Privacy Policy

Introduction

NDF INVESTMENTS LIMITED respects the privacy of every person who visits this website, writes to our research desk or enters a mandate relationship with us. This Privacy Policy describes the personal data we collect, the reasons we collect it, the ways we use it and the choices available to you. It also explains the measures we take to keep that information safe and the rights you may exercise at any time.

We are a computer integrated systems design and professional services business that provides structured investment research and private allocation advisory. Because our work depends on trust, we treat the handling of personal information as part of the service itself rather than an administrative afterthought. This policy is written in plain language so that it can be read without legal assistance.

The developer of this website is NDFInvest, working on behalf of NDF INVESTMENTS LIMITED. The company is the data controller for the personal data described here. Our registered correspondence address is 50 Badgers Way, BUCKINGHAM - MK18 7HL, United Kingdom (GB).

Because our work involves detailed financial material, we think it is important to explain not only what we collect but also what we refuse to do. We do not sell personal information. We do not build advertising profiles from the people who read our research. We do not share a mandate file with any party that has no role in delivering that mandate. These are not marketing promises but operating rules that shape how the desk is run every day.

Who We Are

The data controller responsible for your personal data is NDF INVESTMENTS LIMITED, whose principal correspondence address is 50 Badgers Way, BUCKINGHAM - MK18 7HL, United Kingdom (GB). The company operates the website at https://www.ndfinvest.autos and provides structured investment research, private credit allocations, currency overlay programs, portfolio stress testing, custody and settlement liaison and investor reporting suites.

For any question about this policy or about the way your information is handled, you may write to office@ndfinvest.autos or telephone +15677468273. We maintain a small internal privacy contact who is responsible for monitoring compliance with this policy and for responding to data protection enquiries.

The Company is a professional services business and is not a consumer facing platform. That said, the standards we apply are deliberately higher than the minimum the law demands, because a client who shares a portfolio outline with us is entitled to assume that the information will be handled with the same care we apply to the analysis itself. Our internal records distinguish clearly between material that belongs to a client and material that belongs to us.

If you are unsure whether a particular document should be sent to us, please ask before sending it. It is always easier to agree a secure route in advance than to retrieve material that should not have been transmitted. Our desk will gladly arrange an appropriate channel for any sensitive file.

Scope of This Policy

This policy covers personal data processed through our website, by email, by telephone and in the course of delivering a mandate. It applies to prospective clients, existing clients, professional contacts, suppliers, counterparties and visitors to our website.

This policy does not apply to third party websites that may be reached through a link from our pages, nor to services operated by our professional partners under their own privacy notices. Where we act as a processor on behalf of another organisation, the privacy notice of that organisation governs the relationship and this policy does not replace it.

We review this policy at least once a year and after any significant change to our systems or our service lines. The review considers whether the categories of data we describe remain accurate, whether the lawful bases we rely on are still appropriate and whether the retention periods we apply still reflect our legal duties. Where a review identifies a gap, we correct it rather than leaving the wording to drift.

Personal Data We Collect

The categories of personal data we may collect include the following.

• Identity information such as your name, title and the organisation you represent.
• Contact information such as your email address, telephone number and postal address.
• Correspondence content, including the subject line and body of any message you send to us.
• Mandate information such as the outline of the services you request and the documents you choose to share.
• Financial and portfolio information that you or your advisers provide to us in the course of a mandate.
• Technical information such as the internet protocol address from which you reach the website, the browser type and the pages visited.
• Records of consent, preferences and any instructions you give about how we may contact you.

We do not seek special category data, and we ask that you do not send sensitive information such as health details, political opinions or biometric data unless a specific legal basis and a secure channel have been agreed in writing in advance.

Where you provide information about another person, for example a co-investor or a family member named in a mandate, you confirm that you have the authority to do so and that the person concerned has been given this policy or has asked you to act on their behalf. We will handle that information in the same way we handle information about you.

How We Collect Personal Data

We collect personal data directly from you when you complete the mandate request form, send an email to our desk, telephone our office or provide documents during the delivery of a service. We may also collect data indirectly from your professional advisers where you have asked them to introduce you to us or to coordinate a mandate.

Some technical data is collected automatically when you load a page. This includes basic server logs that record the time of a request, the address requested and the browser type. These logs help us keep the website available and secure. We do not use invasive tracking to build advertising profiles, and we do not sell personal data to any party.

