Privacy notice | NICKOLDS

Nickolds IO Limited

Last updated: 22 September 2026

This privacy notice (notice) explains how we, Nickolds IO Limited, a company registered in England and Wales with company number 17408693 and registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (we, us, our) process your personal data if you use our website, services or otherwise engage with us online or offline.

If you have any questions about your data protection rights or if you do not understand anything explained in this notice, please contact us by email at [email protected].

1. WHO DOES THIS PRIVACY NOTICE APPLY TO?

This notice applies to:

our clients
our partners and suppliers
job applicants
users of our website, services and online content
if you call, email or visit us or otherwise engage with us online or offline.

This notice applies to you if you act in your personal capacity, for example, as an individual client of our services, and if you act in your professional capacity, for example, as an employee or agent of a corporate client or supplier.

2. WHAT TYPES OF PERSONAL DATA DO WE PROCESS?

“Personal data” means any information that identifies you or relates to you.

This may include your contact details, information about your engagement with us, online behavioural data, and other information as set out in the "categories of personal data" section below.

3. DATA ACCURACY

We take reasonable steps to ensure that the personal data we hold is accurate and, where necessary, kept up to date. This includes updating our records where we become aware that information is inaccurate or has changed.

In many cases, we rely on the information provided to us by you or on your behalf, and we ask that you let us know if any of your personal data changes or is inaccurate. We may also obtain personal data from public sources, third parties and other organisations, and will take reasonable steps to ensure that such information is accurate and kept up to date where appropriate.

4. HOW IS YOUR PERSONAL DATA COLLECTED?

We may collect your personal data as follows:

From you, when you contact us, complete our identity verification and know-your-client processes, during your engagement with us as our client, partner or supplier, when you visit our offices by appointment or otherwise deal with us.
From your online user interactions with our website, content and features.
From the public domain and third parties, such as your employer who may provide your professional details, recruitment agencies, your referees, social media platforms, the internet and other public records and third parties. We will receive personal data about you from various third parties and public sources:
- Contact, General, Financial and Client File information may be provided from clients' existing providers, such as banks, custodians, investment managers, trustees, advisers and other providers.
- Contact information is collected from publicly available sources such as Companies House and other government websites and the Electoral Register.

If you provide information about others, please ensure you have their consent to do so (where required by law) or let us know if you do not.

5. WHY DO WE PROCESS YOUR PERSONAL DATA?

On some occasions, we process your data with your consent (e.g., when you ask us to send you information about our services).

On other occasions, we process your data when we need to do this to fulfil a contract with you (e.g., to provide you with our services) or where we are required to do this by law (e.g., to comply with our accounting obligations). If it is mandatory for you to provide data for these purposes and you do not provide the data, then we may not be able to provide the relevant service to you.

We also process your data when it is in our legitimate interests to do this and when these interests are not overridden by your data protection rights. For example, we have a legitimate interest in ensuring the security and integrity of our website, in learning about the interests and preferences of current and prospective clients, in developing new business opportunities, in maintaining accurate business records, and in ensuring that our website operates effectively. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We do not routinely seek special categories of personal data from clients as part of our normal onboarding or services, although we may occasionally receive such information incidentally within documents or communications supplied by you, your advisers, providers or other sources.

Where we process special categories of your personal data, we will only do so where we have an appropriate lawful basis under Article 6 UK GDPR and a condition for processing under Article 9 UK GDPR. Depending on the circumstances, this may include where the processing is necessary for the establishment, exercise or defence of legal claims, compliance with legal obligations, or where you have provided your explicit consent.

We will only retain and process such information to the extent necessary for the relevant purpose and in accordance with our data retention practices.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of the ways we plan to use the various categories of your personal data. We have also identified what our legitimate interests are where appropriate.

The "lawful basis" column explains how we comply with a technical legal justification for data processing under the UK GDPR.

