Elwood Privacy Notice

Elwood Technologies Services Limited (ETSL), a company registered in England and Waleswith company number 13289318 and registered office at 4th Floor Phoenix House, 1 StationHill, Reading, Berkshire, RG1 1NB, is the data controller for personal data collected via thisWebsite (defined below) and through the channels described in this notice. ETSL isregistered with the UK Information Commissioner's Office under registration numberZB125699.

Where another member of the Elwood Group is the controller of personal data described inthis notice (for example, the hiring Elwood Company for Candidate Data, or ElwoodTechnologies LLP for processing carried out as part of its FCA-authorised activities), thereferences to "we", "us", "our" and "Elwood" in this notice should be read as references tothat company.

Your privacy is important, which is why protecting your data is a top priority for Elwood.Elwood collects certain information from users of its systems and services via its website athttps://elwood.io/ ("Website"). This includes the data obtained through interaction with theWebsite and any direct communications with our office and support teams ("Website Data").

This privacy notice also applies if you submit an enquiry, request a meeting, request aproduct demonstration, or subscribe to newsletters, product updates or event informationusing a form on our Website. Information you provide through these forms is referred to inthis notice as "Prospective Client Data".

This privacy notice also applies if you are a prospective employee of our organisation("Candidate"). An Elwood Company may act as a data controller in respect of personal dataprocessed by us in a recruitment process ("Candidate Data"). Where you apply for a rolethrough our careers page, our separate Candidate Privacy Notice (made available to you atthe point of application) provides the full Article 13 UK GDPR information specific torecruitment, and prevails over this notice in the event of any inconsistency. Employee data isgoverned by a separate privacy policy.

Where Elwood Technologies LLP (ETLLP), our FCA-authorised group company (FRN989174), processes personal data on behalf of our institutional customers through ourtrading and portfolio management platform, it does so as a processor acting on theinstructions of the relevant customer (who is the controller of that data). That processing isgoverned by the customer's agreement with ETLLP and any data processing agreemententered into under Article 28 UK GDPR. This privacy notice does not apply to thatprocessing, and data subject rights in respect of that data should be exercised against therelevant customer.

This privacy notice provides information on how Elwood collects and processes personaldata, and the rights that individuals have under the UK General Data Protection Regulation("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications(EC Directive) Regulations 2003 ("PECR").

The following section details the information Elwood collects via the Websites.



‍

What we collect



‍

When you interact with our Website, we may collect:

• IP address and general location information;
• browser type and version, time zone setting, operating system and platform;
• information about your visit, including pages visited, time on site and navigation paths;
• information you provide through direct communications with our office and support teams.

‍

‍

Lawful Basis

‍

We rely on our legitimate interests under Article 6(1)(f) of the UK GDPR in operating,securing and improving our Website and in handling communications from Website users.Where we are required to process personal data to comply with a legal or regulatoryobligation, we rely on Article 6(1)(c).

Our Website includes contact, enquiry and subscription forms which prospective clients andother interested parties may use to request information about our products and services,request a meeting or demonstration, or subscribe to receive updates from us.

‍

What we collect



‍

Through these forms we may collect:

• your name;
• your work email address;
• your company name, role or job title and country or jurisdiction;
• your telephone number, where you choose to provide it;

‍

any information you choose to share in free-text fields, for example the nature of yourenquiry or your firm's profile.

‍

‍

How we use Prospective Client Data
‍

We use Prospective Client Data to:

• respond to your enquiry and provide information about our products and services;
• arrange follow-up calls, meetings or demonstrations at your request;
• send you newsletters, product updates, event invitations and other marketingcommunications where you have asked to receive them;
• maintain accurate records of our communications with you;
• carry out internal analysis to improve our marketing and outreach to institutional clients.

‍

‍

Lawful Basis

‍

We rely on:

• our legitimate interests under Article 6(1)(f) of the UK GDPR in responding to enquiries youhave submitted to us and in marketing our institutional products and services to professionaland corporate contacts; and
• your consent under Article 6(1)(a) where you have specifically opted in to receive marketingcommunications, for example by completing a subscription form on our Website.

‍

‍

Subscribing to updates

‍

Where you subscribe to our newsletters, product updates or event communications, we relyon your consent under Article 6(1)(a) UK GDPR and Regulation 22 PECR. You maywithdraw your consent at any time using the unsubscribe link in any marketing email, or bycontacting legal@elwood.io. Withdrawing consent does not affect the lawfulness of anyprocessing carried out before you withdrew it.

‍

Where we rely on legitimate interests for direct marketing to professional and corporatecontacts, you have an absolute right to object under Article 21(2) UK GDPR and we will stopsending those communications.

We collect Candidate Data when you apply for a role at Elwood, including through thecareers section of our Website. Candidate applications submitted via the careers form on ourWebsite are received and processed by Elwood as data controller under the UK GDPR.

