Privacy notice

Carne recognises that our greatest asset is the data entrusted to us.  This Notice explains how Carne will manage the Personal Data of Individuals, in a manner consistent with the General Data Protection Regulation (2016/679) and equivalent applicable local laws and regulations, each as amended from time to time.  In this notice, we explain how we collect, use, share, retain and transfer information.  We also let you know your rights.

This Privacy Notice applies to all companies within the Carne group of companies (“Carne”).  References within this Notice to “Carne”, “we,” “our,” or “us” are references to the group entities.

Carne is a global company headquartered in Dublin, Ireland, which provides a range of fund management, compliance, governance and related support services (“Services”) to clients including investment funds (both regulated and unregulated), fund management companies and investment firms. In the provision of Services by Carne, Carne will collect and process Personal Data, including Personal Data of its clients and parties connected with clients such as natural persons who are employees, financial advisors, directors, officers, , agents, trustees and/or authorised signatories of clients, registered unitholders and applicants for units in funds sponsored, managed or advised by Clients, and directors, officers, employees of service providers to clients.

For more information about our services, please refer to our website: www.carnegroup.com

Application” means a web-based application developed and maintained by us.

“Authorised User” is an employee or independent contractor of the Client or the Counterparty, as appropriate, who has dealings with us including those registered to receive a user ID to access and use an Application on behalf of the Client or the Counterparty.

“Client” is an individual or entity that contracts or otherwise subscribes to use services provided by Carne.

“Counterparty” is a third party with whom Carne Group or one of Carne Group’s clients has a business relationship including managers of collective investments schemes and accounts, investors in collective investment schemes and account, and companies which distribute the financial products of fund managers or their customers, either directly to investors or via other intermediaries (such as investment platform) and sub-distributors, or any third party which is being considered by a fund manager for appointment as a distributor and any other services providers to collective investment schemes such as investment advisers, fund administrators and depositories.

“Data Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“Data Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the controller.

“Personal Data” is defined as any information relating to an identified or identifiable natural person (‘Data Subject’).  This means any information which Carne has or obtains, or which an Individual provides to Carne whether directly or through Clients or their service providers, such as his / her name, address, email address, date of birth etc, from which that individual can be directly or indirectly personally identified, and may include information such as identification and account numbers, tax identifiers and residency information, and online identifiers. While it is rare, some of this Personal Data may be sensitive Personal Data, such as data revealing political affiliations or criminal convictions which may be required for AML/KYC purposes.

“Data Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal Data as previously defined means any information which Carne has or obtains, or which an Individual provides to Carne whether directly or through Clients or their service providers, from which that individual can be directly or indirectly personally identified, and may include information such as name, address, email address, date of birth, identification and account numbers, tax identifiers and residency information, and online identifiers.

Employees and Candidates

Carne Group has a Privacy Notice for the processing of Personal Data of employees, contractors and job applicants.  This is provided to all candidates and applicants and is available on internal networks for all employees.

 Carne Application Users

Carne Group has a Privacy Notice, available for user of its application platform Curator, Distributor Due Diligence users and AML/KYC Platform users. www.carnegroup.com/privacy-notice/applicationPN

Clients and prospective clients

WHEN

We may ask you to provide Personal Data including but not limited to when:

• You use the website.
• You refer a colleague/contact to us.
• You connect with us directly via phone calls or video conferencing platforms.
• You participate in a marketing/sales promotion.
• You attend trade events and other industry networking events.
• You register or attend a webinar or other event.
• You attend an online or in person meeting.

If you choose to provide us with a third-party’s personal information (the person’s name, email and company), you represent that you have the third-party’s permission to do so.

WHAT

• We may collect and process Personal Data relating to our ongoing relationship with you, such as via correspondence and calls, and in the administration of our relationship with you. Video and/or telephone calls with you may be recorded for the purposes of record keeping, security and training, and you will be notified if this is the case.
• As part of our client onboarding and due diligence process, and in line with legal obligations outlined below, we may process some or all of the following name, signature, postal address, email address, date and place of birth, nationality, professional or employment related information, source of funds details, signatures, other contact details, account numbers and transaction details, your tax or social security ID number or equivalent, utility bills for the purposes of address verification, photographic identification and verification such as copies of your passport, passport number and driver’s license, information relating to ultimate beneficial owner status of an entity, politically exposed person (PEP) screening or sanctions screening.
• We process your Personal Data for the purpose of delivering a service to you, for the purpose of maintaining appropriate business records, including maintaining appropriate registers required under applicable law and regulation, for the purpose of quality control, business and statistical analysis, market research, for the purpose of tracking fees and costs and for the purpose of customer service, training and related purposes.

