Data & privacy

International Data Transfer Statement

The safeguards applied where personal data is transferred outside the United Kingdom, including to Bangladesh and other jurisdictions.

Document reference: FGL-LEG-07
Version date: 1 July 2026
Applies to: Fratres Limited

1.Purpose, scope and application

1.1

This International Data Transfer Statement (this Statement) sets out the circumstances in which Fratres Limited (the Company) transfers Personal Data outside the United Kingdom, the transfer mechanisms on which the Company relies, the assessments it carries out before transferring, and the rights available to Data Subjects in respect of those transfers.

1.2

The Company is registered in England and Wales and carries on a strategic advisory and project facilitation business with operations in the United Kingdom and Bangladesh. Because mandates routinely involve sponsors, counterparties, professional advisers and public authorities located outside the United Kingdom, international transfer of Personal Data is a normal, foreseeable and continuing feature of the Company’s activities. This Statement governs how that is done.

1.3

This Statement applies to all Personal Data processed by the Company, whether the Company acts as controller or as processor, and whether the Personal Data relates to clients, prospective clients, employees, workers, consultants, suppliers, counterparties, beneficial owners, directors, officers, website users or any other individual.

1.4

This Statement binds every director, employee, worker, consultant, contractor, secondee, agent and intermediary of the Company (together, Personnel) in every location in which the Company operates. Compliance is a condition of engagement. Breach may result in disciplinary action or termination of the relevant contract.

1.5

This Statement supplements the Company’s Privacy Policy and its Data Retention and Records Management Policy, and is to be read with them. Where there is an inconsistency, the Privacy Policy prevails as to the lawful basis for processing and this Statement prevails as to the conditions on which Personal Data may be transferred outside the United Kingdom.

1.6

This Statement is a statement of the Company’s obligations and internal control standards. It does not create contractual rights in favour of any person unless it is expressly incorporated into a contract, and it does not limit any right a Data Subject has under data protection law.

2.Interpretation and definitions

In this Statement, the following terms have the following meanings.

Addendum: The International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, laid before Parliament and in force from 21 March 2022.
Adequacy Regulations: Regulations made by the Secretary of State under section 17A of the Data Protection Act 2018 (and Article 45 of the UK GDPR) determining that a country, territory, sector or international organisation provides an adequate level of protection for Personal Data.
Data Subject: An identified or identifiable living individual to whom Personal Data relates.
EU SCCs: The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.
Exporter: The party making a Restricted Transfer, being the Company except where expressly stated otherwise.
IDTA: The International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, laid before Parliament and in force from 21 March 2022.
Importer: The party receiving Personal Data under a Restricted Transfer.
Personal Data: Has the meaning given in Article 4(1) of the UK GDPR, and includes Special Category Data and criminal offence data within the meaning of Article 10 of the UK GDPR.
Restricted Transfer: A transfer of Personal Data to a receiver located outside the United Kingdom, or the making available of Personal Data to such a receiver, where the receiver is legally distinct from the Exporter and the receiver’s processing of that Personal Data is not itself subject to the UK GDPR.
Special Category Data: Personal Data of the kinds listed in Article 9(1) of the UK GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for identification, data concerning health, and data concerning a person’s sex life or sexual orientation.
Supplementary Measures: Technical, organisational and contractual measures applied in addition to a transfer tool in order to bring the protection of transferred Personal Data up to the standard required by UK data protection law.
Third Country: Any country or territory outside the United Kingdom, including the member states of the European Economic Area.
Transfer Risk Assessment: The documented assessment described in clause 8, carried out before a Restricted Transfer is made in reliance on a transfer tool under Article 46 of the UK GDPR.
UK GDPR: Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland, read with the Data Protection Act 2018 and as amended, including by the Data (Use and Access) Act 2025.

2.1

Clause headings are for convenience only and do not affect the construction of this Statement.

2.2

The words including, includes and in particular are to be read as if followed by the words without limitation.

2.3

A reference to a statute, statutory instrument or regulatory instrument is a reference to it as amended, extended, consolidated or re-enacted from time to time, and includes any subordinate legislation and any guidance issued under it.

2.4

Words in the singular include the plural and words in the plural include the singular. A reference to a person includes a body corporate, an unincorporated association and a partnership.

2.5

Terms not defined in this Statement have the meaning given to them in the UK GDPR and the Data Protection Act 2018.

