Privacy Notice
Last updated: 20 October 2026
HSS Capital Group Ltd (“HSS”, “we”, “us” or “our”)
This notice explains how we collect, use, disclose and protect personal information. It is intended to meet the transparency requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (“PECR”), each as amended.
Important: Bracketed items must be confirmed before publication. This notice should be reviewed against HSS’s actual processing activities, systems, contracts, retention schedule and regulatory status.
1. Who we are and how to contact us
HSS Capital Group Ltd is the controller of the personal information described in this notice, except where another group entity is identified as controller at the point of collection.
Registered office:
- Company number: [Insert company number]
- Privacy contact: info@hsscg.com
- Data Protection Officer: [Confirm whether a DPO is appointed and insert contact details, or remove this line]
2. Scope
This notice applies to business contacts, actual or potential management teams and transaction participants, suppliers and professional advisers, website visitors, event attendees, and recipients of our business communications. Separate notices may apply to employees, workers, job applicants or investors.
3. Personal information we collect
Depending on our relationship with you, we may collect:
- identity and contact details, including name, title, employer, role, postal address, email address and telephone number;
- professional information, including employment history, qualifications, CV, references and professional activities;
- transaction, investment and due-diligence information, including financial information, source-of-funds or source-of-wealth information, nationality, tax residence and copies of identity documents;
- compliance information, including sanctions, politically exposed person, fraud-prevention and anti-money-laundering checks, and information relating to alleged or actual offences where permitted by law;
- communications, meeting notes, preferences, event attendance and records of our relationship with you;
- website and device information, including IP address, browser or device information, pages visited and cookie or similar-technology data; and
- any other information you provide to us or that we obtain lawfully in connection with our activities.
4. How we obtain personal information
We collect information directly from you and, where relevant, from your employer or organisation, transaction counterparties, advisers, recruiters, referees, service providers, identity-verification and screening providers, public registers, Companies House, regulatory or governmental bodies, sanctions lists, professional networking sites and other publicly available sources.
If we obtain your information indirectly, we will provide privacy information within the period required by law unless an exemption applies.
5. How we use personal information and our lawful bases
Purpose
Typical lawful basis
Manage business relationships, enquiries, meetings, events, suppliers and professional advisers
Legitimate interests in operating and developing our business; contract or steps requested before entering a contract
Evaluate, structure, complete and administer actual or potential transactions and investments
Legitimate interests; contract or pre-contract steps; legal obligation
Conduct identity, anti-money-laundering, sanctions, fraud-prevention, regulatory and other due-diligence checks
Legal obligation; legitimate interests in preventing fraud, managing risk and protecting our business
Maintain records, protect legal rights, resolve disputes and obtain professional advice
Legal obligation; legitimate interests in governance, record-keeping and establishing, exercising or defending legal claims
Operate, secure, analyse and improve our website and services
Legitimate interests; consent where required for non-essential cookies or similar technologies
Send business updates and event invitations
Consent where required by PECR; otherwise legitimate interests, subject to your right to object
Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and balance them against your rights and reasonable expectations. You may ask us for information about that assessment.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal.
6. Special category and criminal offence information
We do not seek special category or criminal offence information unless it is necessary and lawful. Where we process it, we identify both a lawful basis under Article 6 UK GDPR and an applicable condition under Article 9 UK GDPR or Schedule 1 to the Data Protection Act 2018, and apply appropriate safeguards. Depending on the circumstances, relevant conditions may include explicit consent, employment or social-protection law, substantial public interest, information made manifestly public, or the establishment, exercise or defence of legal claims.
Please do not send sensitive information unless we request it or it is necessary for a matter we are handling.
7. If you do not provide information
Some information is required by law, regulation, contract or as a condition of entering into a transaction. If you do not provide it, we may be unable to verify your identity, meet our legal or regulatory duties, respond to you, provide a service, enter into or perform a contract, or proceed with a transaction. We will tell you when information is mandatory and explain the relevant consequences.
8. Sharing personal information
We may share personal information where necessary with:
- other HSS group entities involved in the relevant relationship or transaction;
- funds, portfolio companies, investors, lenders, transaction counterparties and their advisers, where appropriate;
- professional advisers, including lawyers, accountants, auditors, consultants, insurers and tax advisers;
- IT, hosting, cloud, communications, document-management, analytics, event, due-diligence, identity-verification and screening providers;
- banks, payment providers, regulators, supervisory authorities, law-enforcement agencies, courts, tax authorities and other public bodies; and
- actual or potential purchasers, sellers or reorganised entities in connection with a corporate transaction.
