Sable International
privacy policy 

We operate a joint-controller system within the Sable International company group. This means that the data controller in respect of the processing of your personal information shall be us (Sable International Group Limited) together with any other of our group companies which are directly involved in the provision of services to you.

• When you provide it to us (e.g. by contacting us using our online contact form on our website, by making enquiries by email, telephone, letter or in person, by signing up to our e-newsletter).
• When you provide it directly to any of our group companies (e.g.by making enquiries by email, telephone, letter or in person)
• From your use of our website, using cookies and similar technologies, and
• Occasionally, from third parties.

Name, contact details, payment information (e.g. your credit or debit card details, IP address, information from cookies, information about your computer or device (e.g. device and browser type), information about how you use our website (e.g. which pages you have viewed, the time when you view them and what you clicked on, the geographical location from which you accessed our website (based on your IP address), company name or business name (if applicable), VAT number (if applicable), and identity-checking information such as passport number, national insurance or social security numbers.

In addition to the above, we also collect further information where you order specific services from us such as account numbers, financial history or records, credit-checking information, family tree information, medical information and criminal conviction information.

For administrative purposes (particularly group-wide record keeping), business purposes (particularly to contact you and process any requests or orders you place on our website), to improve our business and website, to fulfil our contractual obligations such as to provide you with any services you order, to advertise our services, for internal analysis of data (including profiling and reporting on use of our websites), and in connection with our legal rights and obligations.

We share information you provide us with our other group companies in order to provide you with the services you request, to fulfil our contractual obligation, and to advertise our services. Our group companies also share some of your personal information with us for our internal administrative and business purposes such as processing payments record keeping and sending out our e-newsletter.

Only to the extent necessary to run our business, to our third-party service providers, to fulfil any contracts we enter into with you and where required by law or to enforce our legal rights.

No.

For no longer than necessary, taking into account any legal obligations we or any of our group companies have (e.g. to maintain records for tax purposes), any other legal basis we have for using your information (e.g. your consent, performance of a contract with you or our legitimate interests as a business), the period of time within which claims may be filed in connection with the performance of our services, and certain additional factors described in the main section below entitled How long we retain your information. For specific retention periods in relation to certain information which we collect from you, please see the main section below entitled How long we retain your information.

Using appropriate technical and organisational measures such as storing your information on secure servers, encrypting transfers of data to or from our servers using Secure Sockets Layer (SSL) technology, encrypting payments you make on or via our website using Secure Sockets Layer (SSL) technology, only granting access to your information where necessary, only sharing within the Sable group the information necessary to perform our business functions or administer our business, encryption of personal data, encrypted email, pseudonymisation and/or anonymisation of information collected electronically from cookies or similar technologies, storing your information within the European Economic Area where possible (or subject to approved technical and organisational safeguards where this is not possible) and keeping within any group company service provider information which is only needed by that particular company.

We use cookies and similar information-gathering technologies such as web beacons on our website including essential, functional, analytical and targeting cookies. For more information, please visit our cookies policy here.

In certain circumstances we transfer your information outside of the European Economic Area, including to the following countries: South Africa, Australia, the United Kingdom and the United States of America. Where we do so, we will ensure appropriate safeguards are in place, including the third parties we use who transfer your information outside the European Economic Area have self-certified themselves as compliant with the EU-U.S. Privacy Shield, the relevant third country is subject to an adequacy decision, or the receiving entity is bound by the standard contractual clauses for transfer of personal data outside the EEA (‘SCCs’).

We use automated decision making and/or profiling, including through our use of web analytics, cookies, web beacons or server logs analysis tools (profiling), through our use of targeting cookies to display advertisements to people who visit our website from other websites around the internet (e.g. using the Google AdSense network) (automated decision making). The companies within the Sable group also use profiling and/or automated decision making when deciding whether we are able to provide you with our professional services, such as when undertaking identity checks, anti-money-laundering and know-your-customer checks, as well as when checking your scores with credit-referencing agencies.

• To access your information and to receive information about its use."
• To have your information corrected and/or completed.
• To have your information deleted.
• To restrict the use of your information.
• To receive your information in a portable format.
• To object to the use of your information.
• To withdraw your consent to the use of your information.
• Not to have significant decisions made about you based solely on automated processing of your information, including profiling.
• To complain to a supervisory authority.

