This notice sets out how Hipgnosis Songs Fund Limited(the “Company”) and The Family (Music) Limited (the “Investment Adviser”) as data controllers, and Estera International Fund Managers (Guernsey) Limited (the “Administrator”) and Computershare Investor Services (Guernsey) Limited (the “Registrar”) as data processors, will process personal data under the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”). With effect from 25 May 2018, the GDPR places restrictions on the processing of personal data and affords data subjects certain rights.
Where your details are provided to the Company as a consequence of your investment in the Company, then the Company, acting as a data controller may itself (or through a third party such as the Administrator, the Registrar or the Investment Adviser) process your personal data or that of your directors, officers, employees and/or beneficial owners. When processing your personal data, there may also be times where the Investment Adviser will act as a data controller. In circumstances where the Investment Adviser acts as a data controller in respect of the information that has been provided to them, all rights afforded to you as a data subject under GDPR shall be exercisable by you solely against the Investment Adviser.
In connection with this, please note the following:
Purposes of Processing and Legal basis for processing
Your personal data may be processed by the Company, the Administrator, the Registrar or the Investment Adviser (or any of their affiliates, agents, employees, delegates or sub-contractors) for the following purposes:
- to enable the administration of your shares in the Company and any related account on an on-going basis (the “Services”) which are necessary for the performance of your contract with the Company, and to maintain the Company’s shareholder register;
- in order to meet any legal obligations imposed on the Company, the Administrator, the Registrar or the Investment Adviser relating to, or to pursue the Company’s, the Administrator’s, the Registrar’s or the Investment Adviser’s legitimate interests in relation to, the prevention of fraud, money laundering, terrorist financing, bribery, corruption, tax evasion and provision of financial and other services to persons who may be subject to economic or trade sanctions;
- to report tax related information to tax authorities in order to comply with a legal obligation;
- to monitor and record calls and electronic communications for (i) processing and verification of instructions, (ii) investigation and fraud prevention purposes, (iii) for crime detection, prevention, investigation and prosecution, (iv) to enforce or defend the rights of the Company and its affiliates, itself or through third parties to whom it delegates such responsibilities or rights in order to comply with any legal obligation imposed on the Company, (v) to pursue the Company’s legitimate interests in relation to such matters or (vi) where the processing is in the public interest;
- to disclose information to other third parties such as service providers, auditors, regulatory authorities and technology providers in order to comply with any legal obligation imposed on the Company, the Administrator, the Registrar or the Investment Adviser or in order to pursue the legitimate interests of the Company, the Administrator, the Registrar or the Investment Adviser;
- to monitor and record calls for quality, business analysis, training and related purposes in order to pursue the legitimate interests of the Company to improve its service delivery;
- to update and maintain records and fee calculation;
- to carry out statistical analysis and market research;
and which are necessary to comply with the Company, the Administrator, the Registrar or the Investment Adviser’s legal obligations, and/or which are necessary for the Company, the Administrator, the Registrar or the Investment Adviser's legitimate interests indicated above, and/or where the processing is in the public interest. Your consent is not required to process your personal data for the purposes referenced above.
Recipients of Data and International Transfer of Data
As noted above, the Company may disclose your personal data as follows:
- to its service providers, including without limitation the Administrator, the Depositary, the Registrar, the Investment Adviser and their affiliates, delegates, sub-contractors and agents, and other third party vendors and sub-processors in order to process the data for the above mentioned purposes; and
- to competent authorities (including tax authorities), courts and bodies as required by law or to affiliates for internal investigations and reporting.
The disclosure of personal data to the third parties set out above may involve the transfer of data to the USA and other jurisdictions outside the European Economic Area (EEA) in accordance with the requirements of the GDPR. Such countries may not have the same data protection laws as your jurisdiction. The Company has authorised the Administrator (and may authorise other delegates) as its agent to transfer personal data to other countries where EU Commission approved Standard Contractual Clauses or other appropriate safeguards permitted under data protection legislation have been put in place with relevant parties to whom personal data will be transferred.
The Company, the Administrator, the Registrar and the Investment Adviser will retain your personal data for as long as required to perform the Services or perform investigations in relation to same depending on whether additional legal/regulatory obligations mandate that the Company retains your personal data.
Data Subject Rights
With effect from 25 May 2018, under the GDPR you have the following rights, in certain circumstances, in relation to your personal information:
- Right to access your personal information.
- Right to rectify your personal information.
- Right to restrict the use of your personal information (in certain specific circumstances).
- Right to request that your personal information is erased (in certain specific circumstances).
- Right to object to processing of your personal information (in certain specific circumstances).
- Right to data portability (in certain specific circumstances).
Where you have provided your consent to processing for the purposes stated above, you may withdraw your consent at any time by contacting us by email at email@example.com.
You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work or in the place of the alleged infringement if you consider that the processing of personal data relating to you carried out by the Company or its service providers infringes the GDPR.
How to contact us
If you have any questions about the use of your personal information by or on behalf of the Company, please contact the Company at firstname.lastname@example.org