3.Legal framework and the general principle

3.1

International transfers of Personal Data are governed by Chapter V of the UK GDPR (Articles 44 to 50) and by the Data Protection Act 2018, in particular sections 17A to 17C and section 119A, as amended by the Data (Use and Access) Act 2025.

3.2

Article 44 of the UK GDPR states the general principle that a transfer of Personal Data to a Third Country may take place only if the conditions of Chapter V are complied with, and that all provisions of Chapter V must be applied in order to ensure that the level of protection guaranteed to Data Subjects is not undermined. That principle applies equally to onward transfers made by an Importer, and the Company treats it as governing the whole life of the data, not only the moment of transmission.

3.3

Accordingly, no Restricted Transfer shall be made by the Company unless one of the following applies:

(a)the destination is covered by Adequacy Regulations (Article 45 of the UK GDPR and section 17A of the Data Protection Act 2018);
(b)the transfer is subject to appropriate safeguards under Article 46 of the UK GDPR, on condition that enforceable Data Subject rights and effective legal remedies are available;
(c)the transfer is made under binding corporate rules approved under Article 47 of the UK GDPR; or
(d)a derogation under Article 49 of the UK GDPR applies, within the strict limits set out in clause 10.

3.4

Compliance with Chapter V is additional to, and not a substitute for, compliance with the remainder of UK data protection law. Every transfer must also satisfy the principles in Article 5, have a lawful basis under Article 6 and, where Special Category Data or criminal offence data is involved, a condition under Article 9 or Article 10 and Schedule 1 to the Data Protection Act 2018. Transparency obligations under Articles 13 and 14, and security obligations under Article 32, apply in full.

3.5

Where the Company relies on a transfer tool under Article 46, it must be satisfied, on a reasonable and proportionate basis, that the standard of protection provided for Data Subjects in the destination country is not materially lower than the standard of protection under UK data protection law. That conclusion must be reached before the transfer is made and must be documented in the Transfer Risk Assessment.

3.6

The Company recognises the effect of retained EU case law, in particular the judgment of the Court of Justice in Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, to the effect that the execution of a transfer tool is not by itself sufficient. The Exporter must assess the law and practice of the destination country and, where the tool alone would not secure an adequate standard, must apply Supplementary Measures or refrain from transferring.

4.When personal data leaves the United Kingdom

4.1

Personal Data processed by the Company may leave the United Kingdom in the following circumstances:

(a)access by, or disclosure to, the Company’s Personnel and representatives based in Bangladesh in the course of delivering mandates and managing the Company’s own operations;
(b)disclosure to sponsors, project partners, joint venture participants, investors, lenders and other counterparties in the course of originating, structuring and delivering transactions;
(c)disclosure to public authorities, ministries, regulators and investment promotion bodies where the disclosure is required or permitted by law in connection with registration, licensing, approval or reporting;
(d)disclosure to professional advisers, including legal, accountancy, tax, technical, environmental, engineering and insurance advisers, engaged by the Company or by a client in connection with a mandate;
(e)processing by technology and business service providers whose infrastructure, support functions or personnel are located outside the United Kingdom;
(f)processing by providers of identity verification, sanctions, politically exposed person and adverse media screening services engaged to meet obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Sanctions and Anti-Money Laundering Act 2018; and
(g)disclosure in connection with the establishment, exercise or defence of legal claims, including cross-border litigation, arbitration and regulatory proceedings.

4.2

The categories of Personal Data that may be transferred include identification and contact data; corporate role, directorship and beneficial ownership data; due diligence and screening outputs; correspondence and meeting records; commercial and financial information relating to individuals; and, where the nature of the engagement requires it, Special Category Data and criminal offence data arising from screening for sanctions exposure, political exposure or adverse media.

4.3

Remote access to Personal Data held on systems in the United Kingdom by a person located in a Third Country is a transfer for the purposes of Chapter V of the UK GDPR and of this Statement. It is not treated as a domestic processing operation merely because the data remains hosted in the United Kingdom.

4.4

The Company applies data minimisation to every transfer. Only the Personal Data that is necessary for the specified purpose may be transferred. Transfer of an entire record, file or database where a narrower extract would serve the purpose is prohibited.

4.5

The Company does not sell Personal Data, and does not transfer Personal Data outside the United Kingdom for the purpose of marketing by a third party on that party’s own account.