We may occasionally collect what is commonly referred to as ‘sensitive information’ when you provide us with medical information relevant to any inheritance, wills or estate-planning services you request, in which case we do so strictly on the basis of your explicit consent. We do not otherwise process sensitive information, and do not otherwise submit sensitive information about you to us. For more information, please see the main section below entitled Sensitive Information.

The data controller in respect of our website www.sableinternational.com, and the primary data controller in respect of the whole Sable International corporate group is Sable International Group Limited. ‘Sable International’ is a trading name of Sable International Group Limited. Our company registration number is 03635405 and our registered address is at 5th Floor, 18 St. Swithin's Lane, London, EC4N 8AD. The data controller is the person which determines the purposes and means of processing your information. You can contact the data controller by writing to 5th Floor, 18 St. Swithin's Lane, London, EC4N 8AD or sending an email to info@sableinternational.com or via the contact form on our website.

We operate a joint-controller arrangement within the Sable group. This means that in most situations, two or more of our group companies together are jointly responsible for deciding how your personal information will be processed.

When you begin to engage one of the Sable International group companies to provide services to you, the joint data controllers in respect of your personal information shall be both (i) us, Sable International Group Limited and (ii) the company which you engage to provide the services. If you engage multiple companies from our group to provide additional services to you, each service provider shall be a joint controller in respect of your personal information.

The data protection officer for the data controller is Mr Gary Kockott. You can contact the data protection officer by writing to Gary Kockott, Regent Square, Doncaster Road, Kenilworth, 7708, South Africa or sending an email to gary.kockott@sableinternational.com.

If you have any questions about this Privacy Policy, please contact the data controller.

We collect information about you when you provide it to us, such as through your use of our website and its features, when you contact us directly by email, phone, in writing, or via social media, when you order goods and services, when you use any of our other websites or applications or any other means by which you provide information to us.

The types of information we collect about you which we collect either from our website or which is relevant to the majority of the services we provide includes information such as:

• your first, middle and last names;
• your email address;
• your home address
• your mobile phone number;
• your landline number;
• your payment information (e.g. your credit or debit card details) when you order services;
• your IP address;
• information about your browsing device (e.g. device and browser type);
• information about how you use our website (e.g. which pages you have viewed, the time you viewed them and what you clicked on);
• cookies and similar technologies;
• information about your mobile device (such as your geographical location);
• a list of our services which you are interested in;
• your business and company information (including company name, number and registered address); and
• your VAT number (or your business’s VAT number).

The types of specific additional information we collect about you in order to provide certain specific services to you includes information such as:

• financial information such as account identification numbers, sort codes, IBAN and SWIFT numbers;
• information about any property or other tangible assets you own;
• details of previous bank accounts you have held;
• previous addresses in which you have lived during the last 20 years;
• information about your family members and your family tree (in the case of estate planning, wills and inheritance services);
• health and medical information (only to the extent that it is relevant to estate planning, wills and inheritance services);
• any criminal convictions (in the case of visa/immigration applications);
• credit-referencing information (for financial products involving credit);
• information relating to your current and previous employment;
• information about any companies in which you hold share capital;
• copies of your passport, driving licence or other identity card (for identity checks); and
• scans of legal documents bearing your name or relating to assets you own such as title deeds, court documents, employment contracts, statutory declarations, other official documents, including, without limitation, visa or citizenship application forms, share certificates, credit notes, debentureshich or other legal securities you may hold or which are effective against assets you own, birth or death certificates of yourself or your relatives and marriage register entries, inter alia.

Cookies are data files which are sent from a website to a browser to record information about users of a website.

We use cookies and similar technologies on or via our website.

You can reject some or all of the cookies we use on or via our website by changing your browser settings, but doing so may impair your ability to use our website or some or all of its features. For further information about cookies, including how to change your browser settings, please visit www.allaboutcookies.org.

We use Google Analytics on our website to understand how you engage and interact with it. For information on how Google Analytics collects and processes data using cookies, please visit www.google.com/policies/privacy/partners/. You can opt out of Google Analytics tracking by visiting: www.tools.google.com/dlpage/gaoptout. We use web beacons in our marketing emails and/or on our website. For information on how third parties use information gathered from our use of web beacons, please visit https://pixel.facebook.com/about/privacy/, www.iubenda.com/privacy-policy/83631461/cookie-policy and www.mailchimp.com/legal/privacy/. Some (but not all) browsers enable you to restrict the use of web beacons by either preventing them from sending information back to their source (e.g. when you choose browser settings which block cookies and trackers) or by not accessing the images containing them (e.g. if you select a “do not display images (in emails)” setting in your email server).

