EIGHT ROADS SHAREHOLDER PRIVACY NOTICE
Eight Roads Shareholdings Limited (the Company, we, us, our) and the Eight Roads Group respects your privacy and is committed to protecting the personal data belonging to you which it collects. This privacy policy sets out the basis on which the data we collect about you, or that you provide to us, will be processed by us. Please read the following carefully to understand our approach and practices regarding your personal data and how we will treat it.
1. INFORMATION ABOUT US
The Company is the ultimate parent of the Eight Roads Group and you are (or may become) a shareholder in the Company. Eight Roads Shareholdings Limited is a data controller under applicable data privacy laws as regards the personal data which it holds in respect of you. Headquartered in Bermuda, Eight Roads conducts business through a number of entities in its group across Bermuda, China, Hong Kong, India, Japan and the UK.
For the sole purposes of the Personal Information Protection Act 2016 in Bermuda, the privacy officer in Bermuda is Eight Roads Head of Risk & Compliance, James McLaughlin.
If you would like to contact Eight Roads about any use by us of your personal data, please email privacy@eightroads.com or write to us at the relevant office listed on our website eightroads.com/en/contact.
2. WHAT INFORMATION WE COLLECT
We collect and process the following types of information on the lawful basis as described next to it (depending on the purpose for which it is collected):
| Type of data | Lawful basis |
|---|---|
| Contact information, for example, personal and work email addresses, personal addresses and phone numbers | Legitimate Interests, Consent, Contract, Legal Obligation |
| Identifying information, for example, name, passport, ID (including corporate ID and tax ID), driving licence number, date of birth and gender | Legitimate Interests, Consent, Contract, Legal Obligation |
| Information from anti-fraud, due diligence, political exposure and Sanctions databases, which may include public domain information about your medical history, your family, criminal convictions, political opinions or affiliations | Legitimate Interests, Legal Obligation |
| Information that you voluntarily disclose to us | Consent, Contract |
3. SOURCES AND HOW WE COLLECT INFORMATION
We collect information:- • through contact with you and, where relevant, your advisers
- • from the evaluation and completion of background checks undertaken in connection with your application for shares in the Company
- • from Fidelity International in accordance with our data sharing arrangements
- • from public domain sources, such as social media and newspaper reports
4. HOW WE USE INFORMATION
We use your personal information for a number of purposes, including the updating of our records, our communications with you regarding your shareholding in the Company, performance of our contractual obligations, to comply with our legal and regulatory obligations and in relation to our legitimate interests in operating and promoting the Eight Roads business. In doing so, we balance our appropriate business needs with your right to have your information handled in a way which does not unreasonably prejudice your interests.
We only collect and process "special categories" of information (such as information regarding political affiliations) when we have been provided with it by you or by third party providers of due diligence and background checking data services, or from information which is in the public domain.
5. SHARING INFORMATION
We may share information with other companies in the Eight Roads group and with our associated firms, FIL Limited and FMR LLC (and members of their groups).
We may share information collected as detailed under Section 4 in order to comply with legal and regulatory obligations and best practice.
We may share information with third party suppliers or service providers, for example, professional advisers, but this will be limited to the amount of information needed for that third party to carry out the relevant function.
We may also share information with third parties where you have authorised us to do so, or for compliance with legal and regulatory obligations, such as providing information for the purposes of completing tax returns, responding to queries from regulators and other authorities. We will never transfer more personal data than is necessary to discharge our legal obligations.
If you would like more details about our sharing of your personal information, please contact us as set out in Section 1.
6. OUR RETENTION OF INFORMATION
We retain information we collect for as long as is reasonably necessary to comply with the purposes set out in Section 5.
7. SECURITY
We have implemented reasonable technical and organisational measures designed to secure your personal information from accidental loss and from unauthorised access, use, alteration or disclosure. These include the anonymization of information where appropriate and the encryption of all personal information stored in our systems where possible.
8. TRANSFERS OF INFORMATION
We may transfer personal information to countries outside Bermuda, including to other members of the Eight Roads group. In such circumstances, we will ensure that approved safeguards for international transfers of personal data are adopted, where applicable.
You can contact us as detailed in Section 1 to find out more about such transfers.
9. YOUR RIGHTS
You have a right to:- • access information we hold about you, and know for what purpose we use that information
- • correct inaccuracies in information we hold about you
- • withdraw any consent you have given to use of your information
- • complain to the relevant supervisory authority in any jurisdiction about our use of your information
- • in some circumstances:
- • request that we erase information we hold about you
- • receive a copy of any personal information provided by you and require us to provide this information to a third party
- • restrict the use of information we hold about you
- • object to the use of information we hold about you, including where that information is used for direct marketing purposes.
You can exercise these rights by contacting us as detailed under Section 2.
10. CHANGES TO OUR PRIVACY POLICY
If our privacy policy changes in any way, we will place an updated version on Sharetrack.
