This notice explains what personal data Gibraltar Asset Management Limited collects about you, why we use it, who we share it with, how long we keep it and what rights you have. It applies to clients and prospective clients, to visitors to gam.gi, to the individuals behind our corporate and trust clients, and to anyone who contacts us. We are committed to handling your information carefully and to using it only for the purposes described here.
1. Who is responsible for your data
Gibraltar Asset Management Limited is the data controller for the personal data described in this notice. We are registered in Gibraltar under number 18064, with our registered office at World Trade Center, Suite 5.28, Gibraltar GX11 1AA.
If you have a question about this notice or about how we handle your data, contact us at gam@gam.gi, on +350 200 75181, or by post at the address above.
2. The information we collect
Depending on our relationship with you, we may collect:
- Identity data — name, date and place of birth, nationality, passport or identity card details, tax identification numbers and photographs from identity documents.
- Contact data — address, email address and telephone numbers.
- Financial data — bank and custody account details, income, assets and liabilities, source of funds and source of wealth.
- Suitability data — your investment objectives, time horizon, attitude to risk, capacity for loss and your knowledge and experience of investments.
- Transaction data — your holdings, instructions, dealings, valuations and payments.
- Compliance data — the results of sanctions, politically-exposed-person and adverse-media screening, and records of the checks we carry out.
- Communications data — correspondence, meeting notes and recordings of telephone calls relating to orders.
- Technical data — IP address, browser and device information and pages visited, where you use our website and consent to analytics cookies.
We collect special category data (such as health information) only where it is necessary — for example to make reasonable adjustments or to assess a vulnerability — and we will explain why at the time.
3. Where we get it from
Most of the information we hold comes directly from you, in your application, in correspondence and in conversations with us.
We also receive information from:
- your financial adviser, intermediary, accountant or lawyer, where they act for you;
- custodians, banks, brokers, fund managers and other counterparties involved in your transactions;
- publicly available sources, including company registries and the electoral roll;
- identity verification, sanctions and adverse-media screening providers;
- our website and the client portal, where you use them.
4. Why we use it, and our legal basis
We use your personal data only where the law allows us to. In practice we rely on the following bases:
- To perform our contract with you — opening and administering your account, assessing suitability, managing your portfolio, executing and settling transactions, producing valuations and statements, collecting our fees and answering your queries.
- To comply with our legal and regulatory obligations — verifying your identity and monitoring for financial crime, reporting to the Gibraltar Financial Services Commission and other authorities, meeting tax reporting requirements such as FATCA and the Common Reporting Standard, recording telephone orders, and keeping records for the periods the law requires.
- For our legitimate interests — running, protecting and improving our business, maintaining the security of our systems, preventing fraud, keeping management records, obtaining professional advice, and establishing, exercising or defending legal claims. We consider these interests against your rights and do not rely on this basis where your interests override ours.
- With your consent — for optional analytics cookies, for marketing to you where you are not an existing client, and in the limited cases where we process special category data. You can withdraw consent at any time; doing so does not affect processing carried out beforehand.
5. Marketing
We may send existing clients market commentary and information about our services. If you do not want to receive these, tell us and we will stop, using the unsubscribe link in any email or by contacting us directly.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
7. Transfers outside Gibraltar
Some of the recipients described above are located outside Gibraltar. Where we transfer personal data outside Gibraltar we do so only where the destination is covered by an adequacy decision, or where appropriate safeguards — such as standard contractual clauses — are in place, or where the transfer is necessary to perform our contract with you.
You can ask us for details of the safeguards applying to a particular transfer.
8. How long we keep it
We keep your personal data for as long as you are a client and for a minimum of five years after our relationship ends, which is the period required by Gibraltar's anti-money-laundering legislation.
Some records are kept longer where a longer period is required by law, where records may be needed to establish or defend a legal claim, or where a regulator requires it. Records of telephone orders are kept for the period required by the applicable rules.
When data is no longer needed we delete it or anonymise it securely.
9. How we protect it
We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including access controls, encryption in transit, secure disposal, supplier due diligence and staff training and confidentiality obligations.
No transmission over the internet is completely secure. Please do not send us account credentials or full identity documents by unsecured email. We will never ask you for your password.
10. Your rights
Subject to certain conditions and exemptions, you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected or incomplete data completed;
- ask us to erase data where we no longer have a reason to hold it;
- ask us to restrict our use of your data while a concern is investigated;
- object to processing we carry out for our legitimate interests, and to object to direct marketing at any time;
- receive certain data in a portable format, or have it transmitted to another controller;
- withdraw consent where we rely on it.
To exercise any of these rights, contact us using the details in section 1. We will respond within one month, and will tell you if we need longer because the request is complex. There is normally no charge. We may ask you to verify your identity first.
Some rights are limited where we are required to keep records by law — for example, we cannot delete anti-money-laundering records during the retention period.
11. Automated decisions
We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing.
We do use automated screening tools to check names against sanctions and other lists. A match is always reviewed by a person before any action is taken.
13. Changes to this notice
We review this notice regularly and will update it when our practices change or when the law requires. The date at the top of this page shows when it was last revised. Where a change is significant we will tell clients directly.
14. If you have a concern
If you are unhappy with how we have handled your personal data, please contact us first — we would like the chance to put it right.
You also have the right to complain to the Gibraltar Regulatory Authority, which supervises data protection in Gibraltar. Complaining to us does not affect that right.
Talk to us about your data
To request a copy of your data, correct something we hold, or ask a question about this notice, email gam@gam.gi or call +350 200 75181.