Privacy and cookie policy

This Privacy Statement explains how Puma Investment Management Limited ("PIML"), Puma Private Equity Limited ("PPEL") and Puma Property Finance Limited (together, the "Group", "we", "us" or "our") use, store and share your personal data when you use our websites, interact with us or use our products and services.

Privacy statement

We process personal data in accordance with applicable data protection laws, including the UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations. For the purposes of applicable data protection laws, each Group entity acts as a data controller in relation to the personal data it processes.

The Group is committed to protecting the privacy and security of your personal data.

The Group has not appointed a formal Data Protection Officer, as it is not required to do so under applicable data protection laws. However, data protection compliance is centrally overseen by the Group’s Compliance team. See section 11 for contact details.

This Privacy Statement should be read together with any other privacy notice or fair processing notice we may provide when we collect or process personal data about you.

1. What is Personal Data?

“Personal data” means any information that can identify you, either on its own or when combined with other information.

Personal data includes factual information, opinions about an individual and records of decisions affecting them. It does not include information that has been irreversibly anonymised.

"Special Category Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data or information concerning a person's sex life or sexual orientation.

Information about criminal convictions, offences, sanctions or alleged offences is subject to additional legal protections.

2. Collection of personal data

We collect personal data in the following ways:

Directly from you or your representatives

You or your representatives may provide personal data, such as your name, contact details, and where relevant financial information, when you complete forms or communicate with us by post, phone, email or other means. Examples include when you:

· apply for our products or services;

· request marketing materials or publications;

· attend our offices or events, including webinars and other online events hosted via third-party platforms;

· complete a survey, promotion or similar activity;

· seek funding for an investment opportunity;

· provide feedback, complain or contact us.

Automatically through our websites

When you use our websites, we may collect technical data about your device, browsing actions and usage patterns through cookies and other similar technologies. See our Cookie Policy below for more information.

From third parties and public sources

We may receive personal data from third parties involved in our relationship with you or acting on your behalf, including advisers, intermediaries, platforms, brokers, registrars, custodians, credit reference agencies, fraud prevention agencies, recruitment consultants and public sources such as Companies House and the Financial Conduct Authority’s (FCA) Register.

We may also receive:

· technical and usage data from analytics providers;

· technical information from advertising networks, where applicable;

· technical and security information from website hosting, content delivery and internet security providers;

· contact, financial and transaction data from payment, technical and delivery service providers;

· identity and contact data from data brokers, aggregators or public databases, where lawful and relevant; and

· information submitted through our websites.

Where you receive marketing communications from us, we may collect information about how those communications are used and interacted with, including whether emails are opened and links are selected.

Where we are legally required or contractually obliged to collect certain personal data, and you do not provide it when requested, we may be unable to enter into or perform our contract with you. In such cases, we may need to cancel the service you have with us, but we will notify you if this is the case at the time.

3. Types of Personal Data Collected

We may collect and process the following categories of personal data:

Identity Data: first name, middle name(s), former name, last name, username or similar identifier, marital status, title, date of birth, nationality, occupation and gender.
Contact Data: billing address, correspondence address, email address and telephone numbers.
Financial and Transactional Data: bank account details, transaction information, investment details, credit information and payment records.
Documentary Data: details contained in documents such as passport, driving licences, birth certificates, proof of address documents and other identification or verification records.
Health Data: information about health conditions, disabilities or support needs where relevant to a product or service, or where we might need to make reasonable adjustments.
Technical, Profile and Usage Data: information collected through your use of our websites and online services, including IP address, login data, browser type and version, time zone and location, browser settings, operating system, platform, website preferences and information about how you use our websites and services.
Communications and Marketing Data: correspondence and communications with us, including emails, telephone recordings, meeting notes, marketing preferences and engagement with our communications.
Event data: information relating to your attendance at events, webinars and other activities organised by us, including registration details and engagement information.

We may create and use aggregated statistical or demographic information that does not identify individuals. If we combine aggregated information with personal data so that you can be identified, we will treat the combined information as personal data and use it in accordance with this Privacy Statement.

We do not routinely process Special Category Personal Data. In limited circumstances, we may process health information where relevant to a product or service, to support individuals with specific requirements or to make reasonable adjustments. We may also process information relating to criminal convictions, offences, sanctions or regulatory matters where necessary to comply with legal or regulatory obligations, conduct due diligence or prevent and detect financial crime.

Where we process Special Category Personal Data or criminal offence data, we will only do so where we have a lawful basis under UK GDPR and an additional condition under applicable data protection laws.