Purpose	Personal data	Lawful basis of processing
To assist with your enquiry.	general information contact information	Necessary for our legitimate interest in responding to enquiries and complying with best practice or, as the case may be, necessary for taking steps prior to entering into a contract or the performance of our contract with you.
To onboard you as a client, including conducting identity and know-your-client checks, and conducting sanctions screening	general information contact information financial information background information client file information	Performance of a contract with you, if you are an individual client, or necessary for our legitimate interests in fulfilling our contractual obligations to our corporate clients and verifying the identities of our clients, and complying with our legal obligations. Where our onboarding, sanctions screening or other due diligence activities result in our processing personal data relating to criminal convictions or offences, we process such information where necessary for our legitimate interests in verifying the identities of our clients, and for reasons of substantial public interest, including the prevention and detection of unlawful acts and the prevention of fraud.
To provide our services to you including collecting and recovering money owed to us.	contact information general information financial information client file information special categories of personal data	Performance of a contract with you, if you are a personal client, or necessary for our legitimate interests in fulfilling our contractual obligations to our corporate clients, and for recovering debts due to us. Where we occasionally or incidentally process special categories of your personal data, we will only do so where we have an appropriate lawful basis under Article 6 UK GDPR and a condition for processing under Article 9 UK GDPR. Depending on the circumstances, this may include where the processing is necessary for the establishment, exercise or defence of legal claims, compliance with legal obligations, or where you have provided your explicit consent.
To provide our online services including our website, content and features to you and the general public which may remember your preferences or include personalised content and services.	technical information usage information	Necessary for our legitimate interest in providing our website to the public and complying with best practice, the performance of our contract with you as our client and compliance with our legal obligations. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services.
To manage our relationship with you, including sending you service communications about matters relevant to your use of our services and your engagement with us, and other feedback requests and contacting you by phone, email and other means.	general information contact information	Necessary for the performance of our contract with you and our legitimate interest in keeping our records updated, managing our relationship with you or your employer, and understanding how our services are used, views about our services and keeping our users informed.
To send you relevant marketing communications	contact information general information, limited to what is necessary and proportionate	Consent where required under applicable electronic marketing rules, including where the recipient is an individual subscriber and the soft opt-in does not apply. Where the soft opt-in is available for individual subscribers, or where the recipient is a corporate subscriber, our processing is necessary for our legitimate interest in promoting our organisation.
To use limited information derived from client engagements to create genuinely anonymised or aggregated benchmarking, analysis and service development outputs, provided the resulting outputs do not identify any client or individual	Client file information and other relevant categories of personal data described above, limited to what is necessary and proportionate and used only to produce anonymised or aggregated outputs.	Necessary for our legitimate interests in improving our services, developing benchmarking and analytical outputs, and understanding trends across our work, subject to safeguards to ensure the resulting outputs do not identify any client or individual.
To assess your job application and for business administration purposes. For example, if you apply for a job, we will review your CV, publicly available information about you, information from your previous employers and professional references	contact information general information public information special categories of your personal data background information	Necessary for our legitimate interest in considering applications, responding to queries and, as the case may be, necessary for taking steps prior to entering into a contract. Special categories data may be processed as is necessary in the context of employment and social security laws.
To develop and improve our information, services, content and features and organisation and development of our internal processes.	usage and technical information, aggregated, anonymised and/or pseudonymised where applicable	Necessary for our legitimate interest in service and process development and keeping our offering relevant. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services.
To ensure the proper administration of our organisation, including to: keep appropriate records; resolve complaints; enforce our terms; debt collection; and similar purposes.	the relevant categories of personal data described above, limited to what is necessary and proportionate	Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims and necessary for our legitimate interest in the proper administration of our organisation and services and protecting our reputation.
To ensure information security of our information systems, website, premises, meetings and communications	general information security information background information	Necessary for our legitimate interest in ensuring the security of people, our organisation and assets and compliance with our contractual obligations, and as necessary for compliance with our legal obligations.
To ensure your health and safety at any premises we utilise and to make reasonable adjustments for job applicants	general information special categories of personal data	Necessary for our legitimate interest in ensuring health and safety and good accessibility at our premises in the substantial public interest and complying with our legal obligations.
To engage our third-party service providers and advisors who may process your personal data on our behalf or otherwise to facilitate the provision of our services and the fulfilment of essential service functions including cloud storage, telecommunications, information security, professional advice and other services.	the relevant categories of personal data described above, limited to what is necessary and proportionate	Necessary for our legitimate interest in providing our services and running our organisation.
To monitor interactions and operations for the prevention and detection of crime including fraud and share information with law enforcement authorities and other stakeholders.	the relevant categories of personal data described above, limited to what is necessary and proportionate	Necessary for our legitimate interest in protecting people, our organisation and assets and detecting and preventing crime, and compliance with our legal obligations.
To share data with another organisation in accordance with the law for the purposes of a joint venture, collaboration, merger or acquisition.	the relevant categories of personal data described above, limited to what is necessary and proportionate	Necessary for our legitimate interest in undertaking and managing strategic business opportunities, and complying with our legal obligations.
Processing and sharing your personal data in connection with legal claims, law enforcement or regulatory requests.	the relevant categories of personal data described above, limited to what is necessary and proportionate	Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims or for our legitimate interest in complying with best practice.

