Privacy policy
This privacy notice is issued by Amber River Group Limited on its behalf, and on behalf of its subsidiaries (each a “member of the Amber River Group” and together, “Amber River“, “Amber River Group“, “we“, “us” or “our“). Amber River is committed to protecting the privacy of individuals whose data we process and complying with our obligations under applicable data protection laws (“Data Protection Laws“).
The information that you trust us with is important, and we are committed to protecting and respecting your privacy. If you are a client, this privacy notice is intended to be read in conjunction with your client agreement.
This privacy notice provides you with information on how we (as a data controller) collect and process personal data in connection with the provision of our services, including if you are:
- a potential, current or former client or business contact of Amber River (and, where applicable, if you are one of our client’s employees, advisers, agents, family members, dependants and other related parties including co-trustees);
- a contractor or service provider to Amber River;
- applying for employment or work experience with us; and/or
- a user of our website.
In addition, this privacy notice outlines your rights under Data Protection Laws.
We may from time to time update this privacy notice at our discretion. Please refer back to this page regularly to see any changes or updates to this Privacy Notice.
If you have any queries in relation to our processing of your personal data please contact us at [compliance@amberriver.com].
You have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is the Information Commissioner’s Office (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance, either at Amber River, Floor 4, 90 High Holborn, London WC1V 6LJ or [compliance@amberriver.com]. We will acknowledge receipt of your complaint within 30 days of receiving it, and, without undue delay, we will take appropriate steps to respond to your complaint and inform you of the outcome of your complaint.
This privacy notice is provided in a layered format to allow you to navigate it easily. The privacy notice is split into the following sections:
Section One, The Controller of Your Personal Data: This section provides details of the Amber River Group so you can identify the controller of your personal data.
Section Two, How We Process Your Personal Data: This section provides information on how we process your personal data, including the purposes for which we process personal data (and the legal bases on which we rely to process it). How we process your personal data will depend on the nature of your engagement/relationship with Amber River, so this section is split into parts:
Part One, Clients: If you are a current, potential or former client of Amber River, this section provides details of how we process your personal data.
Part Two, Business Contacts: If you are a business contact of Amber River but are not a current, potential or former client, this section provides details of how we process your personal data. This includes if you have provided us with a business card, if you have corresponded with us and/or if you have attended events run by Amber River. It may also include persons who are connected to our clients (for example, if you are an employee, adviser, agent, family member, dependant or other related party of our client) where it is relevant in connection with the advice and services we are providing to the relevant client.
Part Three, Contractors and Service Providers: If you are a contractor or provide services to Amber River, this section provides details of how we process your personal data.
Part Four, Job Applicants: If you have applied for a job or work experience with a member of the Amber River Group, this section provides details of how we process your personal data.
Part Five, Website Users: If you are a user of an Amber River website, this section provides details of how we process your personal data.
- Section Three, Other Information: This section applies to all persons about whom we process personal data, and provides information about our data protection practices, including information about our data security and retention policies, details of our arrangements for disclosing personal data to third parties and transferring personal data outside of the UK and EEA and information on your rights under Data Protection Laws.
The controller of your personal data is the entity which, alone or jointly with others, determines the purposes and means of the processing of your personal data.
The member(s) of the Amber River Group which act as a controller of your personal data will depend on the circumstances for which you engage with Amber River and/or provide your personal data to Amber River. The entity / entities which provides you with services and/or which you apply for a job with, receive advice from, visit the website of or otherwise engage with will be the controller(s) of your personal data.
There may be circumstances where more than one member of the Amber River Group is a controller of your personal data (for example, if multiple members of the Amber River Group provide advice to you). A list of all of the members of the Amber River Group is available [here]. This list may be updated from time to time. If you would like further information on who the specific controller(s) of your personal data are, then please contact us at [compliance@amberriver.com].
Contact — Lisa-Jayne Vines · Tel — 01206 710 000 · Email — lisa.vines@amberriverea.com
Contact — Ewan Boyle · Tel — 02890 221 010 · Email — EwanB@amberriverni.com
Contact — Trevor Jackson · Tel — 01628 485 050 · Email — trevorj@amberriverpremier.com
Contact — Simon Cocking · Tel — 0113 487 8660 · Email — simon.cocking@amberriverlw.com
Contact — Helen Lupton · Tel — 01257 260011 · Email — helen.lupton@amberrivertb.com
Contact — David Pelster · Tel — 0207 242 3336 · Email — david@amberriverchancery.com
Contact — Simon Redhead · Tel — 0121 446 5815 · Email — simonredhead@amberrivermidlands.com
Contact — Robin Etherington · Tel — 01242 514563 · Email — robin.etherington@amberriverhda.com
Contact — Ashley Brooks · Tel — 01636 233 200 · Email — ashley.brooks@amberriverdbwood.com
Contact — David McConachie · Tel — 01343 814000 · Email — David@amberrivercm.com
Contact — Edward Cameron · Tel — 0808 175 4433 · Email — complaints@amberriversw.com
Contact — Kathy Theron · Tel — 01628 566777 · Email — kathyt@amberriversfia.com
Contact — John McArdle · Tel — 0131 556 4540 · Email — j.mcardle@amberriverjf.com
How we process your personal data depends on the nature of your engagement with Amber River, so this section is split into five parts — open the part that applies to you.
