This notice explains how Gibraltar Asset Management Limited collects, uses, shares and protects personal data, and the rights available to individuals under applicable data protection law.
1. Who we are and who this notice applies to
Gibraltar Asset Management Limited (“GAM”, “we”, “us” or “our”) is the controller of the personal data described in this notice. GAM is registered in Gibraltar under company number 18064 and has its registered office and principal place of business at World Trade Center, Suite 5.28, Gibraltar GX11 1AA. GAM is authorised and regulated by the Gibraltar Financial Services Commission.
This notice applies to clients and prospective clients and, where relevant, to other individuals connected with an account or relationship. This may include joint account holders, directors, partners, trustees, settlors, beneficiaries, pension or policy members, beneficial owners, authorised signatories, attorneys, representatives, advisers, intermediaries, introducers and other individuals whose information is provided to or obtained by GAM.
It also applies to individuals who contact GAM, use our website or client-facing systems, attend meetings with us, or otherwise interact with GAM in a business capacity.
For privacy questions or requests, contact:
Email: gam@gam.gi
Telephone: +350 200 75181
Post: Gibraltar Asset Management Limited, World Trade Center, Suite 5.28, Gibraltar GX11 1AA
2. Personal data we collect
The information we collect depends on the nature of our relationship with you and the service or account involved. It may include:
- Identity and identification information: name, title, date and place of birth, nationality, passport or identity-card details, photographs, signatures, tax identification numbers and other identification information.
- Contact information: postal address, email address, telephone numbers and other contact details.
- Account and financial information: bank and custody details, income, assets, liabilities, financial circumstances, source of funds, source of wealth and information about contributions, withdrawals or transfers.
- Investment and suitability information: investment objectives, time horizon, risk profile, capacity for loss, knowledge and experience, client categorisation, service eligibility and other information relevant to investment advice, discretionary management or access to a service.
- Transaction and portfolio information: holdings, orders, instructions, trades, valuations, performance information, cash balances, payments, corporate actions and account activity.
- Compliance and financial-crime information: customer due diligence records, beneficial ownership, sanctions and PEP screening, adverse-media results, fraud indicators, regulatory or legal information, source-of-funds and source-of-wealth checks and records of ongoing monitoring.
- Communications and relationship records: emails, letters, secure messages, meeting notes, call recordings, complaints, requests, instructions and records of our interactions with you.
- Vulnerability and support information: information about a vulnerability or circumstances that may affect how we communicate with or provide services to you, including health information where relevant and lawfully processed.
- Technical and digital information: login information, IP address, browser and device information, security logs, portal activity and website information where applicable.
- Corporate, trust and intermediary information: information about individuals connected with companies, trusts, pension arrangements, policies, partnerships, advisers or intermediaries, whether or not those individuals are themselves direct GAM clients.
We do not seek to collect personal data that is irrelevant to the purpose for which it is required. The precise information required may differ by account type, client category, investment service, product, transaction and regulatory requirement.
3. Where we obtain personal data
We obtain personal data from a range of sources, including:
- you directly, including through applications, forms, telephone calls, meetings, email, secure messages and ongoing client reviews;
- a company, trustee, pension provider, insurer, fiduciary, adviser, intermediary, introducer or other organisation through which an account or relationship is established;
- other individuals connected with an account, such as joint holders, directors, trustees, authorised signatories or representatives;
- custodians, banks, brokers, platforms, fund managers, registrars, counterparties and other firms involved in transactions or account administration;
- identity-verification, screening, fraud-prevention, credit-reference or due-diligence providers;
- publicly available and official sources, including company and regulatory registers, sanctions and PEP lists, court or insolvency information, media sources and other lawful public records;
- professional advisers and other third parties where they are authorised or permitted to provide information to us; and
- our website, client portal, telephone and IT systems.
Where we receive personal data about you from another person or organisation, we will provide privacy information as required by law. Depending on the circumstances, this may be provided directly by GAM, through the organisation or intermediary through which your information was supplied, or by making this notice available to you.
4. Why we use personal data and our lawful bases
We process personal data only where we have a lawful basis. Depending on the purpose, more than one basis may apply.
