Privacy policy

This privacy notice is issued by Amber River Group Limited on its behalf, and on behalf of its subsidiaries (each a “member of the Amber River Group” and together, “Amber River“, “Amber River Group“, “we“, “us” or “our“). Amber River is committed to protecting the privacy of individuals whose data we process and complying with our obligations under applicable data protection laws (“Data Protection Laws“).

The information that you trust us with is important, and we are committed to protecting and respecting your privacy. If you are a client, this privacy notice is intended to be read in conjunction with your client agreement.

This privacy notice provides you with information on how we (as a data controller) collect and process personal data in connection with the provision of our services, including if you are:

a potential, current or former client or business contact of Amber River (and, where applicable, if you are one of our client’s employees, advisers, agents, family members, dependants and other related parties including co-trustees);
a contractor or service provider to Amber River;
applying for employment or work experience with us; and/or
a user of our website.

In addition, this privacy notice outlines your rights under Data Protection Laws.

We may from time to time update this privacy notice at our discretion. Please refer back to this page regularly to see any changes or updates to this Privacy Notice.

If you have any queries in relation to our processing of your personal data please contact us at [compliance@amberriver.com].

You have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is the Information Commissioner’s Office (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance, either at Amber River, Floor 4, 90 High Holborn, London WC1V 6LJ or [compliance@amberriver.com]. We will acknowledge receipt of your complaint within 30 days of receiving it, and, without undue delay, we will take appropriate steps to respond to your complaint and inform you of the outcome of your complaint.

This privacy notice is provided in a layered format to allow you to navigate it easily. The privacy notice is split into the following sections:

Section One, The Controller of Your Personal Data: This section provides details of the Amber River Group so you can identify the controller of your personal data.
Section Two, How We Process Your Personal Data: This section provides information on how we process your personal data, including the purposes for which we process personal data (and the legal bases on which we rely to process it). How we process your personal data will depend on the nature of your engagement/relationship with Amber River, so this section is split into parts:
- Part One, Clients: If you are a current, potential or former client of Amber River, this section provides details of how we process your personal data.
- Part Two, Business Contacts: If you are a business contact of Amber River but are not a current, potential or former client, this section provides details of how we process your personal data. This includes if you have provided us with a business card, if you have corresponded with us and/or if you have attended events run by Amber River. It may also include persons who are connected to our clients (for example, if you are an employee, adviser, agent, family member, dependant or other related party of our client) where it is relevant in connection with the advice and services we are providing to the relevant client.
- Part Three, Contractors and Service Providers: If you are a contractor or provide services to Amber River, this section provides details of how we process your personal data.
- Part Four, Job Applicants: If you have applied for a job or work experience with a member of the Amber River Group, this section provides details of how we process your personal data.
- Part Five, Website Users: If you are a user of an Amber River website, this section provides details of how we process your personal data.
Section Three, Other Information: This section applies to all persons about whom we process personal data, and provides information about our data protection practices, including information about our data security and retention policies, details of our arrangements for disclosing personal data to third parties and transferring personal data outside of the UK and EEA and information on your rights under Data Protection Laws.

How we process your personal data depends on the nature of your engagement with Amber River, so this section is split into five parts — open the part that applies to you.

This section of our privacy notice sets out how we may process personal data about our clients (including potential, current and former clients). In this section, "you" and "your" refers to a person whose personal data is held by us, where that data has been provided to us by a client, or has been collected by us, in each case, in the context of the operation of our business, including the provision by us of services.