We use Facebook Pixel on our website to monitor and measure the success of our advertisements. For information on how Facebook collects and processes data using Facebook Pixel, please visit www.facebook.com/about/privacy. You can block Facebook Pixel by visiting www.youronlinechoices.com, selecting your country, clicking “Your Ad Choices”, then locating Facebook and selecting the “Off” option.

We do receive information about you from third parties. The third parties from whom we receive information about you will generally include your previous financial service providers, your employer, and occasionally your family members, trustees and/or beneficiaries (in the case of wills, inheritance and estate planning).

It is also possible that third parties with whom we have had no prior contact may provide us with information about you.

Information we obtain from third parties will generally be your name and contact details, but will include any additional information about you which they provide to us.

Legal bases for processing

Where a third party has passed on information about you to us (such as your name and email address) in order for us to provide services to you, we will process your information in order to take steps at your request to enter into a contract with you and perform a contract with you (as the case may be).

Where you have asked a third party to share information about you with us and the purpose of sharing that information is not related to the performance of a contract or services by us to you, we will process your information on the basis of your consent, which you give by asking the third party in question to pass on your information to us.

Where a third party has shared information about you with us and you have not consented to the sharing of that information, we will have a legitimate interest in processing that information in certain circumstances. For example, we would have a legitimate interest in processing your information to perform our obligations under a sub-contract with the third party, where the third party has the main contract with you. Our legitimate interest is the performance of our obligations under our sub-contract. Similarly, third parties may pass on information about you to us if you have infringed or potentially infringed any of our legal rights. In this case, we will have a legitimate interest in processing that information to investigate and pursue any such potential infringement.

In certain circumstances (for example, to verify the information we hold about you or obtain missing information we require to provide you with a service) we will obtain information about you from certain publicly accessible sources, both EU and non-EU, such as the electoral register, Companies House, online customer databases, business directories, media publications, social media, and websites (including your own website if you have one).

In certain circumstances will also obtain information about you from private sources, both EU and non-EU, such as credit-referencing agencies around the world, and in particular, Experian, Equifax and TransUnion in the United Kingdom.

Legal bases for processing

Where you have entered into a contract or requested that we enter into a contract with you, in certain circumstances, we will obtain information about you from public sources in order to enable us to understand your business and provide services to you or services to a sufficient standard. For example, we would obtain and/or verify your email address from your website or from a directory where you ask us to send you information by email but we do not possess the information or we need to confirm that we have recorded your email address correctly.

In certain circumstances, we will have a legitimate interest in obtaining information about you from public and private sources. For example, if you have infringed or we suspect that you have infringed any of our legal rights, we will have a legitimate interest in obtaining and processing information about you from such sources in order to investigate and pursue any suspected or potential infringement. We may also obtain data brokers to market to you under our legitimate interest of direct marketing.