5.Transfer mechanisms and order of preference

5.1

The Company applies the following order of preference when selecting a transfer mechanism:

(a)first, Adequacy Regulations, where the destination is covered;
(b)second, a transfer tool under Article 46 of the UK GDPR, being the IDTA or, where the same transfer relationship is also governed by the EU SCCs, the Addendum; and
(c)third, and only where clause 10 permits, a derogation under Article 49 of the UK GDPR.

5.2

The mechanism to be relied on must be identified, documented and put in place before the transfer is made, and must be recorded in the transfer register maintained under clause 16. A transfer must not be made on the basis that a mechanism will be executed afterwards.

5.3

The Company does not operate binding corporate rules under Article 47 of the UK GDPR and does not rely on them. Where a counterparty relies on its own approved binding corporate rules, the Company will verify the approval and its scope before treating the transfer as covered.

5.4

The Company does not presently rely on approved codes of conduct or approved certification mechanisms under Article 46(2)(e) or (f) of the UK GDPR. Any future reliance requires approval under clause 16.4.

5.5

A transfer to a receiver whose processing of the relevant Personal Data is itself subject to the UK GDPR is not a Restricted Transfer and does not require a transfer tool. The basis for that conclusion must be recorded, and the remaining obligations in this Statement, including security and onward transfer controls, continue to apply.

5.6

Where the Company acts as a processor for a client, it will use the transfer mechanism specified in the client’s written instructions, provided that the Company is satisfied that the mechanism is lawful. Where it is not, the Company will notify the client in writing under Article 28(3) of the UK GDPR and will not make the transfer.

6.Adequacy regulations

6.1

Where the destination country, territory, sector or international organisation is the subject of Adequacy Regulations, Personal Data may be transferred without an additional Article 46 transfer tool and without a Transfer Risk Assessment. All other requirements of UK data protection law continue to apply to the transfer.

6.2

The Company relies on Adequacy Regulations in respect of the following destinations:

the member states of the European Economic Area and Gibraltar, which are treated as adequate under transitional provisions preserved in United Kingdom law by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019;
countries and territories that were the subject of European Commission adequacy decisions preserved in United Kingdom law on the same basis, and any country or territory subsequently made the subject of Adequacy Regulations by the Secretary of State; and
organisations in the United States of America that are certified under the UK Extension to the EU–U.S. Data Privacy Framework, commonly known as the UK–US Data Bridge, established by Adequacy Regulations in force from 12 October 2023.

6.3

Reliance on the UK–US Data Bridge is permitted only where the intended recipient appears as currently certified on the Data Privacy Framework List with the UK Extension activated, and only in respect of the categories of Personal Data covered by that certification. The certification must be verified before the first transfer and thereafter at least annually. Where a certification lapses or is withdrawn, the transfer must be suspended until an Article 46 transfer tool is in place.

6.4

Adequacy Regulations may be varied, suspended or revoked, and may be subject to challenge. The Company monitors the status of the Adequacy Regulations on which it relies. If Adequacy Regulations cease to cover a transfer, the Company shall, without undue delay, put an Article 46 transfer tool in place supported by a Transfer Risk Assessment, or suspend the transfer.

6.5

Adequacy does not displace the Company’s obligations in respect of onward transfers. Where Personal Data transferred to an adequate destination may be transferred onward to a country that is not adequate, clause 13 applies.

7.The IDTA and the UK Addendum

7.1

Where a Restricted Transfer is not covered by Adequacy Regulations, the Company relies on the transfer tools issued by the Information Commissioner under section 119A of the Data Protection Act 2018, laid before Parliament and in force from 21 March 2022, namely the IDTA and the Addendum. These are appropriate safeguards for the purposes of Article 46(2)(d) of the UK GDPR.

7.2

The IDTA is used where the transfer is governed by United Kingdom law alone. The Addendum is used where the same transfer relationship is also governed by the EU SCCs, so that a single set of clauses, modified by the Addendum, covers both the United Kingdom and European Union positions. The Company does not execute the EU SCCs alone as a means of protecting a Restricted Transfer under the UK GDPR.

7.3

Each IDTA or Addendum must be completed accurately and in full before execution. This includes the identification of the parties and their roles, the categories of Data Subject and Personal Data, the purposes and duration of the transfer, the security requirements applicable to the Importer, any extra protection clauses reflecting the Supplementary Measures required by the Transfer Risk Assessment, and any commercial clauses. Incomplete tables are not acceptable.

7.4

The transfer tool must be executed by a duly authorised signatory of each party before any Personal Data is transferred. The Company will not accept an unexecuted tool, a tool executed by a party other than the true Importer, or any amendment that has the effect of reducing the protection afforded to Data Subjects or of limiting their rights as third party beneficiaries.