The mandate request form on our website is deliberately simple. It asks for a name, an email address, a subject and a message, and it does not post that information to a marketing database. When you press the send button, a message is prepared in your own email application and addressed to our desk. That means the information travels through your own email provider under its terms as well as ours, and it means we hold no hidden copy of what you typed.

Lawful Bases for Processing

Under the United Kingdom General Data Protection Regulation and the Data Protection Act 2018, we must have a lawful basis for each processing activity. We rely on the following bases.

• Consent, where you have clearly agreed that we may contact you or use your information for a stated purpose.
• Contract, where processing is necessary to take steps before entering a mandate or to perform a mandate we have agreed with you.
• Legal obligation, where we must retain or disclose information to comply with the law, including financial record keeping requirements.
• Legitimate interests, where processing supports the responsible operation of our business and does not override your rights, for example keeping our website secure and responding to enquiries.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal, and it does not affect processing based on another lawful basis.

When we rely on legitimate interests, we carry out a balancing exercise before processing begins. That exercise records what the interest is, why the processing is necessary to achieve it and whether a less intrusive route is available. We keep the outcome on file so that the reasoning can be reviewed if circumstances change or if you raise an objection.

Purposes of Processing

We use personal data for the following purposes.

• To respond to enquiries and to provide the research and advisory services you request.
• To prepare, agree and deliver a mandate, including the drafting of planning notes and reports.
• To communicate about a live mandate, including operational and settlement matters.
• To maintain accurate business records and to meet our legal and regulatory obligations.
• To protect the website and our systems against misuse and unauthorised access.
• To improve the clarity and usefulness of our written materials and our service delivery.
• To send updates where you have agreed to receive them.

We will not use your personal data for a purpose that is incompatible with the reason it was collected without first informing you and, where required, obtaining a fresh lawful basis.

We also use personal data to answer the questions that arise after a mandate is drawn. A client who asks why a hedge was rolled on a particular date, or why a stress scenario was chosen, is entitled to a clear answer, and that answer depends on records kept during the engagement. Keeping those records accurate is therefore part of the service, not a separate administrative task.

Sharing Personal Data

We share personal data only where it is necessary and only with parties who are bound to handle it responsibly. The recipients may include the following.

• Professional advisers such as accountants, auditors and legal counsel who support the delivery of a mandate.
• Counterparties, custodians and settlement agents where a mandate requires liaison with them.
• Technology providers who host or maintain our website and systems, acting under written instructions.
• Authorities or regulators where disclosure is required by law or by a valid legal request.

We do not sell, rent or trade personal data. Where a provider processes data on our behalf, we require appropriate contractual protections, confidentiality obligations and security commitments before any data is shared.

Before engaging a new provider that will touch personal data, we ask what data it will see, where it will be stored and who inside the provider can reach it. If the answers are not satisfactory, we either change the design of the process or choose a different provider. This is a slower way to work, but it keeps the chain of responsibility short and visible.

International Transfers

We are based in the United Kingdom and generally process personal data within the United Kingdom and the European Economic Area. Where a mandate involves an international client or counterparty, data may need to be transferred outside those areas.

When we transfer personal data internationally, we take steps to ensure that a comparable level of protection travels with it. These steps may include an adequacy decision of the relevant authority, approved contractual clauses, or another lawful transfer mechanism. You may request further detail about the safeguards used for a specific transfer by writing to office@ndfinvest.autos.

Where a client is based outside the United Kingdom, we agree the transfer route at the outset of the mandate rather than discovering it later when a document is due. That agreement records which entities may receive the data, the legal mechanism that supports the transfer and the contact point for any question about it.

Data Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, and for any additional period required by law. Retention periods differ by category of data and by the nature of the relationship.

• Enquiries that do not lead to a mandate are normally kept for a short period and then deleted.
• Mandate records are kept for the duration of the relationship and for a defined period afterwards to meet legal and regulatory duties.
• Financial and transaction records are retained for the period required by applicable tax and accounting rules.
• Website server logs are kept for a limited operational period and then rotated.

When a retention period ends, we securely delete or irreversibly anonymise the data so that it can no longer be linked to you.

