Privacy Notice

Triple Point Group Privacy Notice

About Triple Point

Triple Point Investment Management LLP (“TPIM”) is part of the Triple Point group of companies (the “Triple Point Group” or “TPG”). It is a regulated financial services business with Financial Conduct Authority (“FCA”) number 456597. It is registered in England and Wales with company number OC321250 and is registered with the Information Commissioner’s Office (“ICO”), number Z1021055. ‘Triple Point’ is a trading name of TPIM and is used by other members of the Triple Point Group. 

Triple Point Administration LLP (“TPAL”) is a regulated business with FCA number 618187. It is registered in England and Wales with company number OC391352, and is registered with the ICO, number ZA049704. 

Triple Point Servco Limited (“TPS”) is an unregulated entity that provides and procures services and support to entities within the Triple Point Group. It is registered in England and Wales with company number 07586478 and is registered with the ICO, number ZA171970. 

All of the above entities are part of the Triple Point Group and are all based at Triple Point’s head office at 1 King William Street, London, EC4N 7AF. 

Please take the time to read this Privacy Notice. If you have any further questions about our Privacy Notice, or our use of your personal information, you can contact us using the details in the Contact us section at the end of this Notice. 

What is the purpose of our Notice?

This Privacy Notice sets out how we collect and use your personal information as a data controller under the UK GDPR. We recognise the importance of maintaining the privacy and security of your personal information and are committed to doing so responsibly. 

Personal information (or personal data) is any detail about you that can be used either on its own, or with other data, to identify you. 

For the purposes of this Privacy Notice, references to “Data Protection Laws” means: 

• the Data Protection Act 2018; 

• the UK GDPR (as defined in, and supplemented by, the Data Protection Act 2018); 

• the General Data Protection Regulation (Regulation (EU) 2016/679); and 

• any other applicable privacy legislation.  

The relevant TPG entity with which you contract (e.g. TPIM, TPAL or TPS, as applicable) is the data controller of your personal data. 

Personal information that we collect

We collect personal information about you in the following ways: 

• directly from you, for example, on application forms (paper or online), through investor portals, on the telephone, by email, on our websites, at our offices, or at events; 

• from individuals or organisations acting on your behalf, such as your Independent Financial Advisor (“IFA”), broker, corporate finance adviser, or other intermediary; and 

• from other sources, including credit reference agencies, fraud prevention agencies, identity verification and anti-money laundering (“AML”) providers, company registries, the electoral roll, our group companies and other publicly available sources. 

In addition, we generate some personal data ourselves when you use our websites. 

Categories of personal data that we  process include: 

• your title, name, nationality, and date of birth; 

• your contact details, such as email addresses, physical addresses and telephone numbers; 

• information about your financial position, investor certification status, and other information required when you invest, secure funding or enter into an arrangement with us; 

• information relating to the nature and scope of services, investments and transactions that you hold or conduct with us; 

• information about your education and professional qualifications and achievements, your curriculum vitae (including your employment and education history), your right to work status and National Insurance information and other information required as part of our candidate tracking and/or screening processes; 

• identification information as required by law, such as copies of passports, utility bills, driving licences, and other identification evidence, used and stored for anti-money laundering and anti-fraud purposes; 

• records of correspondence between you and us, including letters, emails and phone calls; 

• information collected from our websites, including information you provide by filling in forms on our websites, and website usage information, login details and similar, used to help us monitor traffic and optimise the user experience. Please refer to our Cookie Policy for more information on how we use cookies and analogous tools; 

• records of any feedback that you may have completed; 

• records of any survey results that you may have completed for research purposes; and 

• your image, audio and likeness (as captured on a call, webinar, in photographs or on recordings we make of an event, and on CCTV where an event is hosted at our premises). 

We may also collect and process the following special categories of personal data and data related to criminal convictions and offences where it is necessary for the purposes set out in this Privacy Notice (please also see the section on ‘Special Categories of Data’ for more details about how and why we process this type of personal data): 

• information concerning your health and medical conditions (e.g. disability and dietary needs); 

• criminal acts caught on our CCTV cameras; 

• information about any criminal history you might have (as part of our KYC, financial due diligence or screening processes); and 

• information about your political opinions, racial or ethnic origin, religion or similar beliefs, and sexual orientation. 