This section of our privacy notice sets out how we may process personal data about our clients (including potential, current and former clients). In this section, "you" and "your" refers to a person whose personal data is held by us, where that data has been provided to us by a client, or has been collected by us, in each case, in the context of the operation of our business, including the provision by us of services.
We have grouped together the various types of personal data we may hold about you as follows:
Identity data may include names (including nicknames, preferred names, previous names and/or maiden names), titles, gender, date of birth, pronoun preferences, nationality, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, telephone numbers, emergency contact details and details of next of kin;
KYC and other identification data may include copies of passports, driving licences, utility bills and information which may be revealed by an anti-money laundering search and/or due diligence conducted on you (including details of your directorships, your electoral registration, your political exposure, insolvency proceedings against you, criminal convictions and/or any adverse media in relation to you, information revealed by politically exposed person and sanction checks and data related to any public comments about you by statutory or regulatory authorities), credit checks/references and other information from third party publicly accessible sources including Companies House;
Employment data may include details of your employment including your occupation, employment status, employer and employment start date;
Financial data may include details of your personal financial situation such as your earnings, assets, liabilities, gifts given, pensions and investments, estate planning, financial products, expenditures, mortgages, banking activity and bank account details;
Family data may include details of your marital status and dependants;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use when you correspond with us and other details relating to your use of and/or interaction with our IT systems and website;
Marketing data includes your Contact Data and details of your marketing consents and preferences;
Correspondence data includes any personal data which is shared with us when you correspond with us (including over email, during telephone calls, during video calls, in client surveys and feedback and/or in meetings) and includes recordings of telephone and video calls;
Special category personal data including data relating to your health and biometric data; and
CCTV data may include image and sound recordings.
We may collect personal data about you from a variety of sources:
From you: when it is provided to us by you directly including as a result of our services or proposed services for you (including where you provide us this information at meetings, on calls, complete client surveys, use our Digital Factfind tool or provide feedback to us);
From third parties: when it is provided to us by third parties, including from an introducer or other third parties such as accountants, business partners, former advisers, background checks and identity check providers, analytics providers, credit reference agencies and businesses that we may acquire or sell to; and
From publicly available sources: such as Companies House.
We may also process personal data about individuals that are connected with you as a client (for example a family member or dependent). If you provide us with personal data relating to another individual, you agree to provide that person with this privacy notice before you share their personal data with us.
We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:
It is necessary for the performance of a contract between us and you for the provision of our business services or in order to take steps at your request prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests (or the legitimate interests of a third party), where such interests are not overridden by your rights or interests. Our legitimate interests include pursing and developing our business (including business development and attracting new clients), providing our services including complaint handling; preventing fraud, money laundering, sanctions, terrorist financing, bribery, corruption and tax evasion and internal group administration. Further information on our legitimate interests is set out below.
It is necessary for us to comply with a legal obligation on us.
We have your consent. Specifically:
We may use your special category personal data where you have provided your consent.
We may process your personal information, in some cases, for marketing purposes where you have provided your consent.