7.5

Where the Importer is a processor or sub-processor, the transfer tool must be executed alongside written processing terms that satisfy Article 28(3) of the UK GDPR. Where the Importer is a controller in its own right, the tool must be executed alongside terms addressing purpose limitation, security, onward transfer and the handling of Data Subject requests.

7.6

Where the Company is the Importer in respect of Personal Data transferred to it from the European Economic Area, it will enter into the EU SCCs in the module appropriate to the parties’ roles and will comply with them.

7.7

Each executed transfer tool is reviewed on renewal of the underlying engagement, on any material change to the Importer’s processing or sub-processing arrangements, on any material change in the law or practice of the destination country, and in any event at intervals of no more than twenty-four months.

8.Transfer risk assessment

8.1

Before any Restricted Transfer is made in reliance on an Article 46 transfer tool, a documented Transfer Risk Assessment must be completed and approved. A transfer must not proceed while a Transfer Risk Assessment is outstanding.

8.2

The Transfer Risk Assessment shall address, at a minimum:

(a)the categories, volume, sensitivity and frequency of the Personal Data to be transferred, and whether Special Category Data or criminal offence data is involved;
(b)the categories of Data Subject affected and the nature and severity of the harm they could suffer if the Personal Data were accessed, altered, disclosed or lost;
(c)the transfer tool proposed and whether its protections are enforceable in practice in the destination country;
(d)the law and practice of the destination country relevant to the transfer, including powers of public authorities to compel disclosure or to intercept communications, data localisation requirements, and any obligation on the Importer to provide access to data;
(e)whether Data Subjects in the United Kingdom have access to effective administrative and judicial redress in the destination country;
(f)the Importer’s technical and organisational capability and its practical ability to comply with the transfer tool, including its record of resisting unlawful requests;
(g)any onward transfers the Importer may make, and the controls applicable to them; and
(h)the Supplementary Measures available and whether, taken together with the transfer tool, they secure the required standard of protection.

8.3

Transfer Risk Assessments are carried out using the transfer risk assessment tool published by the Information Commissioner’s Office alongside the IDTA, or, where the same transfer is also assessed for European Union purposes, the approach set out in Recommendations 01/2020 of the European Data Protection Board on measures that supplement transfer tools. The methodology used must be recorded.

8.4

The assessment must record one of three outcomes: that the transfer may proceed under the transfer tool alone; that the transfer may proceed subject to identified Supplementary Measures, which must then be implemented and reflected in the extra protection clauses of the transfer tool; or that the transfer must not proceed.

8.5

Where the assessment cannot support a reasonable and proportionate conclusion that the standard of protection in the destination country is not materially lower than the standard under UK data protection law, and no Supplementary Measures are capable of closing the gap, the transfer shall not be made. In that event the transfer must not be re-characterised as falling within a derogation under Article 49 in order to proceed.

8.6

A Transfer Risk Assessment shall be reviewed and, where necessary, repeated on any material change in the destination country’s law or practice, on any material change to the nature, volume or sensitivity of the Personal Data transferred, on any change of Importer or sub-processor, following a personal data breach affecting the transfer, and in any event at intervals of no more than twenty-four months.

8.7

Where a transfer forms part of processing that is likely to result in a high risk to the rights and freedoms of individuals, a data protection impact assessment under Article 35 of the UK GDPR must be carried out and the Transfer Risk Assessment incorporated into it.

9.Supplementary measures

9.1

Where the Transfer Risk Assessment identifies a shortfall in protection, the Company applies Supplementary Measures proportionate to the risk. Measures are selected for their practical effect, not for their appearance in a contract.

9.2

Technical measures used by the Company include:

encryption of Personal Data in transit using current, industry-accepted transport layer security, and encryption at rest using strong, industry-accepted algorithms;
retention of encryption keys within the United Kingdom or a country covered by Adequacy Regulations, under the Company’s sole control, so that the Importer cannot decrypt Personal Data without the Company’s involvement;
pseudonymisation, tokenisation or redaction of identifiers before transfer, where the purpose of the transfer can still be achieved;
transfer of extracts rather than complete records, and provision of access to a hosted environment in place of transfer of copies;
multi-factor authentication, device management and controlled endpoints for all remote access from outside the United Kingdom; and
logging of access and transfer events, with the logs held by the Company and reviewed periodically.

