1. Introduction and what this Privacy Notice covers

This Privacy Notice has been drafted to address the data protection laws applicable in the European Union, including the EU General Data Protection Regulation (GDPR), and the United Kingdom, including the UK GDPR and the Data Protection Act 2018.

This Privacy Notice explains how VEV collects, uses, shares and protects personal data when you interact with us, and what rights you may have in respect of that personal data. VEV is committed to protecting privacy and processing personal data in accordance with applicable data protection laws.

This Privacy Notice may be relevant where you:

• visit or use a VEV website or another VEV digital service that links to this notice;
• are, or represent, a prospective or existing counterparty, customer, supplier or business partner of VEV, including as a director, officer, beneficial owner, authorised representative, agent or other associated individual;
• register for or attend a VEV-hosted, sponsored or co-organised event, or are nominated as a delegate by your employer;
• visit a VEV office or other VEV-operated site, or use visitor Wi-Fi made available by VEV; or
• are otherwise in contact with VEV in a business or professional context, for example as a journalist, regulator or professional adviser.
• directly from you, for example when you contact VEV, attend an event, apply for a role or communicate during a business relationship;
• from your employer or the organisation you represent, for example when you are nominated as a counterparty contact, director, beneficial owner or authorised representative;
• from service providers, including identity-verification, KYC, sanctions-screening, adverse-media, credit-reference, background-check, recruitment, professional-advisory, business-introduction and event-management providers;
• from publicly available sources, including public registers, regulatory filings, court records, company registries, news media, professional networking sites , such as LinkedIn and sanctions and PEP lists;
• from counterparties or transaction parties, including target companies and advisers in a corporate transaction; and
• from information generated by VEV, including records of meetings, correspondence, calls, transactions, screening outcomes and internal analysis.
• banks, financial institutions, credit-reference agencies, insurers and reinsurers;
• commercial counterparties, brokers, intermediaries, exchanges, clearing houses or repositories, where relevant to VEV’s activities;
• regulators, supervisory authorities, tax authorities, customs authorities, courts and other competent governmental, regulatory or judicial bodies;
• law-enforcement and sanctions authorities;
• our professional advisers, including auditors, lawyers, tax and accounting advisers and information-security consultants;
• prospective purchasers, sellers, investors, joint-venture partners, lenders or other parties connected with corporate transactions, restructurings, joint ventures or financings, )and their professional advisers); and
• another third party where you have specifically directed VEV to do so.
• an adequacy decision by the relevant authority;
• the transfer is made subject to appropriate safeguards
• approved binding corporate rules approved by the competent supervisory authority are in place, where applicable; or
• a specific legal derogation applies - used only on an exceptional, non-routine basis.
• For individuals in the EEA: the authority in the place of habitual residence, place of work or place of the alleged infringement, and the supervisory authority for the relevant VEV controller; and
• For individuals in the United Kingdom: the Information Commissioner’s Office.

There may be other circumstances in which VEV collects personal data and provides a separate privacy notice. Where a separate notice applies, that notice will govern the relevant processing.

2. Who we are

The terms “VEV”, “the Company”, “the Group”, “we”, “us” and “our” may be used for convenience. Unless the context requires otherwise, VEV means VEV Services Limited and those direct and indirect subsidiaries and affiliates that participate in the relevant processing, each of which is a separate legal entity.

The VEV entity responsible for processing personal data as controller depends on the relationship a person has with VEV and the relevant processing activity. The applicable controller, registered office and supervisory authority must be confirmed and published in the approved notice.

3. How to contact us

Questions about this Privacy Notice, requests to exercise data protection rights, and privacy concerns should be sent to: privacy@vev.com.

Postal correspondence may be sent to: VEV Services Limited, Manning House, 22 Carlisle Place, London SW1P 1JA.

4. When and how we collect personal data

The personal data VEV collects, and the reasons for collecting it, depend on how a person interacts with VEV. Principal interaction scenarios are described below.

