Privacy Policy

01 Data controller

Cordoba Capital Markets Limited (“Cordoba”, “we”, “us”) is the controller of the personal data described in this notice. We are a private company incorporated in the United Kingdom under registered number 14557638, with our registered office at International House, 36–38 Cornhill, London EC3V 3NG.

We also act as Registrar to Cordoba Capital Markets Jersey PCC (registered in Jersey under number 154059), the protected cell company whose cells issue the notes described on this website. In that capacity we maintain the register of holders.

Enquiries about this notice should be addressed to info@ccmkts.com, marked for the attention of the privacy contact.

02 Scope of this notice

This notice applies to personal data processed by Cordoba as controller: through this website, through the Investor Portal and the Client Portal, and in the course of dealings with investors, portfolio companies, introducers, advisers and prospective clients.

It does not apply to processing carried out by a portfolio company as its own controller, by your own adviser or bank, or by any third-party website to which we link. Where the protected cell company, its administrator or another party acts as controller in its own right, that party’s notice governs the processing concerned.

03 Personal data we process

Website usage

A request for any page transmits your IP address, the page requested, your browser and operating system, and the time of the request. Our host records this information in order to deliver the website, maintain its availability and protect it from misuse.

Your browser also stores a record of your cookie preference, and may retain the media used on the home page in its own HTTP cache. Neither is transmitted to us. Full details are set out in the Cookie Policy.

Access to the PPN factsheet

The factsheet is a financial promotion which may lawfully be directed only at certain categories of investor. Access is therefore subject to an eligibility declaration. On completion of that declaration we record your email address, your name where provided, your responses to the eligibility questions, the category derived from those responses, your IP address, and the date and time of the declaration.

This record is retained for two purposes: to evidence that the promotion was directed only at persons entitled to receive it, and to avoid requiring you to repeat the declaration if you subsequently register for the Investor Portal. Completion of the declaration does not create an account and does not enrol you for marketing.

Investors and prospective investors

Where you invest, or apply to invest, we process:

• identity and verification data, including name, date of birth, nationality, residential address and certified copies of identity and address documents, together with the declarations required under the client passport process operated by the Jersey corporate services provider;
• eligibility data, including your investor classification and the certification on which it rests;
• financial and tax data, including source of funds, source of wealth, bank and payee details, tax residence, taxpayer identification numbers and the self-certifications required for international tax reporting;
• ownership and control data, including, where you subscribe through an entity, details of its directors, shareholders, beneficial owners, nominees and any person exercising control over it;
• holding data, including subscriptions, capital calls, distributions, statements, instructions and entries on the register we maintain as Registrar; and
• correspondence with us, including through the portals.

Portfolio companies and counterparties

Business contact details, role, correspondence, and the identity and verification data required before we finance a trade activity or enter into an agreement.

04 Sources of personal data

Personal data is obtained principally from you. We also obtain it from your advisers, introducers or colleagues where they act on your behalf; from public sources, including company registers; from sanctions, politically exposed person and adverse media screening providers; and from banks and payment providers in the course of confirming a transfer.

05 Legal bases for processing

We rely on the following legal bases under the UK GDPR:

• Compliance with a legal obligation. Customer due diligence, ongoing monitoring and record keeping under money laundering and counter-terrorist financing legislation; international tax reporting; maintenance of the register of holders; and responses to a regulator, court or tax authority.
• Performance of a contract. Administration of your subscription and holding, payment of distributions, and steps taken at your request prior to entering into an agreement.
• Legitimate interests. Operation and security of this website; response to correspondence initiated by you; evidencing that a financial promotion was directed only at persons entitled to receive it; relationship and risk management; and the establishment, exercise or defence of legal claims. A legitimate interests assessment has been carried out in each case and is available on request.
• Consent. Storage of information on your device which is not strictly necessary, and any marketing communications for which you have opted in. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

06 Criminal offence and special category data

Anti-money-laundering legislation requires us to screen investors and their controllers against sanctions lists, politically exposed person lists and adverse media. That process may return, or may require you to declare, information relating to public office held, political exposure, and alleged or actual criminal offences.

Such data is processed only where a condition under the Data Protection Act 2018 is satisfied, namely the prevention or detection of unlawful acts and compliance with regulatory requirements, each being a condition of substantial public interest. It is not used for any other purpose, and access is restricted to those who require it in the performance of their duties.