We have grouped together the various types of personal data we may hold about you as follows:

Identity data may include names (including nicknames, preferred names, previous names and/or maiden names), titles, gender, date of birth, pronoun preferences, nationality, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, telephone numbers, emergency contact details and details of next of kin;
KYC and other identification data may include copies of passports, driving licences, utility bills and information which may be revealed by an anti-money laundering search and/or due diligence conducted on you (including details of your directorships, your electoral registration, your political exposure, insolvency proceedings against you, criminal convictions and/or any adverse media in relation to you, information revealed by politically exposed person and sanction checks and data related to any public comments about you by statutory or regulatory authorities), credit checks/references and other information from third party publicly accessible sources including Companies House;
Employment data may include details of your employment including your occupation, employment status, employer and employment start date;
Financial data may include details of your personal financial situation such as your earnings, assets, liabilities, gifts given, pensions and investments, estate planning, financial products, expenditures, mortgages, banking activity and bank account details;
Family data may include details of your marital status and dependants;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use when you correspond with us and other details relating to your use of and/or interaction with our IT systems and website;
Marketing data includes your Contact Data and details of your marketing consents and preferences;
Correspondence data includes any personal data which is shared with us when you correspond with us (including over email, during telephone calls, during video calls, in client surveys and feedback and/or in meetings) and includes recordings of telephone and video calls;
Special category personal data including data relating to your health and biometric data; and
CCTV data may include image and sound recordings.

We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:

It is necessary for the performance of a contract between us and you for the provision of our business services or in order to take steps at your request prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests (or the legitimate interests of a third party), where such interests are not overridden by your rights or interests. Our legitimate interests include pursing and developing our business (including business development and attracting new clients), providing our services including complaint handling; preventing fraud, money laundering, sanctions, terrorist financing, bribery, corruption and tax evasion and internal group administration. Further information on our legitimate interests is set out below.
It is necessary for us to comply with a legal obligation on us.
We have your consent. Specifically:
- We may use your special category personal data where you have provided your consent.
- We may process your personal information, in some cases, for marketing purposes where you have provided your consent.

We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Purpose / Activity	Type of data	Legal basis for processing
To administer and manage our relationship with you and to respond to requests for services.	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Performance of a contract with you or taking steps prior to entering into a contract with you.Our legitimate interests of pursuing and developing our business and providing services to you.
To provide, or facilitate the provision of our services to you.	Identity data Contact data Correspondence data Employment data Financial data Family data KYC and other identification data Special category personal data	Performance of a contract with you or taking steps prior to entering into a contract with you.Our legitimate interests of pursuing and developing our business and providing services to you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes.
To collect information about you when you engage with us and during our engagement with you (e.g. via our Digital Factfind tool which uses multi-factor authentication), including collecting special category data, in connection with the provision of services to you. This information will be updated and managed (as required) during our engagement with you.	Identity data Contact data Correspondence data Employment data Financial data Family data KYC and other identification data Special category personal data	Performance of a contract with you or taking steps prior to entering into a contract with you.Our legitimate interests of pursuing and developing our business and providing services to you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes.
To instruct bank transfers and other payments required as part of our services.	Identity data Contact data Correspondence data Financial data KYC and other identification data	Performance of a contract with you. Our legitimate interests of providing services to you. Compliance with our legal and regulatory obligations.
To conduct our business, including in relation to our business services.	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Our legitimate interests of pursuing and developing our business and providing services to you.
To fulfil our regulatory compliance obligations including to prevent money laundering or other financial crimes, including to verify your identity.	Identity data Contact data Correspondence data Financial data KYC and other identification data Special category data	Compliance with our legal and regulatory obligations. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of complying with regulatory requirements relating to unlawful acts and dishonesty.
To comply with our legal, compliance, accounting and reporting obligations under applicable law (for example, to tax authorities or courts).	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Compliance with our legal and regulatory obligations.
To manage and effectively operate the financial affairs of our business and protect our rights and/or those of other Amber River entities.	Identity data Contact data Correspondence data KYC and other identification data Financial data	Our legitimate interests of pursuing and developing our business and protecting our business.
To conduct and analyse marketing activities and to invite you to events and seminars and to participate in surveys.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To update and maintain a record of your contact information and preferences in receiving marketing data from us	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To anonymise and/or pseudonymise personal data for profiling and/or marketing purposes.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To extract and use personal data for profiling and marketing purposes, including to identify potential clients with similar or shared characteristics to clients.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To manage our relationship with you as our client and send service emails and details of products and services provided by other Amber River entities that may be of interest and to contact you for marketing or research purposes.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To manage and/or improve services and communications, to collect customer feedback for the purpose of improving our services.	Identity data Contact data Correspondence data	Our legitimate interests of improving our services through feedback.
To monitor emails sent to us (including attachments) for viruses or malicious software.	Identity data Contact data Correspondence data Technical data	Our legitimate interests of protecting and maintaining the security of our systems.
To protect and manage email traffic.	Identity data Contact data Correspondence data Technical data	Our legitimate interests of protecting and maintaining the security and efficiency of our systems.
To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV and monitoring our IT operations.	Identity data Technical data CCTV data	Our legitimate interests of protecting the safety and security of our offices and staff.
To manage and analyse data.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests of pursuing and developing our business, including for service improvement, product development and by analysing aggregated data to support data analysis and support the business in making informed decisions.
We may use AI (artificial intelligence) tools to support us in the delivery of our services or other processing of your personal data (e.g. we use an AI voice agent to process calls from you so we can forward your call to the correct contact). This is typically to improve the efficiency, quality and speed of our business processes and service delivery. Where we do, we ensure that we do not allow the use of your personal data to train any data model or AI tool.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests of pursuing and developing our business, including for service improvement, and to improve the efficiency, quality and speed of our business processes and service delivery.
To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies.	Identity data Contact data Correspondence data Employment data KYC and other identification data Financial data Family data Special category personal data Technical data	Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services).Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you. In relation to special category personal data, your consent. In certain circumstances we may be able to process your special category personal data without your explicit consent. For example, we may be able to process your personal data on the grounds that it is in the substantial public interest (where one of those grounds falls within the scope of the Data Protection Act 2018). This includes processing for the purposes of safeguarding the economic well-being of individuals and for insurance purposes.
For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business.
Generally to manage the activities of our business, including monitoring and recording electronic communications (including telephone calls and emails).	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data CCTV data	Our legitimate interests including of pursuing and developing our business and providing services to you, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