We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
| Purpose / Activity | Type of data | Legal basis for processing |
|---|---|---|
| To administer and manage our relationship with you and to respond to requests for services. |
|
Performance of a contract with you or taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and providing services to you. |
| To provide, or facilitate the provision of our services to you. |
|
Performance of a contract with you or taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and providing services to you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes. |
| To collect information about you when you engage with us and during our engagement with you (e.g. via our Digital Factfind tool which uses multi-factor authentication), including collecting special category data, in connection with the provision of services to you. This information will be updated and managed (as required) during our engagement with you. |
|
Performance of a contract with you or taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and providing services to you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes. |
| To instruct bank transfers and other payments required as part of our services. |
|
Performance of a contract with you. Our legitimate interests of providing services to you. Compliance with our legal and regulatory obligations. |
| To conduct our business, including in relation to our business services. |
|
Our legitimate interests of pursuing and developing our business and providing services to you. |
| To fulfil our regulatory compliance obligations including to prevent money laundering or other financial crimes, including to verify your identity. |
|
Compliance with our legal and regulatory obligations. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of complying with regulatory requirements relating to unlawful acts and dishonesty. |
| To comply with our legal, compliance, accounting and reporting obligations under applicable law (for example, to tax authorities or courts). |
|
Compliance with our legal and regulatory obligations. |
| To manage and effectively operate the financial affairs of our business and protect our rights and/or those of other Amber River entities. |
|
Our legitimate interests of pursuing and developing our business and protecting our business. |
| To conduct and analyse marketing activities and to invite you to events and seminars and to participate in surveys. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To update and maintain a record of your contact information and preferences in receiving marketing data from us |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To anonymise and/or pseudonymise personal data for profiling and/or marketing purposes. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To extract and use personal data for profiling and marketing purposes, including to identify potential clients with similar or shared characteristics to clients. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To manage our relationship with you as our client and send service emails and details of products and services provided by other Amber River entities that may be of interest and to contact you for marketing or research purposes. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To manage and/or improve services and communications, to collect customer feedback for the purpose of improving our services. |
|
Our legitimate interests of improving our services through feedback. |
| To monitor emails sent to us (including attachments) for viruses or malicious software. |
|
Our legitimate interests of protecting and maintaining the security of our systems. |
| To protect and manage email traffic. |
|
Our legitimate interests of protecting and maintaining the security and efficiency of our systems. |
| To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV and monitoring our IT operations. |
|
Our legitimate interests of protecting the safety and security of our offices and staff. |
| To manage and analyse data. |
|
Our legitimate interests of pursuing and developing our business, including for service improvement, product development and by analysing aggregated data to support data analysis and support the business in making informed decisions. |
| We may use AI (artificial intelligence) tools to support us in the delivery of our services or other processing of your personal data (e.g. we use an AI voice agent to process calls from you so we can forward your call to the correct contact). This is typically to improve the efficiency, quality and speed of our business processes and service delivery. Where we do, we ensure that we do not allow the use of your personal data to train any data model or AI tool. |
|
Our legitimate interests of pursuing and developing our business, including for service improvement, and to improve the efficiency, quality and speed of our business processes and service delivery. |
| To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies. |
|
Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services). Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes. |
| For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies. |
|
Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business. |
| Generally to manage the activities of our business, including monitoring and recording electronic communications (including telephone calls and emails). |
|
Our legitimate interests including of pursuing and developing our business and providing services to you, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business. |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we wish to use your personal data for purposes which require your consent, you will be asked to provide this and/or we will contact you to request this. In such circumstances, we will provide you with details of the personal data that we would like to process and the reason we need to process it, so that you can carefully consider whether you wish to consent. Where you do consent and we rely on consent to process your personal data, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent or to opt out of receiving marketing communications, please contact us at [compliance@amberriver.com] or (in relation to marketing) follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent and had the opportunity to process that request, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.
We may process information about criminal convictions as part of and/or in connection with the provision of services to our clients. We may process information about criminal convictions relating to clients' staff and/or directors including in connection with an audit to verify whether relevant Disclosure and Barring Service Checks have been undertaken. We will only collect and use information about criminal convictions where we have a lawful basis to do so. For example, we may use information relating to criminal convictions in relation to legal claims or where regulatory requirements relating to unlawful acts and dishonesty apply.
We may contact you by telephone to market our services from time to time or send to you from time to time, by electronic means or post, marketing communications:
if you have specifically requested that information from us;
if you have specifically consented to receiving marketing communications from us;
which relate to matters connected to those on which we have previously provided services to you, provided you have not opted out of receiving that marketing (which you may do at any time by contacting us); and/or
if it is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
We will only send you marketing communications if we have a lawful basis to do so.
Please note, you can ask us to stop sending you marketing messages at any time by following the opt-out or unsubscribe links on any marketing message sent to you.
Where we need to collect personal data by law or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (and accordingly may be unable to provide you with services). We will notify you if this is the case at that time.
This section of our privacy notice sets out how we may process personal data in relation to business contacts such as if you have provided us with your business card, or have corresponded with a director or employee of Amber River and/or have attended Amber River events. It may also include persons who are connected to our clients (for example, family members) where it is relevant in connection with the advice and services we are providing to our client.
In this section "you" and "your" means a person who is a business contact of Amber River (who is not a client) and whose personal data has been provided to or collected by us, in the context of our business and our work in the provision of services.
