TAIT CAPITAL UK LIMITED

1. About this Privacy Policy

This Privacy Policy explains how Tait Capital UK Limited ("Tait Capital", "we", "us" or "our") collects, uses, stores, shares, and protects personal data. It applies to anyone whose personal data we handle in connection with our business, including clients, the directors and beneficial owners of corporate clients, personal guarantors, brokers, introducers, professional contacts, prospective clients, website visitors, and any other individual who interacts with us.

We are committed to handling personal data lawfully, fairly, and transparently, in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.

Please read this Privacy Policy carefully. By providing us with personal data, or by engaging with our services or website, you confirm that you have read and understood this Privacy Policy.

2. Who We Are

Tait Capital UK Limited is a company incorporated in England and Wales under company number 10146256. Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the "controller" of personal data described in this Privacy Policy, which means we decide why and how it is processed.

We are registered with the Information Commissioner’s Office (the UK’s data protection regulator) under registration number ZA257136

If you have any questions about this Privacy Policy or how we handle personal data, please contact us at info@taitcapital.com.

3. Personal Data We Collect

The personal data we collect depends on your relationship with us. The categories typically include:

Identity and contact information

Full name, date of birth, nationality, and place of birth
Residential address, business address, and previous addresses
Telephone numbers, email addresses, and other contact details
Job title, role, and employer
Government-issued identification (passport, driving licence, national identity card)
National insurance number or tax identification number (where required)

Verification and due diligence information

Photographs and biometric data for identity verification
Information about your role, ownership, or control of a corporate client
Politically exposed person (PEP) status, sanctions screening, and adverse media checks
Source of funds and source of wealth information
Information about prior business activity, qualifications, and professional history

Financial information

Credit reference information, credit history, and credit scores
Bank account details and payment records
Information about your assets, liabilities, income, and financial commitments (in particular where you are a personal guarantor)
Tax residency and tax status information

Transaction and relationship information

Details of the services we provide to you or to the entity you represent
Records of our correspondence and communications with you (including emails, letters, telephone calls, and meetings)
Records of any complaints or disputes

Technical and website information

IP address, device identifiers, browser type, operating system, and language settings
Information about how you use our website, including pages visited, links clicked, and time spent
Cookies and similar tracking technologies (see section 10)

We do not generally seek to collect special category personal data (such as health, racial or ethnic origin, or political opinions). If we ever need to do so, we will tell you and identify the lawful basis we are relying on.

4. How We Collect Personal Data

We collect personal data from a number of sources:

Directly from you, when you contact us, complete a form, provide identification documents, sign an agreement, or interact with our services or website.
From the corporate clients you are connected to, where you are a director, officer, beneficial owner, or personal guarantor. Those clients are required to ensure they have a lawful basis to share your information with us and to make you aware that they are doing so.
From brokers, introducers, and other professional intermediaries who refer you to us.
From publicly available sources, including Companies House, the Land Registry, court records, news media, and online publications.
From third-party providers we use to verify identity, screen for sanctions and politically exposed persons, assess credit, and prevent fraud. These include credit reference agencies, fraud prevention agencies, and identity verification platforms.
Automatically, when you use our website (through cookies and similar technologies).

5. Why We Use Personal Data and Our Lawful Bases

We only use personal data where we have a lawful basis to do so under the UK GDPR. The main purposes for which we process personal data, and the lawful bases we rely on, are:

Onboarding and identity verification

To verify your identity, complete customer due diligence, screen for sanctions and politically exposed persons, and meet our anti-money laundering and counter-terrorist financing obligations. Lawful bases: legal obligation, legitimate interests (in preventing financial crime and protecting our business), and contractual necessity.

Providing our services

To assess, document, deliver, and administer the services we provide to you or to the entity you represent, including credit assessment, lending, monitoring, and (where necessary) enforcement. Lawful bases: contractual necessity and legitimate interests (in operating our business effectively).

Communicating with you

To respond to enquiries, send updates, give notices, and otherwise correspond with you about matters connected to our services. Lawful bases: contractual necessity and legitimate interests.

Credit assessment and fraud prevention

To carry out credit checks, assess risk, prevent and detect fraud, and protect against financial crime. We may share data with credit reference agencies and fraud prevention agencies, and they may share data with us, for these purposes. Lawful bases: legitimate interests, legal obligation, and (where applicable) contractual necessity.

Legal, regulatory, and compliance obligations

To comply with applicable law and regulation, including anti-money laundering and counter-terrorist financing laws, sanctions laws, tax reporting, and any obligation to disclose to a regulator, court, or law enforcement authority. Lawful basis: legal obligation.

Protecting and enforcing our rights

To establish, exercise, or defend legal claims, to enforce our agreements, and to recover sums due to us. Lawful bases: legitimate interests and (where applicable) legal obligation.

Business management and improvement

To manage our internal records, train our staff, monitor and improve our services, and run our business generally. We may also use anonymised or aggregated data for analytics and business intelligence. Lawful basis: legitimate interests.

Marketing

Where we send marketing communications, we will rely on legitimate interests (for business contacts) or your consent (where required). You can opt out of marketing at any time — see section 11.

6. Who We Share Personal Data With

We share personal data only with parties who have a legitimate need to receive it. These include:

Our directors, officers, employees, and Affiliates, on a need-to-know basis.
Our professional advisers, including legal, tax, accounting, audit, and insurance advisers.
Credit reference agencies and fraud prevention agencies, for credit assessment, fraud screening, and information sharing.
Identity verification, sanctions screening, and KYC service providers.
Valuers, surveyors, environmental consultants, and other experts we instruct in connection with a transaction.
Our funders, lenders, banks, investors, and any actual or potential assignees, transferees, sub-participants, securitisation vehicles, or successors in title to our business or any of our agreements.
Receivers, administrators, and insolvency practitioners appointed in connection with any transaction or security.
Regulators, courts, law enforcement agencies, and other competent authorities where we are required or permitted to share.
Information technology and software service providers (including cloud hosting, productivity software, email, document storage, and customer relationship management providers).
Any purchaser, investor, or other party in connection with a sale, restructuring, or financing of all or part of our business.

