How CDM Capital Ltd processes personal information under UK data-protection law.
1. Introduction
CDM Capital Ltd respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and disclose personal information when you:
- visit our website;
- contact us;
- request a callback or consultation;
- subscribe to market updates or newsletters;
- create or use a client account;
- purchase or enquire about an asset;
- communicate with our employees or representatives; or
- otherwise interact with CDM Capital Ltd.
It also explains your rights under applicable UK data-protection legislation.
Please read this Privacy Policy carefully so that you understand how we handle your personal information.
2. Who We Are
CDM Capital Ltd is the controller responsible for the personal information described in this Privacy Policy.
CDM Capital Ltd
Company Registration Number: 14782564
Registered Office:
1 Allied Business Centre
Coldharbour Lane
Harpenden
Hertfordshire
AL5 4UT
Telephone: 020 3006 8409
Email: Admin@cdmcapital.co.uk
Website: www.cdmcapital.co.uk
CDM Capital Ltd is registered with the Information Commissioner’s Office.
ICO Registration Number: ZB867005
For the purposes of this Privacy Policy, “CDM Capital”, “we”, “us” and “our” refer to CDM Capital Ltd.
“You” and “your” refer to the individual whose personal information we process.
3. Data-Protection Legislation
We process personal information in accordance with applicable UK data-protection legislation, including:
- the UK General Data Protection Regulation;
- the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations 2003, where applicable; and
- other applicable laws and regulations concerning privacy, electronic communications and direct marketing.
4. Personal Information
Personal information means any information relating to an identified or identifiable individual.
It does not include information that has been anonymised so that an individual can no longer be identified.
Some information may be considered special-category personal information and is subject to additional legal protection. CDM Capital does not generally seek to collect special-category personal information unless it is necessary and lawful to do so.
5. Personal Information We May Collect
The personal information we collect depends on how you interact with us.
5.1 Identity information
This may include:
- full name;
- title;
- date of birth;
- signature;
- nationality;
- passport details;
- driving-licence details;
- national identification details; and
- copies of identity documents.
5.2 Contact information
This may include:
- residential address;
- correspondence address;
- email address;
- telephone number; and
- preferred method of communication.
5.3 Financial information
This may include:
- bank-account details;
- payment information;
- transaction records;
- source-of-funds information;
- source-of-wealth information;
- financial circumstances;
- investment or purchase budget; and
- information required to process refunds or sale proceeds.
We will not ordinarily request your full online-banking login details, card PIN or password.
5.4 Transaction and asset information
This may include:
- details of assets purchased, sold or considered;
- Purchase Agreements;
- Order Forms;
- Certificates of Acquisition;
- warehouse records;
- ownership details;
- storage and insurance information;
- invoices;
- payment records;
- resale instructions; and
- communications relating to your portfolio or assets.
5.5 Compliance information
This may include:
- anti-money-laundering information;
- identity-verification results;
- sanctions-screening results;
- politically exposed person checks;
- fraud-prevention information;
- information concerning the source of funds or wealth;
- company ownership and control information; and
- records required by law, banks, warehouses, suppliers or professional advisers.
5.6 Communication information
This may include:
- emails;
- letters;
- telephone-call records;
- recorded telephone conversations;
- text messages;
- online enquiries;
- live-chat or messaging conversations;
- meeting notes;
- complaints; and
- customer-service records.
5.7 Marketing information
This may include:
- your marketing preferences;
- newsletter subscriptions;
- events attended;
- campaigns you have responded to;
- areas of interest;
- communication preferences; and
- records of consent or objections to marketing.
5.8 Website and technical information
When you visit our website, we may collect:
- Internet Protocol address;
- browser type and version;
- device type;
- operating system;
- approximate location derived from an IP address;
- time-zone setting;
- website pages viewed;
- links clicked;
- time spent on pages;
- referring website;
- website-session information;
- cookie identifiers; and
- other technical or diagnostic information.
5.9 Professional and corporate information
Where you interact with us on behalf of a company, trust, partnership or other organisation, we may collect:
- your job title;
- company name;
- business contact details;
- directorship information;
- ownership or control information;
- authorised signatory status; and
- your relationship with the organisation.
6. How We Collect Personal Information
We may collect personal information from the following sources.