- Taking steps to open an account, provide an investment service, administer the client relationship, carry out instructions, process transactions, provide valuations and reporting, collect fees and deliver agreed services — lawful basis: necessary to enter into or perform a contract; and, where relevant, legal or regulatory obligation.
- Client categorisation, suitability or appropriateness assessments, service eligibility, product governance and risk management — lawful basis: legal or regulatory obligation; performance of a contract; and legitimate interests where appropriate.
- Customer due diligence, identity verification, sanctions and PEP screening, financial-crime prevention, ongoing monitoring, tax reporting and regulatory reporting — lawful basis: legal and regulatory obligations; legitimate interests in preventing fraud and financial crime where applicable.
- Operating, securing, monitoring and improving our business, systems, communications and client service; business continuity; management information; professional advice; complaints and legal claims — lawful basis: legitimate interests, including operating a regulated investment business securely and efficiently and establishing, exercising or defending legal claims.
- Recording and retaining telephone calls and communications — lawful basis: legal or regulatory obligation where applicable; and legitimate interests in evidencing instructions and communications, quality assurance, security and dispute resolution.
- Marketing and relationship communications — lawful basis: consent where required; or legitimate interests / existing-client permissions where applicable and permitted by law. You can object to direct marketing at any time.
Legitimate interests. Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and balance them against the interests, rights and freedoms of the individual. We do not rely on legitimate interests where those interests are overridden by your rights and freedoms.
5. Special category and criminal-offence data
Some information we process may require additional protection under data protection law.
Vulnerability and health information. Where you tell us about a vulnerability, health condition or other circumstance relevant to how we should communicate with or provide services to you, we may record and use that information so that we can respond appropriately, provide suitable support, protect your interests and meet our legal and regulatory obligations. We will process special category data only where an applicable condition under data protection law permits us to do so, which may include explicit consent or another lawful condition depending on the circumstances.
Biometric information. GAM may use electronic identity-verification services, including facial comparison or liveness checks, where available and appropriate. Where biometric information is processed for the purpose of uniquely identifying an individual, we will process it only where the applicable legal conditions and safeguards are satisfied.
Criminal-offence, sanctions and adverse-media information. Our financial-crime, fraud-prevention and regulatory checks may involve information about criminal convictions or offences, alleged misconduct, sanctions, regulatory action or adverse media. We process this information only where permitted or required by applicable law and subject to appropriate safeguards.
6. Identity verification, screening and automated tools
GAM uses, and may introduce further, electronic tools to support identity verification, customer due diligence, sanctions and PEP screening, fraud prevention, risk assessment and electronic onboarding.
At the date of this notice, GAM does not make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect them. Automated screening results, alerts and other material compliance or client-acceptance issues are subject to human review before a final decision is made.
GAM is developing electronic onboarding functionality which may use automated rules to identify applications that fall outside predefined service criteria, require additional information or should be referred for further review. If GAM introduces solely automated decision-making of a kind that has legal or similarly significant effects, we will update this notice and provide the information and safeguards required by law, including rights to human intervention where applicable.
7. Telephone calls and communications
GAM records telephone calls through its telephone systems. Recordings may include calls relating to investment instructions, account administration, client service, complaints and other communications with GAM.
We use call recordings and related communication records for regulatory record-keeping where applicable, to evidence instructions and conversations, monitor quality and conduct, protect clients and GAM, investigate complaints or disputes, prevent fraud and support training, oversight and security.
9. International transfers and data location
GAM maintains Gibraltar-based server and back-up arrangements as part of its information-security and business-continuity framework. However, some service providers, financial institutions, counterparties and technology providers may process or access personal data from other jurisdictions.
Where personal data is transferred to a third country or international organisation, GAM will use an appropriate legal mechanism as required by applicable data protection law. This may include an applicable adequacy decision, contractual safeguards, or another permitted transfer mechanism or derogation.
You may contact GAM for further information about the safeguards applying to a particular transfer where this is relevant to your personal data.
