Elwood Privacy Notice

Elwood Technologies Services Limited (ETSL), a company registered in England and Waleswith company number 13289318 and registered office at 4th Floor Phoenix House, 1 Station Hill, Reading, Berkshire, RG1 1NB, is the data controller for personal data collected via this Website (defined below) and through the channels described in this notice. ETSL is registered with the UK Information Commissioner's Office under registration number ZB125699.

Where another member of the Elwood Group is the controller of personal data described inthis notice (for example, the hiring Elwood Company for Candidate Data, or Elwood Technologies LLP for processing carried out as part of its FCA-authorised activities), the references to "we", "us", "our" and "Elwood" in this notice should be read as references tothat company.

Your privacy is important, which is why protecting your data is a top priority for Elwood. Elwood collects certain information from users of its systems and services via its website at https://elwood.io/ ("Website"). This includes the data obtained through interaction with the Website and any direct communications with our office and support teams ("Website Data").

This privacy notice also applies if you submit an enquiry, request a meeting, request aproduct demonstration, or subscribe to newsletters, product updates or event information using a form on our Website. Information you provide through these forms is referred to in this notice as "Prospective Client Data".

This privacy notice also applies if you are a prospective employee of our organisation ("Candidate"). An Elwood Company may act as a data controller in respect of personal data processed by us in a recruitment process ("Candidate Data"). Where you apply for a rolethrough our careers page, our separate Candidate Privacy Notice (made available to you atthe point of application) provides the full Article 13 UK GDPR information specific to recruitment, and prevails over this notice in the event of any inconsistency. Employee data is governed by a separate privacy policy.

Where Elwood Technologies LLP (ETLLP), our FCA-authorised group company (FRN989174), processes personal data on behalf of our institutional customers through our trading and portfolio management platform, it does so as a processor acting on the instructions of the relevant customer (who is the controller of that data). That processing is governed by the customer's agreement with ETLLP and any data processing agreement entered into under Article 28 UK GDPR. This privacy notice does not apply to that processing, and data subject rights in respect of that data should be exercised against the relevant customer.

This privacy notice provides information on how Elwood collects and processes personaldata, and the rights that individuals have under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR").

The following section details the information Elwood collects via the Websites.



‍

What we collect



‍

When you interact with our Website, we may collect:

• IP address and general location information;
• browser type and version, time zone setting, operating system and platform;
• information about your visit, including pages visited, time on site and navigation paths;
• information you provide through direct communications with our office and support teams.

‍

‍

Lawful Basis

‍

We rely on our legitimate interests under Article 6(1)(f) of the UK GDPR in operating, securing and improving our Website and in handling communications from Website users. Where we are required to process personal data to comply with a legal or regulatory obligation, we rely on Article 6(1)(c).

Our Website includes contact, enquiry and subscription forms which prospective clients andother interested parties may use to request information about our products and services, request a meeting or demonstration, or subscribe to receive updates from us.

‍

What we collect



‍

Through these forms we may collect:

• your name;
• your work email address;
• your company name, role or job title and country or jurisdiction;
• your telephone number, where you choose to provide it;

‍

any information you choose to share in free-text fields, for example the nature of yourenquiry or your firm's profile.

‍

‍

How we use Prospective Client Data
‍

We use Prospective Client Data to:

• respond to your enquiry and provide information about our products and services;
• arrange follow-up calls, meetings or demonstrations at your request;
• send you newsletters, product updates, event invitations and other marketing communications where you have asked to receive them;
• maintain accurate records of our communications with you;
• carry out internal analysis to improve our marketing and outreach to institutional clients.

‍

‍

Lawful Basis

‍

We rely on:

• our legitimate interests under Article 6(1)(f) of the UK GDPR in responding to enquiries you have submitted to us and in marketing our institutional products and services to professional and corporate contacts; and
• your consent under Article 6(1)(a) where you have specifically opted in to receive marketingcommunications, for example by completing a subscription form on our Website.

‍

‍

Subscribing to updates

‍

Where you subscribe to our newsletters, product updates or event communications, we rely on your consent under Article 6(1)(a) UK GDPR and Regulation 22 PECR. You may withdraw your consent at any time using the unsubscribe link in any marketing email, or by contacting legal@elwood.io. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.

‍

Where we rely on legitimate interests for direct marketing to professional and corporate contacts, you have an absolute right to object under Article 21(2) UK GDPR and we will stopsending those communications.

We collect Candidate Data when you apply for a role at Elwood, including through the careers section of our Website. Candidate applications submitted via the careers form on our Website are received and processed by Elwood as data controller under the UK GDPR.