Fidelity Privacy Policy:
Why we collect your data
We are committed to protecting your personal data. This statement explains how we do that. It sets out what we do with your personal data, how we protect it, and explains your pertinent privacy rights. We collect and use your personal data to enable us to allow participation in the FIL Equity Scheme and to comply with the law. The basis we rely upon for lawfully collecting and using your personal data will depend on the purposes for which we are processing your personal data. These are detailed below:(a) Performing our contract with you
When you participate in the FIL Equity Scheme, you do so under the terms of our contract. For us to meet our obligations to you under those terms we must process your personal data. We will process your personal data in line with those terms only. When you provide personal data to us, we will use that personal data so we can:
- • provide our services to you in the provision, administration and servicing of our contract with you
- • enable the conduct of security operations, such as using your IP address to help identify you when you log on to any of our online services
- • send you information where appropriate
(b) Our legitimate interests
We process your information for the following reasons, which we define as our legitimate interests:
- • internal research and analysis
- • to help us to run our business; this includes shareholder relations, HR, financial management, risk management, planning, corporate governance, audit and research
(c) Our legal obligations
In some circumstances, we have a legal obligation to process and share your personal data. We must provide a wide range of data to regulators or other entities in order to prevent or detect crime. Sometimes this involves personal data. We will never transfer more personal data than is necessary to discharge our legal obligations.
In addition, the Register of Shareholders, which may include personal data, is by Bermuda law publicly available at FIL Limited’s registered office.
What we collect and how
The personal data you provide to us may include combinations of any of the following and similar items such as, your name, email address, telephone number, address, identification numbers such as social security and/or tax identification numbers, banking account details, details of your shareholdings, date of birth, location information, employment information and IP address.We hold your personal information on paper and on computer systems.
Whom we share your personal data with
Like most businesses, we use third parties, including other entities in the FIL Limited Group, to help deliver our services. This will often involve a third party processing your personal data but that will be in line with the purposes set out above only. We operate a regular and strict regime of third party checks on how your personal data is protected.Your personal data will be held in confidence by us but may be passed to other companies and organisations as detailed below:
- • FIL Limited Group companies (including FIL Limited in Bermuda), Fidelity Management Research (FMR LLC in the USA), Crosby Advisors and related organisations in the USA, and their agents or any third parties we appoint for the administration and servicing of our contract with you, which may include the transfer of your information outside the European Economic Area (EEA).
- • Financial regulators, tax authorities, information regulators and/or statutory bodies for the markets in which we operate – we can be fined and subject to other action if we fail to provide certain information to these authorities.
- • Third parties involved in advice relating to shareholder matters, such as tax advisers, or banks involved in funding FIL shareholder loan arrangements.
- • Fraud prevention and law enforcement agencies in relevant circumstances or if there is a legal obligation.
Transferring your personal data to other countries
As part of delivery of our contract with you it may be necessary to transfer your personal data across national borders. These transfers may involve at least one of FIL Limited’s Group entities operating in the EEA and as such will apply the European standard of protections to the personal data we process. In practice, this means that all the entities in the FIL Limited Group agree to process your personal data in line with high global standards. Where your personal data is transferred within the FIL Limited Group but outside the EEA, that data subsequently receives the same degree of protection as it would in the EEA.Where it is necessary to transfer personal data to a third party, stringent reviews of those with whom we share the data are carried out and that data will be transferred in line only with the purpose for which it was collected.
Security of your personal data
Ensuring the confidentiality, integrity and availability of your personal data defines our approach to information security. We ensure that the security risks to your personal data are managed in a way that makes sure we meet our legal and regulatory obligations. We produce, maintain and regularly test our business continuity plans. We utilise the internationally recognised information security best practices, ISO27001 and PCI-DSS. Our Information Security Policy & Standards are regularly reviewed, adhered to and tested for compliance. Information Security training is mandatory for all staff and breaches of information security, actual or suspected, are reported and investigated.Your rights
The law places robust obligations on entities in the protection of personal data. The way we protect your personal data reflects our legal obligations. A number of rights in relation to the use of your personal information empowers you to make certain requests of us, detailed as follows:(a) Requesting a copy of your personal data
You can access the personal data we hold about you and exercise your right to have a copy provided to you, or someone else on your behalf, in a digital format by emailing or writing to us using the contact details set out in the contract we have with you.
(b) Letting us know if your personal data is incorrect
If you think any of the personal data we hold about you is wrong please let us know by contacting us. We will check the accuracy of the information and take steps to correct it if necessary.
(c) Asking us to stop using or to erase your personal data
You have the right to object to our use of your personal data. You can ask us to delete it, to restrict its use, or to object to our use of your personal data for certain purposes such as marketing. If you would like us to stop using your data in any way, please get in touch. If we are still providing services to you we will need to continue using your information to deliver those services. In some circumstances we are obligated to keep processing your information for a set period of time. Information will generally be provided to you free of charge, although we can charge a reasonable fee in certain circumstances.
How long do we keep your personal data?
We keep all personal data safe and only hold it for as long as necessary.How to complain
If you are unhappy with how we have used your personal data you can complain by contacting Phillip Marsh, Bermuda Data Protection Officer, FIL Limited, Pembroke Hall, 42 Crow Lane, Pembroke HM 19, Bermuda.Finally, you also have the right to complain to your national data protection authority.
Phone number – +1 (441) 295-0665
Email – info@fil.com
Our postal address: FIL Limited, Pembroke Hall, 42 Crow Lane, Pembroke HM 19, Bermuda.