Some of the personal information we collect is required by law (for example, identity-verification data under AML regulations) or by contract. If you do not provide the information requested, we may be unable to verify your identity, accept your application, perform the contract or continue to provide our services to you. 

Updating your Personal Details

If any of your personal details change, please notify us promptly, using our contact details set out below. 

You can do so in some cases by logging into your online account and updating your details there directly, e.g. with Triple Point Income Service accounts. 

Alternatively, you can email to advise us of any changes. 

In some cases, such as a change of name, further supporting information may be required to enable us to comply with regulations before we can record the changes. We may also seek to verify certain information by telephone for the purpose of data security and avoiding fraud. 

How we use personal information

We use personal information for the following purposes: 

• to maintain our records and keep them up to date; 

• to respond to questions that are submitted to us; 

• to provide the services, effect the transactions, and manage the investments that we have been commissioned to provide and to communicate with you about these, including by providing statements and notices; 

• to record and monitor our interactions with you, including by recording telephone and video communications (where it is appropriate to do so or where the law requires us to); 

• to identify and prevent illegal activity including money laundering and fraud; 

• to carry out any checks that are required by applicable laws and regulations, including ongoing AML and sanctions monitoring; 

• to ensure that content on our websites is presented in the most effective and convenient manner for you and for your computer or mobile devices, and to monitor usage and interest in different areas of our websites; 

• to carry out general statistical analysis; 

• to monitor and improve the quality of our services, including by reviewing recordings of telephone and video communications for quality assurance and training purposes; 

• to assess creditworthiness in accordance with our lending frameworks; 

• to provide you with information relating to our products and services; 

• to organise and deliver our events (including adviser conferences, investor events, training sessions and webinars), to communicate and follow up with attendees, to accommodate accessibility, dietary and other reasonable requirements; 

• to share direct marketing information with you, with your consent or on the basis of our legitimate interests and in each case in compliance with Data Protection Laws;  

• to carry out our obligations, and exercise our rights in connection with our relationship with you, such as complaint handling, responding to enquiries from regulators (such as the FCA, FOS and HMRC), courts and tribunals, and establishing, exercising or defending legal claims, including under any legal agreements that you are party to;  

• to enter into or perform a contract to which you are a party (we rely on the performance of a contract lawful basis to conduct this processing); and 

• for reporting and internal administrative purposes. 

The legal basis for our use of your information

We need a lawful basis to collect and use your personal data under Data Protection Laws. In the United Kingdom, the UK GDPR establishes defined legal bases on which we can rely to process your personal data (there are additional requirements for special category data and data relating to criminal convictions and offences). This includes processing information: 

• based on your consent (for example, to send you direct marketing by e-mail); 

• where processing is necessary for the performance of a contract with you; 

• where processing is necessary for compliance with a legal obligation (for example, to comply with our reporting obligations to the FCA); and 

• in connection with a recognised legitimate interest or our (and/or your) legitimate interests (please see below for more information). 

Personal information may be collected and processed if it is necessary for a recognised legitimate interest or a legitimate interest of the organisation using the data, as long as that legitimate interest is not overridden by the privacy rights of the individual whose data is being used.  Triple Point’s legitimate interests include responding to solicited enquiries, its commercial interests in providing its services and support to its clients, providing information, research, fraud prevention, credit checks, training and monitoring, statistical analysis and in relation to employment and recruitment requirements. Unless otherwise indicated in this Privacy Notice, the lawful basis for our use of your personal data will primarily be that this information is processed in connection with our legitimate interests. 

Please note that where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. 

If you would like to change our use of your personal data, please get in touch with us using the details in the Contact us section at the end of this Notice. 

Special Categories of Data

In certain circumstances, we may need to process types of personal data that Data Protection Laws consider to be more sensitive.  

The UK GDPR considers data falling into either of the categories below to be more sensitive: 

• data relating to criminal convictions and offences; or 

• personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data (for the purpose of uniquely identifying someone), data concerning health or data concerning a person’s sex life or sexual orientation (“special category data”). 