‍

‍

Separate Candidate Privacy Notice

‍

A separate Candidate Privacy Notice is provided to you at the point you submit anapplication through our Website. That notice contains the full Article 13 UK GDPR information specific to the recruitment process, including the identity of the relevant Elwood controller for your application, the categories of data we collect, the recipients of your data (including any recruitment service providers or background screening providers), the lawful bases we rely on, the retention periods that apply to your data, and your rights as a data subject. You should read that notice in conjunction with this one.

‍

What we collect

‍

Elwood may collect and process the following Candidate Data:

• information about you that you give to us (for example name, email address, telephone number) or by communicating with us, whether face-to-face, by phone, email or otherwise through the recruitment process;
• your full name, date of birth, nationality, education and qualification details, marital status, home address and home telephone number, mobile telephone number, next of kin, emergency contact and dependent details (including contact information, date of birth and nationality), bank account details for the transfer of your salary and other benefits, tax details and your date of hire;
• information obtained from other sources including education and qualification details, confirmation of address, credit and criminal record checks for background screening purposes (where lawful and proportionate to the role).

‍

How we use Candidate Data

‍

Elwood uses and processes Candidate Data to:

• assess your suitability for the role you have applied for, and other roles for which you may be suited where you have agreed;
• communicate with you about your application;
• conduct interviews, assessments and reference and background checks;
• comply with our legal and regulatory obligations as an employer and, where relevant, as an FCA-authorised firm (including in relation to fit and proper assessments under the Senior Managers and Certification Regime).

‍

‍

Lawful Basis

‍

We rely on Article 6(1)(b) UK GDPR (steps prior to entering into a contract at your request), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests in identifying suitable candidates and conducting our recruitment process). Where we process special categorydata (for example to make reasonable adjustments), we rely on the additional condition at Article 9(2)(b) UK GDPR (employment, social security and social protection law) read withSchedule 1 of the Data Protection Act 2018.

‍

‍

Retention of Candidate Data

‍

If your application is unsuccessful, we will retain your Candidate Data for a period of up to 12 months from the conclusion of the recruitment process. This retention period allows us to demonstrate the fairness of our recruitment decisions, respond to any complaint or claim, and contact you about future opportunities for which you may be suited.

‍

If you would like us to retain your Candidate Data for a longer period so that we may consider you for future roles, you may consent to extended retention at the point ofapplication. You may withdraw that consent at any time by contacting legal@elwood.io, in which case we will delete your Candidate Data subject to any shorter retention required to comply with our legal obligations.

‍

Where we are required to retain Candidate Data for a longer period for legal, regulatory or evidential reasons (for example records relating to right to work or fit and proper screeningfor regulated roles), we will retain the relevant data only for that purpose and for the period required.

‍

‍

How we collect your data

‍

You directly provide Elwood with most of the data we collect. We collect and process datawhen you:

• register online or complete an online contact request form;
• voluntarily complete a customer survey or provide feedback on any of our message boards;
• use or view our Website via your browser's cookies;
• submit an enquiry, request a meeting, or subscribe to updates via a form on our Website;
• make an application for a position at Elwood.

‍

We may also receive your data indirectly from publicly available sources, recruitment service providers, background screening providers, business contact databases, and event organisers, in each case to the extent permitted by law.

‍

‍

How we use your data

‍

Elwood collects your data so that we can:

• provide, maintain and improve our Website and services;
• respond to your enquiries and communicate with you;
• send you marketing communications you have asked to receive, or where we are entitled to do so on the basis of legitimate interests;
• comply with our legal and regulatory obligations;
• assess and process job applications.

‍

‍

Marketing

‍

Elwood would like to send you marketing communications that we think you might be interested in, including newsletters, product updates and event invitations.

‍

Where you have given your consent (for example by subscribing through a form on our Website), we rely on Article 6(1)(a) UK GDPR. Where you are a corporate subscriber or business contact and we rely on legitimate interests under Article 6(1)(f) UK GDPR, you have an absolute right to object under Article 21(2) UK GDPR and we will stop sending those communications.

‍

Every marketing message contains an unsubscribe link, and you may also email legal@elwood.io at any time to be removed from our marketing lists. We periodically reviewour marketing lists and remove inactive contacts. Withdrawing consent does not affect thelawfulness of any processing carried out before you withdrew it.

‍

How we store your data

‍

Elwood securely stores all your data on our information systems. Data is only stored for the period necessary to meet our data processing obligations and will be immediately removed from our systems when no longer required (subject to the organisation's legal and regulatory obligations).

