1. Introduction
Ordovian Ltd (“Ordovian”, “we”, “us”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect personal data. It also explains the rights you have under:
- the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations 2003 (“PECR”); and
- where it applies, Regulation (EU) 2016/679 (the “EU GDPR”) and applicable EU data protection laws.
This Policy covers personal data collected through our website ordovian.com (the “Website”). It also covers personal data collected through direct communications with us and in connection with our investment activities, including from co-investors, counterparties, their representatives and advisers.
2. Data Controller
Ordovian Ltd is the controller of your personal data for the purposes of this Policy.
Ordovian Ltd
Registered office: 167–169 Great Portland Street, London W1W 5PF, United Kingdom
Company number: 17492304
Email: compliance@ordovian.com
3. Personal Data We Collect
We may collect and process the following categories of personal data:
- Identification data: name, title, organisation, nationality, date of birth.
- Contact details: email address, telephone number, business address.
- Professional information: role, employer, industry, investment preferences and transaction-related information.
- Due diligence and compliance data: identity documents, ownership and control information, source-of-funds and source-of-wealth information, and the results of sanctions, politically exposed person (PEP) and adverse media screening.
- Communications data: correspondence, meeting notes and records of our interactions with you.
- Technical data: IP address, browser type, device information and Website usage data.
We do not intentionally collect special category data, such as data about health, ethnicity, religion or political opinions. If you provide it voluntarily, we process it only where a lawful condition applies.
Sanctions, PEP and adverse media screening may reveal information about criminal convictions or offences. We process such information only where permitted under the Data Protection Act 2018, for example to prevent unlawful acts or to meet legal or regulatory requirements.
4. Where We Obtain Personal Data
We collect personal data directly from you, for example when you contact us, meet us or take part in a transaction. We may also obtain it from:
- your employer, a co-investor, counterparty or introducer;
- professional advisers acting in a transaction;
- public sources such as Companies House and other company registries, official sanctions lists, regulators’ registers, professional networking sites and the press; and
- screening and identity verification providers.
5. Lawful Basis for Processing
We process personal data on one or more of the following lawful bases:
- Legitimate interests: responding to enquiries, managing relationships with investors and counterparties, evaluating and executing transactions, conducting due diligence, and protecting our business. We only rely on this basis where those interests are not overridden by your rights and interests.
- Performance of a contract: where we have, or are entering into, an agreement with you or your organisation.
- Legal obligation: compliance with anti-money laundering, sanctions, tax, accounting and other legal requirements.
- Consent: for marketing communications where consent is required by law, and for non-essential cookies. You may withdraw consent at any time.
6. How We Use Personal Data
We use personal data to:
- respond to enquiries and communications;
- evaluate, negotiate and execute investment and co-investment opportunities;
- conduct due diligence on transactions, assets and counterparties;
- carry out know-your-customer, anti-money laundering and sanctions checks;
- administer special purpose vehicles and investment arrangements;
- meet our legal, tax and regulatory obligations;
- establish, exercise or defend legal claims;
- operate, secure and improve the Website; and
- send business communications where permitted by law.
We do not sell personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
7. Sharing Personal Data
We share personal data only where necessary and lawful, including with:
- co-investors, special purpose vehicles and counterparties involved in a transaction;
- partners and advisers engaged on a transaction, including diligence providers;
- professional advisers, including lawyers, accountants, auditors and tax advisers;
- banks, administrators and other service providers to our investment vehicles;
- identity verification and screening providers;
- IT, hosting, email and secure document-management providers; and
- regulators, law enforcement, courts and other authorities where required by law.
Service providers that act as our processors may use personal data only on our instructions and must protect it in line with data protection law.
Website services: this website is hosted on Netlify and uses Netlify Forms to process and store contact enquiries, Netlify Database to store a copy for authorised internal enquiry management, Netlify Identity to authenticate authorised team members, and Netlify Image CDN to deliver images. Authorised team members may export enquiries for internal follow-up; exported files must be handled securely and deleted when no longer needed. Google Fonts supplies the website’s fonts. These services receive technical request information, including IP addresses, when website resources are requested. No advertising or analytics tracking is currently installed.
8. International Transfers
We may transfer personal data outside the United Kingdom and the European Economic Area (EEA), for example to co-investors, counterparties or service providers in other jurisdictions. Where we do, we ensure appropriate safeguards are in place, such as:
- transfers to countries covered by UK adequacy regulations or an EU adequacy decision;
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses;
- the EU Standard Contractual Clauses, for transfers subject to the EU GDPR; or
- another lawful transfer mechanism, or a derogation permitted by law.
You may request details of the safeguards used by contacting us.
9. Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected and to meet legal, regulatory, tax and contractual obligations. In general:
- Enquiries and general communications: up to 36 months, unless a business relationship or transaction follows.
- Transaction, investment and due diligence records: seven years after the end of the relationship or transaction, or longer where the law requires.
- Marketing data processed on the basis of consent: until you withdraw consent or the data is no longer needed.
We may keep personal data for longer where needed to meet legal or regulatory requirements, or to establish, exercise or defend legal claims. At the end of the retention period, personal data is securely deleted or anonymised.
10. Data Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure. These include:
- encrypted communications (SSL/TLS);
- access controls, with access limited on a need-to-know basis;
- secure data storage and document-management systems; and
- confidentiality obligations on our people and service providers.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Your Rights
Under the UK GDPR, and the EU GDPR where it applies, you have the right to:
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased in certain circumstances;
- restrict our processing in certain circumstances;
- object to processing based on our legitimate interests;
- object at any time to direct marketing;
- receive your data in a portable format, where processing is based on consent or contract; and
- withdraw consent at any time, without affecting processing that took place before withdrawal.
To exercise these rights, contact us at compliance@ordovian.com. We will respond within one month, which may be extended where the law allows. We may need to verify your identity before acting on a request. Some rights are subject to exemptions, for example where we must keep data to meet a legal obligation.
12. Complaints
If you have concerns about how we handle personal data, please contact us first at compliance@ordovian.com.
You also have the right to complain to the UK Information Commissioner’s Office (ICO):
Website: ico.org.uk · Telephone: 0303 123 1113
If you are in the EEA, you may also complain to the data protection authority in the country where you live or work, or where an alleged infringement took place.
13. Cookies
The Website uses strictly necessary cookies to function and stay secure. With your consent, it may also use analytics cookies to understand how the Website is used.
We will not place non-essential cookies on your device unless you have consented through our cookie banner. You can change or withdraw your consent at any time through the cookie settings on the Website or your browser. Disabling cookies may affect how the Website works.
Further details are set out in our Cookie Notice. No analytics cookies are currently installed; choosing to allow them does not activate any tracking on the current website.
14. Marketing Communications
We send business communications only where permitted by law, including PECR. You can unsubscribe at any time using the link in our communications or by contacting compliance@ordovian.com.
15. Third-Party Websites
The Website may contain links to third-party websites. We are not responsible for their content or privacy practices. Please review their privacy policies before providing personal data to them.
16. Confidential Submissions
Submitting information through the Website does not create a confidentiality obligation unless a separate written agreement, such as a non-disclosure agreement, has been executed. Please do not send confidential or sensitive information through unsecured channels.
17. Children
The Website is not directed at individuals under 18, and we do not knowingly collect their personal data.
18. Changes to This Policy
We may update this Policy from time to time. The updated version takes effect when published on the Website, and we will notify you of material changes where appropriate.