We will only ever process this more sensitive data in a manner that is permitted under Data Protection Laws, for example: 

• where you have provided your explicit consent (such as where you have provided information on your dietary requirements or allergies or where you inform us of an accessibility requirement in respect of an in-person event); 

• where such processing is necessary for the establishment, exercise or defence of legal claims (including sharing with our insurers and legal advisers) or the prevention or detection of crime (for example, detecting criminal actions through the use of CCTV or reporting allegations to the police); or 

• where it is in your vital interests to do so, and you are incapable of giving consent (for example, to inform any specified emergency contact, the NHS or emergency services in the event of your illness or other emergencies). 

From time to time, we may need to process your special category data in order to enable or support the provision of services to you. Examples include: 

• where you want us to make reasonable adjustments or provide additional support, for example, for a disability, health condition or accessibility need. We will only use this information for that purpose; 

• in connection with certain products (such as our estate-planning solutions), where your IFA or representative may share limited health information that is relevant to the suitability or operation of the product; and 

• where we specifically ask you, or your IFA or representative, for the information in order to provide or support a service to you. 

Other than as detailed above, we do not need you to share additional special category data with us unless we have asked you to. 

Who else may have access to your information

We may disclose your information in the circumstances and to the third parties outlined below. 

• if you request us to do so or give us permission to do so; 

• if we are required to disclose or share your personal data in order to comply with any legal or regulatory obligations; 

• if necessary to do so for us to apply or enforce any agreements to which you are a party; 

• to protect our rights and property, or to ensure our safety, or that of our customers or other parties; 

• to AML/KYC providers and credit reference and/or fraud prevention agencies to check your identity and/or to prevent fraud and/or to legitimately assess credit risks (where your data is used for credit checks, the credit database will keep a record of the request and may use it if other applications are made in your name); 

• to subcontractors and agents, that operate, host or support our websites and customer facing platforms, in which case we will ensure that such subcontractors also apply responsible data protection and privacy policies; 

• to recruitment agencies, applicant tracking system (“ATS”) providers and other subcontractors involved in our candidate screening and hiring process, as further described in our Candidate Privacy Notice, in which case we will ensure that such subcontractors also apply responsible data protection, confidentiality and privacy policies; 

• for audit purposes and to meet obligations to legitimate regulatory or tax authorities; 

• to counterparties, if we sell or acquire other businesses which necessitate the sharing of personal data, in which case we will ensure that counterparties also apply responsible data protection and privacy policies; 

• to third-party technology and/or services providers in connection with client relationship management, internal business efficiencies and security in each case in compliance with and adherence to appropriate technical and organisational security measures; 

• within the Triple Point Group to support and enable our service provision to you; 

• if instructed to do so by your financial adviser as part of an agreement to provide products or services to you; 

• to professional advisers (such as lawyers or accountants); 

• to third party document production and management systems; 

• to systems that support our services, including CRMs (such as Salesforce), marketing partners (such as HubSpot), finance, expense and accounting tools (such as Oracle), and contract management systems; 

• web hosting support and service providers; and 

• registrars (such as Computershare) and brokers (such as Panmure). 

From time to time, we may also share information about your investments with authorised advisers, intermediaries, distribution partners or platform operators (the “Recipients”) to facilitate management and monitoring of your products, and to enable you to take advice from your authorised advisers. We may continue to share relevant information with those Recipients following your death, the redemption of your investment, or another relevant change in circumstances, provided such sharing is necessary and we have a continuing lawful basis and purpose for doing so. 

Unless we are required or permitted by law to continue sharing your personal data, we will stop sharing your personal data with the Recipients where we no longer have a purpose or lawful basis to do so or, where we receive a valid request to stop sharing from you or your authorised or personal representative. See the Contact Us section of this Notice for details of how to contact us. 

If we share your information with third parties, we will ensure they are obliged to process your information in compliance with applicable Data Protection Laws. We will only provide such third parties with the information they need for the purposes set out above. 

