Governance&compliance

Privacy Policy

We respect your trust in us to use, store and share your information as required. This Privacy Notice explains how Ashburton (Jersey) Limited (“Ashburton”) collects, uses, discloses and stores your personal data, and your rights in relation to the personal data that we hold.

Ashburton is subject to The Data Protection (Jersey) Law 2018, the Data Protection Authority (Jersey) Law 2018 and the EU General Data Protection Regulation ("GDPR") Regulation 2016/679.

Ashburton has a dedicated point of contact for data protection related matters whose contact details are set out in this Privacy Notice.

Ashburton may amend this Privacy Notice from time to time to reflect any changes in the way that your personal data is processed.

Who is Ashburton?

Ashburton, trades as Ashburton Investments, and is comprised of companies that are incorporated in and operate from Jersey. Any use of “us”, “we” and “our” refers to “Ashburton” for the purpose of this Privacy Notice.

The Data Controller (the individual or legal entity that determines the purposes and the means of processing personal data) of your personal information is dependent on which Ashburton product or how the service is provided to you, or the jurisdiction you (as the data subject) are based. If required, Ashburton’s data protection contact will refer you to the specific data protection contact person in respect to your product or service.

Who are FirstRand?

Ashburton forms part of the FirstRand Group. Protection of customers’ personal information is important to FirstRand and its entities. FirstRand follows general principles in accordance with applicable privacy laws and expects Ashburton Investments to do the same.

In terms of applicable privacy laws, this Privacy Notice may also apply on behalf of other third parties (such as authorised agents and contractors who provide direct services to Ashburton), acting on the group’s behalf when providing customers with solutions. If a FirstRand group business processes personal information for non-related party under a contract or a mandate, such party’s privacy policy or notice will accordingly apply.

Why do Ashburton hold personal data and when can Ashburton Process the personal data?

Data Protection laws allow Ashburton to use personal information only if Ashburton has legitimate reason to do so. The Data Protection laws as per Article 6(1) of the GDPR sets out the conditions that must be met in order for the processing of personal data to be lawful. The prescribed lawful bases are one or more of the following:

• Consent: an individual has given clear consent for Ashburton to process their personal data for a specific purpose
• Performance of a contract: processing is necessary for the performance of a contract which Ashburton has with you, or because they have asked Ashburton to take specific steps before entering into a contract
• Legitimate interests: processing is necessary for Ashburton’s legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests (this does not apply to public authority processing data to perform an official tasks)
• Legal and or Regulatory obligation: processing is necessary for Ashburton to comply with the law (not including contractual obligations)

Note, you can withdraw your consent at any time by contacting us. If you withdraw your consent, this may require termination of our services to you.

Who does this apply to?

For the purpose of this Privacy Notice a “customer”, “or “client” includes:

• Prospective investor
• New and existing custom
• Previous customers

as well as agents or representatives of the above.

Examples provided in this Privacy Notice are for illustrative purposes and are not exhaustive.

What does “process” mean?

The term “process” means how Ashburton collects, uses, stores, makes available, destroys, updates, discloses, or otherwise deals with customers’ personal information. Ashburton respects customers’ privacy and will treat their personal information confidentially.

What are Ashburton’s key data protection principles?

Ashburton shall ensure that all processes and procedures that handle and deal with personal information and/or sensitive data shall comply with the following six principles as well as the important data controller accountability requirement of the law:

1. Personal data shall be processed fairly and lawfully (“lawfulness, fairness and transparency”).
2. Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or those purposes (“purpose limitation”).
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed (“data minimisation”).
4. Personal data shall be accurate and, where necessary, kept up to date (“accuracy”).
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes (“storage limitation”).
6. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data (“integrity and confidentiality”).

How does Ashburton Investments collect your data?

Ashburton shall ensure that all processes and procedures that handle and deal with personal information and/or sensitive data shall comply with the following six principles as well as the important data controller accountability requirement of the law:

• From the information you provide to us when you meet with one of our employees
• When you communicate with us or when we communicate with you by mail, telephone, email or other forms of electronic communication, including identifiers assigned to your computer or other internet connected device including your Internet Protocol (IP) address. In this respect, we may monitor, record and store any such communication
• Information you have provided within application forms, investment services agreements or terms of business documents relating to an Ashburton product or service set up for your benefit by you, or another person on your behalf
• From other companies in the FirstRand Group
• From your appointed agents or advisers
• From publicly available sources or from third parties where we need to conduct background checks about you

What categories of data may Ashburton collect?

We may collect the following categories of personal data about you:

• Your name, date of birth, passport or national identity card details
• Country of birth, domicile and citizenship
• Gender and marital status
• Contact information such as residential or business address, email address and telephone number
• Information relating to your tax affairs including tax identification or national insurance number
• Information about your employment, family and personal circumstances
• Information about your knowledge and experience in the investment field
• An understanding of your goals and objectives in connection with your wealth
• Information relating to your financial situations such as income, expenditure, assets and liabilities, sources of wealth and your bank account details
• Information to assess whether you may represent a money laundering and terrorist financing risk, for example, whether you are a Politically Exposed Person, or have had previous criminal convictions or regulatory sanctions imposed

What is special category information?

