Privacy notice

1. Introduction
2. Third-party links
3. The Data controller
4. Why we may collect data about you
5. General information on our record retention policy
6. Disclosure of your information (including outside of the European Economic Area “EEA”)
7. Storage of your personal data (including outside of the “EEA”)
8. Security
9. Your rights
10. Complaints.

2025

4. Why we may collect data about you and our legal basis

Personal data, in this statement also referred to as “your data”, is defined to be any information on its own, or in combination with other data that can be help identify or link directly or indirectly to you. It does not include data where your identity had been removed (anonymous data). Per the GDPR, and other data protection regulations, where your personal data is processed, we must have a legal reason to use it.  

When engaging with Octopus Group and the subsidiaries under this Privacy notice, you may interact with us for different purposes as a: 

• Website visitor 

• Office visitor 

• Investor or Customer 

• Adviser or Broker 

• Job Applicant 

• Third Party Supplier or Advisor 

There are many reasons why we may legitimately collect and process your personal information and data, including: 

1. Consent: In specific situations, we can collect and process your data with your consent. 

2. Contractual obligations: We may process your information where it is necessary to either enter into a contract with you for the provision of our products or services or to perform our obligations under that contract or to provide you with advice or guidance in relation to our products or services that are offered by us. 

3. Legal compliance: If the law or any regulator in any competent jurisdiction requires us to, we may need to collect and process your data and also provide this to any such regulator 

4. Legitimate interest: We may process your information in the day to day running of our business, to manage our business and financial affairs and to protect our customers, employees and property.  It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business.  In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. 

5. Substantial Public Interest for Economic Harm: We may process your information  

Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you.  