9.3

Organisational measures used by the Company include restriction of access to named individuals on a least privilege basis, written confidentiality undertakings, prohibition on the creation of local copies except where operationally necessary and then only in encrypted form, mandatory training on this Statement, defined secure disposal procedures, and periodic assurance review of the Importer.

9.4

Contractual measures used by the Company include obligations on the Importer to notify the Company of any request for access to transferred Personal Data so far as it is lawfully able, to challenge any request that appears unlawful or disproportionate, to disclose no more than the minimum required, to warrant that it has not created and will not create any means of covert access to the Personal Data, and to permit audit, suspension of transfer, and the return or secure deletion of Personal Data on request.

9.5

Where the purpose of the transfer requires the Importer to have access to Personal Data in intelligible form, that fact must be stated in the Transfer Risk Assessment, the residual risk must be evaluated on that basis, and the transfer may proceed only where the remaining measures are sufficient.

10.Article 49 derogations and their limits

10.1

Article 49 of the UK GDPR permits a transfer in the absence of Adequacy Regulations and appropriate safeguards only in defined situations. The Company treats these derogations as exceptions of last resort. They shall not be used for transfers that are regular, repetitive, systematic or structural in character, and shall not be used to avoid the effort of putting a transfer tool in place.

10.2

The derogations on which the Company may rely, where the conditions are genuinely met, are that the transfer:

(a)is made with the Data Subject’s explicit consent, given after the Data Subject has been informed of the possible risks arising from the absence of Adequacy Regulations and appropriate safeguards;
(b)is necessary for the performance of a contract between the Data Subject and the Company, or for the implementation of pre-contractual measures taken at the Data Subject’s request;
(c)is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the Company and another person;
(d)is necessary for important reasons of public interest recognised in the law of the United Kingdom;
(e)is necessary for the establishment, exercise or defence of legal claims;
(f)is necessary to protect the vital interests of the Data Subject or of another person, where the Data Subject is physically or legally incapable of giving consent; or
(g)is made from a register which, under United Kingdom law, is intended to provide information to the public, subject to the conditions in Article 49(2).

10.3

Consent under clause 10.2(a) must be explicit, specific to the transfer, freely given and informed as to the identity or categories of Importer, the destination and the specific risks. Consent must be capable of withdrawal at any time without detriment, and the Company must be able to cease the transfer on withdrawal. Consent is not used where there is an imbalance of power between the Company and the Data Subject such that it could not be freely given, and in particular is not relied upon for transfers relating to Personnel.

10.4

Necessity in clauses 10.2(b) to (f) is construed strictly. A transfer is necessary only where the relevant purpose cannot reasonably be achieved without it. Convenience, cost, operational preference or administrative simplicity do not make a transfer necessary.

10.5

The residual ground in the second subparagraph of Article 49(1), permitting a transfer necessary for the purposes of compelling legitimate interests pursued by the Company, may be relied upon only where the transfer is not repetitive, concerns a limited number of Data Subjects, the compelling legitimate interests are not overridden by the interests or rights and freedoms of the Data Subject, the Company has assessed all the circumstances surrounding the transfer and has on the basis of that assessment adduced suitable safeguards, and the Company has informed the Information Commissioner’s Office and the Data Subject of the transfer and of the compelling legitimate interests pursued. Reliance on this ground requires the prior written approval of the individual with responsibility for data protection compliance.

10.6

Every reliance on a derogation must be recorded in the transfer register, identifying the derogation, the reasons why it applies, the Personal Data transferred, the Importer and the date. Where the residual ground is used, the assessment and the safeguards adduced must be documented in accordance with Article 30(1)(e) of the UK GDPR.

Derogations are not a transfer tool

A derogation permits a specific, occasional transfer. It does not create a standing route for a data flow. Where the same transfer is required more than occasionally, the Company will put an IDTA or the Addendum in place, supported by a Transfer Risk Assessment, and will suspend the flow until that is done.

11.Transfers to Bangladesh

11.1

Bangladesh is a principal operating market for the Company. Transfers of Personal Data to Bangladesh are routine, foreseeable and integral to the Company’s business. They are treated as a standing category of Restricted Transfer subject to the controls in this clause.

11.2

Bangladesh is not, at the date of this Statement, the subject of Adequacy Regulations. The Company therefore places no reliance on Article 45 of the UK GDPR in respect of any transfer to Bangladesh.