We have grouped together the various types of data we may hold about you as follows:
Identity data may include names, titles, gender, date of birth, pronoun preferences, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, telephone numbers, emergency contact details and details of next of kin;
KYC and other identification data may include copies of passports, driving licences, utility bills and information which may be revealed by an anti-money laundering search and/or due diligence conducted on you (including details of your directorships, your electoral registration, your political exposure, insolvency proceedings against you, criminal convictions and/or any adverse media in relation to you, information revealed by politically exposed person and sanction checks and data related to any public comments about you by statutory or regulatory authorities), credit checks/references and other information from third party publicly accessible sources including Companies House;
Financial data may include details of your personal financial situation such as your earnings, assets, investments, financial products, mortgages, banking activity and bank account details;
Family data may include details of your marital status and dependants;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use when you correspond with us and other details relating to your use of and/or interaction with our IT systems and website;
Marketing data includes your Contact Data and details of your marketing consents and preferences;
Correspondence data includes any personal data which you share with us when you correspond with us (including over email, during telephone calls, during video calls, and/or in meetings) and includes recordings of telephone and video calls; and
CCTV data may include image and sound recordings.
We will not usually collect any special categories of personal data about you, except where: (i) you are invited to attend certain Amber River social events where this may be relevant; or (ii) you volunteer the information to us in writing.
We may collect personal data about you from a variety of sources:
From you: when it is provided to us by you directly;
From third parties: when it is provided to us by third parties, including from one of our clients, or from an introducer or other third parties such as accountants, business partners, former advisers, background checks and identity check providers, analytics providers, credit reference agencies and businesses that we may acquire or sell to; and
From publicly available sources: such as Companies House.
We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:
It is necessary for the performance of a contract between us and you or in order to take steps at your request prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.
We have your consent. Specifically, we may process your personal information, in some cases, for marketing purposes where you have provided your consent.
We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
| Purpose / Activity | Type of data | Legal basis for processing |
|---|---|---|
| To administer and manage our relationship or potential relationship with you or (where you are connected to our client and it is relevant for the purposes of providing our services and/or advice) our client. |
|
Our legitimate interests of pursuing and developing our business. |
| To provide, or facilitate the provision of, services or advice to our client(s) (where you are connected to the client and it is relevant for the purposes of providing our services and/or advice). |
|
Our legitimate interests of pursuing and developing our business and providing services to our clients. |
| To fulfil our regulatory compliance obligations including to prevent money laundering or other financial crimes, including to verify your identity. |
|
Compliance with our legal and regulatory obligations. |
| To comply with our legal, compliance, accounting and reporting obligations under applicable law (for example, to tax authorities or courts). |
|
Compliance with our legal and regulatory obligations. |
| To manage and effectively operate the financial affairs of our business and protect our rights and/or those of other Amber River entities. |
|
Our legitimate interests of pursuing and developing our business. |
| To conduct and analyse marketing activities and to invite you to events and seminars and to participate in surveys. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To update and maintain a record of your contact information and preferences in receiving marketing data from us |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To anonymise and/or pseudonymise personal data for profiling and/or marketing purposes. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To extract and use personal data for profiling and marketing purposes, including to identify potential clients with similar or shared characteristics to clients. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To contact you for marketing or research purposes. |
|
Our legitimate interests of pursuing and developing our business. In certain circumstances (in relation to marketing) with your consent. |
| To monitor emails sent to us (including attachments) for viruses or malicious software. |
|
Our legitimate interests of protecting and maintaining the security of our systems. |
| To protect and manage email traffic. |
|
Our legitimate interests of protecting and maintaining the security and efficiency of our systems. |
| To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV and monitoring our IT operations. |
|
Our legitimate interests of protecting the safety and security of our offices and staff. |
| To manage and analyse data. |
|
Our legitimate interests of pursuing and developing our business, including for service improvement, product development and by analysing aggregated data to support data analysis and support the business in making informed decisions. |
| To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies. |
|
Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services). Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you. |
| For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies. |
|
Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business. |
| Generally to manage the activities of our business, including monitoring and recording electronic communications (including telephone calls and emails). |
|
Our legitimate interests including of pursuing and developing our business and providing services to you, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business. |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we wish to use your personal data for purposes which require your consent, you will be asked to provide this and/or we will contact you to request this. In such circumstances, we will provide you with details of the personal data that we would like to process and the reason we need to process it, so that you can carefully consider whether you wish to consent. Where you do consent and we rely on consent to process your personal data, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent or to opt out of receiving marketing communications, please contact us at [compliance@amberriver.com] or (in relation to marketing) follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent and had the opportunity to process that request, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.