‍

‍

Separate Candidate Privacy Notice

‍

A separate Candidate Privacy Notice is provided to you at the point you submit anapplication through our Website. That notice contains the full Article 13 UK GDPRinformation specific to the recruitment process, including the identity of the relevant Elwoodcontroller for your application, the categories of data we collect, the recipients of your data(including any recruitment service providers or background screening providers), the lawfulbases we rely on, the retention periods that apply to your data, and your rights as a datasubject. You should read that notice in conjunction with this one.

‍

What we collect

‍

Elwood may collect and process the following Candidate Data:

• information about you that you give to us (for example name, email address, telephonenumber) or by communicating with us, whether face-to-face, by phone, email or otherwisethrough the recruitment process;
• your full name, date of birth, nationality, education and qualification details, marital status,home address and home telephone number, mobile telephone number, next of kin,emergency contact and dependent details (including contact information, date of birth andnationality), bank account details for the transfer of your salary and other benefits, tax detailsand your date of hire;
• information obtained from other sources including education and qualification details,confirmation of address, credit and criminal record checks for background screeningpurposes (where lawful and proportionate to the role).

‍

How we use Candidate Data

‍

Elwood uses and processes Candidate Data to:

• assess your suitability for the role you have applied for, and other roles for which you may besuited where you have agreed;
• communicate with you about your application;
• conduct interviews, assessments and reference and background checks;
• comply with our legal and regulatory obligations as an employer and, where relevant, as anFCA-authorised firm (including in relation to fit and proper assessments under the SeniorManagers and Certification Regime).

‍

‍

Lawful Basis

‍

We rely on Article 6(1)(b) UK GDPR (steps prior to entering into a contract at your request),Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests in identifying suitablecandidates and conducting our recruitment process). Where we process special categorydata (for example to make reasonable adjustments), we rely on the additional condition atArticle 9(2)(b) UK GDPR (employment, social security and social protection law) read withSchedule 1 of the Data Protection Act 2018.

‍

‍

Retention of Candidate Data

‍

If your application is unsuccessful, we will retain your Candidate Data for a period of up to 12months from the conclusion of the recruitment process. This retention period allows us todemonstrate the fairness of our recruitment decisions, respond to any complaint or claim,and contact you about future opportunities for which you may be suited.

‍

If you would like us to retain your Candidate Data for a longer period so that we mayconsider you for future roles, you may consent to extended retention at the point ofapplication. You may withdraw that consent at any time by contacting legal@elwood.io, inwhich case we will delete your Candidate Data subject to any shorter retention required tocomply with our legal obligations.

‍

Where we are required to retain Candidate Data for a longer period for legal, regulatory orevidential reasons (for example records relating to right to work or fit and proper screeningfor regulated roles), we will retain the relevant data only for that purpose and for the period required.

‍

‍

How we collect your data

‍

You directly provide Elwood with most of the data we collect. We collect and process datawhen you:

• register online or complete an online contact request form;
• voluntarily complete a customer survey or provide feedback on any of our message boards;
• use or view our Website via your browser's cookies;
• submit an enquiry, request a meeting, or subscribe to updates via a form on our Website;
• make an application for a position at Elwood.

‍

We may also receive your data indirectly from publicly available sources, recruitment serviceproviders, background screening providers, business contact databases, and eventorganisers, in each case to the extent permitted by law.

‍

‍

How we use your data

‍

Elwood collects your data so that we can:

• provide, maintain and improve our Website and services;
• respond to your enquiries and communicate with you;
• send you marketing communications you have asked to receive, or where we are entitled todo so on the basis of legitimate interests;
• comply with our legal and regulatory obligations;
• assess and process job applications.

‍

‍

Marketing

‍

Elwood would like to send you marketing communications that we think you might beinterested in, including newsletters, product updates and event invitations.

‍

Where you have given your consent (for example by subscribing through a form on ourWebsite), we rely on Article 6(1)(a) UK GDPR. Where you are a corporate subscriber orbusiness contact and we rely on legitimate interests under Article 6(1)(f) UK GDPR, youhave an absolute right to object under Article 21(2) UK GDPR and we will stop sendingthose communications.

‍

Every marketing message contains an unsubscribe link, and you may also email legal@elwood.io at any time to be removed from our marketing lists. We periodically reviewour marketing lists and remove inactive contacts. Withdrawing consent does not affect thelawfulness of any processing carried out before you withdrew it.

‍

How we store your data

‍

Elwood securely stores all your data on our information systems. Data is only stored for theperiod necessary to meet our data processing obligations and will be immediately removedfrom our systems when no longer required (subject to the organisation's legal and regulatoryobligations).