• Improving our website and business, including personalising our website and services for you and other customers. This is necessary for our legitimate interest of better understanding our other customers’ and potential customers’ preferences and tailoring our website, products and services to their needs, preferences and desires.
• Communicating directly with you with information, updates and changes to our website and in response to enquiries we receive from you. This is necessary for our legitimate interests of informing you about changes to our business, website and privacy policy and responding to enquiries we receive from you.
• To supply you with Sable’s e-newsletter bulletin where you have signed up to this. This is on the basis that you have provided your specific consent to receive Sable’s e-newsletter bulletin from time to time by email.
• Protecting our business and our business interests, including for the purposes of credit and background checks, fraud and website misuse prevention and debt recovery. This is necessary for our legitimate interests of preventing criminal activity such as fraud or money laundering, for ensuring that our website and services are not misused. Where we carry out credit and background checks, we will only carry out such checks to the extent that we are permitted or authorised by law to do so and to the minimum extent necessary.
• Communicating with our business advisors and legal representatives. This is necessary for our legitimate interests of obtaining legal or professional business advice. In such circumstances, we will only share your information where it is necessary to do so, to the minimum extent necessary, subject to appropriate confidentiality restrictions and on an anonymised basis wherever possible.
• Within the Sable corporate group from time to time for internal administrative purposes, including client, customer and employee information. This will be necessary for our legitimate interest of running and managing our business. Where you have purchased goods or services from us or asked us to take certain actions to enter into a contract with you, this will be necessary for us to perform a contract with you or take steps at your request to do so.
• Sharing your information with third parties which are either related to or associated with the running of our business (including to third parties within our corporate group from time to time) such as our business partners, insurers, affiliates, associates, suppliers, independent contractors (including our third party advisors such as accountants, lawyers and notaries), email providers, IT and web development service providers and any contract counterparties involved in transactions you have asked us to perform for you. We will share your information with these parties where it is necessary for our legitimate interest of running and managing our business effectively, fulfilling our contractual obligations (e.g. to our insurers) or for our own direct marketing purposes. Where you purchase goods or services from us or request that we take steps to do so, we may also need to share your information with such third parties in order to perform a contract which we have entered into with you or to take steps, at your request, to enter into a contract with you. Where we share your information with such third parties, we will do so strictly on a need-to-know basis, subject to appropriate confidentiality restrictions, on an anonymised basis as far as possible and only to the extent strictly necessary for any of these purposes.
• Processing or passing on your information to third parties, such as foreign exchange agents and payment service providers, including Mastercard, Judopay, GoCardless and Barclaycard in order to process your payments for the services you order from us. This is necessary for us to perform a contract we have entered into with you (or to take steps, at your request, to enter into a contract with you) and for that third party’s legitimate interest in processing your payment(s) for the services you order from us.
  • You can access the privacy policy of Mastercard here: https://www.mastercard.co.uk/en-gb/about-mastercard/what-we-do/privacy.html..
  • o You can access the privacy policy of Judopay here: https://www.judopay.com/privacy-notice/privacy-policy/.
  • You can access the privacy policy of GoCardless here: https://gocardless.cdn.prismic.io/gocardless/8f3a48d1-7aa6-4985-8a57-2f6435b33184_GoCardless+Privacy+Notice+v2019.10.12.pdf
  • You can access the privacy policy of Barclays Bank PLC here: https://www.barclaycard.co.uk/personal/privacy-policy
• Ensuring physical, network and information security and integrity. This is necessary for our legitimate interest of ensuring that our IT systems and networks are secure and uncompromised, including, for example, preventing malware, viruses, bugs or other harmful code, preventing unauthorised access to our systems, and any form of attack on, or damage to, our IT systems and networks.
• To send you marketing communications. This is necessary for our legitimate interest of direct marketing and promoting our business. Where we are required by law to obtain your consent to market to you, however, the legal basis on which we process your information will be your consent rather than our legitimate interests.

• Providing statistical information to third parties such as Google Analytics, Olark, Facebook, Microsoft and CrazyEgg. This is necessary for our and third parties’ legitimate interests of processing information for research purposes, including market research, better understanding our respective customers, and tailoring our respective products and services to their needs. Your information will be shared with such parties on an anonymised basis.
• Displaying advertisements to you and analysing the information we receive in relation to those advertisements. This is necessary for our own and for third parties’ legitimate interests in direct marketing and advertising our and their products and services respectively, and for market research purposes.

• Enforcing our legal rights. This is necessary for our legitimate interest of protecting our business and enforcing our contractual and other legal rights.
• Indicating possible criminal acts or threats to public security to a competent authority. This is necessary for our legitimate interest of promoting the success of our business, preventing crime, for compliance with a legal obligation to which we are subject, in the general public interest or for the legitimate interests of governmental bodies and competent authorities that prevent crime.
• In communication with any of our professional regulators. This is necessary for our legitimate interest of compliance with a legal obligation to which we are subject and in the general public interest.
• In connection with any legal or potential legal dispute or proceedings. This is necessary for our legitimate interest of promoting and ensuring the success of our business, resolving disputes and making such disclosures as are required by law or which we consider, acting reasonably, are required by law.
• Complying with laws, regulations and other legal requirements. We may need to use and process your information in order to comply with legal obligations to which we are subject. For example, we may require your information pursuant to a statutory obligation to conduct anti-money-laundering checks or to disclose your information to a court following receipt of a court order or subpoena. We may also need your information to comply with ongoing legal obligations, such as tax laws and regulations to which we are subject (where you have placed an order for goods or services with us for example).

The processing of your information to comply with legal obligations to which we are subject applies to legal obligations of other countries where they have been integrated into the legal framework of the United Kingdom, for example in the form of an international agreement which the United Kingdom has signed. Where the legal obligations of another country have not been so integrated, we will process your information to comply with such obligations where it is in our legitimate interest to do so.