We do not keep data simply because storage is cheap. Every category of record has an owner and a review point, and the review asks a single question: is there still a reason to hold this? Where the answer is no, the record is released. That discipline reduces the harm that any future incident could cause and keeps our own records trustworthy.

How We Protect Data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration and disclosure. These measures include access controls that limit data to staff who need it, encrypted channels for sensitive correspondence, disciplined record keeping and regular review of the systems we rely on.

No method of transmission or storage is completely secure. We therefore combine several layers of protection rather than depending on any single safeguard. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and, where required, inform you without undue delay.

Staff receive guidance on handling client material, on recognising a suspicious request and on reporting a potential incident immediately. Access to mandate folders is limited to the people working on the engagement, and it is removed when their role ends. We test our recovery arrangements so that a disruption does not become a permanent loss of records.

Cookies and Similar Technologies

Our website is designed to work with the minimum of tracking. We may use a small number of essential cookies or local storage entries that are needed for the site to function, for example to remember a display preference during a visit.

Where any non-essential cookie is used, we will explain its purpose and, where the law requires it, ask for your agreement before it is set. You can control cookies through your browser settings and can remove stored data at any time. Blocking essential cookies may affect how parts of the website behave.

Marketing Communications

We send research updates and service notes only where we have a lawful basis to do so. If you have agreed to receive them, you may withdraw that agreement at any time by using the contact details in this policy or by replying to any message with a request to stop.

We do not share your contact details with third parties for their own marketing. Where we rely on legitimate interests to send a relevant business communication, we keep the content measured, we honour every opt out request promptly, and we keep a record of the preferences you have expressed.

Your Data Protection Rights

Subject to the conditions in the applicable law, you have the following rights in relation to your personal data.

• The right to be informed about how your personal data is used.
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure in circumstances where there is no continuing lawful reason for us to keep the data.
• The right to restrict processing while a question about accuracy or lawfulness is resolved.
• The right to data portability for data you provided to us and that we process by automated means on the basis of consent or contract.
• The right to object to processing based on legitimate interests or carried out for direct marketing.
• The right to withdraw consent at any time where consent is the basis for processing.

To exercise a right, please contact us using the details below. We will respond within the period allowed by law and may ask for proof of identity so that we do not release data to the wrong person.

Privacy for Children

Our services are intended for professional and business audiences and are not directed at children. We do not knowingly collect personal data from anyone under the age of sixteen. If we become aware that we have collected such data without an appropriate basis, we will delete it promptly.

If you believe that a child has provided personal data to us, please contact office@ndfinvest.autos so that we can investigate and take the necessary steps.

Third Party Links

Our website may contain links to websites operated by others. We are not responsible for the privacy practices or the content of those websites. We encourage you to read the privacy notice of any site you visit, because its practices may differ from ours.

A link from our pages does not imply that we endorse the operator of the linked site or the way it handles personal information. Any interaction you have with a third party is governed by that party and its terms.

Automated Decisions and Profiling

We do not make decisions about you that are based solely on automated processing and that produce a legal or similarly significant effect. Our advisory work is carried out with human judgement at every stage, and any analytical tool we use supports that judgement rather than replacing it.

Where we use analytical methods to prepare a plan or a stress test, the output is reviewed by a member of the research desk before it is shared with you. You may ask us to explain the reasoning behind a recommendation at any time.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, in technology or in the law. When we make a material change, we will publish the revised version on this page and update the effective date shown at the foot of the page.

We encourage you to review this policy periodically so that you remain aware of how we protect personal information. Continued use of our website or services after an update indicates that you have had the opportunity to read the revised policy.

How to Contact Us

If you have a question about this policy, a request relating to your personal data or a concern about the way we handle information, please contact us using the details below.

Please include enough detail for us to identify the matter and respond helpfully. We normally acknowledge a privacy request within a few working days and provide a substantive reply within the period allowed by law.

How to Make a Complaint

We would like the chance to resolve any concern directly before you take it further. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner, which is the supervisory authority for data protection in the United Kingdom.

You may also contact the supervisory authority in the country where you live or work if you believe that your rights have been infringed. We will cooperate fully with any lawful investigation and will provide the information needed to resolve the matter fairly.

This policy is provided by NDF INVESTMENTS LIMITED and applies to the website at https://www.ndfinvest.autos. It should be read together with our Terms of Service, which govern the use of this website.