4.1 When you use a VEV website or digital service

When you visit a VEV website or use a VEV digital service, VEV may collect limited technical data automatically, including IP address, browser type and version, operating system, device identifiers, referrer URL, pages visited and timestamps, together with cookie and similar-technology information described in Section 7 and the applicable Cookie Policy. Where you submit a contact form or enquiry, VEV may also collect the information you provide through that form.

4.2 When you use visitor Wi-Fi

If you connect to a VEV visitor Wi-Fi service, VEV or the relevant host may collect your name(s), business email address and company name to create your Wi-Fi account and manage access. During use, VEV may record the MAC address, IP address and visitor Wi-Fi username associated with the device. VEV uses this information to operate the service securely and investigate misuse or cyber-security incidents.

4.3 When you are, or represent, a prospective or existing business partner

If you are, or represent, a prospective or existing counterparty, customer, supplier or other business partner of VEV, VEV may collect personal data about you and, where applicable, individuals associated with the organisation you represent, such as directors, officers, beneficial owners and authorised representatives. This may include identification and contact details, professional information, financial information and identity-verification documents.

If required information is not provided, you or the organisation you represent may not be able to enter into or continue a business relationship with VEV.

4.4 When you apply for a role or other engagement

Where you apply for a role or other engagement with VEV, or are introduced by a recruitment agency or other intermediary, VEV may collect information described in our separate Fair Processing Notice for Job Applicants which will be made available to you. That notice will prevail over this notice for recruitment-related processing.

4.5 When you register for or attend an event

If you register for or attend an event hosted, sponsored or co-organised by VEV, VEV may collect registration details, including name, employer, job title and contact details. If VEV organises travel, accommodation or visas, VEV may also collect passport, visa and related travel information.

4.6 When you visit VEV premises

When you visit a VEV office or other premises, VEV may record your name, company name, arrival and departure times, and the name of your host in our visitor logs. For security reasons, premises may be monitored by CCTV in accordance with applicable signage and local requirements.

4.7 When you are connected with a corporate transaction

Where VEV is considering an acquisition, investment, divestment, financing, restructuring or other corporate transaction, VEV may collect personal data about directors, shareholders, officers, employees or other associated individuals of a target, investor, purchaser, seller or other transaction party. Such information may be obtained from public registers, professional advisers, data rooms, the transaction party, or the relevant organisations.

4.8 When you are granted or hold a power of attorney

If a VEV entity grants a power of attorney to you, VEV may collect identification, contact and authority information necessary to evidence, administer and rely on that authority.

5. What personal data we process, where we get it, and why

The table below sets out the categories of personal data we process, the purposes, the legal basis we rely on, and our rationale.

5.1 Sources of personal data

VEV may obtain personal data:

5.2 Anonymisation and aggregation

VEV may convert personal data into statistical or aggregated form, or otherwise de-identify it, so that individuals cannot reasonably be identified. VEV may use properly anonymised information for research, analysis and statistical reporting without further notice, subject to applicable law.

6. Automated decision-making

VEV may use automated tools to assist us. Where the outcome of such a tool could have legal or similarly significant effects on you, the result is always subject to meaningful human review before any decision is taken, and we do not make such decisions on a solely automated basis.

7. Cookies

VEV websites and digital services may use cookies and similar technologies to distinguish users, operate securely, remember preferences and, where permitted, measure usage. Information about the cookies we use, their purposes, duration and recipients is set out in our Cookie Policy.

8. Marketing and event communications

From time to time, VEV may invite business contacts to events or send information that may be relevant or of interest to you in a professional capacity. Individuals may object to direct marketing at any time by contacting privacy@vev.com.