‍

Indicative retention periods are as follows:

• marketing list contacts: until you unsubscribe or we identify you as an inactive contactthrough our periodic list review;
• enquiry and meeting request records: typically up to two years from the date of last contact,unless a commercial relationship is established;
• Website server logs and analytics data: typically up to 12 months;
• Candidate Data for unsuccessful applicants: typically up to 12 months from the conclusion ofthe recruitment process, unless you consent to a longer retention so that we may consideryou for future opportunities;
• Platform Data: for the duration of the customer relationship and for such further period as isrequired by applicable law, regulation or regulatory expectation (including under the FCAHandbook).

‍

Where a longer retention period is required by law, regulation or regulatory expectation, or isnecessary for the establishment, exercise or defence of legal claims, we will retain therelevant personal data for that longer period.

‍

‍

Sharing your data with third parties

‍

We may share your data with:

• our group companies, where necessary for the purposes set out in this notice;
• our service providers and processors (for example IT, hosting, email delivery, customerrelationship management, marketing analytics, recruitment and background screeningproviders), who act on our behalf under written terms compliant with Article 28 UK GDPR;
• professional advisers (legal, accounting, audit) where necessary;
• regulators, law enforcement and other authorities where required by law.

‍

These third parties will be subject to confidentiality requirements and they will only use yourpersonal data as described in this privacy notice; and, to the extent required by law, forexample if we are under a duty to disclose your personal data in order to comply with anylegal obligation, or to establish, exercise or defend our legal rights, provided in each casethat the data is governed by the same standards of protection as provided by Elwood.

‍

‍

International Transfers

‍

Where we transfer personal data outside the United Kingdom, we ensure that an appropriate safeguard is in place under Articles 44 to 49 UK GDPR. The mechanisms we rely on are:

• UK adequacy regulations made under section 17A of the Data Protection Act 2018, wherethe destination country has been recognised as offering an adequate level of protection;
• the International Data Transfer Agreement (IDTA) issued by the Information Commissionerunder section 119A of the Data Protection Act 2018;
• the EU Standard Contractual Clauses with the UK Addendum issued by the InformationCommissioner;
• Binding Corporate Rules where relied on by an intra-group recipient; or
• where appropriate, a derogation under Article 49 UK GDPR.

‍

Where the transfer is to a country without UK adequacy, we carry out a transfer riskassessment in line with current ICO guidance to verify that the transfer mechanism providesessentially equivalent protection in practice, taking account of the law and practice of thedestination country.

‍

‍

Cookies

‍

Our Website uses cookies and similar technologies. A cookie is a small file placed on your device to enable certain functionality and to collect information about how the Website is used.

‍

Under Regulation 6 PECR, we must obtain your consent before storing or accessing cookieson your device, save where the cookie is strictly necessary for the provision of a service thatyou have requested. Strictly necessary cookies are set on a default basis. All other cookies(including preferences, analytics and marketing cookies) are set only with your prior consentgiven through our cookie banner.

‍

You can withdraw or change your consent at any time using the cookie preferences link inthe footer of our Website. Our Cookie Policy lists each cookie used on the Website togetherwith its purpose, provider, duration and category.

‍

Your rights under data protection law

‍

You have the following rights in respect of your personal data:

• The right of access. You have the right to request copies of any personal data we hold about you. We will provide this free of charge unless your request is manifestly unfounded orexcessive.
• The right of rectification. You have the right to ask us to correct inaccurate or incompletepersonal data.
• The right to erasure. You have the right to ask us to delete your personal data in certaincircumstances.
• The right to restriction of processing. You have the right to ask us to restrict our use of yourpersonal data in certain circumstances.
• The right to data portability. You have the right to receive personal data you have provided ina structured, commonly used, machine-readable format, and to ask us to transmit it toanother controller, where technically feasible.
• The right to object. You have the right to object to our processing of your personal data,including an absolute right to object to direct marketing under Article 21(2) UK GDPR.
• The right to withdraw consent. Where we rely on your consent, you may withdraw it at anytime. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights in relation to automated decision-making. You have the right not to be subject to adecision based solely on automated processing, including profiling, which produces legal orsimilarly significant effects, save in the limited cases permitted by Article 22 UK GDPR.
• The right to lodge a complaint with the ICO. You have the right to lodge a complaint with theInformation Commissioner's Office (https://ico.org.uk) if you consider our processing of yourpersonal data infringes the UK GDPR. We would, however, appreciate the opportunity toaddress your concerns first.

‍

To exercise any of these rights, please contact legal@elwood.io.

If you have any questions about this notice, or wish to exercise any of your rights, please contact:

‍

Elwood Technologies Services Limited 4th Floor Phoenix House, 1 Station Hill, Reading,Berkshire, RG1 1NB legal@elwood.io

‍

Changes to this notice

‍

Elwood keeps this privacy notice under regular review. We will publish updated versions onour Website and, where the changes are material, take reasonable steps to bring them toyour attention.

‍

This notice was last updated on 13 May, 2026