Data Protection Statement

SUI Securities Ltd is committed to protecting the personal data of everyone who contacts us, applies to work with us or entrusts us with their wealth. This statement explains how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which together set the rules for processing personal data in the United Kingdom.

Data protection is a standing responsibility of the firm. Personal data is processed lawfully, fairly and transparently, collected for specified purposes and kept no longer than necessary.

Under the UK GDPR and the Data Protection Act 2018, personal data must be:

• processed lawfully, fairly and transparently;
• collected only for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date;
• not kept in a form that identifies you for longer than needed;
• processed securely, protecting against unauthorised access, loss or damage.

We process personal data only where we have a lawful basis. For website inquiries, applications and complaints, we rely on consent and on taking steps at your request. For client work, we rely on the performance of our contract with you and on compliance with legal and regulatory obligations that apply to an investment management firm. Where we rely on consent, you may withdraw it at any time.

The UK GDPR and the Data Protection Act 2018 give you rights over your personal data. You may ask us for access to the data we hold about you, for correction of inaccurate data, for erasure where the law allows, to restrict or object to processing, for data portability, and not to be subject to decisions based solely on automated processing. To exercise any right, contact us through the form on our homepage or write to us; we will respond without undue delay and within one month.

We apply appropriate technical and organisational measures to protect personal data, including limiting access to the firm, encrypting data in transit and storing records in systems designed for that purpose. We keep inquiry, application and complaint records only as long as needed for the purposes described in our Privacy & Cookie Policy and for any period required by law or regulation.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within the statutory deadline and inform affected individuals where required.

The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection. You have the right to complain to the ICO if you believe we have mishandled your personal data, at ico.org.uk or on 0303 123 1113. We would, of course, welcome the chance to resolve any concern with you first.

We keep personal data within systems that provide appropriate safeguards for transfers outside the United Kingdom. Where a transfer occurs, we rely on the safeguards recognised under UK data protection law, such as the UK international data transfer addendum to the European Commission standard contractual clauses.

We review this statement regularly and update it when the law or our practices change. The current version is always published on this page.