6.1 Directly from you
For example, when you:
- complete a website form;
- request a callback;
- contact us by telephone or email;
- subscribe to a newsletter;
- attend a meeting;
- complete an Order Form or Purchase Agreement;
- provide identity-verification documents;
- purchase or sell an asset;
- make a payment;
- submit a complaint; or
- exercise a data-protection right.
6.2 Through our website and systems
We may collect technical and usage information through:
- cookies;
- tracking pixels;
- scripts;
- server logs;
- analytics systems;
- online forms; and
- similar technologies.
6.3 From third parties
We may receive information from:
- identity-verification providers;
- fraud-prevention providers;
- sanctions and politically exposed person screening providers;
- warehouses and custodians;
- insurers;
- distilleries;
- suppliers;
- dealers;
- brokers;
- payment and banking providers;
- professional advisers;
- credit-reference or public-record sources;
- marketing and lead-generation partners;
- existing clients who make an introduction;
- companies you represent; and
- publicly accessible sources, including Companies House and professional websites.
Where another person provides us with your information, they should have the authority or lawful basis to do so.
7. How We Use Personal Information
We may use your personal information for the following purposes.
7.1 Responding to enquiries
We use contact and enquiry information to:
- respond to questions;
- arrange telephone calls or meetings;
- provide requested information;
- understand your requirements; and
- discuss potential products or services.
7.2 Preparing and performing contracts
We use personal information to:
- prepare quotations and proposals;
- issue Purchase Agreements and Order Forms;
- process purchases;
- verify payments;
- issue ownership documentation;
- arrange storage and insurance;
- administer assets;
- arrange transfers;
- provide ongoing support;
- process sale instructions; and
- pay sale proceeds or refunds.
7.3 Identity verification and compliance
We may process information to:
- verify identity and address;
- assess the source of funds and wealth;
- conduct anti-money-laundering checks;
- carry out fraud-prevention checks;
- screen for sanctions and politically exposed person status;
- meet legal and compliance obligations;
- respond to lawful requests from authorities; and
- protect CDM Capital, our clients and third parties from crime or misuse.
7.4 Customer service
We use personal information to:
- administer your relationship with us;
- respond to questions;
- correct records;
- handle complaints;
- provide transaction updates;
- provide warehouse or ownership information; and
- maintain accurate records of communications.
7.5 Marketing and communications
Subject to applicable law, we may use personal information to:
- send newsletters;
- provide market commentary;
- notify you about available assets;
- send event invitations;
- provide company news;
- communicate offers or opportunities;
- understand the effectiveness of campaigns; and
- personalise marketing according to your recorded interests.
You can unsubscribe from marketing at any time.
7.6 Improving our business
We may use information to:
- analyse website performance;
- understand how clients use our services;
- improve our website and communications;
- improve customer service;
- train employees;
- monitor service standards;
- develop new products or services;
- conduct internal reporting;
- assess business performance; and
- protect the security of our systems.
7.7 Legal and business administration
We may process information to:
- establish, exercise or defend legal claims;
- obtain professional advice;
- manage insurance matters;
- perform audits;
- comply with tax and accounting obligations;
- manage a restructuring, investment, merger or sale of the business;
- maintain corporate records; and
- comply with legal, regulatory or court requirements.
8. Our Lawful Bases
We will only process personal information where we have a lawful basis.
Depending on the circumstances, we may rely upon the following bases.
8.1 Performance of a contract
Processing may be necessary to:
- take steps at your request before entering into a contract;
- complete a purchase;
- arrange storage, insurance or ownership;
- administer an existing transaction;
- facilitate a sale or transfer; or
- fulfil another contractual obligation.
8.2 Legal obligation
We may need to process personal information to comply with:
- anti-money-laundering requirements;
- fraud-prevention obligations;
- tax and accounting legislation;
- court orders;
- law-enforcement requests;
- sanctions requirements;
- data-protection law; or
- other applicable legal obligations.
8.3 Legitimate interests
We may process information where it is necessary for our legitimate business interests and those interests are not overridden by your rights.
Our legitimate interests may include:
- operating and managing our business;
- responding to enquiries;
- maintaining client relationships;
- protecting against fraud;
- securing our systems;
- maintaining accurate business records;
- improving our website and services;
- recovering debts;
- obtaining professional advice;
- defending legal claims; and
- marketing relevant products or services where legally permitted.