11.3

Transfers to Bangladesh are made under the IDTA or, where the same relationship is also governed by the EU SCCs, under the Addendum, in each case supported by a current Transfer Risk Assessment and by the Supplementary Measures that assessment requires. The only exception is a transfer that genuinely falls within a derogation under clause 10.

11.4

The Transfer Risk Assessment for Bangladesh gives particular consideration to the powers of public authorities to compel the production of information or to intercept communications, to information requirements arising in connection with investment registration, licensing and approval processes, to the practical availability of redress for a Data Subject located in the United Kingdom, and to the information security posture of the specific Importer rather than the market in general.

11.5

Transfers to Bangladesh are limited to what is necessary for the specific mandate or operational purpose. Transfer of client databases, contact lists or pipeline records in bulk is prohibited. Where a Bangladesh-based recipient requires access to Personal Data on a continuing basis, access shall be provided through controlled remote access to systems hosted in the United Kingdom in preference to the transfer of copies.

11.6

Where Personal Data must be provided to a public authority in Bangladesh in connection with an approval, registration, licensing or reporting requirement, the Company shall:

(a)confirm the legal basis for the requirement and the identity and authority of the requesting body before disclosing;
(b)disclose only the Personal Data that the requirement actually calls for;
(c)inform the affected Data Subject in advance where it is lawful and practicable to do so, and otherwise as soon as it becomes lawful and practicable; and
(d)record the disclosure, its basis and its scope in the transfer register.

11.7

Personnel located in Bangladesh are subject to the same access controls, confidentiality undertakings, training requirements and disciplinary consequences as Personnel located in the United Kingdom. Local storage of Personal Data on personal devices or personal accounts is prohibited.

11.8

Nothing in this Statement requires any person to act in breach of the law of Bangladesh. Where a requirement of local law appears to conflict with an obligation under this Statement or under a transfer tool, the conflict must be escalated immediately under clause 16 and the transfer suspended until the conflict is resolved or the affected processing is brought within lawful limits.

12.Advisers, counterparties and other jurisdictions

12.1

The Company engages professional advisers in Bangladesh, the United Kingdom and other jurisdictions. Where an adviser is located in a country covered by Adequacy Regulations, clause 6 applies. Where it is not, the engagement shall be supported by the IDTA or the Addendum and a Transfer Risk Assessment, save where the transfer is occasional and genuinely necessary for the establishment, exercise or defence of legal claims, in which case clause 10.2(e) may be relied upon and the reliance recorded.

12.2

Transfers to counterparties, including sponsors, investors, lenders, operators and joint venture participants, are limited to the Personal Data required for the transaction, typically identification and contact data, corporate role and ownership data, and the outputs of due diligence. Such transfers are made under the IDTA or the Addendum, or, where the transfer is occasional and necessary for the conclusion or performance of a contract with or in the interest of the Data Subject, under clause 10.2(b) or (c).

12.3

Where a counterparty receives Personal Data as a controller in its own right, the Company will inform it in writing of the purposes for which the Personal Data may be used, will require it to provide its own transparency information to affected Data Subjects, and will not transfer Personal Data for the counterparty to use for unrelated purposes.

12.4

Providers of identity verification, sanctions, politically exposed person and adverse media screening may process Personal Data outside the United Kingdom. Such providers are engaged under written terms complying with Article 28(3) of the UK GDPR together with an Article 46 transfer tool where required. The Company will not use a screening provider that is unable or unwilling to identify the jurisdictions in which it and its sub-processors process Personal Data.

12.5

Transfers connected with litigation, arbitration, regulatory investigation or the response to a lawful request from a United Kingdom authority shall be limited to the Personal Data reasonably required, shall be reviewed for privilege and for the presence of Special Category Data and criminal offence data before disclosure, and shall be recorded.

12.6

The Company shall not transfer Personal Data to any person or jurisdiction where to do so would contravene the Sanctions and Anti-Money Laundering Act 2018 or regulations made under it. Where a transfer may require a licence, the Company will seek the appropriate licence from the Office of Financial Sanctions Implementation before proceeding, and will not proceed without it.

12.7

Information about the countries to which Personal Data is transferred, the mechanisms relied upon and the means by which a copy of the relevant safeguards may be obtained is provided to Data Subjects in the Company’s Privacy Policy in accordance with Articles 13(1)(f) and 14(1)(f) of the UK GDPR.

13.Onward transfers and sub-processors

13.1

The protection required by Chapter V of the UK GDPR travels with the Personal Data. An Importer may not defeat that protection by transferring the Personal Data onward.