We may contact you by telephone to market our services from time to time or send to you from time to time, by electronic means or post, marketing communications:
if you have specifically requested that information from us;
if you have specifically consented to receiving marketing communications from us;
which relate to matters connected to those on which we have previously provided services to you, provided you have not opted out of receiving that marketing (which you may do at any time by contacting us); and/or
if it is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
We will only send you marketing communications if we have a lawful basis to do so.
Please note, you can ask us to stop sending you marketing messages at any time by following the opt-out or unsubscribe links on any marketing message sent to you.
Where we need to collect personal data by law or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (and accordingly may be unable to continue our business relationship with you). We will notify you if this is the case at that time.
This section of our privacy notice sets out how we may process personal data about contractors and service providers to Amber River. In this section:
contractor or service provider means an individual or organisation providing services to Amber River; and
you and your means a person whose personal data is held by us, where that data has been provided to us by you directly or by a contractor or service provider or by its directors, partners, employees, agents or representatives on its behalf, or has been collected by us, in each case, in the context of the provision of services to Amber River by that contractor or service provider.
We have grouped together the various types of data we may hold about you as follows:
Identity data may include names, titles, gender, date of birth, pronoun preferences, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, telephone numbers, emergency contact details and details of next of kin;
Employment data may include places of work and job titles, employment history and qualifications;
Financial data may include bank account details;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use when you correspond with us and other details relating to your use of and/or interaction with our IT systems and website;
Correspondence data includes any personal data which you share with us when you correspond with us (including over email, during telephone calls, during video calls, in client surveys and feedback and/or in meetings) and includes recordings of telephone and video calls; and
CCTV data may include image and sound recordings.
We will not usually collect any special categories of personal data about you, except where (i) this is relevant to any services that you are providing to Amber River, or (ii) you volunteer this information to us in writing.
We may collect personal data about you from a variety of sources:
From you: when it is provided to us by you directly;
From third parties: when it is provided to us by third parties, including as part of supplier due diligence; and
From publicly available sources: such as Companies House.
We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:
It is necessary for the performance of a contract between Amber River and you or in order to take steps prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.
We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
| Purpose / Activity | Type of data | Legal basis for processing |
|---|---|---|
| To administer and manage our relationship with you and/or the contractor or service provider. |
|
Performance of a contract with you. Our legitimate interests of pursuing and developing our business and receiving services from the contractor or service provider. |
| To comply with our obligations under the terms of a contract between the contractor or service provider and Amber River. |
|
Performance of a contract with you. Our legitimate interests of pursuing and developing our business, receiving services from the contractor or service provider and complying with the terms of contracts to which we are a party. |
| To assess your skills and qualifications, your suitability for the role and to decide whether to enter into a contract with you, the contractor or service provider or to permit access to our offices. |
|
Our legitimate interests of pursuing and developing our business and ensuring continuity and quality of services. |
| To assess and to monitor the standard of services being provided or offered to us. |
|
Our legitimate interests of pursuing and developing our business and ensuring continuity and quality of services. |
| To allow us to process payments in relation to any goods and services provided to Amber River. |
|
Performance of a contract with you. Our legitimate interests of pursuing and developing our business, receiving services from the contractor or service provider and complying with the terms of contracts to which we are a party. |
| To update and maintain our records including details of people that have accessed our offices. |
|
Our legitimate interests to keep our records updated and in certain circumstances for the prevention of criminal activity. |
| To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV. |
|
Our legitimate interests of maintaining the security of our offices. |
| To comply with our legal and regulatory requirements. |
|
Compliance with our legal and regulatory obligations. |
| To monitor emails sent to us (including attachments) for viruses or malicious software. |
|
Our legitimate interests to protect and maintain the security of our systems. |
| To protect and manage email traffic. |
|
Our legitimate interests to protect and maintain the security of our systems. |
| To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies. |
|
Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services). Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you. |
| For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies. |
|
Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business. |
| Generally to manage the activities of Amber River, including by monitoring and recording electronic communications (including telephone calls and emails). |
|
Our legitimate interests of pursuing and developing our business. |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we wish to use your personal data for purposes which require your consent, you will be asked to provide this and/or we will contact you to request this. In such circumstances, we will provide you with details of the personal data that we would like to process and the reason we need to process it, so that you can carefully consider whether you wish to consent. Where you do consent and we rely on consent to process your personal data, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent please contact us at [compliance@amberriver.com]. Once we have received notification that you have withdrawn your consent and had the opportunity to process that request, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.
