Privacy Policy

1. Introduction

CPA HOLDINGS LTD ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services or visit our website.

We are registered as a data controller with the Information Commissioner's Office (ICO) under registration number 13850958. Our registered office is at 204 Dover House Road, London, England, SW15 5AH.

2. Information We Collect

2.1 Personal Information

We may collect and process the following personal information:

• Contact Information: Name, address, telephone number, email address
• Financial Information: Bank details, investment amounts, income information, financial circumstances
• Identification Information: Date of birth, passport/driving license details, National Insurance number
• Professional Information: Employment details, company information, professional qualifications
• Investment Information: Investment objectives, risk tolerance, investment experience

2.2 Technical Information

When you visit our website, we may automatically collect:

• IP address and location data
• Browser type and version
• Device information
• Website usage data and analytics
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Service Delivery

• Providing investment management and advisory services
• Processing investment transactions and managing your portfolio
• Conducting customer due diligence and know-your-customer (KYC) procedures
• Communicating with you about your investments and our services

3.2 Legal and Regulatory Compliance

• Complying with Financial Conduct Authority (FCA) regulations
• Meeting anti-money laundering (AML) and counter-terrorism financing requirements
• Fulfilling tax reporting obligations
• Responding to legal requests and court orders

3.3 Business Operations

• Risk management and fraud prevention
• Service improvement and development
• Marketing our services (with your consent)
• Website analytics and optimization

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: To fulfill our contractual obligations to provide investment services
• Legal Obligation: To comply with FCA regulations, AML requirements, and tax obligations
• Legitimate Interest: For business operations, fraud prevention, and service improvement
• Consent: For marketing communications and non-essential cookies

5. Information Sharing and Disclosure

We may share your personal information with:

5.1 Authorized Third Parties

• Depositary Banks: For custody and safekeeping of investments
• Fund Administrators: For portfolio administration and reporting
• Auditors: For audit and compliance purposes
• Legal Advisors: For legal advice and representation
• Technology Providers: For IT services and support

5.2 Regulatory Authorities

• Financial Conduct Authority (FCA)
• HM Revenue & Customs (HMRC)
• Financial Intelligence Unit (FIU)
• Law enforcement agencies (when legally required)

6. Data Retention

We retain your personal data for different periods depending on the purpose:

• Client Records: 7 years after relationship ends (FCA requirement)
• Transaction Records: 5-7 years as required by law
• AML Records: 5 years after relationship ends
• Marketing Data: Until you withdraw consent
• Website Data: 2 years or as specified in our Cookie Policy

7. Your Rights

Under UK GDPR and Data Protection Act 2018, you have the following rights:

7.1 Access and Information

• Right of Access: Request a copy of your personal data
• Right to Information: Understand how we process your data

7.2 Data Control

• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Limit how we process your data
• Right to Portability: Receive your data in a structured format

7.3 Objection and Consent

• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: Withdraw consent for marketing or cookies

To exercise these rights, contact us at [email protected] or write to our registered address.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: Data encrypted in transit and at rest
• Access Controls: Role-based access and authentication
• Network Security: Firewalls and intrusion detection systems
• Staff Training: Regular data protection training for employees
• Incident Response: Procedures for data breach notification
• Regular Audits: Security assessments and compliance reviews

9. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us: