September 2023

General Privacy Policy

CBW Recovery LLP is committed to protecting your privacy and this Privacy Policy explains your rights, what information we collect, how we use and protect it.

CBW Recovery LLP (“CBWR”, “we” or “us”) is a limited liability partnership, registered in England and Wales.

This Privacy Policy applies to CBWR.

CBWR’s Data Protection Officer is John Dickinson: John.Dickinson@cbwrecovery.co.uk

How do we collect personal data?

We obtain personal data directly from individuals in a variety of ways, including obtaining personal data from individuals who: provide us their business card, complete our online forms, subscribe to our newsletters and preference centre, register for webinars, attend meetings or events we host, visit our offices or apply for open roles.

We may also obtain personal data directly when, for example, we are establishing a business relationship, performing professional services through a contract.

We obtain personal data indirectly about individuals from a variety of sources, including recruitment services and our clients.  

We may attach personal data to our customer relationship management records to better understand and serve our business clients, subscribers and individuals, satisfy a legal obligation, or pursue our legitimate interests.

Personal data may be obtained from public registers (such as Companies House, London Gazette, Individual Insolvency Register), news articles, sanctions lists, and internet searches.

Our business clients may engage us to perform professional services which involves sharing personal data they control as part of that engagement.  For example, we may review payroll data, prior to and following an insolvency appointment.  Our services may also include processing personal data under our clients’ control on our software applications, which may be governed by different privacy terms and policies.

We may obtain personal data about candidates from an employment agency, and other parties including former employers and credit reference agencies.

What categories of personal data do we collect?

We may obtain the following categories of personal data about individuals through direct interactions with us, or from information provided through client engagements, from applicants, our suppliers and through other situations including those described in this Privacy Policy:

Personal Data

Here is a list of personal data we commonly collect to conduct our business activities:

  • Contact details (e.g. name, company name, job title, work and mobile telephone numbers, work and personal email and postal address)
  • Professional details (e.g. job and career history, educational background and professional memberships, published articles)
  • Family and beneficiary details for insurance and pension planning services (e.g. names and dates of birth)
  • Financial information (e.g. taxes, payroll, investment interests, pensions, assets, bank details, insolvency appointment records)

Sensitive personal data

We typically do not collect sensitive or special categories of personal data about individuals.  When we do need to process sensitive personal data, it is with the consent of the individual unless it is obtained indirectly for legitimate purposes. Examples of sensitive personal data we may obtain include:

  • Dietary restrictions or access requirements when registering for in-person events that reveal religious beliefs or physical health
  • Personal identification documents that may reveal race or ethnic origin of private individuals, beneficial owners of corporate entities, or applicants
  • Expense receipts submitted for individual tax or accounting advice that reveal affiliations with trade unions or political opinions
  • Adverse information about potential or existing clients and applicants that may reveal criminal convictions or offences information
  • Information provided to us by our clients in the course of a professional engagement

What lawful reasons do we have for processing personal data?

We may rely on the following lawful reasons when we collect and use personal data to operate our business and provide our products and services:

  • Contract – We may process personal data in order to perform our contractual obligations
  • Consent – We may rely on your freely given consent at the time you provided your personal data to us
  • Legitimate interests – We may rely on legitimate interests based on our evaluation that the processing is fair, reasonable and balanced.  These include:
    • Delivering services to our clients – To deliver the professional services our clients have engaged us to provide
    • Direct marketing – To deliver timely market insights and speciality knowledge we believe is welcomed by our business clients, subscribers and individuals who have interacted with us
    • Legal obligations and public interests – We may process personal data in order to meet regulatory and public interest obligations or mandates

Why do we need personal data?

