LOM Customer Data Privacy Notice

LOM Financial Group

Customer Data Privacy Notice

Privacy Statement

The policy of LOM Financial Limited and its subsidiaries (“LOM” or “LOM Group”) is to respect and protect the privacy of individuals on whom we process data during the course of our business, including data relating to customers and employees.

As a firm with a global presence, we are subject to varying requirements of data protection legislation where we operate. Our aim is to be as consistent as possible, to obey all applicable laws, and apply the highest standard of privacy principles in our approach.

A.  Introduction

“We”, “our”, “us” or “LOM” means the LOM Financial Group, consisting of LOM Financial Limited and its wholly-owned subsidiaries.

This notice applies to personal data we receive or otherwise create in connection with the provision of services to our customers, including any associated services provided via our website at www.lom.com.

LOM respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

We are a “data controller” in respect of your personal data. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

B. Relevant Data Protection Legislation

Personal data of customers of LOM Financial (Bermuda) Ltd, LOM Asset Management Ltd, Global Custody & Clearing Ltd, LOM Corporate Finance Ltd, LOM Funds SAC Ltd, and Burnaby Special Funds SAC Ltd, is subject to the Bermuda Personal Information Protection Act 2016 (“PIPA”).

Personal data of customers of the branch office LOM Financial (Cayman), is subject to PIPA and the Cayman Islands Data Protection Law 2017.

Personal data of customers of LOM Financial (Bahamas) Ltd is subject to PIPA and the Bahamas Data Protection (Privacy of Personal Information Act), 2003.

LOM (UK) Limited provides IT, accounting, disaster recovery and business continuity services to the rest of the LOM group companies, and is a Data Processor, subject to the UK General Data Protection Regulation.

We have appointed local Privacy Officers who are responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the Group Privacy Officer or the relevant local Privacy Officer, using the details set out below, in Section M “Contact Us”.

We comply with the requirements of the applicable Data Protection regulations, which share certain central principles relating to processing of personal data. The personal data received from you and held with us will be:

• Used lawfully, fairly and in a transparent way.
• Collected for legitimate purposes that we have explained to you.
• Relevant to the purposes we have told you about and limited to those purposes.
• Disclosed in a manner compatible with the purpose(s) and our legal obligations.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

C.  Personal data that we collect about you

Examples of specific data may include, but are not limited to:

• Identity Data: name, username, date of birth, place of birth, nationality, passport or other ID details, drivers licence details, photograph, gender
• Family Data: marital status, number of dependents, personal relations with politically exposed persons
• Contact Data: residence address, business address, mailing address, email addresses, telephone numbers, fax numbers
• Education Data:  level of education, degrees, diplomas, professional qualifications
• Occupation Data:   employment status, positions held, employer’s details, expected retirement date, disqualifications, details of any license, authorization, registration, notification, membership or other permission granted or revoked by any governmental or statutory authority or any other regulatory or self‐regulatory body, any censure, discipline, suspension, fines or investigation by any regulatory or self‐regulatory body.
• Financial Data: bank account and investment account details, investment preferences, risk appetite and goals, tax residency, tax identification number, sources of funds and sources of wealth, net worth, annual salary, other earned income, investment portfolio details, shareholdings, information about other assets, investments, loans and other liabilities, bankruptcy history
• Transaction Data: trading history, details about payments and transfers, cash and securities balances, records of instructions and transactions
• Technical Data: internet protocol (IP) address, login data, browser type and version, and other technology on the devices used to access products or services
• Marketing and Communications Data: preferences in receiving marketing material and communication preferences
• Criminal Convictions: details of criminal convictions and offences of fraud, theft, false accounting, serious tax offences, market manipulations or insider dealing, or other regulatory issues

Special Categories of Personal Data

During our relationship with you, you may choose to disclose to us personal information about you, your family, and your business and/or financial associates which is sensitive or intrinsically private. This includes in areas such as health, your political, religious, sexual or philosophical beliefs, race and ethnic origin, trade union membership, and genetic or biometric data. This is known as Sensitive Personal Data. Such data is not required by us, and there is no expectation from us that you need to provide such information.   If you volunteer such information to us, we will only record this where we believe this helps us to understand your circumstances and to improve our personal relationship with you. For customers of LOM Financial (Bermuda) Ltd, information regarding your place of origin, gender, marital and family status may be processed for our legitimate business interests and to meet legal and regulatory obligations, however will not be used to discriminate against any person.