Where information is provided for the purposes of our candidate screening and/or hiring processes, and has been provided via our third party ATS platform, it will be retained for a period of 1 year after the relevant process has concluded, unless we have expressly agreed otherwise with the relevant candidate (or is otherwise being retained in compliance with our internal data retention policies/procedures). We will seek to retain such information to enable us to promote new opportunities to unsuccessful candidates, to answer queries from the relevant candidate and carry out statistical analysis. Candidates will have the ability to opt out of our (and our subcontractor’s) continued retention of their data (albeit some data may be retained for legal or regulatory reasons or as part of our, or our subcontractors’, automated archive and/or disaster recovery systems, wherein which the deletion of such information in full or in part may impair or otherwise impair the workings of such systems). 

Our websites may contain links to other sites, content, or videos (embedded or direct links) that are maintained by third parties. If you follow a link to any of these websites, please note that such sites are not maintained or controlled by us, and those third parties will have their own privacy policies, which will apply at that point.

Our use of AI 

We use approved third-party artificial intelligence, machine learning and generative AI tools (“AI“) to support our internal business operations. This may include using AI to assist with financial reporting and analysis, document production, drafting, summarising information, and preparing internal reports. 

AI tools may process personal data where it appears in business records, correspondence, contracts, supplier or customer information, financial records or other internal materials. 

We only use AI where lawful, necessary and proportionate. Our use of AI is subject to our internal AI Policy, data minimisation, security controls, vendor due diligence, contractual safeguards and applicable Data Protection Laws. We consider necessity, proportionality, fairness and security when using AI, and we carry out Data Protection Impact Assessments where required under the UK GDPR. 

AI supports human review and decision-making; it does not replace it. We do not use AI to make solely automated decisions about individuals that have legal or similarly significant effects. 

We do not permit personal data entered into our approved AI tools to be used to train or improve public or general-purpose AI models. 

Storing personal information

We are committed to ensuring the responsible handling and security of personal details held. 

Once we have received personal data, we use a variety of manual and automated procedures to ensure it is secure and to prevent unauthorised access, unlawful processing, accidental loss, destruction, or damage of your data. 

Your personal data is stored on our secure servers or those of our suppliers which may be situated outside of the UK or the European Economic Area (“EEA”). Your information may also be processed by TPG personnel or third parties who are based outside of the UK or the EEA. Where we transfer personal information outside of the UK or the EEA, we will ensure that we take steps to ensure that your personal information is processed in compliance with Data Protection Laws, including by ensuring that a compliant data transfer mechanism (such as standard contractual clauses) is in place.  

We remind and urge you to adopt responsible best practices for your passwords and your own data security more generally and to comply with any requirements related to passwords and or data security that are set out in any agreements that you have with us.  

We also remind you that the transmission of information over the internet is not secure and whilst we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted electronically to us; such transmission is at your own risk. Email technology has unfortunately evolved without native encryption (sending an email is often compared with sending a postcard through conventional mail) therefore, please do not email personal information or login details that you would be concerned about were it to be intercepted. We ask that you re-confirm important information like bank account details by telephone as a precaution against interception. 

Retention of your personal information

We will keep your personal information for no longer than is necessary for the purposes for which it is processed, in accordance with our internal policies and Data Protection Laws. 

The length of time that Triple Point will keep personal information will depend on: 

• the reasons for which we are processing the data; 

• any relevant legal or regulatory requirements that may affect the information (such as the FCA data retention requirements or statutory limitation periods, etc.); or 

• any ongoing legal or contractual obligations we might have. 

For example, the FCA requires us to retain records about your identification for a period of at least 5 years (but potentially up to 7 years) after our relationship with you has ended, and statutory limitation periods for any potential disputes can last up to 12 years. 

Once the retention period has expired, the information will be confidentially disposed of, permanently deleted, or in some cases archived. 

Please note that we cannot commit to removing any information that is required to be retained by reason of law, compliance, regulation or other governmental or court order or instrument in force at the time, provided that any information retained will be processed and secured in accordance with Data Protection Laws. 

Where we cannot immediately delete personal information from our backup or archive systems for technical reasons, we will put that information beyond use until it is overwritten or deleted in the ordinary course of our backup cycle. 