We may process your personal data for other purposes which are compatible with the existing ones. However, we will obtain your prior consent for any new purpose where required by law.

Direct marketing

We may send you marketing communications where permitted by applicable electronic marketing rules.

Where you are an individual subscriber, we will generally need your consent unless the soft opt-in applies. The soft opt-in may apply where we obtained your contact details in the course of a sale or negotiation for our services, our marketing relates to similar services, and you were given a clear opportunity to opt out when your details were collected and in each subsequent message.

Where you are a corporate subscriber, we may send business-to-business marketing communications subject to applicable opt-out requirements. You can opt out of marketing at any time.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you, or contacting us by email using the details set out in section 14.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example appointment reminders, updates to our Terms and Conditions, and checking that your contact details are correct.

6. WHO IS YOUR PERSONAL DATA DISCLOSED TO?

We may share your personal data with the following third parties:

Our group companies
Your existing and prospective providers, such as banks, custodians, investment managers, trustees, advisers and other providers where we are authorised to do so and it is necessary for providing our agreed services
Our service providers in the context of the services and advice they provide to us, including our third-party cloud, technology, AI and professional services providers
Your employer, who may need information about your interactions with us
Our professional advisers, including our legal advisers and our accountants
Tax, law enforcement and other authorities where required by law or best practice
The public if you interact with us on social media
Third parties where ordered by the court or necessary in establishing, exercising or defending legal claims
Another organisation in case of a merger, acquisition or collaboration
Other third parties where you have provided consent, or as otherwise disclosed at the time of collection.

Where these organisations process your personal data on our behalf, it will be on the basis that these organisations are required to keep the information confidential and secure, and that they will only use the information to carry out the instructed services. Some of these organisations may be located outside the UK or the list of countries deemed by the UK to provide adequate level of protection. Any transfer of your personal data to those organisations will be subject to appropriate safeguards such as the standard data protection clauses approved by the UK ICO which are available from the ICO website www.ico.org.uk.

7. HOW DO WE SECURE YOUR PERSONAL DATA?

We have put in place appropriate organisational and technical measures designed to safeguard your personal data that we keep on premises and on our systems. Access to your personal data is restricted on a "need to know" basis.

We seek to ensure our third-party service providers do the same. We appoint service providers only under an appropriate contract who provide sufficient guarantees about data security in accordance with applicable law.

As effective as modern security practices are, we cannot guarantee the complete security of personal data held in our systems, nor that information you supply through the internet or any network is entirely safe from unauthorised intrusion, access or manipulation during transmission. Any transmission is at your own risk. We will deal with any personal data breach in accordance with our incident response procedure and will notify you and the regulator where we are legally required to do so.

8. HOW LONG IS YOUR DATA KEPT?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of maintaining business records and satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

After the retention period, your personal data will either be securely deleted, anonymised and/or aggregated, provided that you cannot reasonably be identified from that data.

We may retain and use anonymised or aggregated data for our own internal business purposes, including analysis, benchmarking, service improvement, product development and operational reporting, provided that such data does not identify the Client or any individual.

9. WHERE WE STORE YOUR PERSONAL DATA

Generally, your personal data will be held in the UK.

Where we use tools which require the transfer of your personal data outside the UK or any country deemed by the UK authorities to provide an adequate level of protection, we will only make the transfer where we are satisfied that your data protection rights are adequately protected. We will put in place appropriate technical, organisational and contractual safeguards in accordance with applicable data protection laws before any such transfer. These safeguards may include the standard data protection clauses.

You may request further information on the measures used for the international transfers or access to your personal data.

10. THIRD PARTY WEBSITES

Our website may contain links to other websites not operated by us. These other websites may collect personal information about you in accordance with their own privacy notice and cookies policy. We cannot accept any responsibility for the privacy practices or content of those websites.

11. YOUR RIGHTS

You have the right to request a copy of the information we hold about you. If you would like a copy of some or all of your personal information then please write to us at our registered address (provided above) or email us at the address below (see section 14).