This section of our privacy notice sets out how we may process personal data in relation to business contacts such as if you have provided us with your business card, or have corresponded with a director or employee of Amber River and/or have attended Amber River events. It may also include persons who are connected to our clients (for example, family members) where it is relevant in connection with the advice and services we are providing to our client. In this section "you" and "your" means a person who is a business contact of Amber River (who is not a client) and whose personal data has been provided to or collected by us, in the context of our business and our work in the provision of services.

We have grouped together the various types of data we may hold about you as follows:

Identity data may include names, titles, gender, date of birth, pronoun preferences, country of residence and personal identifiers such as your national insurance number, tax file number and images of you;
Contact data may include addresses, work email addresses, personal email addresses, telephone numbers, emergency contact details and details of next of kin;
KYC and other identification data may include copies of passports, driving licences, utility bills and information which may be revealed by an anti-money laundering search and/or due diligence conducted on you (including details of your directorships, your electoral registration, your political exposure, insolvency proceedings against you, criminal convictions and/or any adverse media in relation to you, information revealed by politically exposed person and sanction checks and data related to any public comments about you by statutory or regulatory authorities), credit checks/references and other information from third party publicly accessible sources including Companies House;
Financial data may include details of your personal financial situation such as your earnings, assets, investments, financial products, mortgages, banking activity and bank account details;
Family data may include details of your marital status and dependants;
Technical data may include internet protocol (IP) address, mail server URL, MIME version, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use when you correspond with us and other details relating to your use of and/or interaction with our IT systems and website;
Marketing data includes your Contact Data and details of your marketing consents and preferences;
Correspondence data includes any personal data which you share with us when you correspond with us (including over email, during telephone calls, during video calls, and/or in meetings) and includes recordings of telephone and video calls; and
CCTV data may include image and sound recordings.

We will not usually collect any special categories of personal data about you, except where: (i) you are invited to attend certain Amber River social events where this may be relevant; or (ii) you volunteer the information to us in writing.

We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:

It is necessary for the performance of a contract between us and you or in order to take steps at your request prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.
We have your consent. Specifically, we may process your personal information, in some cases, for marketing purposes where you have provided your consent.

