data for the reason(s) for which it was first collected. Your personal data will therefore be kept for the following periods (or, where there is no fixed period, the following factors will be used to determine how long it is kept):

• If you make an inquiry but do not engage with our services, we will keep your personal data for 3 months from the date of last communication.

• If you engage our services, we will keep your personal data for 7 years from the date of last communication.

• If you unsubscribe from our marketing communications, we will maintain a record of your unsubscribe request and associate it with your email address to ensure you do not receive future communications.    

7. Do We Share Your Personal Data?

We set out below the circumstances in which your personal data might be shared with third parties:

• Service providers: We share the personal data collected by Vega with service providers we use to help us operate our business, including organisations that provide us with technology-related services, such as AWS, Intercom, Cloud Computing Services, Data Storage Service Providers, Website Hosting Service Providers, and Communication & Collaboration Tools. We may also need to share your personal data with contractors we engage.

• HMRC and law enforcement agencies: We may also disclose your personal data to HMRC and/or law enforcement agencies in order to assist with any investigations, when we bring a claim or defend ourselves against a claim that requires the disclosure of the personal data, and when we engage professional advisors.

• Sale/restructuring: We may also transfer your personal data to third parties in the context of a sale or possible sale of the whole of or part of our business or the restructuring of our business.

• Business Tools and Platforms: We might share your data with third-party platforms that assist in our operations. This can include Data Analytics Services, Performance Monitoring Tools, Product Engineering & Design Tools, Retargeting Platforms, Sales & Marketing Tools, Testing Tools, and Finance & Accounting Tools.

• Marketing and Advertisements: Your personal information may be shared with Affiliate Marketing Programs, Ad Networks, and Retargeting Platforms to help us promote our services.

• Payment and Financial Checks: To process transactions, assess creditworthiness, and manage financial risks, we may share your details with Payment Processors and Credit Reference Agencies (CRAs). By working with CRAs, we aim to verify your identity, assess product suitability, manage your account, trace and recover debts, and prevent illegal activities. As part of this cooperation, we will periodically update CRAs on your financial activities, and they may share this data with other organisations. Furthermore, your personal data may be associated with the data of your spouse, joint applicants, or other financial associates.

• Account Management: To ensure user safety and offer reliable services, we collaborate with User Account Registration & Authentication Services.

• External Screening Services: On certain occasions, we may rely on Specialist External Screening Services to verify user information or for other specialised purposes.

• Other Data Sharing: There could be other instances in which we might need to share your personal data with third parties, such as during legal proceedings or when defending our rights. Rest assured, we will always ensure that such sharing complies with applicable laws.

8. International transfers

When your data is transferred internationally, we are required to ensure you are afforded equivalent protection in respect of your personal data to that provided in the UK.

Generally, we will put in place appropriate safeguards when making international transfers, for example, by using specific contractual clauses which have been approved by the European Commission and/or the UK Government together with supplementary measures if we deem it necessary in the circumstances, for example, further contractual commitments or enhanced security. 

We are following the developments in this area of law and will be putting in place any necessary new, different and/or additional measures for any such transfers.

9. How Can You Access Your Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email or postal addresses shown in section 1 of this privacy notice. To make this as easy as possible for you, a Subject Access Request Form is available for you to use. You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will aim to respond to your subject access request within one month of receiving it or as otherwise provided for in data protection legislation. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

10. How Can You Contact Us?

To contact us regarding your personal data and data protection, including to make a subject access request, please use the contact details in section 1 of this privacy notice.

11. Changes to this Privacy Notice

We may change this privacy notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be made available in the latest version of this document, which is always available from our website.