About this privacy notice
This privacy notice describes how Brevan Howard collects, uses and shares the information you provide to us and the information we collect in the course of operating our business and our website as well as your rights in relation to this information and how you can contact us in order to exercise your rights.
In this privacy notice when we refer to Brevan Howard or “we”/”us”/”our”, we mean Brevan Howard Investment Management Limited (“BHIM”) and the other relevant Brevan Howard group entities. BHIM’s contact address is 82 Baker Street, London, W1U 6AE and we are authorised and regulated in the UK by the Financial Conduct Authority.
We are a data controller in respect of your personal data for the purposes of applicable data protection law, such as the European Union’s General Data Protection Regulation 2016/679 and national implementing legislation, UK GDPR (which is the retained EU law version of the General Data Protection Regulation), the UK Data Protection Act 2018, the Swiss Data Protection Act, the Cayman Islands Data Protection Act (As Revised), the Data Protection (Jersey) Law 2018, Dubai International Financial Centre (“DIFC”) Data Protection Law No.5 of 2020, Abu Dhabi Global Market (“ADGM”) Data Protection Regulations 2021, the Personal Data Protection Act 2012 of Singapore (in which case, we are an ‘organisation’ for purposes of such law) and Israeli Protection of Privacy Law 1981, together with all laws and regulations supplementing, amending or replacing the same.
We may revise this privacy notice at any time by amending this page. You are expected to check this page from time to time to take note of any changes we make, as they are binding on you.
In this privacy notice, “personal data” or “personal information” is any information that can be used to identify you or that we can link to you and which we have in our possession or control.
The personal information that we collect and where we get it from
We will process personal data that you give to us including when you email us or contact us through various channels as follows:
• Accessing our website: In accessing our website, especially through the password protected investor login portal, the information that you provide may include your full name, title, telephone number, geographical location, email address and content, date and time of your email correspondence and information about your employer or your business.
• Contacting our Investor Relations, Marketing or other teams: When contacting us to obtain information about our funds or our firm, we are required to obtain certain personal data as outlined above to meet regulatory obligations in relation to client classification and know your customer requirements. We store this information in our Client Relationship Management system.
How we use the information we collect
We may do the following with your personal data:
• use it to engage in marketing and business development activity in accordance with applicable law in relation to our funds and services. This may include sending you monthly newsletters, updated DDQ documents, monthly risk reports, marketing communications and other information in relation to the Brevan Howard funds that may be of interest to you
• to comply with legal and regulatory obligations that we have to discharge
• record and monitor your use of our websites or our other online services for our business purposes which may include analysis of usage, measurement of site performance and generation of marketing reports
• use it for our legitimate business interests, such as undertaking business research and analysis, managing the operation of our websites and our business
• use it to look into any complaints or queries you may have, and
• use it to prevent and respond to actual or potential fraud or illegal activities.
Also, we may collate, process and share any statistics based on an aggregation of information held by us provided that any individual is not identified from the resulting analysis and the collation, processing and dissemination of such information is permitted by law.
Grounds for using your personal data
We rely on the following legal grounds to process your personal data, namely:
• Consent – we may (but usually do not) need your consent to use your personal data. You can withdraw your consent by contacting us (see below).
• Performance of a contract – we may need to collect and use your personal data to enter into a contract with you or to perform our obligations under a contract with you.
• Legitimate interest – we may use your personal data for our legitimate interests, some examples of which are given above.
• Compliance with law or regulation – we may use your personal data as necessary to comply with applicable law/regulation.
The data protection laws in jurisdictions such as Israel do not recognise all of the above legal grounds to process personal data and for these jurisdictions, we process your personal data based on your consent or as may be required by applicable laws.
You are not required by law to provide your personal data, or to agree to all the terms of this privacy notice. Where we need to collect your personal data by law, under the terms of a contract we have with you or based on our legitimate interest, and you choose not to give us the personal data, it may delay or prevent us from meeting our obligations and providing our services to you.
How we share information with third parties
We may share your personal data to other members of the Brevan Howard group for the purposes described above. We will take steps to ensure that the personal data is accessed only by group employees that have a need to do so for the purposes described in this privacy notice.
We may also share your personal data with third parties outside the firm. These groups or individuals may include:
• Third party agents/suppliers or contractors, bound by obligations of confidentiality, in connection with the processing of your personal data for the purposes described in this privacy notice in accordance with applicable law. This may include, but is not limited to, IT and communications service providers.
• Third parties relevant to the regulated services that we provide. This may include, but is not limited to, counterparties to transactions or litigation, regulators, authorities, governmental institutions and stock exchanges.