8.4 Consent
We may rely on your consent where required, including for certain:
- electronic marketing;
- non-essential cookies;
- advertising technologies; or
- other optional processing activities.
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing already carried out lawfully before consent was withdrawn.
8.5 Vital interests
In exceptional circumstances, we may process information where necessary to protect your life or the life of another person.
8.6 Legal claims
Where applicable, we may process special-category or criminal-offence information where necessary to establish, exercise or defend legal claims or where another legal condition applies.
9. Marketing
We may contact you with information about CDM Capital’s products, available assets, market updates, services, events or opportunities.
We may use:
- email;
- telephone;
- text message;
- post; or
- other electronic communications.
We will send electronic marketing to individuals only where permitted under applicable law.
This may include where:
- you have given consent;
- the limited existing-customer exception applies;
- you are a corporate subscriber and the communication is otherwise lawful; or
- another lawful basis and applicable PECR condition are satisfied.
Every marketing email should provide a clear method of unsubscribing.
You may ask us to stop sending marketing communications at any time by:
- selecting the unsubscribe link in a marketing email;
- emailing Admin@cdmcapital.co.uk; or
- calling 020 3006 8409.
We may retain a limited suppression record after you unsubscribe to ensure we do not contact you again for the same marketing purpose.
Opting out of marketing will not prevent us from sending essential administrative or contractual communications relating to an existing enquiry, purchase, asset or account.
10. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies are small files placed on or accessed from your device when you visit a website.
Similar technologies may include:
- tracking pixels;
- scripts and tags;
- local storage;
- device identifiers;
- conversion tracking; and
- other storage or access technologies.
10.1 Strictly necessary technologies
These technologies may be used where necessary to:
- operate the website;
- maintain website security;
- prevent fraud;
- remember privacy settings;
- enable forms;
- maintain sessions; or
- provide a service specifically requested by you.
Consent may not be required for technologies that are strictly necessary.
10.2 Analytics technologies
With your permission where required, we may use analytics technologies to understand:
- how visitors reach our website;
- which pages are viewed;
- how long visitors remain on pages;
- which devices or browsers are used; and
- whether website features work effectively.
10.3 Advertising and marketing technologies
With your permission where required, we may use advertising technologies to:
- measure campaigns;
- record conversions;
- display more relevant advertising;
- limit repeated advertisements; and
- understand interactions with advertising.
10.4 Managing cookies
You can manage non-essential technologies using our cookie-consent tool, where available.
You may also adjust your browser settings to block or delete cookies. Blocking certain cookies may affect website functionality.
Our cookie banner or separate Cookie Policy should provide further details about the specific technologies currently used, their providers, purposes and duration.
11. Telephone Calls
Telephone calls may be monitored or recorded where lawful for:
- confirming transaction instructions;
- maintaining accurate records;
- quality assurance;
- employee training;
- fraud prevention;
- compliance;
- complaint investigation; and
- establishing, exercising or defending legal claims.
Where practicable, callers will be informed that a call may be recorded.
Call recordings will be retained only for as long as reasonably necessary for the relevant purpose, legal obligations or the handling of disputes.
12. Automated Decision-Making and Profiling
CDM Capital does not generally make decisions producing legal or similarly significant effects solely through automated processing.
We may use screening systems to assist with:
- identity verification;
- fraud detection;
- sanctions screening;
- politically exposed person screening;
- website analytics; and
- marketing segmentation.
Where an automated decision producing a legal or similarly significant effect is used, we will provide information required by law and ensure that applicable safeguards are available.
13. Sharing Personal Information
We may share personal information where necessary with the following categories of recipient.
13.1 Warehouses and custodians
Information may be shared to:
- register ownership;
- administer storage;
- arrange insurance;
- conduct compliance checks;
- process transfers;
- arrange regauging or sampling; and
- facilitate sales or removals.
13.2 Suppliers and asset providers
This may include:
- distilleries;
- spirit producers;
- dealers;
- galleries;
- brokers;
- wholesalers;
- precious-metal suppliers; and
- other asset providers.
13.3 Service providers
We may use third parties that provide:
- website hosting;
- cloud storage;
- customer-relationship management;
- email services;
- communications systems;
- analytics;
- marketing;
- electronic signatures;
- document management;
- accounting;
- identity verification;
- fraud prevention;
- payment support;
- IT security; and
- professional support.
These providers may process information only for authorised purposes and subject to appropriate contractual protections.