As a job applicant, we may also collect your CV/resume and cover letter.  A copy of our Employee / Candidate Privacy Notice is made available at application stage.

Website & other social media platform visitors

WHEN

We collect information about your visits to the website when you land on any of our web pages through cookies and similar tracking technology.

For further information about the types of cookies we use, you can access our Cookie Notice at this link.

WHAT

The information collected includes:

• access times
• the pages you view
• the links you click on
• the search terms you enter
• actions you take in connection with any of the visited pages
• your device information such as IP address, location, browser type and language
• the Uniform Resource Locator (URL) of the website that referred you to our website and
• the URL you browse away from our pages if you click on an external link

We may also collect information when you open email messages from us or click on links within those email messages.

Carne will use the Personal Data:

1. for the purposes of performing the Services for which Carne is engaged under contract, including:

• setting up and administering the account(s) of Clients;
• setting up and administering, where applicable to the service, investor fund applications;
• establishing and managing access to Application Authorised Users;
• to conduct or arrange for the conduct of anti-money laundering checks and related actions to meet applicable legal obligations of Carne or Clients relating to the prevention of fraud, money laundering, terrorist financing, bribery, corruption, tax evasion.
• to deal with queries or complaints from registered unitholders of funds managed, sponsored or advised by Carne and/or its Clients, where applicable to the service;
• in connection with the board reporting and regulatory reporting requirements; and
• for other day to day operational and business purposes.

 

2. for compliance with Carne’s legal obligations, including:

• anti-money laundering and anti-terrorist financing (collectively “AML”) and fraud prevention purposes, including OFAC and PEP screening for these purposes and to comply with UN, EU and other applicable sanctions regimes;
• compliance with applicable tax and regulatory reporting obligations including but not limited to updating Registers of Beneficial Ownership;
• (c) where Carne is ordered to disclose information by a court with appropriate jurisdiction;
• where necessary to establish, exercise or defend its legal rights or for the purpose of legal proceedings;

Where Carne needs to process Personal Data in connection with the provision of its Services to Clients, or where Carne has a legal obligation to collect certain Personal Data relating to an Individual (for example, in order to comply with AML obligations), Carne will not be able to provide the Services if the Individual does not provide the necessary Personal Data and other information required by Carne.

3. where use is for a legitimate interest of Carne, including:

• for day to day operational and business purposes;
• to take advice from Carne and Clients’ external legal and other advisors;
• for direct marketing purposes in order to provide information and about Carne’s products and services;

4. where an Individual has provided consent to use their data for a particular purpose. If an Individual gives consent for Carne to use his / her Personal Data for a particular purpose, that Individual has the right at any time to withdraw consent to the future use of his / her Personal Data for some or all of those purposes by writing to the address specified below;
5. in limited instances where processing is necessary in order to protect the vital interests of the data subject or of another natural person;
6. in unlikely event processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Carne will not disclose any Personal Data to any third party, except as outlined above and/or as follows:

• to enable Carne to carry out the obligations under the contract for Services with Clients or in anticipation of entering into such a contract for Services;
• where the execution of the contract and surrounding legal and regulatory obligations requires Personal Data to be shared with the service providers appointed to Clients, including Counterparty entities, investment management entities, administrator entities, trustee entities and its or their sub-contractors in connection with the Services;
• where the services we provide make us subject to a separate legal obligation requiring us to act as Controller of the Personal Data, including where it is required to use the Personal Data for the discharge of AML / KYC or regulatory reporting obligations;
• where we need to share Personal Data with critical service providers, auditors, and legal and other advisors;
• in the event of a merger or proposed merger, any (or any proposed) transferee of, or successor in title to, the whole or any part of Carne’s business, and their respective officers, employees, agents and advisers, to the extent necessary to give effect to such merger;
• to other legal entities within the Carne Group;
• where the disclosure is required by law or regulation, or court or administrative order having force of law or is required to be made to any applicable regulators.