• If we sell any of our business or assets or we are acquired by a third party, we may disclose your personal data to the prospective buyer for due diligence purposes.
• To the extent required by law, regulation or court order, for example, if we are under a duty to disclose your personal data in order to comply with any legal obligation.
Categories of personal data we disclose: in the preceding 12 months, the only category of personal data we have disclosed are Identifiers and Professional or employment-related information.
Categories of personal data we sell: in the preceding 12 months, we have not sold any personal data for business purposes.
International transfers of personal data
The personal data that we collect from you may be transferred to, and stored at, a destination outside of the jurisdiction in which it was originally collected (“Relevant Location”). It may also be stored and processed by other companies and/or third parties in other countries, which may include destinations outside of the Relevant Location.
Jurisdictions outside the Relevant Location to which your personal data may be transferred include the EU, EEA, UK and USA; countries where Brevan Howard is incorporated (as listed on our website), where your or our representatives are located and/or where a financial instrument you trade is listed or traded.
Where your personal data is transferred outside of the Relevant Location, we will ensure that it is protected in a manner that is consistent with how your personal data will be protected by us in the Relevant Location. This can be done in a number of ways, for instance, as applicable:
• the country that we send the data to might be approved by the data protection authority in the Relevant Location as offering an adequate level of protection for your personal data; or
• the recipient might have signed up to a contract based on “model contractual clauses” approved by the data protection authority in the Relevant Location, obliging them to protect your personal data to a standard comparable to that of the Relevant Location.
In other circumstances the law may permit us to otherwise transfer your personal data outside the Relevant Location. In all cases, however, we will ensure that any transfer of your personal data is compliant with the relevant data protection law.
You can obtain more details about the protection given to your personal data when it is transferred outside the Relevant Location (including a copy of the relevant contractual clauses entered into with recipients of your personal data, if any) by contacting us using the details set out below.
Keeping your information and information security
How long we hold your personal data for will vary and will depend principally on:
• the purpose for which we are using your personal data – we will need to keep the information for as long as is necessary for the relevant purpose, and
• legal obligations – laws or regulation may set a minimum period for which we have to keep your personal data.
We take reasonable security measures to protect against unauthorised access to, or unauthorised alteration, disclosure or destruction of personal data. Such measures include the following:
• We protect our systems and networks from the Internet with Firewall systems.
• We employ intrusion detection software and monitor for unauthorised access.
• We maintain and selectively review activity logs, to prevent unauthorized activities from occurring within our computing environment.
• We use encryption technology to protect certain sensitive information that is transmitted over the Internet.
• We control access to your information inside our company by limiting employee access to systems and data based on business requirements.
• We build information security into our systems and networks by following our information security policies, procedures and standards. These documents are based on internationally respected security standards, applicable laws and regulations, and industry-based 'best practices'.
• We provide information security awareness courses and materials to our employees to ensure they apply our information security standards in the course of their work.
Your choices and rights
You have a number of legal rights in relation to the personal data. These rights may (depending on where your personal data is located) include:
• Obtaining information regarding the processing of your personal data and access to the personal data which we hold about you.
• Please note that there may be circumstances in which we are entitled to refuse requests for access to copies of personal data.
• Requesting that we correct your personal data if it is inaccurate or incomplete.
• Requesting that we erase your personal data in certain circumstances. Please note that there may be circumstances where you ask us to erase your personal data but we are obliged under regulation to retain it.
• Objecting to processing for direct marketing purposes.
• Objecting to, and requesting that we restrict, our processing of your personal data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally or regulatory entitled to refuse that request.
• To object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.
• To not be discriminated against by us when exercising your rights.
• In some circumstances, receiving some personal data in a structured, commonly used and machine-readable format and/or requesting that we transmit those information to a third party where this is technically feasible. Please note that this right only applies to personal data which you have provided to us.
• Withdrawing your consent where we obtained your consent to process your information (without this withdrawal affecting the lawfulness of any processing that took place prior to the withdrawal), although in certain circumstances it may be lawful for us to continue processing without your consent if we have another legitimate reason (other than consent) for doing so.
• Lodging a complaint with the relevant data protection authority (details of which are provided below), if you think that any of your rights have been infringed by us.
• We can, on request, tell you which data protection authority is relevant to the processing of your personal data.
You can exercise your rights in line with applicable law in the relevant location by contacting us using the details set out below. However, please note that these rights are conditional and are not always absolute rights.