We require service providers acting as processors to handle personal information only on documented instructions, protect it appropriately and meet applicable data-protection requirements. We do not sell personal information.
9. International transfers
Some recipients or systems may be located outside the UK. Before making a restricted transfer, we will use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, binding corporate rules, or an applicable statutory exception. Where required, we will complete a transfer risk assessment (also referred to in legislation as the data protection test) and implement supplementary protections.
You may contact us for further information about the safeguards used for relevant transfers.
10. How long we keep information
We keep personal information only for as long as reasonably necessary for the relevant purpose, including to meet legal, regulatory, tax, accounting, anti-money-laundering and reporting requirements, and to establish, exercise or defend legal claims. Retention periods vary according to the type of record, our relationship with you, the sensitivity of the information, risk, limitation periods and applicable requirements.
Publication check: Insert or link to the approved retention schedule, including confirmed periods for transaction and KYC files, business contacts, supplier records, marketing suppression records, website logs and cookie data.
When information is no longer required, we delete or anonymise it securely, unless continued retention is required or permitted by law.
11. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, confidentiality obligations, supplier due diligence, appropriate contractual safeguards and incident-management procedures. No transmission or storage system can be guaranteed to be completely secure.
12. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, unless we tell you otherwise and explain the applicable safeguards. [Confirm this statement against actual screening, profiling and transaction processes.]
13. Cookies and similar technologies
Our website may use cookies and similar storage or access technologies. We provide clear information about the technologies used, their purposes, relevant third parties and duration. We obtain prior consent for technologies that require consent and do not set them before consent is given. Technologies covered by a legal exception, such as those strictly necessary to provide a requested service or maintain security, may be used without consent.
You can accept, reject or manage non-essential technologies through [insert link or description of consent-management tool]. Withdrawing consent must be as easy as giving it. Browser settings may provide additional controls.
Publication check: Add a current cookie schedule naming each technology, provider, purpose, category and duration. Confirm that the website banner offers equally prominent accept and reject choices and blocks non-essential technologies until consent.
14. Direct marketing and business updates
We may send relevant business updates and event invitations where permitted by data-protection law and PECR. For electronic marketing to individual subscribers, we will obtain consent unless a valid statutory exception applies. Different rules may apply to corporate subscribers, but we will still respect objections and apply data-protection law when using personal business contact details.
Every electronic marketing message will identify us and provide a valid, simple way to opt out. You can object to direct marketing or unsubscribe at any time by using the link in a message or contacting info@hsscg.com. We may retain limited suppression information to ensure we honour your request.
15. Social media and external links
Our website may include links or sharing tools operated by third parties, including LinkedIn. Those organisations may collect information independently and act as separate controllers. Their privacy and cookie notices apply to their activities. We are not responsible for external websites, and you should review their notices before providing information.
16. Your rights
Subject to applicable law and exemptions, you may have the right to:
- ask for access to your personal information and information about its use;
- ask us to correct inaccurate or incomplete information;
- ask us to erase personal information;
- ask us to restrict processing;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive information you provided in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller, where the right to data portability applies;
- withdraw consent at any time where processing relies on consent; and
- ask for safeguards relating to qualifying solely automated decisions.
To exercise a right, email info@hsscg.com. We may need information to verify your identity. We normally respond within one month, although the law permits an extension for complex or numerous requests. We will explain if an exemption applies or a request cannot be fulfilled.
You may complain to the Information Commissioner’s Office (“ICO”), the UK supervisory authority, at www.ico.org.uk. We would welcome the opportunity to address your concerns first.
ICO registration: [Insert current registration number, if applicable]
17. Changes to this notice
We may update this notice to reflect changes in law, regulatory guidance or our processing. The current version will be published on our website, and we will highlight material changes where appropriate.
18. Publication checklist
Confirm the controller’s legal name, registered office and company number.
Confirm the privacy email and whether a Data Protection Officer is appointed.
Confirm the current ICO registration number.
Verify all data categories, sources, recipients, purposes and lawful bases against the record of processing activities.
Insert approved retention periods or a link to the retention schedule.
Confirm international destinations, transfer mechanisms, risk assessments and supplementary measures.
Complete a live cookie audit and publish the cookie schedule and consent controls.
Confirm marketing audiences, consent records, soft opt-in use and suppression procedures.
Confirm whether any solely automated decisions, profiling, children’s data or additional sector-specific processing occurs.
Obtain legal and compliance approval before publication.