Purpose	Data Types	Legal Basis	Retention
When engaging with our websites  When you visit and browse our website  When you provide your information on our contact page; The right team in Octopus will be able to contact you when a query or comment is submitted to us.  When you fill in job application under the career section; When you submit your interest to work with us, the information you provide in the career section will help our team to review your application and the necessary credentials to consider your application. We will use the information and/or personal data provided to inform you the status of your application.  When you log in as an investor or advisor; The login credentials will provide you the access to your investment product and profile.	Website: Please refer to our  Cookie Notice  Contact page:  Email address, individual’s message and if provided, includes the name, telephone number and other personal data directly submitted by the individual  Career section: Please refer to section 8, below  Investors/Advisors Login: Login credentials and your CON or FCA Advisor number  Webinars and Events: Company name, Company FCA number, Individual FCA number, accessibility needs (if relevant)	We rely on the legitimate interest of the business as the legal basis to process your information and/or personal data. We will use your information to contact you and provide the necessary service relevant to the purpose of using our website. It will also help us to improvise the usage and functionality of our website. For accessibility needs, we will process these on explicit consent in order to support you during your engagement with us.	Personal data under the Contact page will be held in our online system for 3 (three) months after it being submitted. Information and/or personal data on the career section will be retained with our HR team for 12 (twelve) months, unless consent is given for us to hold it longer than this period. Our customer’s information in the investor’s Login page will be recorded for as long as the investor has an online account with Octopus Investments and 5 (five) years after the account has been closed.
When visiting our offices  Octopus Investment has the responsibility to look after the safety of our employees and visitors when you are in our office. Only authorised individuals are allowed to be in our office making sure that it is safe and secure for everyone.  The personal data used for the purpose of our Guest Wi-Fi will be used to provide the online connection to our visitors and keep track of any connection issues.	Name; Email address; Organisation you are working for; Date and time of your visit; When connected to our Wi-Fi: IP address assigned by the network, hostname of device, first and last seen, data usage, device type and the last access point (all of which when combined amount to your personal data); Photographs or video images (through CCTV); Any other information you may provide to us for specific request	Legal obligation under the Health & Safety Act 1974 to use your information to facilitate your visit; Octopus Investment’s legitimate interest to ensure a secure and safe access to our office; and Consent, when you agree to share your details with us to meet us.	We will keep your data for 6 (six) months from your first visit and they are held in the visitor management system provided by our building landlord (Sainsbury’s). We do not separately hold your information and/or personal data outside of the system. Please visit Sainsbury’s website to read their Privacy Notice.   In the event you are using our Wi-Fi, your personal data will be held for 30 (thirty) days from the last connection. Please let us know should you wish to have your personal data deleted sooner than the retention period and we will attend to your request accordingly.
When you apply for a job with us  We process your personal data either through the employment agencies, on our website career section or through LinkedIn. Your information will be processed by our Recruitment team who will then send it across to the relevant business unit for the job role you are applying for.    We would not be able to consider your application without your information and/or personal data as we need to assess your suitability for the role. Additional information provided will be used to prepare the necessary working arrangements when you have been selected.	Name, date of birth, home address, email address, telephone number; LinkedIn profile (your profile link) Work experience; Academic and professional qualifications/membership; School, college and/or university; Current salary & salary expectation; Notification period; Health and disability information; Marital Status; Gender; Disability or health conditions that you share with us; Race and religion (optional) Sexual orientation (optional) Any other information you provide to us in relation to your application whether in your CV or directly with us	Consent – When you choose to progress with your interest either on LinkedIn; our career section; or with the employment agency; Legitimate Interest – Your application will help us to assess your skills and experience relevant to the role you are applying for, and the process may help us to develop and improve our recruitment process. Additionally, it is important for us to verify the information in your application and we use a background check service provider to do the necessary to confirm your details and previous working experience. Legal Obligations – Some information you provide may impose a legal obligation on Octopus Investments and require us under the Equality Act 2010 to protect your wellbeing at the workplace. Performance of a Contract – In the event your application is successful, Octopus Investments will use your personal data to do the necessary to prepare your employment contract Processing under Article 9(2)(b) – We are allowed to process your sensitive and special category of personal data under Article 9(2)(b) when we receive sensitive information such as race, religion, sexual orientation and/or health	Your data may be retained for up to one (1) year in case there are queries or where your application is re-considered for the same role or other role(s).
When you engage with us as an Investor or a Customer  Octopus Investments requires your personal data when you submit your interest to invest and/or enquire about our products. Your personal data will also be used when we create your profile for your investment and product and for an online account on our website.  To manage your investment with us.  To send the company’s news, updates and/or products following your consent for marketing communications.  Relevant to our lending products only and through your application process, we may share your personal information with credit reference agencies (CRAs) and fraud prevention agencies (FPAs) to (among all other necessary checks to be carried out prior to providing services to you) verify your identity, assess creditworthiness, provide your financial history, manage your account, and help us prevent fraud and money laundering.  We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. Your data will also be linked to the data of your spouse, any joint applicants or other financial associates. The CRAs may also share your information with other organisations in accordance with their rightful legal basis to do so. More details on the CRAs and the ways in which they use and share personal information, are explained in more detail at CRAIN.  To determine your eligibility for our products, and provide you support in relation to our products.	Name, date of birth, home and/or office address, email address, telephone number; Employment details; Gender; Income/Financial/Tax Details; NI number; Nationality and country of citizenship; Investment data and valuations; Login details (for online account); Health or disability information (if provided); Nationality and country of citizenship; Communication records (for security and monitoring purposes)	It is within our legitimate interests to process your personal data for us to fulfil your investment into one of our products, and for the general administration of your investment and profile. We rely on your consent when you choose to receive the marketing communications from Octopus. We also have a legal obligation to comply with the laws and regulations concerning your investment, fund and/or product, for example for fraud reporting obligations or anti-money laundering. Processing under a substantial public interest when we believe its necessary for the purpose of safeguarding you for your economic wellbeing and prevent you from harm Further details of how you information will be used by our FPAs, and your data protection rights can be found here https://www.cifas.org.uk/fpn.	Your personal data will be retained for 5 (five) years after the account has been closed.
When you engage with us as a third party or supplier  We collect personal data of the account manager or contact person of the third-party supplier when we request for the company’s goods or services; or when we agree to sign the contract with the supplier .   We do not use your personal data for other purposes than to manage the third-party supplier contract with us.	Name, email address, telephone number Job title Bank account details (particularly for individual supplier/consultant)	Performance of a contract for the goods and/or services; Legal obligation: To comply with the Bribery Act 2010, Modern Slavery Act 2015 and other applicable laws Legitimate interest: To manage business contacts and the general administration of our third-party suppliers	Personal data in relation to managing the goods and services will be retained in our record until they are being replaced with a new business contact from your organisation. The same retention period applies to individual consultants.

A copy of this Privacy Notice will be made available to you during your engagement with us. If you have any further questions to why we may process your personal data please contact us at [email protected].   

5. General information on our record retention policy 

Records can be held on a variety of media (physical or electronic) and formats. Retention periods for records are determined based on the type of record, the nature of the activity, product or service, applicable local legal or regulatory requirements. Retention periods may be changed from time to time based on business or legal and regulatory requirements. 

We may, on exception, retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from any courts or competent authority, or in relation to an investigation by law enforcement agencies or our regulators. This is intended to make sure that we are able to produce records as evidence, if needed to those respective authorities. 

Please refer to each individual category on how long we keep your information and/or personal data for. If you believe the record, you are looking for has not been stated, please contact us directly to inquire at  [email protected].   

