Privacy Notice

How Data Trust Company Limited handles personal data.

This notice explains how Data Trust Company Limited ("DTC", "we", "us") uses personal data you share with us. It is given under Article 12 of the Data Protection (Jersey) Law 2018 (the "DPJL").

Who we are

Data Trust Company Limited is a Jersey-incorporated company (Company No. 161774) with its registered office at 1 Grenville Street, St Helier, Jersey, JE2 4UF. DTC is registered by the Jersey Financial Services Commission as a trust company business (TCB-15499) and is the data controller for the personal data covered by this notice. We are registered with the Jersey Office of the Information Commissioner under JOIC No. 103038.

You can contact us by email at info@datatrustcompany.com or by post at the registered office above.

What personal data we collect

This website does not use cookies, analytics, embedded trackers, or forms. It collects no personal data by itself.

We do collect personal data when you contact us — for example, by email, by phone, or by post. The data we hold is ordinarily limited to:

• Your name and the organisation you represent (if any).
• Your email address, phone number, or postal address.
• The content of your enquiry and any correspondence that follows.
• Technical data generated by the email system you use to contact us (for example, headers and timestamps).

Why we use it, and on what lawful basis

We use your personal data for the following purposes:

• Responding to your enquiry and keeping a record of the correspondence. Lawful basis: our legitimate interests under Article 8(1)(f) DPJL in operating the business, dealing with enquiries, and maintaining business records.
• Taking steps at your request prior to entering a contract, where your enquiry concerns a potential engagement with DTC. Lawful basis: Article 8(1)(b) DPJL (steps prior to entering a contract).
• Complying with legal and regulatory obligations, including record-keeping and anti-money-laundering duties. Lawful basis: Article 8(1)(c) DPJL (legal obligation).

Who we share it with

We do not sell personal data. We share it only with:

• Our service providers — hosting (Netlify, Inc.) and the email service that handles mail to @datatrustcompany.com. These providers act on our instructions and are bound by confidentiality and data-protection obligations.
• Regulators and law-enforcement bodies, where we are required or entitled to disclose — including the Jersey Financial Services Commission and the Jersey Office of the Information Commissioner.
• Our professional advisers (counsel, auditors, accountants) where disclosure is necessary for the defence or establishment of legal claims or for the operation of the business.

International transfers

Some of our service providers operate outside Jersey. Where personal data is transferred outside Jersey, we rely on transfer mechanisms permitted by Part 7 DPJL — in particular, transfers to jurisdictions JOIC has treated as providing adequate protection, or transfers protected by appropriate safeguards such as standard contractual clauses.

How long we keep it

We keep casual enquiry correspondence for up to 24 months from the last contact. Correspondence that forms part of a client engagement, anti-money-laundering (CDD) file, or other regulatory record is retained for at least 10 years after the end of the relevant business relationship, as required by Article 20 of the Money Laundering (Jersey) Order 2008 and the JFSC AML/CFT Handbook.

Your rights

Under the DPJL you have the right to:

• Ask for a copy of the personal data we hold about you (right of access).
• Ask us to correct data that is inaccurate or incomplete (right to rectification).
• Ask us to erase your data, subject to the limits on that right (right to erasure).
• Ask us to restrict or object to certain processing.
• Withdraw any consent you have given (where we rely on consent).
• Receive a copy of your data in a portable format in certain circumstances.

To exercise any of these rights, email info@datatrustcompany.com. We will respond within one month.

Complaints

If you are not satisfied with how we have handled your personal data, you can complain to the Jersey Office of the Information Commissioner — jerseyoic.org.

Changes to this notice

We may update this notice from time to time. The version date below tells you when it was last changed.

Version 1.0 — 21 April 2026