4. How we use your Personal Data and our lawful basis

We process personal data for the purposes described below. Depending on the circumstances, we rely on one or more of the following lawful bases: contractual necessity, compliance with legal or regulatory obligations, legitimate interests, consent or another lawful basis permitted by applicable data protection laws. Your personal data may be stored and processed by us for the following purposes:

to assess your application as a prospective investor, client, borrower, business contact or other relevant stakeholder and, where applicable, to provide the products and services you request;
to manage and administer our relationship with you, including responding to enquiries, requests, complaints and feedback;
to provide information about the Group, our products, services, events and other activities that may be of interest to you and, where permitted, to undertake marketing and business development activities;
to organise, administer and manage events, webinars and other communications;
to understand the effectiveness of our communications and improve the relevance, quality and effectiveness of future communications;
to carry out statistical analysis, business analysis and management reporting;
to detect, prevent and investigate financial crime, including fraud, money laundering, terrorist financing, sanctions breaches and other unlawful activity;
to comply with applicable legal, regulatory, tax, accounting and reporting obligations;
to monitor and assess compliance with our legal, regulatory and internal policy requirements; and
to administer, maintain and improve our systems, databases, websites and business operations.

Marketing communications and engagement information

Some marketing communications may contain tracking technologies that enable us to understand whether emails have been opened, whether links have been selected and how recipients interact with those communications. This may include limited technical information associated with the interaction. We use this information to understand engagement, maintain communication records and improve future communications. You may object to this processing or manage your communication preferences at any time using the options provided in our communications or by contacting us.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or otherwise similarly significantly affects you.

5. The legal basis for processing your personal data

We rely on one or more of the following lawful bases when processing personal data:

5.1 Consent

In certain circumstances, we may process your personal data where you have given consent, for example for certain marketing or cookie-related purposes.

You are free at any time to withdraw your consent. The consequence might be that we are unable to provide certain products and services to you.

5.2 Contractual necessity

We may process personal data where necessary to enter into or perform a contract with you, including to assess applications, provide products or services, manage our relationship with you, maintain records and respond to your requests.

5.3 Legal and regulatory obligations

We may process personal data to comply with legal and regulatory obligations, including to verify your identity, conduct KYC, AML, sanctions and fraud prevention checks, respond to rights requests, comply with tax and accounting requirements, maintain regulatory records, monitor communications where required and make disclosures to regulators, law enforcement agencies or other authorities where required by law or regulation.

5.4 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include:

understanding your interests and requirements;
communicating with you about our business, services and events;
maintaining effective governance, risk management and compliance arrangements;
operating, managing and improving our businesses;
protecting our business, systems, clients, investors and stakeholders;
establishing, exercising or defending legal rights; and
maintaining records of commercial communications and transactions.

Where permitted by law, we may use engagement information to understand the effectiveness of our communications, improve customer experience and ensure communications remain relevant and useful.

If you are a business contact, we may use your contact details to send you information about products, services, events or publications that we believe may be relevant to you. You can opt out at any time by using the unsubscribe link in our communications or by emailing unsubscribe@pumainvestments.co.uk.

Before relying on legitimate interests, we consider the potential impact on you and your rights. We do not rely on legitimate interests where our interests are overridden by your rights and freedoms, unless we have your consent or are otherwise required or permitted by law. You may request further information about our legitimate interests assessment by contacting us.

We may record or monitor telephone and electronic communications for regulatory compliance, training, supervision, service quality, dispute resolution and to evidence commercial communications or transactions.

We ensure that personal data is processed in accordance with applicable data protection laws and is accessed only by individuals who need it for the purposes described in this Privacy Statement.

6. Sharing your information with third parties

We may share personal data within the Group where necessary for operational, administrative, legal, regulatory or business purposes. We may also share personal data with:

business partners, including Pershing Securities Limited and Neville Registrars Limited, where necessary to provide services or administer products and services. We require business partners to comply with appropriate data protection, privacy and confidentiality obligations;
service providers, agents and contractors who provide services to us, including accountants, auditors, professional advisers, IT providers, communications platforms, hosting providers, payment providers and record-keeping providers;
HM Revenue & Customs, the FCA, the Information Commissioners Office (ICO), law enforcement agencies, courts, regulators and other authorities where required by law or regulation;
third parties where necessary to comply with a legal obligation or to establish, exercise or defend legal rights;
prospective buyers, investors, funders or advisers if we sell, transfer or reorganise all or part of our business or assets; and
a buyer or successor entity if our business, assets or relevant services are acquired or transferred.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7. International Transfers

In certain circumstances, we may transfer your data outside the UK.

Where we transfer personal data outside the UK, we will ensure that appropriate safeguards are in place. This may include transferring data to countries covered by UK adequacy regulations, using the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another transfer mechanism permitted by applicable data protection laws.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

8. Security and data retention

We have appropriate technical and organisational measures in place to protect personal data against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration or destruction. Access to personal data, including Special Category Personal Data, is limited to individuals who need it to perform their roles. Unauthorised use or disclosure of confidential information is prohibited and may result in disciplinary action.

When you contact a Group Employee regarding the product or service we provide to you, you may be asked for some personal data. This type of safeguard is designed to ensure that only you, or someone authorised by you, has access to your records held by us.