13.4 Professional advisers
We may share information with:
- solicitors;
- accountants;
- auditors;
- insurers;
- tax advisers;
- compliance consultants; and
- other professional advisers.
13.5 Banks and payment providers
Information may be shared to:
- process payments;
- verify transactions;
- issue refunds;
- pay sale proceeds;
- prevent fraud; and
- meet banking or compliance requirements.
13.6 Public authorities
We may disclose information to:
- HM Revenue & Customs;
- law-enforcement agencies;
- courts;
- regulators;
- fraud-prevention bodies;
- sanctions authorities; and
- other public bodies.
We will do so only where legally required or otherwise lawful.
13.7 Purchasers or investors in our business
If CDM Capital is involved in a proposed or completed:
- merger;
- acquisition;
- restructuring;
- financing;
- sale of assets; or
- transfer of business,
personal information may be disclosed to relevant advisers, purchasers, investors or successor entities subject to appropriate confidentiality and legal safeguards.
13.8 Other parties authorised by you
We may disclose information to a person or organisation where:
- you instruct us to do so;
- you have given consent; or
- that person is authorised to act on your behalf.
We do not sell personal information to third parties for monetary consideration.
14. Fraud Prevention and Identity Verification
We may share personal information with identity-verification, anti-money-laundering and fraud-prevention providers.
These providers may check information against:
- public records;
- electoral records;
- sanctions lists;
- politically exposed person databases;
- adverse-media sources;
- fraud-prevention databases; and
- information held by credit-reference or identity-verification agencies.
False, inaccurate or suspicious information may result in:
- a transaction being delayed;
- additional information being requested;
- a transaction being refused;
- an account or relationship being suspended; or
- information being disclosed to an appropriate authority where legally required.
15. International Transfers
Some of our service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard applies.
Safeguards may include:
- transfer to a country covered by UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses;
- another legally approved transfer mechanism; or
- a specific legal exception where permitted.
You may contact us for further information about the safeguards applied to a relevant international transfer.
16. Data Security
We take reasonable organisational and technical measures to protect personal information against:
- unauthorised access;
- accidental loss;
- unlawful disclosure;
- alteration;
- destruction;
- misuse; and
- cyber threats.
Measures may include:
- access controls;
- password protection;
- multi-factor authentication;
- encryption where appropriate;
- secure backups;
- staff confidentiality obligations;
- system monitoring;
- supplier due diligence;
- employee training; and
- incident-response procedures.
Access to personal information is restricted to employees, contractors and service providers who have a legitimate need to use it.
No internet transmission or electronic-storage system can be guaranteed to be completely secure. However, we aim to use appropriate safeguards proportionate to the nature of the information and associated risks.
17. Personal Data Breaches
We maintain procedures for responding to suspected personal-data breaches.
Where legally required, we will notify:
- the Information Commissioner’s Office; and
- affected individuals where the breach is likely to result in a high risk to their rights and freedoms.
You should contact us immediately if you believe that personal information relating to you has been lost, disclosed, accessed or used without authorisation.
18. Retention of Personal Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, compliance and dispute-resolution purposes.
Retention periods may vary according to the type of information.
18.1 Enquiries
General enquiry information may normally be retained for up to two years after the most recent meaningful contact, unless there is a continuing business relationship, legal requirement or reason to retain it for longer.
18.2 Clients and transactions
Client, purchase, ownership, payment and transaction records may normally be retained for at least six years after the end of the relevant relationship or transaction.
Some records may be retained for longer where necessary for:
- ownership verification;
- ongoing storage;
- long-term whisky-cask holdings;
- anti-money-laundering compliance;
- tax or accounting requirements;
- legal claims;
- fraud prevention; or
- another legitimate legal or business requirement.
18.3 Identity and compliance records
Identity-verification and anti-money-laundering records may be retained for the period required by applicable law and for a reasonable period thereafter where legally permitted.
18.4 Marketing records
Marketing preferences may be retained while you remain subscribed.
Suppression records may be retained for longer to ensure that an opt-out request continues to be respected.
18.5 Website information
Website analytics and cookie information will be retained according to the duration stated in our cookie-management system or Cookie Policy.
18.6 Call recordings
Call recordings will generally be retained for a limited period unless they are required for a transaction, complaint, investigation, legal claim or compliance matter.
When personal information is no longer required, we will securely delete or anonymise it.