6. Disclosure of your information (including outside of the European Economic Area “EEA”) 

When we share your information with third parties, they will process your information and/or personal data as either as a data controller or as our data processor and this will depend on the purposes of our sharing your information and/or personal data with such third party.  We will only share your information and/or personal data in compliance with the applicable data protection laws and regulatory requirements. 

We may disclose your information: 

• With previous employers or through the employment agency when you submit your job application; 

• When other products and services within the Octopus Group may interest you provided we have your consent; 

• Including buyers or sellers or any of our business or assets; 

• If we are under a duty to disclose or share your personal data with any of the government bodies or agencies, the law enforcements, to comply with any judicial or legal obligations or regulatory requirements or to protect the rights, property or safety of: (i) the Octopus Group websites, (ii) our customers, (iii) exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction; and/or 

• To third-party suppliers who will process our data on our behalf and their authorised employee(s) and/or team(s) who needs to access your personal data. 

Transfers may be made outside the EEA where we are satisfied that appropriate safeguards are in place. 

We may share some broader statistics and customer profiling information with third parties and within the Octopus Group, but the information or data will be anonymised, so you will not be identifiable from that data. We do not rent or sell your personal data and/or information details to any other organisation or individual. 

7. Storage of your personal data (including outside of the “EEA”) 

Our main storage and back-up database is located within the U.K. However, the information and/or personal data that we collect, and process may be transferred to, and stored at, a destination outside of the UK, via a third-party system particularly when we use a cloud-based platform.  We ensure that appropriate safeguards are implemented, and your information and/or personal data will be protected in the same way that they are managed and stored in the UK. 

In the event that we transfer information to countries outside of the EEA, we will only do so where: 

1. the European Commission has decided that the country or the organisation, entity or individual to whom we are transferring to or sharing your personal data and/or information with, will protect your information and/or personal data adequately; 

2. the transfer has been authorised by the relevant data protection authority; and/or 

3. we have entered into a contract with the organisation, entity or individual with whom we are sharing your personal data and/or information (on such terms as approved by the European Commission), to ensure your information is adequately protected. 

8. Security 

We take all steps reasonably necessary to ensure that your information and/or personal data is treated securely and in accordance with this Privacy Notice. 

We implement strict procedures and security features to protect your information and/or personal data to prevent unauthorised access. Unfortunately, the transmission of information via the internet sometimes may not be completely secured from any malicious online attack, however, we will do our best to protect your information and/or personal data while we retain it for our purpose. 

9. Your rights 

We want to make sure you are aware of your rights in relation to the information and/or personal data that we process about you. We have described those rights and the circumstances in which they apply, in the table below and you can contact us at [email protected] to exercise your rights: 

Rights	Description
Access – You have the right to get access to the information and/or data that we hold about you.	If you would like a copy of the information and/or data that we hold about you please contact us
Rectification- You have a right to rectification of any inaccurate information and/or data and to update incomplete information and/or data that we hold about you.	If you believe that any of the information and/or data that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and/or data and to rectify any inaccurate data and/or information that we hold about you.
Erasure – You have a right to request that we delete your information and/or data.	You may request that we delete your information and/or data, if you believe that: we no longer need to process your information and/or data for the purposes for which it was provided; we have requested your permission to process your information and/or data and you wish to withdraw your consent; or we are not using your information and/or data in a lawful manner
Restriction – You have a right to request that we restrict the processing of your information and/or data.	You may request that we delete your information and/or data if you believe that: we no longer need to process your information and/or data for the purposes for which it was provided; we have requested your permission to process your information and/or data and you wish to withdraw your consent; or we are not using your information and/or data in a lawful manner
Portability – You have a right to data and/or information portability.	Where we have requested your permission to process your information and/or data or you have provided us with information and/or data for the purposes of entering into a contract with us, you have a right to receive the information and/or data you provided to us in a portable format.  You may also request us to provide it directly to a third party, if technically feasible     Please note that this right is only applicable to electronic processing of your personal data and when the information and/or personal data is collected directly from the individual requesting to exercise this right. We will attend to your request only in the event that the information and/or personal data is being processed based on your consent or contractual necessity.    You may also request us to provide it directly to a third party, if technically feasible.
Marketing – You have a right to object to direct marketing.	You have a right to object at any time to processing of your information and/or personal data for direct marketing purposes, including profiling you for the purposes of direct marketing.     We do not carry out processing that involves automated decision making that may affect the rights or produces legal effect on you.

10. Complaints 

We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO) to further inquire or to lodge your complaint by visiting their page at https://ico.org.uk/global/contact-us/. 

If you wish to raise a complaint on how we have handled your information or to exercise your rights you can contact our Data Protection Team who will investigate the matter via e-mail at [email protected] or write to us at Data Protection 33 Holborn, London, EC1N 2HT.