Data Protection

1. Who is responsible for your data

Lydiam Group operates through a number of affiliated entities across different jurisdictions. The entity that determines how and why your personal data is processed (the data controller) depends on the service you use and the entity you contract with. Where processing is carried out by another Lydiam entity or a service provider on our behalf, that party acts as a processor under appropriate contractual terms.

2. Principles we apply

We handle personal data in line with recognised data protection principles. We aim to ensure that personal data is:

• Processed lawfully, fairly and transparently.
• Collected for specified, explicit and legitimate purposes and not used in a manner incompatible with those purposes.
• Adequate, relevant and limited to what is necessary.
• Accurate and, where necessary, kept up to date.
• Retained no longer than necessary for the purposes for which it is processed and for legal and regulatory recordkeeping.
• Processed securely, with appropriate technical and organisational measures.

3. Lawful bases for processing

We process personal data on the basis of the performance of a contract, compliance with a legal obligation (including anti-money laundering, sanctions and tax obligations), our legitimate interests (such as fraud prevention, security and the proper running of our business), and, where required, your consent. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Your rights

Subject to applicable law and to our legal and regulatory obligations, you may have the right to:

• Be informed about how your personal data is used.
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where there is no overriding legal reason for us to retain it.
• Restrict or object to certain processing.
• Request portability of data you have provided to us.
• Withdraw consent where we rely on it.

5. How to exercise your rights

To make a request, please contact us at info@lydiamgroup.com. We may need to verify your identity before responding. We will respond within the period required by applicable law. Some rights are limited where we are legally required to retain information, in particular records held to meet anti-money laundering and counter-terrorist financing obligations.

6. International transfers

As a multi-jurisdiction group, we may transfer personal data between our entities and to service providers located in other countries. Where we do so, we apply appropriate safeguards consistent with applicable data protection law, such as recognised adequacy mechanisms or standard contractual clauses.

7. Retention

We retain personal data for as long as necessary to provide our services and to satisfy legal, regulatory, accounting and reporting obligations. Onboarding, due diligence and transaction records are retained for the minimum periods required by applicable anti-money laundering and recordkeeping rules.

8. Security and data breaches

We maintain technical and organisational measures designed to protect personal data, including access controls, encryption where appropriate, and monitoring. In the event of a personal data breach that is likely to result in a risk to affected individuals, we will assess and, where required, notify the relevant supervisory authority and affected individuals in accordance with applicable law.

9. Complaints to a supervisory authority

If you have a concern about how we handle your personal data, we would encourage you to contact us first so we can address it. You also have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

10. Contact

For any data protection question or request, please contact us at info@lydiamgroup.com.