The length of time we retain personal data depends on the purpose for which it was collected and any legal, regulatory, tax, accounting or reporting requirements.

we retain personal data for as long as reasonably necessary for the relevant purpose; and
we may retain personal data for longer where required by law, regulation or our legitimate business needs, including record-keeping, audit, complaint handling, regulatory reporting or legal claims.

We generally retain client, investor and transaction records for at least five years and, in many cases, for six years or longer where required by law, regulation or our internal retention schedule.

When deciding how long to retain personal data, we consider the nature and sensitivity of the data, the purposes of processing, the risk of harm from unauthorised use or disclosure, whether the purposes can be achieved in another way, and applicable legal, regulatory, tax, accounting and reporting requirements. Further details are set out in our internal retention schedules.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We also have procedures to deal with suspected personal data breaches and will notify you and any applicable regulator where legally required.

9. Your rights

You have the following rights under applicable data protection laws, subject to certain conditions and exemptions:

· Access: the right to request a copy of the personal data we hold about you and information about how we process it.

· Withdraw consent: where we rely on consent, the right to withdraw that consent at any time. We may still process your personal data where we have another lawful basis, for example to comply with a legal or regulatory obligation.

· Rectification: The right to ask us to correct inaccurate or incomplete personal data.

· Erasure: the right to ask us to delete personal data in certain circumstances. We may be entitled or required to retain certain information.

· Restriction or objection: the right to object to, or ask us to restrict, processing in certain circumstances. There may be circumstances where we are legally entitled or required to refuse that request.

· Data portability: the right to receive certain personal data in a structured, commonly used, machine-readable format and to ask us to transfer it to another organisation where technically feasible. This right applies only in limited circumstances.

· Complain: the right to lodge a complaint with the Information Commissioner’s Office if you believe your data protection rights have been infringed.

To protect your data, we may request specific information to confirm your identity before fulfilling any rights request. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month, but complex or multiple requests may take longer. In such cases, we will notify you and keep you updated.

You can exercise your rights by contacting us, see Section 11 below.

10. Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The latest version will always be available on our website.

11. Contact and complaints information

If you have any questions about this Privacy Statement, wish to exercise your rights or raise a concern regarding our use of your personal data, please contact us:

Email: complaints@pumainvestments.co.uk
Telephone: 020 7096 8453
Post: Complaints, Puma Investments, Cassini House, 57 St James’s Street, London, SW1A 1LD.

You also have the right to complain to the ICO, the UK data protection regulator. You can contact the ICO through its website at https://ico.org.uk or by telephone on 0303 123 1113. We would appreciate the opportunity to address your concerns before you contact the ICO and encourage you to contact us in the first instance.

Further information is available in our Complaints Handling Procedure.

Cookie policy

Our website uses cookies to improve your browsing experience. This Cookie Policy explains what cookies are, the types of cookies we use and how you can manage your cookies preferences. As a user of our website, you have control over your cookie preferences.

When you first visit our website, or after clearing your cookies, a cookie banner appears. This explains why cookies are used and allows you to accept or reject different types of cookies.

You can change your cookie preferences at any time by:

Clicking the cookie icon in the bottom left corner of our website.
Selecting ‘Manage Cookies’ located in the footer of our website.

What are cookies?

Cookies are small text files stored on your browser or device when you visit a website. They help the site function properly, remembering preferences and collecting information to improve user experience. Cookies are either:

Session cookies: Deleted when you close your browser.
Persistent cookies: Remain for a set period, even after your browser is closed.

Cookies placed by our website are first-party cookies. Cookies from other services, for example analytics tools, are third-party cookies.

Types of cookies we use

Necessary cookies: Enable core functionality such as security, navigation and accessibility. Without these, the website may not work properly.
Analytical/performance cookies: Help us understand how visitors use the site, for example number of visitors, pages viewed, and time spent. Where required by law, we will only use these cookies with your consent. The information is used to evaluate and improve website navigation, functionality and user experience.

We do not currently use marketing or advertising cookies. However, some of our email communications may contain technologies that enable us to understand whether communications have been opened and links selected. We use this information to understand engagement with our communications, improve future communications and maintain communication records. Further information about how we process this information is set out in the Privacy Statement.

Managing your cookie preferences

You can change or withdraw consent at any time by:

Clicking the cookie icon in the bottom left corner of our website.
Clicking ‘Manage Cookies’’ in the footer displayed on all pages of this website.
Adjusting your browser settings to accept or reject new cookies and to delete existing cookies. You can also set your browser to notify you each time new cookies are placed on your device. For detailed guidance, visit your browser’s Help section or visit the About Cookies website which offers guidance for all modern browsers.

Please note, if you set your browser to reject cookies, you may not be able to use all the features on our website.

This Cookie Policy may be updated from time to time. The latest version is always available online.