‍

Indicative retention periods are as follows:

• marketing list contacts: until you unsubscribe or we identify you as an inactive contact through our periodic list review;
• enquiry and meeting request records: typically up to two years from the date of last contact, unless a commercial relationship is established;
• Website server logs and analytics data: typically up to 12 months;
• Candidate Data for unsuccessful applicants: typically up to 12 months from the conclusion of the recruitment process, unless you consent to a longer retention so that we may consider you for future opportunities;
• Platform Data: for the duration of the customer relationship and for such further period as is required by applicable law, regulation or regulatory expectation (including under the FCA Handbook).

‍

Where a longer retention period is required by law, regulation or regulatory expectation, or is necessary for the establishment, exercise or defence of legal claims, we will retain therelevant personal data for that longer period.

‍

‍

Sharing your data with third parties

‍

We may share your data with:

• our group companies, where necessary for the purposes set out in this notice;
• our service providers and processors (for example IT, hosting, email delivery, customer relationship management, marketing analytics, recruitment and background screening providers), who act on our behalf under written terms compliant with Article 28 UK GDPR;
• professional advisers (legal, accounting, audit) where necessary;
• regulators, law enforcement and other authorities where required by law.

‍

These third parties will be subject to confidentiality requirements and they will only use your personal data as described in this privacy notice; and, to the extent required by law, for example if we are under a duty to disclose your personal data in order to comply with any legal obligation, or to establish, exercise or defend our legal rights, provided in each casethat the data is governed by the same standards of protection as provided by Elwood.

‍

‍

International Transfers

‍

Where we transfer personal data outside the United Kingdom, we ensure that an appropriate safeguard is in place under Articles 44 to 49 UK GDPR. The mechanisms we rely on are:

• UK adequacy regulations made under section 17A of the Data Protection Act 2018, where the destination country has been recognised as offering an adequate level of protection;
• the International Data Transfer Agreement (IDTA) issued by the Information Commissionerunder section 119A of the Data Protection Act 2018;
• the EU Standard Contractual Clauses with the UK Addendum issued by the Information Commissioner;
• Binding Corporate Rules where relied on by an intra-group recipient; or
• where appropriate, a derogation under Article 49 UK GDPR.

‍

Where the transfer is to a country without UK adequacy, we carry out a transfer risk assessment in line with current ICO guidance to verify that the transfer mechanism provides essentially equivalent protection in practice, taking account of the law and practice of the destination country.

‍

‍

Cookies

‍

Our Website uses cookies and similar technologies. A cookie is a small file placed on your device to enable certain functionality and to collect information about how the Website is used.

‍

Under Regulation 6 PECR, we must obtain your consent before storing or accessing cookies on your device, save where the cookie is strictly necessary for the provision of a service that you have requested. Strictly necessary cookies are set on a default basis. All other cookies (including preferences, analytics and marketing cookies) are set only with your prior consent given through our cookie banner.

‍

You can withdraw or change your consent at any time using the cookie preferences link inthe footer of our Website. Our Cookie Policy lists each cookie used on the Website together with its purpose, provider, duration and category.

‍

Your rights under data protection law

‍

You have the following rights in respect of your personal data:

• The right of access. You have the right to request copies of any personal data we hold about you. We will provide this free of charge unless your request is manifestly unfounded or excessive.
• The right of rectification. You have the right to ask us to correct inaccurate or incomplete personal data.
• The right to erasure. You have the right to ask us to delete your personal data in certain circumstances.
• The right to restriction of processing. You have the right to ask us to restrict our use of your personal data in certain circumstances.
• The right to data portability. You have the right to receive personal data you have provided in a structured, commonly used, machine-readable format, and to ask us to transmit it to another controller, where technically feasible.
• The right to object. You have the right to object to our processing of your personal data, including an absolute right to object to direct marketing under Article 21(2) UK GDPR.
• The right to withdraw consent. Where we rely on your consent, you may withdraw it at anytime. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights in relation to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, save in the limited cases permitted by Article 22 UK GDPR.
• The right to lodge a complaint with the ICO. You have the right to lodge a complaint with the Information Commissioner's Office (https://ico.org.uk) if you consider our processing of your personal data infringes the UK GDPR. We would, however, appreciate the opportunity to address your concerns first.

‍

To exercise any of these rights, please contact legal@elwood.io.

If you have any questions about this notice, or wish to exercise any of your rights, please contact:

‍

Elwood Technologies Services Limited 4th Floor Phoenix House, 1 Station Hill, Reading, Berkshire, RG1 1NB legal@elwood.io

‍

Changes to this notice

‍

Elwood keeps this privacy notice under regular review. We will publish updated versions onour Website and, where the changes are material, take reasonable steps to bring them to your attention.

‍

This notice was last updated on 13 May, 2026