Privacy Statement

1.

WHO ARE WE?

2.

TO WHOM DOES THIS PRIVACY STATEMENT APPLY?

This Privacy Statement sets out how the TISE Entities, as joint data controllers, collect, process and retain personal data. 'Personal data' means any information relating to an identified or identifiable natural person.

The Privacy Statement does not form part of any contract to provide services.

This Statement applies to you as a:

• casual browser of our website, tisegroup.com (the “Website”);
• subscriber to our market and research material;
• Member or prospective Member of the Exchange;
• Issuer or prospective Issuer for listing on the Exchange;
• user of the TISE Portal;
• shareholder of TISEG; or
• potential employee, employee, contractor, consultant or temporary worker of the TISE Entities.

3.

HOW DO WE COLLECT PERSONAL DATA?

4.

WHAT PERSONAL DATA DO WE COLLECT?

Casual browsers of our Website

When you browse our Website we may automatically collect the following:

• technical information, including your Internet Protocol (“IP”) address to help diagnose problems with our server, and to administer our Website. An IP address is a number that is assigned to your computer when you use the internet. Your IP address is also used to help identify you during a particular session and to gather broad demographic data; and

• information about your visit including, for analytical purposes, using the Google Analytics service which collects information such as how often and what pages you visit on the Website and what other sites you used prior to coming to the Website.

4.2

Subscribers to our market and research material

4.3

Members and prospective Members of the Exchange

4.4

Issuers and prospective Issuers for listing on the Exchange

4.5

Users of the TISE Portal

4.6

Shareholders

In addition to the requirements under law for the TISE Entities to maintain records of their shareholders, we may collect, retain and process personal data (including where appropriate your name, postal address, email address and any other relevant information that you provide to us or that we collect) for:

• the processing and payment of dividends, and associated reporting;
• the issuance of circulars to shareholders; and
• routine correspondence and administration purposes.

4.7

Potential Employees

As part of our recruitment process we collect, process and retain personal data (including where appropriate your CV and any covering letter, your name, residential address, personal contact details, work experience, residential status, education, qualifications, skills, and any other relevant information that you provide to us or that we collect) for: :

• assessing your suitability for a role within the TISE Entities;
• verifying your information and carrying out reference checks and/or conducting background or criminal records checks (where applicable) if you are offered employment;
• communicating with you about the recruitment process and/or your application, including, in appropriate cases, informing you of other potential career opportunities at the TISE Entities; and/or complying with applicable laws, regulations or other legal duties.

5.

HOW WE WILL USE INFORMATION ABOUT YOU?

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to comply with an agreement, we have entered into with you.
• Where we need to comply with a contractual, legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal data in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else's interests).
• Where it is needed in the public interest, including to prevent fraud.

The situations in which we will process your personal data are listed below.

• The operation of the Exchange under the terms of its licence.
• The operation of the TISE Portal.
• Administering any contract, we have entered into with you or where you are a party related to an entity for which we are contracted to provide services.
• Complying with a valid order by a court or other governmental body or applicable law.
• Satisfying any legal or regulatory obligation.
• Business management and planning, including accounting and auditing.
• Making arrangements for the termination of a commercial relationship or contract.
• Dealing with legal disputes involving you.
• To prevent fraud, criminal activity or market abuse.
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
• To conduct data analytics studies to review and better understand customer retention and attrition rates.
• To undertake the staff recruitment and onboarding process.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data.

6.

HOW WE USE SENSITIVE PERSONAL DATA

'Special Category Data requires higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal data in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where we need to comply with our legal or regulatory obligations and in line with our data protection policy.
• Where it is needed in the public interest, such as to prevent fraud and in line with our data protection policy.
• During the recruitment process to establish if you have a medical condition or disability for which the Company is required to make reasonable adjustments for.

7.

AUTOMATED DECISION-MAKING

8.

DATA SHARING

We may also need to share your personal information with:

• a court, regulator, government body, applicable authority, enforcement agency or to otherwise comply with the law; or
• the Appeals Committee or Disciplinary Committee of TISEA.

For the purposes of the sharing of personal data, Guernsey’s Office of the Data Protection Commission has defined an authorised jurisdiction as: 

• the Bailiwick of Guernsey;
• a Member State of the European Union, or any sector within a country, or any international organisation that the (European) Commission has determined ensures an adequate level of protection within the meaning of Article 45(2) of the GDPR and for which the determination is still in force; or
• a designated jurisdiction (by Ordinance).

We may transfer the personal data we collect about you to an Authorised Jurisdiction.

Save as permitted by law we will not transfer the personal data we collect about you to unauthorised Jurisdictions.

9.

STORAGE AND SECURITY OF YOUR PERSONAL DATA

10.

DATA RETENTION

11.

LINKS TO OTHER WEBSITES

12.

RIGHTS OF ACCESS, CORRECTION, ERASURE AND RESTRICTION

Under certain circumstances, by law you have the:

• Right of access to your personal data (commonly known as a "data subject access request"). This entitles you to ask what data we hold about you and why.

• Right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes or if data were being processed on grounds of public interest or for historical or scientific purposes.

• Right to rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

• Right to erasure of your personal data, enabling you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.

• Right to the restriction of processing of your personal data enabling you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

• Right to be notified of rectification, erasure and restrictions.

• Right not to be subject to decisions based on automated processing.

• Right to data portability: right to request the transfer of your personal data to another party.

13.

ENQUIRES AND COMPLAINTS

14.

DATA PROTECTION OFFICER

15.

DATA PROTECTION REGISTRATION

Guernsey Office of the Data Protection Commissioner - The TISE Entities are registered as data controllers and processors:

• TISEG – Registration ID DPA1564; and
• TISEA – Registration ID DPA1562.

Jersey Office of the Information Commissioner:

• TISEG – Registration ID 22077 – is registered as a data controller and processor; and
• TISEA – Registration ID 22078 – is registered as a data controller.

Isle of Man Information Commissioner – TISEG is registered as a data controller and processor:

• TISEG – Registration ID R000101

16.

CHANGES TO OUR PRIVACY STATEMENT