Guildwell respects privacy and handles personal information in accordance with the legal and regulatory requirements applicable to the entity processing the data.
Because Guildwell operates through separate legal entities, the entity responsible for personal information depends on the service being provided, the jurisdiction involved and the purpose for which the information is processed.
Shared technology, personnel or Group infrastructure do not remove the responsibility of the relevant Guildwell entity for the personal information processed in connection with its activities.
Information we collect
Depending on the relationship and service, Guildwell may collect and process information including:
- identity and contact information
- corporate ownership and control information
- KYC and AML information
- transaction and payment information
- account and service information
- communications
- compliance and risk information
- investor or eligibility information where relevant
- instructions, transaction and settlement records
- information relating to beneficial owners, directors, authorised users and other connected persons
- information required by law, regulation or a competent authority
We seek to collect only information that is relevant and necessary for the purpose for which it is being processed.
Why we use personal information
Personal information may be processed for purposes including:
- providing and administering Guildwell services
- onboarding and maintaining client relationships
- identity and business verification
- AML, sanctions and financial crime controls
- processing payments, transactions and instructions
- risk management and compliance monitoring
- meeting legal and regulatory obligations
- maintaining business and regulatory records
- preventing fraud, misuse and security incidents
- communicating with clients and other relevant parties
- managing disputes, complaints and legal claims
- operating, protecting and improving Guildwell's services
The legal basis for processing depends on the applicable law and activity and may include consent where required, contractual necessity, compliance with legal or regulatory obligations and legitimate interests where permitted.
Canada
Where personal information is processed by Guild Financial Ltd. / Guildwell Canada, the Canadian privacy framework applies according to the activity and information involved.
Guildwell's Canadian privacy controls are designed to support compliance with applicable requirements including the Personal Information Protection and Electronic Documents Act, PIPEDA, together with the recordkeeping and operational requirements applicable to Guild Financial's money services and retail payment activities where relevant.
Canadian privacy obligations include accountability for personal information under the entity's control, appropriate safeguards, appropriate purposes for collection and use, access and correction rights, and breach assessment and response.
Where a breach of security safeguards affecting Canadian personal information occurs, the relevant entity assesses whether the breach creates a real risk of significant harm.
Where the applicable legal threshold is met, this may require:
- reporting to the Office of the Privacy Commissioner of Canada
- notification to affected individuals as soon as feasible
- notification to another organisation or government institution where appropriate to reduce or mitigate harm
- maintenance of required breach records
These assessments are handled under Guildwell's privacy and incident-management framework.
Cayman Islands
Personal information processed by Sparling Financial in the Cayman Islands is subject to the privacy, confidentiality and regulatory requirements applicable to that entity.
This includes the Cayman Islands Data Protection Act and applicable confidentiality requirements, including the Confidential Information Disclosure Law, together with the recordkeeping and governance obligations relevant to Sparling Financial's regulated activities.
Personal information is expected to be processed lawfully, fairly and for appropriate purposes, with controls around collection, use, disclosure, retention, security and individual rights.
Confidential information is not disclosed without an appropriate legal basis, authority or other lawful justification.
Where information is processed in connection with regulated securities activity, the same privacy principles apply to relevant client, investor, beneficial ownership, eligibility, instruction, transaction, intermediary and settlement information.
Sharing within the Guildwell group
Information is not automatically available for unrestricted use across Guildwell entities simply because the entities belong to the same Group.
Where personal information is shared between Group entities, the receiving entity must have an appropriate purpose and lawful basis for using it.
The information shared should be limited to what is appropriate for that purpose, and applicable confidentiality, access, contractual and regulatory requirements must continue to be respected.
Information collected by one Guildwell entity is not automatically repurposed by another.
Service providers and other third parties
Guildwell may share personal information with service providers, affiliates, financial institutions, counterparties, professional advisers, regulators or authorities where this is:
- necessary to provide a service
- required or permitted by law
- necessary for compliance or risk management
- appropriately supported by contractual or other safeguards
Third parties processing personal information on behalf of a Guildwell entity are subject to controls appropriate to the nature of the processing.
Guildwell does not sell personal information.
International transfers
Guildwell operates internationally, and personal information may therefore be processed or stored outside the jurisdiction in which it was originally collected.
Where personal information is transferred internationally, the responsible entity uses a lawful transfer mechanism and appropriate safeguards as required by the law applicable to the information and transfer.
Depending on the circumstances, those safeguards may include contractual protections, adequacy mechanisms, consent where legally appropriate or another permitted legal basis.
International transfer does not remove the accountability of the Guildwell entity responsible for the information.
Data security
Guildwell applies technical and organisational safeguards appropriate to the sensitivity of the information and the risks associated with its processing.
These controls are designed to protect personal information against unauthorised access, disclosure, alteration, loss, misuse or destruction.
Detailed security architecture and internal control procedures are not published.
Retention
Guildwell retains personal information and regulated records for as long as necessary to meet the applicable legal, regulatory, contractual, operational and legitimate business requirements.
Retention periods vary according to:
- the responsible entity
- jurisdiction
- type of information
- activity
- regulatory requirements
- legal or contractual obligations
Certain compliance and transaction records may need to be retained for extended periods under applicable financial-services laws.
Information may also need to be preserved for longer where it is subject to a legal hold, regulatory inquiry, investigation, audit, complaint, litigation or other preservation requirement.
When information is no longer required to be retained, it is subject to secure deletion, destruction or anonymisation according to the applicable record-management procedures.
Your privacy rights
Depending on the law applicable to you and the processing involved, you may have rights including:
- being informed about how your information is used
- requesting access to personal information
- asking for inaccurate information to be corrected
- requesting deletion where legally available
- requesting restriction of processing where applicable
- objecting to certain processing
- data portability where applicable and feasible
- rights concerning automated decision-making where applicable
These rights are not absolute.
Financial-services, AML, regulatory, recordkeeping, legal or other obligations may require Guildwell to retain or continue processing certain information even where a deletion or restriction request has been made.
Privacy requests
Requests concerning personal information may be submitted to:
Changes and accountability
Privacy requirements are considered when material new products, jurisdictions, technologies or processing activities introduce elevated privacy risk.
Each relevant Guildwell entity remains responsible for the privacy obligations arising from its own activities, including where information is processed through Group systems, affiliates or third-party providers.