We want to be transparent when we collect and use personal data and tell you why we need it, which typically includes:

  • Providing professional advice and delivering reports related to our restructuring, corporate recovery and insolvency work. Our services may include reviewing client files for quality assurance purposes, which may involve processing personal data for the relevant client
  • Promoting our professional services, products and capabilities to existing and prospective business clients
  • Sending invitations and providing access to guests attending our events and webinars or our sponsored events
  • Administering, maintaining and ensuring the security of our information systems, applications and websites
  • Authenticating registered users to certain areas of our sites
  • Seeking qualified candidates, and forwarding candidate career inquiries to our HR team, which may be governed by different privacy terms and policies
  • Processing online requests, including responding to communications from individuals or requests for proposals and quotations
  • Contacting journalists regarding company press releases, invitations to annual press parties, highlighting messages that may be of interest on specific industry topics
  • Complying with legal and regulatory best practice guidance relating to insolvency appointments
  • Complying with legal and regulatory obligations relating to countering money laundering, terrorist financing, fraud and other forms of financial crime

Do we share personal data with third parties?

We may occasionally share personal data with trusted third parties to help us deliver efficient and quality services.  These recipients are contractually bound to safeguard the data we entrust to them.  We may engage with several or all of the following categories of recipients:

  • Parties that support us as we provide our services (e.g., providers of telecommunication systems, IT system support, archiving services, document storage and production services and cloud-based software services)
  • Our professional advisers, including lawyers, auditors, accountants, insurers, asset valuation agents and employment rights specialists
  • A potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger/acquisition of part or all of our business or assets, or any associated rights or interests
  • Payment services providers
  • Marketing services providers
  • Law enforcement or other government and regulatory agencies (e.g., HMRC) or to other third parties as required by, and in accordance with, applicable law or regulation
  • Recruitment services providers

Do we transfer your personal data outside the European Economic Area?

We store personal data on servers located in the European Economic Area (EEA).  We may transfer personal data to reputable third-party organisations situated inside or outside the EEA when we have a business reason to engage these organisations.  Each organisation is required to safeguard personal data in accordance with our contractual obligations and data protection legislation.

Do we use cookies?

Our websites may use cookies.  To learn more, please refer to our Cookie Policy.

What are your data protection rights?

Individuals have certain rights over their personal data and data controllers are responsible for fulfilling these rights.  Where we decide how and why personal data is processed, we are a data controller and include further information about the rights that individuals have and how to exercise them below.

Access to personal data

You have a right of access to personal data held by us as a data controller.  This right may be exercised by emailing us at info@cbwrecovery.co.uk.  We may charge for a request for access in accordance with applicable law.  We will aim to respond to any requests for information promptly, and in any event within the legally required time limits (currently 30 days).

Amendment of personal data

To update personal data submitted to us, you may email us at info@cbwrecovery.co.uk, directly to the case administrator’s email address, or where appropriate, contact us via the relevant website registration page or by amending the personal details held on relevant applications with which you registered.

When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make corrections (where appropriate) based on your updated information.

Withdrawal of consent

Where we process personal data based on consent, individuals have a right to withdraw consent at any time.  We do not generally process personal data based on consent (as we can usually rely on another legal basis).  

To withdraw consent to our processing of your personal data please email us at info@cbwrecovery.co.uk or directly to the case administrator’s email address. 

To stop receiving an email from a CBWR marketing list, please click on the unsubscribe link in the relevant email received from us.

Other data subject rights

This privacy statement is intended to provide information about what personal data we collect about you and how it is used.  As well as rights of access and amendment referred to above, individuals may have other rights in relation to the personal data we hold, such as a right to erasure/deletion, to restrict or object to our processing of personal data and the right to data portability.  Some of these rights will only be available from 25 May 2018.

If you wish to exercise any of these rights, please send an email to info@cbwrecovery.co.uk.

Complaints

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to info@cbwrecovery.co.uk.  We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”) (the UK data protection regulator).  For further information on your rights and how to complain to the ICO, please refer to the ICO website, https://ico.org.uk.

What about personal data security?

We have put appropriate technical and organisational security policies and procedures in place to protect personal data (including sensitive personal data) from loss, misuse, alteration or destruction.  We aim to ensure that access to your personal data is limited only to those who need to access it.  Those individuals who have access to the data are required to maintain the confidentiality of such information.

How long do we retain personal data?

We retain personal data to provide our services, stay in contact with you and to comply with applicable laws, regulations and professional obligations that we are subject to. Unless a different time frame applies as a result of a business need or specific legal, regulatory or contractual requirements, where we retain personal data in accordance with these uses, we retain personal data for seven years.  We will dispose of personal data in a secure manner when we no longer need it.