MJB Logo

Privacy Policy

Privacy policy relating to Cameron Sustainable Pensions Engine

CAMERON SUSTAINABLE PENSIONS ENGINE LIMITED

PRIVACY NOTICE

This privacy notice sets out how we use and protect your personal data. We may change this privacy notice from time to time. Where we make significant changes to this privacy notice or the way in which we use personal data within the scope of this privacy notice, we will communicate this to you via our website and/or email.

  1. Our details
    1. CAMERON SUSTAINABLE PENSIONS ENGINE LIMITED is a private limited company registered in England with company number 16310510 and with registered office at 42 Como Road, London, England, SE23 2JW.
    2. We are an independent controller of the personal data we process, meaning we process personal data for our own purposes, separate from our customer's purposes.
    3. If you wish to contact us in relation to this notice, or data protection generally, please contact us by:
      1. email on social@mettle.capital or
      2. post using our registered address stated above, marked for the attention of the Data Protection Officer.
  2. Status
    1. We provide an AI intelligent chat agent called Cameron SPE which is an AI solution for gathering and analysing users' sustainable pensions investment preferences.
    2. Only where you have given consent, we may use your personal data to train and improve the models contained within our solution as set out in the section titled "What information we collect and why". This privacy notice only relates to that use.
  3. What information we collect and why
    1. Type of data
      1. Information about your investment preferences
      2. Contact data, including your telephone numbers and email addresses
      3. Where the records above contain information about your:
        • racial and ethnic origin
        • political opinions
        • religion
        • trade union membership
        • health
        • sex life and sexual orientation
        • criminal record
    2. Why we use it
      1. To train the bespoke AI models that underpin the provision of our service to our customers.
      2. To provide support services to you.
      3. Where relevant, to train the bespoke AI models that underpin the provision of our service to our Customers
      4. To provide support services to our Customers.
    3. Our lawful for basis for using it
      1. Our legitimate interests - see "Legitimate interests as our lawful bases for the collection and use of your data" below.
      2. Explicit consent, obtained from you - we will always ask for your consent to collect and use this type of information.
  4. Where our legal basis for processing is legitimate interests, you may have the right to object to our processing (see the section titled "Objecting to legitimate interests processing" below).
  5. Legitimate Interests as our lawful basis for the collection and use of your data
    1. We're collecting or using your personal data because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
    2. Our legitimate interests are building bespoke AI models that work for the benefit of our Customers, and to improve our service to our Customers and their clients in future.
    3. We hold your personal data for a period of time, ensuring it is retained for only as long as necessary to achieve these purposes. Additionally, the large language models we use operate entirely on-premise rather than in the cloud, which means the use of your personal data is confined within a secure environment which significantly reduces the potential for unauthorised access or misuse of that personal data.
  6. Where we collect your personal data from
    1. We collect your personal data in the following ways:
      1. from the conversation you have with our intelligent chat function, Cameron.
      2. by your voluntary participation in any focus groups or questionnaires that we may run.
  7. How long we keep your data for
    1. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
    2. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
    3. c. In some circumstances you can ask us to delete your data: see the section titled "Your rights" below for further information.
  8. Who we may disclose your personal data to
    1. We may share your personal data where necessary with the parties set out below for the purposes set out in the section titled "What information we collect, use and why"
    2. We will share your personal data with the following external third parties in some circumstances
      1. regulators and government authorities, if we are required to do so by law or if the regulator or authority requests it and we regard that request as reasonable or are required to comply by law;
      2. our insurers, legal advisers or other third parties who need access to it in the context of managing, investigating or defending claims or complaints;
      3. in connection with re-organisations, mergers and acquisitions of all or part of our business;
      4. organisations that process your data on our behalf who are not allowed to use your data for any other purpose;
      5. and anyone else, where you have consented to us doing so.
    3. Where we share your personal data with our service providers, we have contracts with those service providers setting out how they must handle your personal data, including not to use your personal data other than in accordance with our instructions.
    4. Where we have been able to fully anonymise personal data, we may share that anonymised data with third parties.
  9. International transfers
    1. We do not transfer your personal data outside the UK or the EEA.
  10. How we protect your personal data
    1. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, volunteers, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
    2. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
  11. Objecting to our legitimate interests processing
    1. Where we process your personal data on the basis of our legitimate interests for direct marketing purposes, you always have the right to object to that processing. To object to direct marketing please follow the instructions for objecting to marketing in the section immediately above.
    2. You have the right to object to other processing on the basis of our legitimate interests, but, with the exception of direct marketing, we might not have to cease processing where you do so if either:
      1. we are able to demonstrate compelling legitimate grounds for the processing which override your interests; or
      2. where that legitimate interest is the establishment, exercise or defence of legal claims.
    3. To object to legitimate interests processing, please contact us using the details at the top of this notice.
  12. Your rights: The law gives you certain rights in respect of the personal data that we hold, which you should be aware of:
    1. You have the right to obtain your personal data from us except in limited circumstances. Where we provide it, the first copy will be free of charge, but we reserve the right to charge a small fee for additional requests;
    2. You have the right to require us to rectify any inaccurate personal data we hold concerning you;
    3. Taking into account the purposes of the processing, you may also have the right to have incomplete personal data completed, by means of providing a supplementary statement or otherwise;
    4. You have the right to require us to erase your personal data on certain limited grounds (including where they are no longer necessary for the purpose for which they were collected or where we rely on consent, which you withdraw, and there is no other legal ground for the processing);
    5. You have the right to require us to restrict the processing of your personal data on certain grounds, including where:
      1. you contest the accuracy of the personal data and want us to restrict processing of your personal data while we verify its accuracy;
      2. the processing is unlawful, but you request a restriction of the processing rather than erasure;
      3. we (as controller) no longer need the data for the purposes of the processing, but you have told us you require us to retain that personal data for you to establish, exercise or defend legal claims; or
      4. you have objected to us processing your personal data on grounds of legitimate interests and want us to restrict processing of your personal data while we consider your objection.
    6. If you would like to exercise any of these rights, please contact us using the details set out in the section titled "Our details" above
  13. If we can't remedy an issue you have
    1. If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details set out in the section titled "Our details" above
    2. If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.
    3. The ICO's address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
      1. Helpline number: 0303 123 1113
      2. Website: https://www.ico.org.uk/make-a-complaint