Subject to certain exemptions and conditions, you may also have the following rights in relation to your personal data:

Right to information about matters set out in this notice. You may also contact us for further details about our data retention policies, international data transfers and other matters that are unclear.
Right to rectification of any inaccurate or incomplete personal data.
Right to withdraw consent previously provided.
Right to opt-out or object to our processing of personal data based on our legitimate interests.
Right to erasure of personal data that is no longer needed.
Restriction on the processing of personal data.
Rights relating to significant decisions based solely on automated processing in respect of any decision based solely on automated processing, including profiling, which produces legal effects for you or similarly affects you. Where applicable, you may have the right to be given information about the decision, make representations to us, obtain human intervention and contest the decision.
Right to data portability from one service provider to another, where applicable.
Right to lodge a complaint if you have a complaint about how we have handled your personal data or responded to your data protection rights, please contact us using the details set out in section 14 below. We will acknowledge your complaint within 30 days, investigate it fairly and respond without undue delay. If you remain dissatisfied, you may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/data-protection-complaints/.

If you wish to exercise any of the rights set out above, please contact us as set out below.

All data subject rights requests will be processed without undue delay and no later than within one month, subject to the permitted extension of up to a further two months where applicable. If we cannot respond to your request within one month, we shall explain why and process it as soon as possible thereafter. We may, where appropriate, first require appropriate proof of your identity. Your data rights are not absolute and they are subject to exemptions and limitations under applicable data protection laws.

12. THIRD PARTIES MAY PROCESS YOUR PERSONAL DATA

Our website, content and features may involve the use of third-party services, social media platforms or other third-party services.

We may also share your personal data with third parties, such as public authorities and others who process your personal data for their own purposes.

You should check the privacy statements of these third parties, and we are not responsible for how they may process your personal data. Please note some of them may use your personal data for business administration or product development purposes.

13. AUTOMATED DECISION MAKING

We may use artificial intelligence and other automated tools to support our services and internal operations to assist our personnel and improve efficiency and accuracy.

We do not currently make decisions that produce legal effects concerning individuals, or similar significant decisions, based solely on automated processing. Any material conclusions, recommendations or outputs are subject to meaningful human review and oversight before they are relied or acted upon.

14. OUR CONTACT DETAILS

If you have any queries or complaints in relation to our processing your personal data please contact us at [email protected].

Nickolds IO Limited is the data controller. It is registered in England and Wales with company number 17408693, its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, and it is registered with the Information Commissioner’s Office under registration number 00015325701.

15. CATEGORIES OF PERSONAL DATA

We process the following categories of personal data about you:

Client file information	including circumstances of your matters, records of communication including voicemails, services provided, documents produced or shared with us by you, your other advisers, and similar information on our client files.
Contact information	including your home or business address, telephone, email and similar information.
Financial information	including your bank details, payment details, VAT and other tax information, assets, liabilities, billing address and similar information.
General information	including your name, job function, gender, date of birth, age bracket, passport or national identity card details, tax status, countries of domicile and residence, immigration status, image, details of your enquiry or communication and similar information.
Public information	from public registers, databases, social media, the Internet and similar sources.
Security information	including logs, network monitoring and logging data, antivirus scan and similar information.
Special categories of personal data	including your race, ethnic origin, religious or philosophical beliefs, sexual orientation, political or trade union affiliation and information about your health.
Technical information	including online identifiers, device ID, internet protocol (IP) address, details of operating system and platform, browser and plug-in type and version, language, time zone setting, location, date and time of access, local storage data and similar information obtained from your device, browser, an API or similar source.
Usage information	about how you navigate and engage with our online services, newsletters and marketing communications, features including online activity data.
Your background information	including personal, contact, professional and financial information obtained from you, public sources and third parties, your general information, public information and background information obtained from third parties such as identity verification information, sanctions and politically exposed person screening results, know-your-client and other onboarding, risk and other due diligence information and similar information. Where sanctions screening, adverse media checks or other due diligence activities result in our receipt of personal data relating to criminal offences or alleged offences, we may process that information where permitted by applicable data protection laws.

16. UPDATES TO THIS NOTICE

If we make any changes to our notice, you will be able to see them on this page, as indicated by the “Last updated” date at the top. We encourage you to visit this page periodically to learn of any updates.

If any such changes materially affect you, we will ask for your prior consent where we are required to do so by law.