Purpose / Activity	Type of data	Legal basis for processing
To administer and manage our relationship or potential relationship with you or (where you are connected to our client and it is relevant for the purposes of providing our services and/or advice) our client.	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Our legitimate interests of pursuing and developing our business.
To provide, or facilitate the provision of, services or advice to our client(s) (where you are connected to the client and it is relevant for the purposes of providing our services and/or advice).	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Our legitimate interests of pursuing and developing our business and providing services to our clients.
To fulfil our regulatory compliance obligations including to prevent money laundering or other financial crimes, including to verify your identity.	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Compliance with our legal and regulatory obligations.
To comply with our legal, compliance, accounting and reporting obligations under applicable law (for example, to tax authorities or courts).	Identity data Contact data Correspondence data Financial data Family data KYC and other identification data	Compliance with our legal and regulatory obligations.
To manage and effectively operate the financial affairs of our business and protect our rights and/or those of other Amber River entities.	Identity data Contact data Correspondence data KYC and other identification data Financial data	Our legitimate interests of pursuing and developing our business.
To conduct and analyse marketing activities and to invite you to events and seminars and to participate in surveys.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To update and maintain a record of your contact information and preferences in receiving marketing data from us	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To anonymise and/or pseudonymise personal data for profiling and/or marketing purposes.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To extract and use personal data for profiling and marketing purposes, including to identify potential clients with similar or shared characteristics to clients.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To contact you for marketing or research purposes.	Identity data Contact data Correspondence data Marketing data	Our legitimate interests of pursuing and developing our business.In certain circumstances (in relation to marketing) with your consent.
To monitor emails sent to us (including attachments) for viruses or malicious software.	Identity data Contact data Correspondence data Technical data	Our legitimate interests of protecting and maintaining the security of our systems.
To protect and manage email traffic.	Identity data Contact data Correspondence data Technical data	Our legitimate interests of protecting and maintaining the security and efficiency of our systems.
To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV and monitoring our IT operations.	Identity data Technical data CCTV data	Our legitimate interests of protecting the safety and security of our offices and staff.
To manage and analyse data.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests of pursuing and developing our business, including for service improvement, product development and by analysing aggregated data to support data analysis and support the business in making informed decisions.
To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services).Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you.
For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies.	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data	Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business.
Generally to manage the activities of our business, including monitoring and recording electronic communications (including telephone calls and emails).	Identity data Contact data Correspondence data KYC and other identification data Financial data Family data Technical data CCTV data	Our legitimate interests including of pursuing and developing our business and providing services to you, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business.

This section of our privacy notice sets out how we may process personal data about contractors and service providers to Amber River. In this section:

contractor or service provider means an individual or organisation providing services to Amber River; and
you and your means a person whose personal data is held by us, where that data has been provided to us by you directly or by a contractor or service provider or by its directors, partners, employees, agents or representatives on its behalf, or has been collected by us, in each case, in the context of the provision of services to Amber River by that contractor or service provider.

We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:

It is necessary for the performance of a contract between Amber River and you or in order to take steps prior to entering into such a contract.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.