07 Recipients of personal data

We do not sell personal data and we do not disclose it for the marketing purposes of any third party. Personal data may be disclosed to the following categories of recipient:

Hosting provider

Netlify, which delivers this website and holds the server logs referred to in section 3. No other third party is involved in delivering these pages: the typeface and code libraries are served from this origin.

Issuer and administrator

Cordoba Capital Markets Jersey PCC, the relevant issuing cell, and the corporate services provider responsible for the client passport process and the administration of the cells.

Screening and verification providers

Providers of identity verification and of sanctions, politically exposed person and adverse media screening.

Banks and payment providers

For the receipt of subscription monies and the payment of distributions to the account you nominate.

Professional advisers

Legal advisers, accountants and auditors, in each case subject to a duty of confidentiality.

Technology providers

Providers who host and support our platform and correspondence systems, acting as processors on our documented instructions.

Authorities

Regulators, tax authorities, law enforcement agencies and courts, where disclosure is required of us or is necessary for the establishment or defence of a legal claim. Where a report of suspicion is made under money laundering legislation, we may be prohibited by law from informing you of it.

08 International transfers

The issuing structure is established in Jersey, and investor data is accordingly transferred to Jersey. Jersey is the subject of UK adequacy regulations, and no additional safeguard is required in respect of that transfer.

Certain providers operate in other jurisdictions. Where a transfer is made to a jurisdiction which is not the subject of adequacy regulations, it is made under the International Data Transfer Agreement, or under the Addendum to the European Commission standard contractual clauses, supported by a transfer risk assessment. Details of the safeguard applicable to a particular transfer are available on request.

09 Retention

Personal data is retained for as long as required for the purpose for which it was collected and for any further period required by law. In particular:

• customer due diligence records and transaction records are retained for at least five years following the end of the business relationship, as required by money laundering legislation;
• the register of holders and the records supporting an issue are retained for the life of the issue and for the period thereafter prescribed by the constitutional documents and by Jersey law;
• records evidencing the direction of a financial promotion are retained for so long as we may be required to demonstrate that the promotion was properly directed;
• correspondence is retained for the duration of the matter and for a further period consistent with our record keeping obligations; and
• server logs are retained for the period specified in our hosting provider’s retention policy.

Where no statutory period applies, the retention period is set by reference to the applicable limitation period. Our retention schedule is available on request.

10 Your rights

Subject to the conditions in applicable law, you have the right to request access to your personal data; rectification of inaccurate or incomplete data; erasure; restriction of processing; data portability; and to object to processing carried out on the basis of legitimate interests. Where processing is based on consent, you may withdraw that consent at any time.

These rights are qualified. Where we are required by law to retain a record, including records maintained for customer due diligence purposes, we will be unable to give effect to a request for erasure, and will inform you accordingly.

Requests should be sent to info@ccmkts.com. We will respond within one month of receipt, and will notify you if an extension is required by reason of the complexity or number of requests. We may require verification of your identity before responding.

11 Automated decision-making

The eligibility questionnaire derives an investor category from the responses given, and screening tools generate matches for review. Neither constitutes a decision based solely on automated processing producing legal effects concerning you or similarly significantly affecting you: eligibility is confirmed by us before an account is opened, and every screening match is assessed by a member of staff. We do not carry out profiling for marketing purposes.

12 Security

This website is a static site served over HTTPS, with no database and no authentication behind it. Systems which hold personal data are subject to authentication, role-based access restrictions and access logging. Appropriate technical and organisational measures are maintained in accordance with Article 32 of the UK GDPR.

Identity documents and bank details should not be sent to us by unencrypted email. Where such information is required, we will request it through a secure channel.

13 Children

Our services are directed at businesses and at professional and qualified investors. They are not directed at children, and we do not knowingly process the personal data of children.

14 Amendments

This notice is amended when our processing changes, and the date stated at the head of this page is revised accordingly. Where an amendment is material, and in particular where it affects processing carried out on the basis of your consent, we will notify you.

15 Contact and complaints

Cordoba Capital Markets Limited (registered number 14557638)
International House, 36–38 Cornhill
London EC3V 3NG, United Kingdom

info@ccmkts.com

If you are dissatisfied with our handling of your personal data, please raise the matter with us in the first instance. You are also entitled to lodge a complaint with the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.