Where we need to collect personal data by law or under the terms of a contract we have with the contractor or service provider or you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with the contractor or service provider or you. We will notify you if this is the case at that time.
This section of our privacy notice sets out how we may process personal data about applicants for jobs, students applying for or attending work experience with Amber River and/or in relation to other potential employees of Amber River.
In this section you and your means a person who is an applicant for work, or work experience, with Amber River.
We have grouped together the various types of data we may hold about you as follows:
Identity data may include names, titles, gender, date of birth, pronoun preferences, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, and telephone numbers;
Right to work data may include copies of your passport, driving licence, utility bills, details of unspent criminal convictions and other information which may be revealed by background checks on you;
Financial data may include bank account details and details of your salary;
Equal opportunities data may include your gender, gender identity, ethnicity, age, sexual orientation, religion and beliefs, physical or mental impairments, and native language;
Career data may include your current and former places of work and job titles, as well as details of your employment history, qualifications and CV;
Correspondence data includes any personal data which you share with us when you correspond with us (including over email, during telephone calls and/or in meetings (including interviews)) and includes recordings of telephone and video calls;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you when you correspond with us; and
CCTV data may include image and sound recordings.
We may hold special categories of personal data about you if this is necessary for Amber River to comply with its legal and regulatory obligations and for equal opportunities monitoring (see further details below). We may also collect special category data if you volunteer the information to us in writing.
We may collect personal data about you from a variety of sources:
From you: when it is provided to us by you directly including in a CV and/or covering letter;
From third parties: when it is provided to us by third parties, including from recruitment agencies and/or background check providers, which may include reports from the disclosure and barring service (namely unspent criminal convictions); and
From publicly available sources: such as Companies House and social media (including LinkedIn).
We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:
It is necessary in order to take steps at your request prior to entering into a contract between you and Amber River.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.
In relation to our processing of special category data, we rely on an additional basis as set out below.
We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
| Purpose / Activity | Type of data | Legal basis for processing |
|---|---|---|
| To assess your skills and qualifications, to consider your suitability for the position, to decide whether to enter into a contract with you and to take steps prior to entering into a contract with you. |
|
Taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and growing our work force. |
| To carry out background and reference checks. |
|
Taking steps prior to entering into a contract with you. Compliance with our legal and regulatory obligations. Our legitimate interests of growing our work force and ensuring potential employees meet our requirements and standards. |
| To communicate with you about the recruitment process. |
|
Taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and growing our work force. |
| To keep records related to our hiring processes. |
|
Compliance with our legal and regulatory obligations. Our legitimate interests of pursuing and developing our business, growing our work force and defending any potential legal claims. |
| To comply with our legal and regulatory requirements. |
|
Compliance with our legal and regulatory obligations. |
| To consider whether we need to provide appropriate adjustments during our recruitment process. |
|
Compliance with our legal and regulatory obligations. Necessary for the purposes of carrying out obligations in the field of employment law (in particular, our obligation to make reasonable adjustments under the Equality Act 2010). |
| To be able to undertake equal opportunity monitoring and reporting. |
|
Our (and our employees’ / prospective employees’) legitimate interests to maintain a diverse and equal working environment and ensure that no discrimination occurs in the workplace. Necessary for the purposes of identifying and keeping under review the existence or absence of equality of opportunity and treatment. |
| To monitor emails sent to us (including attachments) for viruses or malicious software. |
|
Our legitimate interests to protect and maintain the security of our systems. |
| To protect and manage email traffic. |
|
Our legitimate interests to protect and maintain the security of our systems. |
| To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV. |
|
Our legitimate interests of maintaining the security of our offices. |
| To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies. |
|
Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services). Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you. |
| Generally to manage the activities of Amber River, including by monitoring and recording electronic communications (including telephone calls and emails). |
|
Our legitimate interests of pursuing and developing our business. |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we wish to use your personal data for purposes which require your consent, you will be asked to provide this and/or we will contact you to request this. In such circumstances, we will provide you with details of the personal data that we would like to process and the reason we need to process it, so that you can carefully consider whether you wish to consent. Where you do consent and we rely on consent to process your personal data, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent, please contact us at [compliance@amberriver.com]. Once we have received notification that you have withdrawn your consent and had the opportunity to process that request, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.
We may send to you from time to time, by email or post, information about employment opportunities with us. You can ask us to stop providing any such information to you at any time.
If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application. For example, if we require references for a role and you fail to provide us with the relevant details, we will not be able to take your application further.
If your application is successful, the information you provide during the application process will be retained by us as part of your employee file and held in accordance with applicable laws and Amber River's employee privacy notice (copies of which will be available).