Purpose / Activity	Type of data	Legal basis for processing
To administer and manage our relationship with you and/or the contractor or service provider.	Identity data Contact data Employment data Correspondence data Financial data	Performance of a contract with you. Our legitimate interests of pursuing and developing our business and receiving services from the contractor or service provider.
To comply with our obligations under the terms of a contract between the contractor or service provider and Amber River.	Identity data Contact data Employment data Correspondence data Financial data	Performance of a contract with you. Our legitimate interests of pursuing and developing our business, receiving services from the contractor or service provider and complying with the terms of contracts to which we are a party.
To assess your skills and qualifications, your suitability for the role and to decide whether to enter into a contract with you, the contractor or service provider or to permit access to our offices.	Identity data Contact data Employment data Correspondence data	Our legitimate interests of pursuing and developing our business and ensuring continuity and quality of services.
To assess and to monitor the standard of services being provided or offered to us.	Identity data Contact data Employment data Correspondence data	Our legitimate interests of pursuing and developing our business and ensuring continuity and quality of services.
To allow us to process payments in relation to any goods and services provided to Amber River.	Identity data Contact data Correspondence data Financial data	Performance of a contract with you. Our legitimate interests of pursuing and developing our business, receiving services from the contractor or service provider and complying with the terms of contracts to which we are a party.
To update and maintain our records including details of people that have accessed our offices.	Identity data Contact data Employment data Correspondence data Financial data Technical data	Our legitimate interests to keep our records updated and in certain circumstances for the prevention of criminal activity.
To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV.	Identity data Technical data CCTV data	Our legitimate interests of maintaining the security of our offices.
To comply with our legal and regulatory requirements.	Identity data Contact data Employment data Correspondence data Financial data Technical data	Compliance with our legal and regulatory obligations.
To monitor emails sent to us (including attachments) for viruses or malicious software.	Identity data Contact data Correspondence data Technical data	Our legitimate interests to protect and maintain the security of our systems.
To protect and manage email traffic.	Identity data Contact data Correspondence data Technical data	Our legitimate interests to protect and maintain the security of our systems.
To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies.	Identity data Contact data Employment data Correspondence data Financial data Technical data CCTV data	Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services).Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you.
For internal corporate reporting, business administration, ensuring adequate insurance coverage for our business, ensuring the security of company facilities, research and development, and to identify and implement business efficiencies.	Identity data Contact data Employment data Correspondence data Financial data Technical data CCTV data	Our legitimate interests including of pursuing and developing our business, improving the quality of our services, protecting and maintaining the security of our systems, offices and staff and generally to manage and operate our business.
Generally to manage the activities of Amber River, including by monitoring and recording electronic communications (including telephone calls and emails).	Identity data Contact data Employment data Correspondence data Financial data Technical data CCTV data	Our legitimate interests of pursuing and developing our business.

This section of our privacy notice sets out how we may process personal data about applicants for jobs, students applying for or attending work experience with Amber River and/or in relation to other potential employees of Amber River. In this section you and your means a person who is an applicant for work, or work experience, with Amber River.

We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:

It is necessary in order to take steps at your request prior to entering into a contract between you and Amber River.
It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.

In relation to our processing of special category data, we rely on an additional basis as set out below. We have set out in the table below a description of the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Purpose / Activity	Type of data	Legal basis for processing
To assess your skills and qualifications, to consider your suitability for the position, to decide whether to enter into a contract with you and to take steps prior to entering into a contract with you.	Identity data Right to work data Financial data Equal opportunities data Career data Correspondence data	Taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and growing our work force.
To carry out background and reference checks.	Identity data Contact data Right to work data Career data Correspondence data	Taking steps prior to entering into a contract with you. Compliance with our legal and regulatory obligations. Our legitimate interests of growing our work force and ensuring potential employees meet our requirements and standards.
To communicate with you about the recruitment process.	Identity data Contact data Correspondence data	Taking steps prior to entering into a contract with you. Our legitimate interests of pursuing and developing our business and growing our work force.
To keep records related to our hiring processes.	Identity data Contact data Right to work data Financial data Equal opportunities data Career data Correspondence data	Compliance with our legal and regulatory obligations. Our legitimate interests of pursuing and developing our business, growing our work force and defending any potential legal claims.
To comply with our legal and regulatory requirements.	Identity data Contact data Right to work data Equal opportunities data Correspondence data	Compliance with our legal and regulatory obligations.
To consider whether we need to provide appropriate adjustments during our recruitment process.	Identity data Equal opportunities data	Compliance with our legal and regulatory obligations. Necessary for the purposes of carrying out obligations in the field of employment law (in particular, our obligation to make reasonable adjustments under the Equality Act 2010).
To be able to undertake equal opportunity monitoring and reporting.	Identity data Equal opportunities data	Our (and our employees’ / prospective employees’) legitimate interests to maintain a diverse and equal working environment and ensure that no discrimination occurs in the workplace.Necessary for the purposes of identifying and keeping under review the existence or absence of equality of opportunity and treatment.
To monitor emails sent to us (including attachments) for viruses or malicious software.	Identity data Contact data Correspondence data Technical data	Our legitimate interests to protect and maintain the security of our systems.
To protect and manage email traffic.	Identity data Contact data Correspondence data Technical data	Our legitimate interests to protect and maintain the security of our systems.
To detect, prevent and/or investigate fraud and crime such as monitoring office CCTV.	Identity data Technical data CCTV data	Our legitimate interests of maintaining the security of our offices.
To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies.	Identity data Contact data Right to work data Financial data Career data Correspondence data Technical data CCTV data	Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services).Compliance with our legal and regulatory obligations. Performance of a contract with you or taking steps prior to entering into a contract with you.
Generally to manage the activities of Amber River, including by monitoring and recording electronic communications (including telephone calls and emails).	Identity data Contact data Right to work data Financial data Career data Correspondence data Technical data CCTV data	Our legitimate interests of pursuing and developing our business.

