This Privacy Notice applies to the processing of personal data in connection with Austin Powder’s Third Party Onboarding Form. The information applicable to you depends on whether your personal data are collected directly from you or obtained from a third party.
1. Controller
The controller responsible for the processing of your personal data is the Austin Powder Group entity that requests you to complete the Third Party Onboarding Form (“Austin Powder”).
2. Personal Data Collected or Processed
2.1 Where you provide your personal data directly (Article 13 GDPR)
We collect the following personal data from you directly in connection with the completion of the Third Party Onboarding Form:
• If you are a contact person of the counterparty: full name, telephone number, e-mail address(es), company, company language.
• If you act as a legal representative of the counterparty: name, date, company and signature.
• If you are a director, officer, or shareholder of the counterparty and provide information relating to past or pending criminal investigations, prosecutions, convictions, or regulatory enforcement proceedings concerning yourself: such information.
• If you are a sole trader completing the Form on behalf of your own business: full name, telephone number, e-mail address(es), and information relating to past or pending criminal investigations, prosecutions, convictions, or regulatory enforcement proceedings concerning yourself.
2.2 Where your personal data are obtained from a third party (Article 14 GDPR)
Where your personal data are not obtained directly from you, we process the following categories of personal data provided to us in connection with the submission of the Third Party Onboarding Form:
• Full name
• Date of birth
• Identity document number
• Country of residence / nationality
• Ownership percentage (major shareholders only)
• Position / function (directors and officers)
• PEP status and government connections (where applicable)
• Information relating to past or pending criminal investigations, prosecutions, convictions, or regulatory enforcement proceedings
3. Source of Personal Data (Article 14 GDPR)
Where your personal data are not obtained directly from you, the personal data are provided to us in connection with the submission of the Third Party Onboarding Questionnaire and may originate from the relevant counterparty’s records and, where applicable, publicly accessible sources (e.g. commercial registers).
Where applicable, this Privacy Notice may be provided to you together with or in connection with the submission of the Third Party Onboarding Questionnaire.
4. Purposes and Legal Bases
We process your personal data for the following purposes and on the following legal bases:
| Purpose |
Legal Basis |
| Counterparty onboarding and identity verification |
Art 6(1)(f) GDPR — legitimate interests (see section 5) |
| Counterparty integrity screening, including sanctions screening, PEP checks, and anti-corruption due diligence |
Art 6(1)(f) GDPR — legitimate interests (see section 5) |
| Compliance with statutory obligations (e.g. EU sanctions regulations, Regulation (EU) 2019/1148) |
Art 6(1)(c) GDPR — compliance with a legal obligation |
| Processing of data relating to criminal convictions, offences, or regulatory proceedings for integrity screening |
Art 6(1)(f) GDPR — legitimate interests (see section 5) |
5. Legitimate Interests Pursued
Where processing is based on Art 6(1)(f) GDPR, our legitimate interests are: the establishment and management of a compliant and secure business relationship with the counterparty, including verification of the counterparty’s identity, integrity and reliability, prevention of fraud, corruption, sanctions violations, and other regulatory risks, compliance with internal anti-corruption and integrity policies and protection of Austin Powder’s business and legal compliance position.
Where processing concerns data relating to criminal convictions, offences, or regulatory proceedings (Art 10 GDPR), such processing is carried out exclusively on the basis of Art 6(1)(f) GDPR.
Your right to object: Where processing is based on Art 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of legal claims.
6. Recipients
Your personal data may be shared with internal onboarding and compliance personnel of Austin Powder entity; Austin Powder´s subsidiaries, affiliates and divisions; Microsoft Ireland Operations Ltd (cloud infrastructure and IT services, acting as processor); LexisNexis / Bridger (third-party compliance screening service, acting as processor); providers of ERP system, and other external service providers that we use to achieve the purposes listed above.
7. Retention
We retain your personal data for 5 years following the end of the business relationship. Data processed solely on the basis of Art 6(1)(c) will be retained for the duration required by the applicable statutory obligation.
Where your personal data relating to criminal convictions, offences, or regulatory proceedings (Art 10 GDPR) are processed for integrity screening, such data will be deleted or anonymised as soon as the onboarding decision has been made, unless retention is required by a statutory obligation.
8. International Transfers
Your personal data may be transferred to Austin Powder´s subsidiaries, affiliates and divisions. The transfer is carried out on the basis of Standard Contractual Clauses pursuant to Art 46(2)(c) GDPR.
9. Your Rights
You have the right to request: access to your personal data (Art 15 GDPR); rectification of inaccurate data (Art 16 GDPR); erasure (Art 17 GDPR); restriction of processing (Art 18 GDPR); data portability (Art 20 GDPR, where applicable). You also have the right to object to processing as set out in section 5 above.
You have the right to lodge a complaint with a supervisory authority, in particular in the state of your habitual residence, place of work, or place of the alleged infringement (if it is relevant).
10. Obligation to Provide Personal Data (Article 13 GDPR)
Where you provide your personal data directly, provision of your contact details is necessary for the completion of the onboarding process. Without them, Austin Powder is unable to process the counterparty relationship. There is no statutory obligation on you personally to provide the data; however, failure to provide them can prevent the onboarding from proceeding.
11. No Automated Decision-Making
No automated decision-making within the meaning of Article 22(1) GDPR takes place in connection with this processing.