D. Sources of personal data

We may collect and use information you give us, information we generate in providing services to you, and information we collect from other sources.  We use different methods to collect data from and about you, including through:

• information that you provide by completing forms that we provide to you
• information that you provide by speaking or corresponding with us, including by post, phone, e-mail or otherwise
• information we obtain from administering your investment accounts
• information we obtain when you use our online services
• information from third-parties, including paid due diligence/sanctions databases
• publicly available information, from the internet or otherwise
• any other information (including where obtained from third parties) which we reasonably need to operate your account, make decisions about you or fulfill our legal or regulatory obligations

E. How we use your personal data

Most commonly, we will use your personal information in the following circumstances:

• for the purpose of our legitimate business interests to allow us to provide our services to you
• to enter into and perform a contract with you
• to meet our legal and regulatory obligations
• for the purpose of our legitimate interests
• where the information is publicly available
• and/or where you have given us your consent

Specific examples may include, but are not limited to:

• Entering into a contract and implementing pre‐contractual measures
• To process and complete your requests and/or applications for accounts and/or services
• Providing our products and services
• Account and client relationship management
• Trading and holding in custody securities and other investments
• To process payments
• Fulfilling know-your-customer and due diligence requirements
• Authenticating a natural or legal person
• To update our records and maintain your account(s) with us
• To make decisions about your eligibility for our accounts and/or services
• To develop and improve our accounts and/or services
• Performing control and risk management functions
• Conducting sanctions and anti‐money laundering/countering the financing of terrorism compliance processes
• Conducting regulatory screening
• Complying with requirements of our agents, bankers, brokers and any financial institution or intermediary with which we may have dealings, entities that are financial market infrastructure entities or trading venues, and industry bodies
• Carrying out financial, regulatory and tax reporting
• To detect and prevent criminal activity and fraudulent transactions
• To provide specific information to our regulators and other government bodies to adhere to our regulatory, legal and compliance obligations;
• Performing obligations to any party that may have an interest in any of our rights or obligations
• Establishing, investigating, pursuing, exercising, defending or remedying claims, complaints, regulatory or investigative inquiries or information subpoenas
• Taking, holding, protecting, perfecting, preserving or enforcing (or attempting to do so) any rights, powers, authorities or discretions vested in us or a third party under a contract or by law
• Ensuring and supporting network, information or physical security
• Obtaining guarantee, security or taking collateral

F. Sharing your personal data

We may share your personal data with the parties listed below for the purposes set out above:

• Our employees and directors.
• Our parent company, subsidiaries, and affiliated entities.
• Our business partners or intermediaries with which we may have dealings.
• Our auditors and professional advisors, such as lawyers and consultants.
• Bankers, brokers, payment-processing service providers, and financial market infrastructure entities.
• Trading venues.
• Governmental, regulatory or similar authorities or industry bodies.
• Courts or tribunals of competent jurisdiction.
• Law enforcement officials.
• Notary public, administrators, trustees or other executors.
• Liquidator, conservator, custodian, trustee or a temporary administrator, external administrator, receiver or similar or analogous officer or body appointed in any bankruptcy, prevention measures, insolvency, bankruptcy, dissolution, liquidation or winding‐up (or any analogous or similar proceedings).
• Third‐party service providers, such as providers of IT system management or information security.
• to third parties who are bound to keep such information secure and confidential, such as our suppliers, contractors, agents, and business partners (and their sub-contractors) who help us provide our services to you;
• to organizations or agencies who host or maintain data centers, service platforms and other infrastructure and systems on our behalf, where your personal information is processed and/or stored

People we have obligations to give it to

• to regulators and authorities in connection with their duties;
• when we are required to do so as part of our duty to protect your accounts
• when we are required to comply with (i) a court order, (ii) a request from a law enforcement agency or (iii) other legal obligations;
• when there is a public duty to disclose information;
• to comply with anti-money laundering legislation;
• when it is necessary to prevent bribery, fraud, terrorist financing and money laundering;
• to meet our obligations under the sanctions compliance regime;
• to reduce credit risk or recover any money you owe to us;
• when required to share information about your accounts with the relevant tax authorities, either directly or via the local tax authority who may share that information with the appropriate tax authorities abroad, including under the Common Reporting Standard (CRS) or FATCA

People you want us to give it to

• to your advisers (such as accountants, lawyers, financial or other professional advisers) if you have authorised anyone like this to represent you, or any other person you have told us is authorized to receive information, give instructions or to use the account or services on your behalf (such as an attorney under a power of attorney);
• to a guarantor, where appropriate;
• when you have provided consent.

Our legitimate interests

• in the event that we sell or buy any of our business or assets, in which case we may disclose your personal information (as a client) to the prospective seller or buyer of such business or assets, or to anyone funding the sale or purchase of such business or assets regardless of whether the sale or purchase is completed;
• to protect our rights, property, or safety of our employees, clients or others including in order to enforce our terms of use and other agreements;

G. Transfer of personal data outside the jurisdiction 

We may host or transfer your personal information outside the country in which your LOM account is held and contractually domiciled for legitimate business purposes.  In particular:

• Customers of LOM Financial (Bahamas) Ltd and LOM Financial (Cayman): your data will be transferred to Bermuda, and processed by LOM affiliate Global Custody & Clearing Limited (“GCCL”); GCCL provides custody, trading, administration, and compliance services to its regulated sister companies.
• All LOM customers: your data may be transferred to the U.K., to be processed by LOM affiliate LOM UK Limited (“LOMUK”).  LOMUK provides information technology, accounting, HR, and compliance services to the other LOM group affiliated companies.

