1. Who we are
VeloShip Global Ltd (“VeloShip Global”, “we”, “us”) is a company registered in England and Wales, providing allocated storage, secure transport and related services for precious metals. For the purposes of data protection law we are the controller of the personal data described in this policy.
Our registered office, company number and the contact details of the person responsible for data protection are set out at the end of this policy. If you have any question about how we use your data, please contact us using those details.
2. The personal data we collect
The data we hold depends on how you interact with us. It may include:
- Identity data: full name, date of birth, nationality, copies of identity documents and the information they contain, and photographs.
- Contact data: postal address, email address and telephone numbers.
- Due-diligence data: information about your occupation, the source of your wealth and of the funds used to acquire metal, company and trust documents, and the results of sanctions, politically-exposed-person and adverse-media screening.
- Account data: your client code, portal login, preferred language and currency, and records of your use of the client portal.
- Holdings and transaction data: the metal we hold for you, bar details, deposits, withdrawals, shipments, transfers of ownership, invoices, receipts and payments.
- Communications: messages sent through the portal or the website contact form, emails, letters and records of telephone calls.
- Next-of-kin data: names, relationships and contact details of the people you ask us to record, and the date they were last verified.
- Site and security data: visitor logs, access records and CCTV images when you visit our premises or a hand-over location.
- Website data: technical information such as IP address, browser type and the pages you view, collected through strictly necessary cookies and, if you consent, analytics cookies.
We collect most of this data directly from you. We also receive data from identity-verification and screening providers, from public registers such as Companies House, from carriers and partner vaults involved in your movements, and from people acting on your behalf.
3. How we use your data and our lawful bases
We only use personal data where the law allows us to. The main purposes and lawful bases are:
- To provide our services under our contract with you — storing, moving, insuring and certifying your metal, operating your portal account, invoicing and responding to your instructions (performance of a contract).
- To meet our legal and regulatory obligations, including anti-money-laundering and counter-terrorist-financing checks, sanctions compliance, record-keeping, tax reporting and responding to lawful requests from authorities (legal obligation).
- To protect your metal, our premises and our staff, prevent fraud and maintain the integrity of our chain of custody, including CCTV and access logging (legitimate interests).
- To manage our business, including audits, insurance, legal claims, quality control and improving our services (legitimate interests).
- To contact your next of kin or personal representatives where appropriate (legitimate interests, and to protect the interests of you and your beneficiaries).
- To respond to enquiries made through our website (legitimate interests, or steps taken at your request before entering into a contract).
- To use analytics cookies on our website, only where you have given consent (consent).
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that balancing exercise.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human involvement. Screening tools may flag matches for review, but decisions are made by our compliance staff.
5. International transfers
Because our services are international, personal data may be transferred outside the United Kingdom — for example to a partner vault in Switzerland, the United Arab Emirates, Singapore, Hong Kong or the United States, or to a carrier at the destination of a shipment. Some of our technology providers may also process data outside the UK.
Where data is transferred to a country that the UK has not recognised as providing adequate protection, we use appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or rely on an exception permitted by law, such as a transfer necessary for the performance of our contract with you. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
We keep personal data only for as long as we need it for the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements:
- Customer due-diligence records and transaction records: at least five years after the end of our business relationship, as required by the Money Laundering Regulations, and longer where the law requires or a claim is anticipated.
- Records of title, certificates of ownership and change of ownership, and chain-of-custody documents: for the life of the relationship and for at least twelve years afterwards, because they may be needed to establish title to metal long after it has left our custody.
- Invoices and accounting records: at least six years after the end of the financial year to which they relate.
- Website enquiries from people who do not become clients: up to two years after our last contact.
- CCTV images: normally 90 days, unless needed to investigate an incident.
7. How we protect your data
We apply technical and organisational measures appropriate to the sensitivity of the data we hold. These include encryption of data in transit and at rest, role-based access controls so that clients can see only their own records and staff only what their role requires, secure authentication for the client portal, short-lived links for document downloads, logging of administrative actions, staff vetting and training, and contractual controls over our processors.
No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and, where required, you, without undue delay.
8. Your rights
Subject to certain conditions and exemptions, you have the right to:
- be informed about how we use your personal data;
- access the personal data we hold about you;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, where there is no overriding reason for us to keep it;
- restrict our use of your data in certain circumstances;
- object to our use of your data where we rely on legitimate interests;
- receive data you provided to us in a portable format, where processing is based on contract or consent and carried out by automated means;
- withdraw consent at any time, where we rely on consent.
Some rights are limited by our legal obligations. For example, we cannot delete due-diligence or transaction records that the law requires us to keep, and we may be prohibited from telling you about certain reports we make to the authorities.
To exercise your rights, contact us using the details below. We will respond within one month, and may need to verify your identity before doing so.
10. Children
Our services are not directed at children and we do not knowingly collect personal data from anyone under 18, except where a minor is recorded as next of kin or beneficiary at a client’s request. In that case we hold only the minimum information needed.
11. Changes to this policy
We may update this policy from time to time. The date at the top of the page shows when it was last changed. Where changes are significant, we will tell clients through the portal.
12. Contact and complaints
Questions and requests about this policy or your personal data should be sent to our data protection lead through the contact form on our website (choose “Privacy or data request”), or by post to our registered office, marked for the attention of the Data Protection Lead.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ico.org.uk). We would, however, appreciate the chance to deal with your concerns first.