We operate globally and recognise that our Clients’ relationships span across multiple geographies.  Our data centres are located within the EEA, specifically in Frankfurt, Luxembourg and Ireland.  In connection with the above purposes we may transfer your Personal Data outside the European Economic Area and United Kingdom, including to jurisdictions which are not recognised by the European Commission as providing for an equivalent level of protection for Personal Data as is provided for in the European Union. If and to the extent that we do so, we will ensure that appropriate measures are in place to comply with our obligations under applicable law governing such transfers, which may include: (a) entering into a contract governing the transfer which contains the “standard contractual clauses” approved for this purpose by the European Commission; or (b) transferring your Personal Data pursuant to binding corporate rules.

Further details of the measures that we have taken in this regard and the territories to which your Personal Data may be transferred are available by contacting us via one of the methods set out at the end of this notice.

We are committed to protecting the security of all of the personal information we collect and use.  We use a variety of physical, administrative and technical safeguards designed to help protect it from unauthorized access, use and disclosure. We have implemented best-practice standards and controls in compliance with internationally recognized security frameworks. We use encryption technologies to protect data at rest and in transit.

We will retain your Personal Information for as long as is necessary for the provision of any services we provide to you. When we no longer need your Personal Information in connection with any services, we will retain your Personal Information for a period of time that reasonably allows us to comply with the law, regulatory obligations or governance requirements, defend legal claims, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce our Terms of Service and take other actions permitted by law.  Our policy is that the retention period will not exceed 10 years after our contracted services have finished.

Carne recognised the following Data Subject Rights to all individuals regardless of their location or applicable privacy regulations.  For personal information we have about you, you have the:

• Right to be Informed – you have the right to obtain confirmation from Carne as to whether or not Personal Data concerning them is being processed and to be furnished with details of the processing.
• Right of Access – Where Carne is Processing Personal Data, you have the right to access such Personal Data and other information in relation to the purpose, categories of Personal data, data disclosures, storage, and rights;
• Right to Rectification – Carne will use reasonable efforts to keep Personal Data up to date. However, where the Personal Information relates to Individuals connected with or under the control of Clients, Clients will need to notify Carne without delay in the event of changes to the personal circumstances of an Individual connected with the Client so that Carne can keep the Personal Data up to date.
• Right to Erasure – you have the right for Personal Data to be erased without undue delay in certain contexts including, but not limited to, where the Personal Data has been processed unlawfully, where the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise or where the Data Subject has withdrawn their consent.
• Right to Restrict Processing – you have the right to require that Carne restricts Processing of Personal Data in certain circumstances including, but not limited to, where the Personal Data is inaccurate, is no longer required in light of the purposes of the Processing or the Data Subject has exercised their right to object. Where Processing has been restricted, such Personal Data shall, with the exception of storage, only be processed with your consent. Carne will inform you before the restriction of Processing is lifted.
• Right to Data Portability -you have the right to obtain and reuse your personal data for your own purposes across different services.
• Right to Object – you have the right to object, on grounds relating to your particular situation, at any time to Processing of Personal Data concerning you where the Processing is based on the legitimate interests pursued by Carne. Carne shall no longer process the Personal Data unless it demonstrates compelling legitimate grounds for the Processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.
• Where Carne is relying on a legitimate purpose of Carne in order to use and disclose Personal Data, you are entitled to object to such use or disclosure of your Personal Data, and if you do so, Carne will cease to use and process the Personal Data for that purpose unless Carne can show there are compelling legitimate reasons for it to continue or it needs to use the Personal Data for the purposes of legal claims.
• Rights related to automated decision-making including profiling – you have the right to not be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects the Data Subject. Automated processing includes profiling.

Further information on these rights, and the circumstances in which they may arise in connection with Carne’s processing of Personal Data can be obtained by writing to Carne at dpo@carnegroup.com.

You may lodge a complaint with the Irish Data Protection Commission, or your local supervisory authority. See their contact details here National Data Protection Authorities.

 

Our services are not directed to individuals under the age of sixteen (16), and we do not knowingly collect personal information from minors under the age of 16.

Details of the cookies in place on our website are available at Cookies

You may contact us to exercise any of your rights or ask for more information about your personal information and our privacy practices by contacting us at dpo@carnegroup.com or by post to

Data Protection Officer, Carne Group, 2nd Floor, Block E, Iveagh Court, Harcourt Road, Dublin D02 YT22, Ireland.

The EU Representative for Carne’s non-EU entities is Larry. Morrissey@carnegroup.com