Making a privacy complaint
You can contact us using the contact details at the end of this privacy notice if you have any concerns about how we have handled your personal data or to exercise your rights in line with applicable law in the Relevant Location. However, please note that these rights are conditional and are not always absolute rights. If you are not satisfied with the manner in which we have dealt with your complaint, you may contact the relevant data protection authority in your jurisdiction. These may include (but are not limited to):
UK: by contacting the Information Commissioner’s Office at ico.org.uk.
EU: by contacting the relevant data protection authority in the applicable EU Member State. For more information, please search the website at edpb.europa.eu.
Cayman Islands: by contacting the Cayman Islands’ Ombudsman. For more information, please search their website at ombudsman.ky.
Jersey: by contacting the Jersey Office of the Information Commissioner. For more information, please search their website at www.jerseyoic.org.
DIFC: by contacting the DIFC Commissioner of Data Protection. For more information, please search their website at difc.ae/data-protection.
ADGM: by contacting the ADGM Office of Data Protection. For more information, please search their website at adgm.com.
Singapore: by contacting the Personal Data Protection Commission. For more information, please search their website at https://www.pdpc.gov.sg/.
Switzerland: by contacting the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch/edoeb/en/home.
Israel: by contacting the Israeli Protection of Privacy Authority. For information, please search their website at https://www.gov.il/he/departments/the_privacy_protection_authority/govil-landing-page.
Contacting us
If you would like further information on the collection, use, disclosure or processing of your personal data or the exercise of any of the rights listed above, please contact us at [email protected].
Annex
California Consumer Privacy Act 2018
This Annex shall apply to the personal data of individuals residing in California ensuring compliance with the California Consumer Privacy Act 2018.
Definitions
“CCPA” means the California Consumer Privacy Act of 2018, Cal. Civil Code § 1798.100 et seq. and its implementing regulations.
“Sensitive Personal Information” means personal information that reveals (a) consumer’s Social Security or other state identification number; (b) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) consumer’s geolocation; (d) consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a consumer’s mail, email, or text messages, unless the business is the intended recipient of the communication; and (f) consumer’s genetic data. In addition, “sensitive personal information” includes processing of biometric information for purposes of identifying a consumer; personal information collected and analysed concerning a consumer’s health, and personal information collected and analysed concerning a consumer’s sex life or sexual orientation.
“Service Provider” has the same meaning as set forth in the CCPA, which in general means a for-profit legal entity to whom we disclose Personal Information for processing on our behalf for a “business purpose” (as defined in the CCPA) pursuant to a written contract.
“Third-Party Business” means any third party unaffiliated with us to whom we disclose personal data, including clients or partners who advertise, market and sponsor their goods and services, consumer data suppliers and resellers, data enrichment providers and aggregators, social media and social networking services, advertisers, and any other businesses that assist us with our Services.
Special notification for California residents — your California privacy rights
California residents have the following rights under the CCPA:
• The right to know the ways in which we collect, use, share, disclose, and otherwise process your personal data;
• the right to know the categories of personal data we have collected about you;
• the right to know the categories of sources from which personal data is collected, sold or shared, and to whom;
• the right to know our business or commercial purpose for collecting, selling, or sharing your personal data;
• the right to know the categories of third parties to whom we disclose your personal data;
• the right to know the specific pieces of your personal data that we hold;
• the right to request the deletion of your personal data, subject to several exceptions;
• the right to request that we limit the use and disclosure of Sensitive Personal Information collected about you;
• the right to request that we correct inaccurate personal data that we have about you; the right to opt out of the sale of your personal data; and
• the right not to be unlawfully discriminated against for exercising these rights.
We will not discriminate against you for exercising your rights under the CCPA. We may take reasonable steps to verify your identity before fulfilling your request to know or delete. For example, we may seek to establish your identity by matching information that you submit alongside your request with information that we have on our records. We may also ask for supplemental information as needed to establish your identity. An agent may submit a request on your behalf, but you must verify that your agent is authorized to do so. You may send your request for access to that personal data or request deletion by email to [email protected].
California's “Shine the Light” law, California Civil Code §1798.83, gives California customers the right to prevent our disclosure of their personal data to third parties for those third parties’ direct marketing purposes, and requires certain businesses to respond to requests from California customers asking about the business' practices related to disclosing personal data to third parties for the third parties' direct marketing purposes. Please submit such requests using the contact information above.
Exercising your rights under the CCPA
California privacy rights requests must include the reference “Request for California Privacy Information” in the subject line, and in the body of the message, and must include an email address or mailing address that we may use for the response. We reserve the right not to respond to requests submitted other than as specified above.
You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your personal data from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our Service Provider(s) to:
• Complete the transaction for which we collected the personal data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfil the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech rights, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
Responding to California residents
We endeavour to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.