10. Security
GAM applies technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are proportionate to the nature and sensitivity of the information and may include access controls, authentication, system monitoring, secure storage and back-up, encryption where appropriate, supplier due diligence, confidentiality requirements, staff training and incident-management procedures.
No system can be guaranteed to be completely secure. Individuals should also take reasonable care when communicating with GAM, including protecting login credentials and using secure channels where available.
11. How long we keep personal data
There is no single retention period for all personal data. GAM keeps records for as long as they are required for the purpose for which they were collected and for any additional period required or permitted by applicable law, regulation or legitimate business need.
Retention periods are determined by factors including:
- financial-services, anti-money-laundering, sanctions, tax and regulatory record-keeping requirements;
- whether an account or client relationship remains active;
- the type of transaction, communication or record;
- limitation periods and the need to establish, exercise or defend legal claims;
- complaints, investigations, audits or regulatory enquiries;
- security, fraud-prevention and business-continuity requirements; and
- any applicable requirements imposed by a custodian, counterparty or other service provider.
When personal data is no longer required, GAM will delete, destroy or anonymise it securely in accordance with its retention and disposal arrangements.
12. Marketing and service communications
GAM may send clients and other contacts information about GAM services, market commentary, insights, events, newsletters or other relationship communications where permitted by law.
Where consent is required for direct marketing, we will obtain it. Where applicable law permits marketing on another basis, such as in connection with an existing client relationship or legitimate interests, we will provide a clear way to opt out.
You may object to direct marketing at any time by using the unsubscribe facility provided in a marketing message or by contacting gam@gam.gi. We will then stop using your personal data for direct marketing, although we may continue to send service, regulatory, security or account communications that are necessary for the relationship.
13. Your rights
Subject to applicable conditions, exemptions and legal restrictions, you may have the right to:
- access the personal data GAM holds about you and receive information about how it is used;
- ask GAM to correct inaccurate information or complete incomplete information;
- ask GAM to erase personal data where there is no lawful reason to continue processing it;
- ask GAM to restrict processing in certain circumstances;
- object to processing based on legitimate interests in certain circumstances;
- object at any time to the use of personal data for direct marketing;
- receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another controller;
- withdraw consent at any time where processing is based on consent, without affecting processing that was lawful before withdrawal; and
- where applicable, not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to request human intervention and contest the decision where the law provides those rights.
To exercise a right, contact gam@gam.gi. GAM may ask for information necessary to verify identity or authority before acting on a request. We normally respond within one month, although the period may be extended where permitted for complex or numerous requests.
Data-protection rights are not absolute. For example, GAM may be required to retain information despite an erasure request where financial-services, anti-money-laundering, tax, legal or regulatory obligations require continued retention.
14. Information you are required to provide
Some personal data is required by law or regulation, is necessary for GAM to enter into or perform a contract, or is necessary for GAM to assess whether it can provide a service.
If required information is not provided, or GAM cannot complete necessary verification or regulatory checks, GAM may be unable to open or continue an account, provide a requested service, accept an instruction, complete a transaction, make a payment or transfer, or otherwise continue the relationship. GAM may also be required to restrict or terminate services in accordance with applicable law, regulation and contractual terms.
16. Changes to this notice
GAM reviews this Privacy Notice periodically and may update it when its services, systems, data-processing activities or legal obligations change. The current version will be made available through GAM’s website and may also be provided directly where appropriate. Where a change is material, GAM will take reasonable steps to bring it to the attention of affected individuals where required.
17. Questions and complaints
If you have a question, wish to exercise a data-protection right or have a concern about how GAM has handled your personal data, please contact us first at gam@gam.gi or using the contact details in section 1.
You also have the right to complain to the Gibraltar Regulatory Authority, which acts as Gibraltar’s Information Commissioner for data-protection matters:
Organisation: Gibraltar Regulatory Authority
Address: 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar GX11 1AA
Telephone: +350 200 74636
Email: privacy@gra.gi
Making a complaint to GAM does not affect your right to complain to the Gibraltar Regulatory Authority or to seek any other remedy available under applicable law.
Talk to us about your data
To request a copy of your data, correct something we hold, or ask a question about this notice, email gam@gam.gi or call +350 200 75181.