13.2

Every transfer tool executed by the Company requires that the Importer shall not make an onward transfer of Personal Data except where:

(a)the onward recipient is located in a country covered by Adequacy Regulations;
(b)the onward transfer is made under a transfer tool, or equivalent binding arrangement, that affords a standard of protection no lower than that afforded by the transfer tool between the Company and the Importer;
(c)the Company has given prior written authorisation to the specific onward transfer; or
(d)the onward transfer is required by law, in which case clause 14 applies.

13.3

Where the Importer is a processor, it shall not engage a sub-processor without the Company’s prior specific or general written authorisation in accordance with Article 28(2) of the UK GDPR. Where general authorisation is given, the Importer must notify the Company of any intended addition or replacement of a sub-processor with sufficient notice for the Company to object. The Importer must impose on each sub-processor the same data protection obligations as bind it, and remains fully liable to the Company for the sub-processor’s performance in accordance with Article 28(4).

13.4

The Company maintains a record of the sub-processors used in connection with its processing and the countries in which they process Personal Data. That record forms part of the transfer register maintained under clause 16.

13.5

Where a proposed onward transfer or sub-processor would materially reduce the protection afforded to Personal Data, the Company shall object, and where the objection is not resolved shall suspend the transfer and require the return or secure deletion of the Personal Data already transferred.

13.6

An onward transfer made in breach of these controls is treated as a potential personal data breach and is assessed under Articles 33 and 34 of the UK GDPR without delay.

14.Requests from public authorities

14.1

Under Article 48 of the UK GDPR, a judgment of a court or tribunal, or a decision of an administrative authority, of a Third Country requiring the transfer or disclosure of Personal Data is recognised or enforceable only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting country and the United Kingdom. That is without prejudice to the other grounds for transfer under Chapter V.

14.2

Every transfer tool executed by the Company requires the Importer, on receiving a request or order for access to transferred Personal Data from a public authority, to:

(a)notify the Company promptly, unless prohibited by law from doing so;
(b)where notification is prohibited, use all reasonable efforts to obtain a waiver of the prohibition and to provide as much information as it is lawfully able, including aggregate information about the number and type of requests received;
(c)review the lawfulness of the request and challenge it, including by seeking interim relief, where there are reasonable grounds to consider it unlawful, defective or excessive;
(d)disclose no more than the minimum amount of Personal Data required, assessed on a reasonable interpretation of the request; and
(e)record the request, the response and the reasoning, and provide that record to the Company on request.

14.3

The Company shall inform affected Data Subjects of a request for access to their Personal Data by a public authority in a Third Country where it is lawful and practicable to do so, and shall consider whether the request gives rise to a personal data breach requiring notification under Articles 33 and 34 of the UK GDPR.

14.4

Records of such requests are retained in accordance with the Company’s Data Retention and Records Management Policy and are made available to the Information Commissioner’s Office on request.

14.5

A pattern of requests, or a refusal by an Importer to accept the obligations in clause 14.2, is treated as a material change requiring a fresh Transfer Risk Assessment and, where the risk cannot be mitigated, suspension of the transfer.

15.Rights of data subjects in respect of transfers

15.1

Data Subjects are entitled under Articles 13(1)(f) and 14(1)(f) of the UK GDPR to be told whether their Personal Data is transferred to a Third Country, on what basis, and how to obtain a copy of the safeguards relied upon. That information is given in the Company’s Privacy Policy at the point at which Personal Data is collected.

15.2

On making a request for access under Article 15, a Data Subject whose Personal Data has been transferred to a Third Country is entitled under Article 15(2) to be informed of the appropriate safeguards relating to that transfer.

15.3

The Company will provide a copy of the relevant IDTA or Addendum on request. Redactions will be made only to the extent necessary to protect commercial confidentiality, trade secrets or the rights of third parties, and the Company will state which parts have been redacted and why. The substantive protections and the third party rights conferred on Data Subjects will not be redacted.

15.4

Transfer does not diminish any other right. Rights of rectification, erasure, restriction of processing, data portability and objection under Articles 16 to 22 of the UK GDPR continue to apply to transferred Personal Data. Where a Data Subject exercises such a right, the Company will communicate it to each Importer under Article 19 and will require the Importer to give effect to it, unless doing so proves impossible or involves disproportionate effort, in which case the Company will inform the Data Subject.