This section of our privacy notice sets out how we may process personal data about persons who use an Amber River website. Some members of the Amber River Group may have supplementary privacy notices available on their website(s), which outline in more detail how the relevant member of the Amber River Group will process your personal data in connection with their website. Please refer to the privacy notice on each Amber River website you visit for further information. Our website(s) are not intended for children and we do not knowingly collect personal data about children in connection with our website(s). In this section, "you" and "your" refers to a person whose personal data is held by us, where that data has been provided to us through your use of our website(s).

We will only use your personal information as the law permits. The legal bases we principally rely upon when processing your personal data are as follows:

It is necessary for the purposes of our legitimate interests, where such interests are not overridden by your rights or interests.
It is necessary for us to comply with a legal obligation on us.

Purpose / Activity	Type of data	Legal basis for processing
To manage our relationship with you and to provide you with the use of our website(s).	Identity data Contact data Correspondence data Technical data Usage data	Our legitimate interests of providing you with access to and use of our website (including in connection with our business).
Creating and managing an account with you via our website(s) and website portals.	Identity data Contact data Correspondence data Technical data Usage data	Our legitimate interests of providing you with access to and use of our website (including in connection with our business).
Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us.	Identity data Contact data Correspondence data Technical data Usage data	Our legitimate interests of providing you with access to and use of our website (including in connection with our business).
To obtain information about the number of visitors and their use of our website(s).	Technical data Usage data	Our legitimate interests of monitoring the use of our website, including for business purposes.Your consent (obtained via our cookies banner).
Retaining and evaluating information on your recent visits to our website(s) and how you move around different sections of our website(s) for analytics purposes to understand how people use our website(s) so that we can make them more intuitive or to check our website(s) are working as intended.	Technical data Usage data	Our legitimate interests of monitoring the use of our website, including for business purposes.Your consent (obtained via our cookies banner).
To ensure that our website(s) are secure.	Technical data Usage data	Our legitimate interests of protecting and ensuring the security of our website(s).
To address any issues you may experience with our website(s).	Identity data Contact data Correspondence data Technical data Usage data	Our legitimate interests of providing you with access to and use of our website (including in connection with our business).
To share personal data with third parties in certain circumstances as detailed in Section Three (including in certain circumstances with third parties based outside of the UK and/or EEA). This includes intra-group data sharing within the Amber River Group, and the sharing of personal data with prospective and actual buyers of the business or assets or the shares of any of the Amber River group companies.	Identity data Contact data Correspondence data Technical data Usage data	Our legitimate interests of managing, performing and conducting our business (including outsourcing certain work and/or services).

This section of our privacy notice provides information about our data protection practices, including information about our data security and retention policies, details of our arrangements for disclosing personal data to third parties and transferring personal data outside of the UK and EEA and information about your rights under Data Protection Laws.