If your application is unsuccessful, we may retain and use your personal data to consider you for other positions in the future. Details of the criteria we use to determine the period for which your data will be retained are in Section Three.
This section of our privacy notice sets out how we may process personal data about persons who use an Amber River website. Some members of the Amber River Group may have supplementary privacy notices available on their website(s), which outline in more detail how the relevant member of the Amber River Group will process your personal data in connection with their website. Please refer to the privacy notice on each Amber River website you visit for further information.
Our website(s) are not intended for children and we do not knowingly collect personal data about children in connection with our website(s).
In this section, "you" and "your" refers to a person whose personal data is held by us, where that data has been provided to us through your use of our website(s).
We may hold various kinds of personal data about you, which you may provide to us from time to time or which we otherwise obtain in the course of your use of our website(s) and which we have grouped together as follows:
Identity data may include names, gender, date of birth, pronoun preferences, country of residence;
Contact data may include addresses, work email addresses, personal email addresses and telephone numbers;
Correspondence data includes any personal data which you share with us when you correspond with us;
Technical data may include your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website(s);
Marketing data includes your Contact Data and details of your marketing consents and preferences; and
Usage data may include information about how you use our website(s), products and services, and any communications we may receive from you.
We will not usually collect any special categories of personal data about you through the use of our website(s). If we do collect any special categories of data, we will make clear the reason to you, and we will ensure we have a lawful basis to process this type of information.
We may collect personal data about you from a variety of sources:
From you: when it is provided to us by you directly including by entering your details into our website; and
From third parties: when it is provided to us by third parties, including data analytics services.
We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.
We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
| Purpose / Activity | Type of data | Legal basis for processing |
|---|---|---|
| To manage our relationship with you and to provide you with the use of our website(s). |
|
Our legitimate interests of providing you with access to and use of our website (including in connection with our business). |
| Creating and managing an account with you via our website(s) and website portals. |
|
Our legitimate interests of providing you with access to and use of our website (including in connection with our business). |
| Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us. |
|
Our legitimate interests of providing you with access to and use of our website (including in connection with our business). |
| To obtain information about the number of visitors and their use of our website(s). |
|
Our legitimate interests of monitoring the use of our website, including for business purposes. Your consent (obtained via our cookies banner). |
| Retaining and evaluating information on your recent visits to our website(s) and how you move around different sections of our website(s) for analytics purposes to understand how people use our website(s) so that we can make them more intuitive or to check our website(s) are working as intended. |
|
Our legitimate interests of monitoring the use of our website, including for business purposes. Your consent (obtained via our cookies banner). |
| To ensure that our website(s) are secure. |
|
Our legitimate interests of protecting and ensuring the security of our website(s). |
| To address any issues you may experience with our website(s). |
|
Our legitimate interests of providing you with access to and use of our website (including in connection with our business). |
| To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies. |
|
Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services). |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we wish to use your personal data for purposes which require your consent, you will be asked to provide this and/or we will contact you to request this. In such circumstances, we will provide you with details of the personal data that we would like to process and the reason we need to process it, so that you can carefully consider whether you wish to consent. Where you do consent and we rely on consent to process your personal data, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent or to opt out of receiving marketing communications, please contact us at [compliance@amberriver.com] or (in relation to marketing) follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent and had the opportunity to process that request, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.
Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Using cookies and collecting this information is for our legitimate interests to ensure our website(s) work and to learn more about the use of our website(s). In some cases (in relation to the use of non-essential cookies), we will ask for your consent. For information on how we use cookies, please see the cookies policy on the website you are visiting.
Our website(s) may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices/statements. When you leave our site, we encourage you to read the privacy notice of every website you visit.
If you fail to provide information when requested, we may not be able to provide you with full access to, and use of, our website.
This section of our privacy notice provides information about our data protection practices, including information about our data security and retention policies, details of our arrangements for disclosing personal data to third parties and transferring personal data outside of the UK and EEA and information about your rights under Data Protection Laws.
We may share your personal data with selected third parties including:
third party service and software providers (including the provider of our practice management system, marketing, PR, communication services providers, call centre tools (including those which use AI voice agents) and digital agencies) and our processors and sub-processors;
other members of the Amber River group of companies, including for Amber River's own business purposes and to promote the services of other members of the group, to allow us to deliver our services to you more efficiently, for quality and compliance checking purposes and/or for marketing purposes. If you have agreed to receive marketing information, you may opt out at a later date;
third parties such as those that we engage for professional compliance, anti-money laundering verification purposes, insurance, accountancy or legal services;
third parties (including product and platform providers) that we use to arrange financial products for you;
third party agencies and authorities (including the tax authorities and the national crime agency) in connection with our obligations in respect of prevention of money-laundering and other financial crime; and
prospective and actual buyers (and their advisors) in connection with the sale or the proposed sale of any of Amber River's businesses or assets.