Your rights 

Aside from our own policies and approaches to data, you have various rights by law in respect of your personal data which are set out below: 

• Right of information and access (also called a subject access request or SAR) 

You have the right to know what information we hold about you and to ask to see your records. There are some exemptions, which means you may not always receive all the information we process, and there are specific statutory timeframes within which we are required to reply to any valid SAR. 

We will not usually charge you for a SAR (unless we think your request is manifestly unfounded or excessive, which is assessed on a case-by-case basis). You will, however, be asked for proof of identity as the person dealing with your request may not be a staff member you have met before. We need to be sure we are only releasing your personal data to you or to a party authorised by you to receive such information. 

• Right to object 

You also have a right to object to us processing your personal data in certain circumstances (e.g. you have the right to stop your personal data being used for direct marketing purposes).  

• Right to restrict processing 

In certain situations, you have the right to ask for processing of your personal data to be restricted, for example, because there is some disagreement about its accuracy or legitimate usage. 

• Right of erasure (‘right to be forgotten’) 

In some cases, you have the right to be forgotten i.e. to have your personal data deleted from our records. Where you have requested that we do not send you marketing materials, we will need to keep some limited information in order to ensure that you are not contacted in the future. 

Please note, whilst we will do our best to action any request to erase a data subject’s information, we cannot commit to removing any information that is required to be retained by reason of law, compliance (including bona fide internal compliance procedures), regulation or other governmental or court order or instrument in force at the time, provided that any information retained will continue to be stored and processed in accordance with Data Protection Laws. 

• Right of rectification 

If you believe our records are inaccurate or incomplete, you have the right to ask for those records concerning you to be updated. 

• Right to data portability 

The right to data portability only applies: 

• when our lawful basis for processing the information is consent or the performance of a contract; and  

• we are carrying out the processing by automated means. 

This right gives you the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to request that we transmit this data directly to another controller. 

• Rights in respect of automated decision making 

This right ensures that individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal (or similarly significant) effects concerning them or similarly affects them.  

Whilst some of our procedures may incorporate automated processing or decision making (e.g. AML checks) there will always be meaningful human involvement, and we will: (i) tell you that the decision has been made; (ii) allow you to make representations about it; (iii) provide a route for you to obtain review by a member of our staff with authority to change the decision; and (iv) give you the opportunity to contest the decision. 

No solely automated decisions will be made unless permitted by, and in accordance with, Data Protection Laws. 

The ICO provides detailed information on each of the rights listed above which can be accessed via its homepage: Information Commissioner’s Office. 

Right to lodge a complaint 

You also have the right to make a complaint directly to the relevant supervisory authority at any time, which in the UK is the ICO. You can find details about how to do this on the ICO’s website at: www.ico.org.uk/concerns/ or by calling their helpline on 0303 123 1113. 

In addition to the right to complain to the relevant supervisory authority described above, you also have the right to complain to us if you consider that we have infringed your rights under the UK GDPR. You can contact us using the details in the Contact Us section at the end of this Notice. Please provide as much detail as possible about your concern, including:  

• your name and contact details  

• the nature of your complaint  

• any relevant dates or correspondence  

We will acknowledge, investigate and respond to your complaint promptly and in accordance with timescales set by Data Protection Laws.  

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office, this right is without prejudice to your right to lodge a complaint with the Information Commissioner at any time as detailed above.

Response timeframe

We will try our best to respond to all legitimate requests without undue delay and, in any event, within the timescales applicable under Data Protection Laws. In some cases, it may take us more than a month to deal with a request (for example, if it is particularly complex or you have made several requests). We will inform you should we need more time and the reasons for this. 

Contact us

If you have any further questions about our Privacy Notice, our use of your personal information, or would like to exercise any of your rights, you can contact us at: 

Compliance Team

Triple Point Group

1 King William Street

London

EC4N 7AF

Email: [email protected]

Telephone:  020 7201 8990 

Finally, we do welcome and value all feedback, both positive and negative, and if you have any feedback for us, please let us know. 

We may modify this Privacy Notice at any time. The current version is available at: 

09 July 2026