We have assessed the level of protection afforded by the laws applicable to each data processor to provide a comparable level of protection; furthermore, each LOM affiliate is subject to binding corporate rules of conduct including groupwide policies and procedures regarding personal data protection and privacy.

H. How long we keep your personal data

How long we hold your personal data for will vary.  We will retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We typically retain personal data for the periods set out below, subject to any exceptional circumstances such as for historical, statistical or research purposes or to comply with laws or regulations that require a specific retention period.

Accountholder Data and Records

Once your relationship with us ends, we will keep your information for a period of at least 7 years thereafter, or longer if required by applicable law or regulation.   This includes both physical account documents, scanned documents, and personal data held in our databases.  All such records and data are generally destroyed within 8 years.  Certain accountholder data may be held within our client databases indefinitely, including: LOM account number, accountholder name, and the dates the account was opened and closed.

Account Transaction Data

Transaction data refers to data recorded relating to activity and holdings within your financial accounts or otherwise undertaken by us or our counterparties on your behalf.  This includes purchases, sales, and transfers of securities or other investments; payments received in or sent from your accounts; foreign exchange transactions; dividends and corporate actions.  This includes data held electronically in our portfolio investment databases, and physical records, including your instructions to transfer assets or cash in or out of your account.

Account transaction data and records are kept for a minimum of 7 years, or longer if required by applicable law or regulation, and is generally destroyed within 8 years.

I. Your rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of the rights set out below, please, contact the relevant local DPO, or the Group Privacy Officer.

You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, including an explanation, if applicable and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure, such as in the case of back up data and any specific legal reasons, which you will be notified, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information, which override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have overriding

legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party.  Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying solely on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

In addition to your written request, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may refuse to provide access to personal information in the following circumstances:

•             the personal information is protected by any legal privilege;

•             the disclosure of the personal information may reveal confidential information of LOM group of companies or of a third party that is of a commercial nature and it is not unreasonable to withhold that information

•             the personal information is being used for a current disciplinary or criminal investigation or legal proceedings, and refusal does not prejudice the right of the individual to receive a fair hearing;

•             the personal information is being used for a current disciplinary or criminal investigation or legal proceedings, and refusal does not prejudice the right of the individual to receive a fair hearing.

J.  Data Security

We have put in place measures to protect the security of your information against risk of loss; unauthorized access, destruction, use, modification or disclosure; or any other misuse.

We require our staff and any third parties who carry out any work on our behalf to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.

K.  Breaches

In case of a breach of security leading to the loss or unlawful destruction, modification or unauthorized disclosure of or access to personal information which is likely to adversely affect an individual, the LOM affiliate responsible for that personal information will notify the relevant local privacy commissioner (or equivalent), and then the individual affected by the breach.  Such notification will be without undue delay, and generally would be expected to be within 72 hours.

L.  Changes to this Privacy Notice

We keep this notice under regular review. Updates we make to this notice in the future will be posted on our website.

M.  Contact us

Group Data Privacy Officer

Scott Hill

By post:  27 Reid Street, Hamilton HM11, Bermuda

By telephone:  441-292-5000

By email:  scott.hill@lom.com

LOM Financial (Bermuda) Ltd, LOM Asset Management Ltd, Global Custody & Clearing Ltd, LOM Corporate Finance Ltd, LOM Funds SAC Ltd, and Burnaby Special Funds SAC Ltd

Deputy Privacy Officer:  Tracey Thompson

By post:  27 Reid Street, Hamilton HM11, Bermuda

By telephone:  441-292-5000

By email:  privacy@lom.com

LOM Financial (Cayman)

Local Privacy Officer:  Daisy Lines

By post: 18 Forum Lane, Ground Floor, Camana Bay, Grand Cayman, Cayman Islands

By telephone: (345) 926-2838

By email:  privacy@lom.com

LOM Financial (Bahamas) Ltd

Local Privacy Officer:  Jalinka Strachan

By post:  3 Pineapple Grove, Old Fort Bay Rd, Nassau, Bahamas

By telephone: (242) 327-5100

By email:  privacy@lom.com

LOM UK Limited

Local Privacy Officer:  Justin Cornell

By post:  29 Farm Street Mayfair, London, W1J 5RL

By telephone:  +44 11 7925 4777

By email:  privacy@lom.com

COMPLAINTS

Customers have the right to make a complaint to the relevant Information Commissioner.  We would, however, appreciate the chance to deal with your concerns before you do so, so please contact us in the first instance.

LOM Bermuda customers:

Privacy Commissioner at privcom@privacy.bm

       By phone: (441) 543-7748

LOM Cayman customers:

Ombudsman at  info@ombudsman.ky,

By post:  PO Box 2252, Grand Cayman KY1-1107, Cayman Islands

Or to the Bermuda Privacy Commissioner

LOM Bahamas customers:

Data Protection Commissioner at dataprotection@bahamas.gov.bs

By post:  31A Poinciana House, North Building, East Bay St, P. O. Box N-3017, Nassau, Bahamas

By Phone: (242) 604-1001