Where third parties are involved in processing your data as processors (on our behalf), we will have a contract in place with them to ensure that the nature and purpose of the processing is clear, that they are subject to a duty of confidence in processing your data and that they’ll only act in accordance with our written instructions.
Where we disclose your personal data to third parties, those third parties may in certain circumstances be required to process your personal data for purposes and means which they determine. For example, they may need to use your information to comply with their own legal obligations, including under anti-money laundering legislation. In those cases, the relevant service provider will be acting as a controller in respect of your personal data, and its use of your personal data will be subject to its privacy notice (which they are required by law to make available to you).
Where it’s necessary for your personal data to be forwarded to a third party we’ll use appropriate security measures designed to protect your personal data in transit. This may include encryption, password protection, courier services and other measures, as required.
We have put measures in place designed to protect the security of your personal data that we collect and store about you. These are internal policies, procedures and controls which are designed to minimise the risk of your personal data from being accidentally lost or destroyed, altered, disclosed, used or accessed in an unauthorised way but we cannot guarantee the security of data that we collect and process, particularly over the internet.
Your personal data may be stored in different places, including within our IT systems and our processors' systems, on our premises and within our storage facilities (virtual and physical).
We have procedures in place to deal with a suspected data security breach and we will notify the Information Commissioner's Office (and/or any other applicable supervisory authority or regulator) and you of a suspected breach where we are legally required to do so.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We are subject to regulatory requirements to retain certain data for specified minimum periods. In addition, we take into account our legitimate interests in providing our services, including appropriate investigations and complaints handling., As such, we will typically hold your data for five years after the end of our relationship with you as a client, and in respect of certain data for pension transfers and opt-outs, we will hold your data indefinitely, to comply with our regulatory obligations.
We reserve the right to retain data for longer than the above periods provided that this retention is in compliance with applicable data protection laws.
Where we transfer your personal data outside the UK or European Economic Area ("EEA"), we will ensure that it is protected in a manner that is consistent with how your personal data will be protected by us in the UK or EEA. We will only transfer your personal data outside the UK or EEA if an appropriate safeguard is in place, including for example that:
the country or territory that we send the data to is approved by the Secretary of State or European Commission (as applicable) as offering equivalent protections to those afforded by data protection law in the UK and EEA (as applicable); or
we have put in place specific standard contracts approved by the Secretary of State or European Commission (as applicable) which give personal data the same protection it has in the UK and EEA (as applicable).
Please contact us if you want further information on the specific safeguards we use when transferring your personal data out of the UK or EEA.
As noted above (in Part One of Section Two) we may use AI tools in our business including to help us streamline the provision of our services, but you will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
As a data subject, you have several statutory rights. Subject to specific conditions, and in certain circumstances, you have the:
Right to be Informed about the collection and the use of your personal data.
Right of Access. This enables you to request a copy of the information that we hold about you and check that we are lawfully processing it (commonly known as a "data subject access request").
Right of Rectification. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Right to Erasure. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Right to Restricting Processing. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Right to Data Portability. This enables you to request the transfer of your personal information to another party.
Right to Object. This enables you to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Right to Withdraw your Consent. If we are processing your personal data on the basis of your consent, you have the right to withdraw such consent at any time. Withdrawing your consent will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent or to opt out of receiving marketing communications, please contact us at [compliance@amberriver.com] or follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
Should you wish to have any further information regarding your rights, or if you would like to exercise any of these rights, please write to us at Amber River, Floor 4, 90 High Holborn, London WC1V 6LJ and/or [compliance@amberriver.com].
You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
You also have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is the Information Commissioner's Office (www.ico.org.uk).
We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance, either at Amber River, Floor 4, 90 High Holborn, London WC1V 6LJ or [compliance@amberriver.com.] We will acknowledge receipt of your complaint within 30 days of receiving it, and, without undue delay, we will take appropriate steps to respond to your complaint and inform you of the outcome of your complaint.
The personal data we hold about you needs to be accurate and up to date in order to comply with data protection law. Please let us know of any changes to your personal data so that we can correct our records.
We may update this Privacy Notice from time to time and will ensure that any such changes to this policy are made available. We may also notify you from time to time about the any additional processing of your data by providing you with a supplementary privacy notice.