united-kingdom privacy data-protection shareholders investment
Does a UK private company need a privacy notice to store shareholders&#39; personal data?
<p>I'm the co-founder of a UK-based startup, and we're on the cusp of raising a seed round from a number of angel investors, the majority of whom will invest as private persons.</p>
<p>Our lawyers advised us to conduct KYC on our angel investors. To do that, we are looking to use <a href="https://amiqus.co/" rel="nofollow noreferrer">Amiqus</a>, which is a UK government certified Identity Service Provider.</p>
<p>It's all fine and dandy as long as we store the KYC data with Amiqus. However, we may wish to eventually stop paying their monthly subscription. When we do that, we will be able to download the KYC data in PDF form and store it ourselves.</p>
<p>Here's the question: will we need to send a privacy notice to our investors (by that time, our shareholders) before we are able to cancel our Amiqus subscription?</p>
<p>I imagine that the relationship between a company and its customers is different than that between a company and its shareholders. At a minimum, I would suspect that in the latter case, the data protection requirements should be less stringent.</p>

<h2>The GDPR applies to natural persons</h2>
<p>If your shareholders are natural persons in the EU or UK, it applies to them it exactly the same way that it applies to customers or any other natural person about who you are collecting data. If your shareholders are body corporates (e.g. other companies) or not in the EU or UK, it doesn’t apply to them.</p>
<p>Putting aside the KYC aspect, you will need to process personal information: like your shareholder’s name and address. You need to have all the aspects of GDPR compliance in place, including giving the shareholders the reasons why you are collecting data and how it will be used, before you collect it</p>