Where we process your information on the basis of your consent, you can withdraw your consent to such processing at any time by emailing us at info@sableinternational.com or writing to us at Sable International, 5th Floor, 18 St. Swithin's Lane, London, EC4N 8AD

We use automated decision-making, including profiling. Automated decision-making is decision-making by technological means (i.e. by a machine) without human involvement. Profiling is any form of automated processing of your information to evaluate personal aspects about you, in particular to analyse or predict things like your performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

We automate some of our decision-making and profiling functions in order to improve the efficiency of our business, to expedite the delivery of any orders placed by you, to improve the consistency with which we deliver our products or services, to reduce our administrative costs, to update our records, to organise our customer database to improve the services we offer you, to monitor your interaction with our business, to evaluate the viability of any services you have requested and to undertake identity checks and credit checks.

This is important because it means that many actions and decisions we take (such as whether we enter into a contract with you, the amount of any credit we are able to offer you, or the storage, use and transfer of your information, as well as specific communications that we may send you) are performed automatically by machines and algorithms rather than humans.

Your information will be used by these systems to determine how we interact with you, and also to collect aggregate anonymised data relating to our collective customer base. This is significant because the outcome of your interactions with us will in certain circumstances be based on the information you provide to us (and information we receive from third parties) and not the choices of any individual. Depending on the outcome of the automated decision making or profiling activity, we may not be able to offer you certain services

You have the right to request that we do not use automated decision-making in relation to your information by emailing us at info@sableintrenational.com.

Server log information: we retain information on our server logs for two (2) years.

Service information: when you engage us to provide our services, we retain that information for six years following the end of the financial year in which those services were completed and/or you otherwise ceased to be a customer of Sable, in accordance with our legal obligation to keep records for tax purposes.

Correspondence and enquiries: when you make an enquiry or correspond with us for any reason, whether by email or via our contact form or by phone, we will retain your information for as long as it takes to respond to and resolve your enquiry, and for six (6) further month(s), after which point we will delete your information.

E-Newsletter: we retain the information you used to sign up for our e-newsletter for as long as you remain subscribed (i.e. you do not unsubscribe) or if we decide to cancel our e-newsletter service, whichever comes earlier.

In any other circumstances, we will retain your information for no longer than necessary, taking into account the following:

• the purpose(s) and use of your information both now and in the future (such as whether it is necessary to continue to store that information in order to continue to perform our obligations under a contract with you or to contact you in the future);
• whether we have any legal obligation to continue to process your information (such as any record-keeping obligations imposed by relevant law or regulation);
• whether we have any legal basis to continue to process your information (such as your consent);
• how valuable your information is (both now and in the future);
• any relevant agreed industry practices on how long information should be retained;
• the levels of risk, cost and liability involved with us continuing to hold the information;
• how hard it is to ensure that the information can be kept up to date and accurate; and
• any relevant surrounding circumstances (such as the nature and status of our relationship with you).

The above rights are provided in summary form only and certain limitations apply to many of these rights. For further information about your rights in relation to your information, including any limitations which apply, please visit the following pages on the ICO’s website:

• https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/; and
• https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

You can also find out further information about your rights, as well as information on any limitations which apply to those rights, by reading the underlying legislation contained in Articles 12 to 22 and 34 of the General Data Protection Regulation, which is available here: www.ec.europa.eu

Where you request access to your information, we are required by law to use all reasonable measures to verify your identity before doing so.

These measures are designed to protect your information and to reduce the risk of identity fraud, identity theft or general unauthorised access to your information

How we verify your identity

Where we possess appropriate information about you on file, we will attempt to verify your identity using that information.

If it is not possible to identity you from such information, or if we have insufficient information about you, we may require original or certified copies of certain documentation in order to be able to verify your identity before we are able to provide you with access to your information.

We will be able to confirm the precise information we require to verify your identity in your specific circumstances if and when you make such a request.

Where we make minor changes to our Privacy Policy, we will update our Privacy Policy with a new effective date stated at the beginning of it. Our processing of your information will be governed by the practices set out in that new version of the Privacy Policy from its effective date onwards.

Where we make major changes to our Privacy Policy or intend to use your information for a new purpose or a different purpose than the purposes for which we originally collected it, we will notify you by email (where possible) or by posting a notice on our website.

We will provide you with the information about the change in question and the purpose and any other relevant information before we use your information for that new purpose.

Wherever required, we will obtain your prior consent before using your information for a purpose that is different from the purposes for which we originally collected it.