19. Your Data-Protection Rights
Depending on the circumstances and lawful basis, you may have the following rights.
19.1 Right to be informed
You have the right to receive clear information about how your personal information is used.
19.2 Right of access
You may request confirmation of whether we process your personal information and receive a copy of relevant information.
This is commonly known as a subject access request.
19.3 Right to rectification
You may ask us to correct personal information that is inaccurate or complete information that is incomplete.
19.4 Right to erasure
You may ask us to delete personal information in certain circumstances.
This right is not absolute. We may retain information where necessary to:
- comply with law;
- perform an existing contract;
- establish, exercise or defend legal claims;
- prevent fraud; or
- meet another lawful requirement.
19.5 Right to restrict processing
You may ask us to restrict how personal information is used in certain circumstances.
19.6 Right to data portability
Where processing is automated and based on consent or contract, you may be entitled to receive information you supplied in a structured, commonly used and machine-readable format.
You may also ask us to transmit it to another controller where technically feasible.
19.7 Right to object
You may object to processing based on legitimate interests in certain circumstances.
You have an absolute right to object to the use of your personal information for direct marketing.
19.8 Rights relating to automated decision-making
You may have rights concerning decisions based solely on automated processing where those decisions produce legal or similarly significant effects.
19.9 Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect processing carried out lawfully before consent was withdrawn.
20. Exercising Your Rights
To exercise a data-protection right, contact:
Email: Admin@cdmcapital.co.uk
Telephone: 020 3006 8409
Alternatively, write to:
Data Protection Enquiries
CDM Capital Ltd
1 Allied Business Centre
Coldharbour Lane
Harpenden
Hertfordshire
AL5 4UT
Please provide:
- your full name;
- your contact details;
- details of your request; and
- information reasonably necessary to locate the relevant records.
We may ask for proof of identity before responding.
We will ordinarily respond within the period required by applicable law. In certain circumstances, the response period may be extended where a request is complex or multiple requests have been made. We will notify you where an extension applies.
We will not ordinarily charge a fee. However, a reasonable fee may apply where legally permitted, including where a request is manifestly unfounded, excessive or repetitive.
We may refuse a request where legally permitted and will explain the reason unless the law prevents us from doing so.
21. Complaints
Please contact us first if you have concerns about how your personal information has been handled.
Email: Admin@cdmcapital.co.uk
Telephone: 020 3006 8409
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.
The Information Commissioner’s Office can be contacted through its official website, by telephone or by post.
We would appreciate the opportunity to investigate and respond to your concerns before you approach the Information Commissioner’s Office, although you are not required to contact us first.
22. Children’s Information
Our website and services are intended for adults.
CDM Capital does not knowingly offer products or services to anyone under the age of 18 and does not knowingly collect personal information from children for sales or investment-related purposes.
If we become aware that we have collected a child’s personal information without an appropriate lawful basis, we will take reasonable steps to delete it.
A parent or guardian who believes that a child has supplied personal information to us should contact Admin@cdmcapital.co.uk.
23. Third-Party Websites
Our website may contain links to websites operated by third parties.
We do not control those websites and are not responsible for:
- their content;
- their security;
- their privacy notices;
- their cookie practices; or
- how they process personal information.
You should review the privacy information of any third-party website before providing personal information.
24. Social Media
We may operate pages or profiles on third-party social-media platforms.
When you interact with those platforms, the platform operator may independently collect and process personal information according to its own privacy policy.
Information posted publicly on social media may be visible to other users.
Please avoid sharing confidential, financial, identification or transaction information through public posts or comments.
25. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes in legislation;
- regulatory guidance;
- changes to our services;
- changes to technology;
- changes to our service providers; or
- changes in how we process personal information.
The updated version will be published on our website with a revised “Last updated” date.
Where a change materially affects how we use personal information, we may provide an additional notice where appropriate.
You should review this Privacy Policy periodically.
26. Contact Us
For questions about this Privacy Policy, our use of personal information or your data-protection rights, contact:
CDM Capital Ltd
Company Registration Number: 14782564
Registered Office:
1 Allied Business Centre
Coldharbour Lane
Harpenden
Hertfordshire
AL5 4UT
Telephone: 020 3006 8409
Email: Admin@cdmcapital.co.uk
Website: www.cdmcapital.co.uk
ICO Registration Number: ZB867005