15.5

The transfer tools used by the Company confer directly enforceable rights on Data Subjects as third party beneficiaries, including the right to bring a claim against the Importer for breach. Where a Data Subject wishes to exercise those rights, the Company will provide the information reasonably required to identify the correct party and the applicable clauses.

15.6

Requests and enquiries under this Statement should be submitted through the enquiry form at fratresgroup.com/contact. Requests are acknowledged within five business days. A substantive response is provided without undue delay and in any event within one month of receipt, in accordance with Article 12(3) of the UK GDPR. That period may be extended by up to two further months where necessary, taking account of the complexity and number of requests, in which case the Company will inform the Data Subject of the extension and the reasons for it within one month of receipt.

15.7

No fee is charged for responding to a request unless it is manifestly unfounded or excessive, in which case the Company may charge a reasonable fee or refuse to act, and will explain the reasons and the right to complain.

Right to complain

A Data Subject who is dissatisfied with how the Company has handled an international transfer may complain to the Company through the enquiry form at fratresgroup.com/contact, and may lodge a complaint with the Information Commissioner’s Office under Article 77 of the UK GDPR and section 165 of the Data Protection Act 2018.

Complaining to the Company first is encouraged but is not a precondition. A Data Subject also has the right to an effective judicial remedy under section 167 of the Data Protection Act 2018 and the right to compensation for damage suffered as a result of a contravention, under Article 82 of the UK GDPR and section 168 of that Act.

16.Governance, records and review

16.1

The board of directors is accountable for compliance with this Statement. Day-to-day responsibility rests with the individual appointed to lead the Company’s data protection compliance, who maintains the transfer register, approves transfer mechanisms and Transfer Risk Assessments, and reports to the board at least annually. Enquiries for that person should be routed through the enquiry form at fratresgroup.com/contact.

16.2

The Company maintains a transfer register recording, for each transfer or category of transfer: the Exporter and Importer; the destination country; the categories of Data Subject and Personal Data; the purpose and duration; the transfer mechanism relied upon and the date it was put in place; the date and outcome of the Transfer Risk Assessment; the Supplementary Measures applied; the sub-processors engaged; and the next review date. The register is maintained consistently with the record-keeping obligations in Article 30 of the UK GDPR, including Article 30(1)(e).

16.3

No new recurring transfer to a Third Country may commence, and no new Importer or sub-processor may be engaged, without prior approval under this clause and entry in the transfer register.

16.4

All Personnel receive training on this Statement on induction and at least annually thereafter. Personnel who arrange, approve or execute international transfers receive enhanced training covering transfer mechanisms, Transfer Risk Assessments and the handling of requests from public authorities.

16.5

The Company reviews the transfer register at least annually, tests the operation of the Supplementary Measures it relies upon, and carries out proportionate assurance review of Importers, which may include questionnaires, evidence of certification, and audit where the risk justifies it.

16.6

A personal data breach affecting transferred Personal Data is handled under the Company’s breach procedure. Where the breach is likely to result in a risk to the rights and freedoms of individuals, it will be notified to the Information Commissioner’s Office without undue delay and, where feasible, within seventy-two hours of the Company becoming aware of it, in accordance with Article 33 of the UK GDPR, and affected Data Subjects will be informed where Article 34 requires.

16.7

Personnel and third parties may raise concerns about international transfers, including suspected unlawful transfers, under the Company’s Whistleblowing and Speak-Up Policy. Protections under the Public Interest Disclosure Act 1998 apply to qualifying disclosures, and no person will suffer detriment for raising a concern in good faith.

16.8

This Statement is reviewed at least annually and additionally on any material change to the law governing international transfers, including any change to Adequacy Regulations, to the transfer tools issued by the Information Commissioner, or to the Company’s operating footprint. The document reference and version date shown at the head of this Statement identify the current version.

16.9

This Statement and any dispute or claim arising out of or in connection with it are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, without prejudice to any right a Data Subject has to bring proceedings elsewhere under data protection law or under a transfer tool.

Related policies

Privacy PolicyHow Fratres Limited collects, uses, shares and protects personal data, and the rights available to data subjects under the UK GDPR.FGL-LEG-04 Cookie PolicyThe cookies and similar technologies used on this website, their purposes, and how consent may be given or withdrawn.FGL-LEG-05 Data Retention & Records Management PolicyRetention periods applied to categories of records held by the firm, the basis for those periods and the secure disposal process.FGL-LEG-06

Full legal register