We may share your personal data with selected third parties including:

third party service and software providers (including the provider of our practice management system, marketing, PR, communication services providers, call centre tools (including those which use AI voice agents) and digital agencies) and our processors and sub-processors;
other members of the Amber River group of companies, including for Amber River's own business purposes and to promote the services of other members of the group, to allow us to deliver our services to you more efficiently, for quality and compliance checking purposes and/or for marketing purposes. If you have agreed to receive marketing information, you may opt out at a later date;
third parties such as those that we engage for professional compliance, anti-money laundering verification purposes, insurance, accountancy or legal services;
third parties (including product and platform providers) that we use to arrange financial products for you;
third party agencies and authorities (including the tax authorities and the national crime agency) in connection with our obligations in respect of prevention of money-laundering and other financial crime; and
prospective and actual buyers (and their advisors) in connection with the sale or the proposed sale of any of Amber River's businesses or assets.

Where third parties are involved in processing your data as processors (on our behalf), we will have a contract in place with them to ensure that the nature and purpose of the processing is clear, that they are subject to a duty of confidence in processing your data and that they’ll only act in accordance with our written instructions. Where we disclose your personal data to third parties, those third parties may in certain circumstances be required to process your personal data for purposes and means which they determine. For example, they may need to use your information to comply with their own legal obligations, including under anti-money laundering legislation. In those cases, the relevant service provider will be acting as a controller in respect of your personal data, and its use of your personal data will be subject to its privacy notice (which they are required by law to make available to you). Where it’s necessary for your personal data to be forwarded to a third party we’ll use appropriate security measures designed to protect your personal data in transit. This may include encryption, password protection, courier services and other measures, as required.

As a data subject, you have several statutory rights. Subject to specific conditions, and in certain circumstances, you have the:

Right to be Informed about the collection and the use of your personal data.
Right of Access. This enables you to request a copy of the information that we hold about you and check that we are lawfully processing it (commonly known as a "data subject access request").
Right of Rectification. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Right to Erasure. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Right to Restricting Processing. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Right to Data Portability. This enables you to request the transfer of your personal information to another party.
Right to Object. This enables you to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Right to Withdraw your Consent. If we are processing your personal data on the basis of your consent, you have the right to withdraw such consent at any time. Withdrawing your consent will not affect the lawfulness of processing based on consent before its withdrawal. To withdraw your consent or to opt out of receiving marketing communications, please contact us at [compliance@amberriver.com] or follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Should you wish to have any further information regarding your rights, or if you would like to exercise any of these rights, please write to us at Amber River, Floor 4, 90 High Holborn, London WC1V 6LJ and/or [compliance@amberriver.com]. You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Privacy policy

› Your guide to our privacy notice

› Section One – The Controller of Your Personal Data

› Members of the Amber River Group – hub contact details

› Section Two – How We Process Your Personal Data

› Part One – Clients

› The data we may hold

› Where we collect information about you from

› What we use your personal data for and our legal basis for processing

› Where your consent is required

› Processing of information about criminal convictions

› Marketing

› If you fail to provide personal information requested

› Part Two – Business Contacts

› The data we may hold

› Where we collect information about you from

› What we use your personal data for and our legal basis for processing

› Where your consent is required

› Marketing

› If you fail to provide personal information requested

› Part Three – Contractors & Service Providers

› The data we may hold

› Where we collect information about you from

› What we use your personal data for and our legal basis for processing

› Where your consent is required

› If you fail to provide personal information requested

› Part Four – Job Applicants

› The data we may hold

› Where we collect information about you from

› What we use your personal data for and our legal basis for processing

› Where your consent is required

› Potential employment information

› If you fail to provide personal information requested

› Data retention periods in relation to job applications

› Part Five – Website Users

› The data we may hold

› Where we collect information about you from

› What we use your personal data for and our legal basis for processing

› Where your consent is required

› Cookies

› Third Party Websites

› If you fail to provide personal information requested

› Section Three – Other Information

› Sharing your personal data

› Information Security

› How long do we keep hold of your information?

› International transfers

› Automated decision-making

› Your legal rights

› What can you do if you are unhappy with how your personal data is processed?

› Changes to your data

› Changes to our Privacy Notice