Ashburton may, where required, also hold some ‘special category’ information, such as:

• Religious and philosophical beliefs
• Race (e.g. where a customer applies for a solution where the statistical information must be recorded)
• Ethnic origin
• Trade union membership
• Information relating to your tax affairs including tax identification or national insurance number
• Political beliefs
• Health including physical or mental health, disability and medical history
• Biometric information (e.g. to verify a customer’s identity)
• Criminal behaviour where it relates to the alleged commission of any offence or the proceedings relating to that offence

When can Ashburton process your data without your consent?

As noted above, there are some situations whereby Ashburton process your personal data without holding your specific consent. Such instances will include:

• To prepare preliminary information or a proposal for you regarding the products and investment services we offer
• For the management and administration of our business
• Seeking advice on our rights and obligations, such as where we require our own legal advice
• To meet our compliance and regulatory obligations, such as compliance with anti-money laundering and countering terrorist financing regulations and tax reporting
• Protecting the vital interests of you or others
• Our legitimate interests

Who may Ashburton share your personal data with?

• Your agents, trustees, advisers, or intermediaries
• Brokers, custodians of your assets, banks, fund administrators and third-party service providers who we may engage to assist in delivering the services to you inclusive of entities to which functions of Ashburton have been delegated to
• Our advisers (legal, auditors or otherwise) where it is necessary for us to obtain their advice or assistance
• Companies within our Group
• Payment processors where we are making payments to you
• Our auditors where it is necessary as part of their auditing functions
• With third parties who assist us in conducting background checks about you
• With relevant regulators, tax authorities and law enforcement agencies where we are required to do so
• Our data storage providers

Customers’ personal information may be processed through centralised functions and systems across companies in the FirstRand Group and it may be used for the purposes, in the manner, and with the appropriate controls as set out in this notice.

How secure is your information?

Ashburton has measures in place to ensure the security of the data we collect and that it will only be accessible by authorised staff. Any third party we work with must confirm they also adhere to data privacy controls and only process your personal information in line with our instructions.

All data processors are required by law to report (without undue delay) any security breaches involving personal data to Ashburton.

Ashburton will ensure that all data is non-recoverable from any computer systems we may have previously used within the organisation if it is replaced.

Transferring of data

To help us provide our products and services to you, your personal data may be transferred to, and processed in, countries outside Jersey and the EEA. Some of these countries may not have been deemed by the European Commission or the Jersey Office of the Information Commissioner to provide an adequate level of data protection.

In such cases, we ensure that appropriate safeguards are in place, including reliance on the European Commission’s Standard Contractual Clauses, or other valid transfer mechanisms permitted under the GDPR and the Data Protection (Jersey) Law 2018.

Where feasible, we identify the countries to which personal data is transferred. These countries allowed for data transfer currently include - South Africa.

Retention of data

Personal data may be retained for a period of up to 12 years after the termination of our contractual relationship with you in order to meet our regulatory and legal obligations. In other circumstances, we will retain information collected about you for as long as permitted for legitimate business purposes.

What happens after the required retention period?

Ashburton will then destroy your personal data including all paper and electronic records.

Who is our Data Protection Officer?

Ashburton it does not require d to have an appointed Data Protection officer, however, its Administrator - JTC Fund Solutions (Jersey) Limited will be accepting complaints on behalf of the Data Controller, and can be contacted as per the details noted in the section - “How you can contact us?”.

What are your rights?

You have a number of rights in relation to the information that we hold about you which are set out below.

• Right to request access to your personal data
• Right to request rectification of any inaccuracies in your personal data
• Right to request restrictions on the processing of your personal data
• Right to object to the processing of your personal data in certain circumstances
• Right to be forgotten (erasure of your personal data) in certain circumstances
• Right to data portability
• Right to not be subject to decisions based solely on automated processing (including profiling)
• Right to withdraw consent for those data processing activities based on consent

If you withdraw your consent, there may be situations where we continue to hold and process information about you if there is a legitimate reason for us doing so, for example: to continue to administer or manage your investments or to comply with our own legal or regulatory obligations.

Ashburton does not make any decision based on purely automated means, but if we do, we will inform data subjects of their right to object.

If you wish to exercise any of the rights set out above, please contact us using the contact details below.

We try to respond to all legitimate requests within four weeks. Occasionally it may take us longer than four weeks if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

How do you make a complaint?

If you have a complaint about how your information has been processed, you should put full details of your complaint in writing to us using the contact details noted below in the section - “How you can contact us?”.

What is the complaint process?

Upon receipt of a complaint from you (data subject) we will investigate the nature of the complaint accordingly.

We will only use the personal information we collect to process the complaint and to confirm the level of service we provide.

This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will use best endeavors to maintain anonymity. However, it may not always be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for a specified number of years (please see above for our Data Retention Policy details). It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

How can I make a complaint to the supervisory body?

If you would like to find out more about your rights under data protection legislation, or you are not satisfied with how we are processing your personal data, you can make a complaint to the supervisory body, where you reside, work or where you think an infringement took place. The supervisory authority in Jersey is the Jersey Office of the Information Commissioner (JOIC).

For further details on how to contact the JOIC visit https://jerseyoic.org

How can you contact us?

If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please submit these through our Administrator - JTC Fund Solutions (Jersey) Limited - using the methods below:

Address: [C/O Ashburton (Jersey) Limited] 28 Esplanade, St Helier, Jersey JE4 8SJ
Email: ashburton.admin@jtcgroup.com
Tel: +441534 700000

When did we last update this Privacy Notice?

We keep our privacy notice under regular review. The last update was March 2026.