1. BACKGROUND

1. 1.1  The Cayman Islands Data Protection Law 2017 came into force on the 30 September 2019 and was duly revised in 2021 by the Cayman Islands Data Protection Act (2021 Revision) (the “DPL”) and, in essence, requires companies operating in Cayman to adopt international best-practices for the storage and use of data about individuals. The law is based on the EU’s GDPR legislation although there are some differences notably with respect to notification protocols, fines and other areas
2. 1.2  HLX Management Ltd. and Helix Advisory Services Ltd. (“HLX”) is a Data Controller (this is a defined term in the DPL). This means that we follow the rules and regulations in how we maintain and process Personal Data. If HLX appoints a third party to process Personal Data that party is defined as a “Data Processor” and HLX is required to ensure that they uphold the same high standards of data protection as we do. You will see a list of those who are our Data Processors later in this document

2. WHAT TO DO IF YOU HAVE QUESTIONS

1. 2.1  If you have any questions or concerns about the legislation or indeed about how HLX handles Personal Data about you then please do obviously email us. If you feel we are not satisfactorily answering your questions or requests then you have the right to approach the Information Commissioner, who, in Cayman is defined as the Cayman Islands Ombudsman. This person has the power to undertake investigations. The Ombudsman’s details are found at https://ombudsman.ky/
2. 2.2  Also, at this website there are various documents that may help individuals understand better what their rights are, what the responsibilities of companies are and what the law and associated regulations say. We encourage you to review the Ombudsman’s website if you have any questions or concerns.

3. OUR USE OF PERSONAL DATA

In this section we explain how HLX uses Personal Data, why it needs to collect Personal Data and what we may do with Personal Data. This section is not exhaustive as unexpected reasons for processing data may arise, and users must be aware of and accept this.

1. 3.1  HLX collects personal data for a variety of reasons, most of which are required by regulation as set out and governed by the Cayman Islands Monetary Authority (“CIMA”)
2. 3.2  By law, we are required to carry out Anti-Money Laundering (“AML”), Counter Terrorist Financing (“CFT”), Proliferation Financing (“PF”) and other Know Your Customer (“KCY”) checks on each prospective and actual customer and to keep this information up-to-date and accurate
3. 3.3  As a result of this we must maintain information on our prospective and actual clients (collectively “Clients”) that enables us to unambiguously identify them.
4. 3.4  This includes collecting information such as date-valid passport details, driving licence details, other identification documents, as well as address verification documents, banking details, details of professional advisors (including reference letters) and then run checks using a range of systems that check those details against internationally recognised databases of persons with whom one should not be conducting business.
5. 3.5  In certain instances, where for instance a client is designated high risk, additional investigations may be undertaken. Such investigations may seek to identify the person’s business activities, their business partners, persons with whom they are known to spend time with, people they have transacted with, places they have visited or other matters, including financial.
6. 3.6  Where, despite these other investigations there still remains some ambiguity as to the identity of an individual (perhaps because of a common name or because the name appears on a watchlist), then HLX shall undertake additional investigations that will identify more information about the individual such as family members, acquaintances, schooling, travel, social activities or memberships of organisations. This may be necessary so as to rule out that person from being a match to someone on a watchlist or similar.
7. 3.7  You should expect that we will share Personal Information with the appropriate Regulatory and Legal Authorities in order to discharge our regulatory obligations. In the event that we receive a legitimate request for information from a Government, Court, Police or other authorised body we shall comply with such request.
8. 3.8  We will do our best to ensure that we communicate to you the parties with whom your Personal Data is shared. We must stress though that there may be instances where we are prohibited from so doing, perhaps due to a court order, police or other investigation, or for other regulatory reasons. In those instances we may not be able to advise you as to how your data is shared.

4. THE DPL AND ITS OBLIGATIONS

In this section we give some additional information on the Data Protection Law and what its core ingredients are. We shall not however be republishing the entirety of the DPL in this section as this would serve no useful purpose when it is clearly available on the ombudsman’s website. We strongly encourage you to visit that website to understand more about the principals behind the DPL

1. 1. 4.1  HLX ensures that all Personal Data that we collect complies with the DPL
   2. 4.2  We therefore need to ensure that we comply with the eight data protection principles as set out in the DPL
   3. 4.3  In this document we set out the principles but guide you to ombudsman.ky for greater detail on the specifics of these principles as recreating them here would be burdensome to you and make this document unnecessarily complex thereby diminishing its core purpose and value
   4. 4.4  The 8 DPL Principles are:
      
      1. 1. Fair and Lawful Processing
      2. 2. Purpose Limitation
      3. 3. Data Minimisation
      4. 4. Data Accuracy
      5. 5. Storage Limitation
      6. 6. Respect for the Individual’s Rights
      7. 7. Security-Integrity and Confidentiality
      8. 8. International Transfers

5. RETENTION OF DATA

In this section we advise how long we store Personal data for

1. 1. 1. 5.1 As we are a CIMA regulated entity we are required to retain Personal Information for a period of 5 years once a relationship has terminated
      2. 5.2 You should expect that the vast majority of Personal Data, if not all of it, shall be stored according to this policy

6. DATA STORAGE PROTOCOLS

In this section we explain how we store data, how we keep it safe and what our policies are in the event of a data breach

1. 1. 6.1  HLX stores data on clients in digital format. We use Microsoft Sharepoint and OneDrive storage systems. The data is thus stored in the cloud under the purview of Microsoft
   2. 6.2  We have reviewed and investigated, to the best of our ability, Microsoft’s protocols and standards and they confirm that their storage protocols are compliant with the GDPR. As such we rely on this and are satisfied that they understand their obligations as a Data Processor
   3. 6.3  We have enabled the Data Protection tools provided by Microsoft that allows us to flag advertent and inadvertent data breaches. Thus when Personal Information is sent outside the organisation individuals are warned and records kept of this. This helps us monitor leakages of Personal Data
   4. 6.4  We require all of our users to log on to these systems using two factor authentication protocols
   5. 6.5  We require all of our users to maintain firewalls and antivirus on their devices to protect against breaches of data due to malicious software of other digital attacks
   6. 6.6  We provide and ensure staff are trained and aware of their obligations with respect to data security and data protection
   7. 6.7  We track who in our organisation accesses or transmits any Personal Data and are able to search and investigate all inbound and outbound communication by any employee
   8. 6.8  We require users to encrypt their devices so that any inadvertent Personal Data stored on their local machine is not exploitable by malicious actors
   9. 6.9  In the event that a Data Breach were to occur we would do three things promptly:
      
      1. a. We would notify you of the incident
      2. b. We would notify the Ombudsman of the incident
      3. c. We would take protective actions to limit the scope of the breach

7. PERMITTED DATA PROCESSORS

This section sets out the entities with whom HLX shall share Personal Data with and the reasons for such sharing.