We require third parties who receive personal data on our behalf to keep it confidential, to use it only for the purposes for which we provide it, and to protect it with appropriate security measures.

7. International Transfers

Some of the third parties we use are based outside the United Kingdom, including in the European Economic Area (EEA) and the United States. This means personal data may be transferred to, stored in, or accessed from countries outside the UK.

When we transfer personal data outside the UK, we make sure it is protected by appropriate safeguards, including:

Transfers to countries which the UK Government has decided provide an adequate level of data protection (including the EEA).
Transfers under the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other transfer mechanisms approved under UK GDPR.
Transfers under the UK extension to the EU-US Data Privacy Framework where the recipient is certified under that framework.

You may contact us at info@taitcapital.com for further information about the safeguards we use for international transfers.

8. How Long We Keep Personal Data

We keep personal data for as long as is necessary for the purposes for which it was collected, and to meet our legal, regulatory, accounting, and reporting obligations.

Our general retention period for personal data relating to a client (and the individuals connected to them) is seven (7) years from the end of our relationship with that client, in line with industry practice and our record-keeping obligations under anti-money laundering legislation.

We may keep personal data for longer where:

there is an ongoing legal claim, investigation, or regulatory matter to which the data is relevant;
we are required to do so by law or by a competent authority;
we need to protect, establish, or defend our legal rights.

Once we no longer have a legitimate reason to keep personal data, we will delete it or anonymise it so that it can no longer be associated with an identifiable individual.

9. Your Data Protection Rights

Subject to certain conditions and exemptions under UK GDPR, you have the following rights in relation to personal data we hold about you:

Right of access: to request a copy of the personal data we hold about you, and information about how we use it.
Right to rectification: to ask us to correct any personal data that is inaccurate or incomplete.
Right to erasure (the "right to be forgotten"): to ask us to delete personal data, where we no longer have a legitimate reason to hold it.
Right to restrict processing: to ask us to restrict how we use your personal data in certain circumstances.
Right to data portability: to receive personal data you have provided to us in a structured, commonly used format, where we process it on the basis of consent or contract.
Right to object: to object to processing based on legitimate interests, including processing for direct marketing.
Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of any processing carried out before withdrawal.
Rights in relation to automated decision-making: we do not generally make decisions about you using purely automated means; if we ever do, we will tell you and respect your rights to challenge those decisions.

To exercise any of these rights, please contact us at info@taitcapital.com. We may need to verify your identity before responding, and we will respond within the time limits required by UK GDPR (usually one month, which can be extended for complex requests).

Some rights are subject to exceptions — for example, we may need to keep personal data to meet a legal obligation, defend a legal claim, or comply with anti-money laundering rules. If we cannot fully comply with a request, we will explain why.

10. Cookies and Our Website

Our website uses cookies and similar technologies to help it function and to help us understand how it is used.

Cookies are small text files stored on your device when you visit a website. We use:

Strictly necessary cookies, which are required for the website to function (for example, to remember your cookie preferences). These do not require your consent.
Functional cookies, which remember your preferences and improve your experience on the website.
Analytics cookies, which help us understand how visitors use our website (for example, through Google Analytics). These help us improve the website.

When you first visit our website, we will ask for your consent to non-essential cookies through a cookie banner. You can change your cookie preferences at any time using the cookie settings on our website, or by adjusting your browser settings to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the website.

11. Marketing Communications

We may from time to time send you marketing communications about our services, industry updates, or other content we think will be of interest to you. We will only do so where we have a lawful basis to do so:

For business contacts and corporate representatives, we rely on our legitimate interest in promoting our services. You can object to receiving these communications at any time.
For individuals (where applicable), we will only send marketing communications where we have your consent.

You can opt out of marketing communications at any time by following the unsubscribe link in any marketing email, or by emailing us at info@taitcapital.com. Opting out of marketing will not stop us sending you communications related to the services we provide to you.

12. How We Protect Personal Data

We take the security of personal data seriously. We use a combination of organisational and technical measures to protect personal data from unauthorised access, disclosure, alteration, loss, or destruction. These include:

Access controls, ensuring that personal data is only available to those who need it for their work.
Encryption of data in transit and (where appropriate) at rest.
Secure storage in reputable cloud platforms with strong information security credentials.
Staff training and confidentiality obligations.
Regular review of our security practices and supplier security.

Despite these measures, no system can be guaranteed to be entirely secure. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office, and where required, the affected individuals, in accordance with UK GDPR.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, our use of personal data, or applicable law. The "Last updated" date at the top of this Policy shows when it was last changed.

Where the change is material, we will take reasonable steps to bring it to your attention (for example, by posting a notice on our website or contacting you directly).

14. Contact and Complaints

If you have any questions about this Privacy Policy, would like to exercise any of your rights, or have any concerns about how we handle personal data, please contact us at:

Tait Capital UK Limited

Email: info@taitcapital.com

If you are not satisfied with how we have handled a privacy concern, you have the right to lodge a complaint with the Information Commissioner’s Office, the UK’s data protection regulator. You can contact the ICO at:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

We would, however, appreciate the chance to address your concerns directly before you approach the ICO, so please contact us first if you can.