9. Who we share personal data with

9.1 Within VEV

VEV may share personal data with VEV entities where necessary for the purposes described in Section 5 of this notice, including centralised or shared functions such as IT, finance, Legal and Compliance, HR, treasury, risk, audit and corporate governance, for the management of our commercial relationships, for risk and exposure management and for regulatory reporting. Access is limited according to role, purpose and need to know.

9.2 Outside VEV

VEV may engage third parties to perform business functions such as IT support, hosting and cloud services, KYC and sanctions screening, background and credit checks, recruitment, event management, communications, physical security and travel management. Where a third party acts as processors on our behalf, VEV will ensure appropriate contractual, organisational and security measures are in place.

VEV may also share personal data with independent controllers, including:

10. International transfers

Personal data collected in the EEA, or the United Kingdom may be transferred to, stored in or processed in other countries where VEV entities, personnel or service providers or their staff operate. We take all steps reasonably necessary to ensure that personal data is treated securely and in accordance with this notice.

VEV will transfer personal data outside the EEA or the UK only where an applicable transfer mechanism or exception is available, which may include:

Where we rely on appropriate safeguards, we assess the level of protection in the destination country and put in place any additional measures needed to ensure your data remains adequately protected.

11. How we keep personal data secure

VEV will implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage. These measures may include encryption, access controls, multi-factor authentication, vulnerability management, service-provider due diligence, incident-response procedures, disaster-recovery arrangements and staff training, as appropriate to the risk and VEV’s actual control environment.

In the event of a personal data breach, VEV will assess the risk to individuals and take appropriate containment, investigation and remediation steps. Where required by applicable law, VEV will notify the competent supervisory authority and affected individuals within the applicable legal timeframes.

12. How long we keep personal data

VEV keeps personal data only for as long as reasonably necessary for the purposes for which it was collected, including compliance with legal, regulatory, tax, accounting, reporting, contractual and dispute-management requirements.

When determining retention periods, VEV considers the nature, sensitivity and volume of personal data; the purpose of processing; potential harm from unauthorised use or disclosure; applicable legal tax, accounting, reporting and regulatory obligations; contractual requirements; and relevant legitimate interests.

At the end of the applicable retention period, VEV will securely delete, destroy or anonymise personal data, subject to applicable law and technical constraints. Where data has been anonymised so that it can no longer be associated with you, we may continue to use the anonymised information without further notice to you.

13. Your rights

Subject to the conditions, exemptions and limitations of applicable data protection law, you have the following rights in respect of the personal data we hold about you. Please note that your ability to exercise these rights may be limited in circumstances where we are obliged to retain certain data.

We will respond to any request without undue delay and in any event within one month of receipt, extendable by a further two months for complex or numerous requests (in which case we will inform you of the extension within one month). We do not generally charge a fee, save where requests are manifestly unfounded or excessive.

To exercise your rights, please contact privacy@vev.com. We may ask you for additional information to confirm your identity before responding. If any of the personal data you have provided to us changes, or you believe something we hold about you is incorrect, please let us know without delay.

To help us deal with your request as quickly as possible, please tell us as clearly as you can which personal data your request relates to (for example by reference to a date range, a specific VEV entity or a specific business interaction). Where you wish to update or correct personal data we hold about you, please first check whether the relevant information can be updated directly (for example through any account or registration portal you may have with us).

14. Right to lodge a complaint

VEV encourages individuals to raise privacy concerns with VEV first so that they can be addressed. However, this does not affect the right to lodge a complaint at any time with a competent supervisory authority.

15. Children

VEV websites and services are not directed to , or intended for use by, children under the age of 16, or such lower age as Member State law permits (e.g. 13 in the United Kingdom). If you believe we have inadvertently collected personal data of a child, please contact privacy@vev.com and we will take appropriate steps.

16. Changes to this Privacy Notice

VEV may update this Privacy Notice from time to time to reflect changes in processing activities, organisational structure or applicable law. The effective date and version will be updated when a revised notice is issued.

17. Contact

For further information or to discuss a concern, please contact privacy@vev.com.