Privacy Notice

1. Introduction

ebi Portfolios Ltd is committed to protecting your personal information and privacy.

This Privacy Notice contains information about what personal details we collect, what we do with that information, who we may share it with and why, and your choices and rights when it comes to the personal information you have given us and how it is kept secure.

We may change our Privacy Notice so please check our website for updates from time to time. If we make particularly significant changes, we will contact you to let you know.

When you browse our websites, we use cookies to store information about how you use these websites to improve the quality of service provided to you. To understand the types of cookies we use and how these work when you use our websites, you can access our Cookie Policy here.

This version of our Privacy Notice was last updated August 2026.

2. Who we are

The data controller will be ebi Portfolios Ltd (ebi), incorporated and registered under company registration number 07473221, the registered office of which is Aurora, Counterslip, Bristol, BS1 6BX.

3. Information we collect and use

We take your privacy seriously and will only collect and use your personal information where it is necessary, fair and lawful to do so. We will only process your personal information where we can rely on one or more lawful bases under applicable data protection law. Depending on the purpose of the processing, our lawful basis will be one or more of the following:

a. To fulfil our contractual obligations to you; to provide you with our products and services in accordance with their terms
b. Where the processing is necessary for legitimate interests; to operate and improve our products and services and keep you informed about our products and services or for any other purposes we identify as appropriate to our business needs, or those business needs of a third party. Where the processing is in our legitimate interests, we will conduct an assessment as required by regulations, to ensure that this use of your personal information is not excessive, unnecessary, or adversely impacts your individual rights and freedoms
c. When we have received your consent; where we have obtained appropriate consents to collect or use your Personal Information for a particular purpose
d. It’s necessary for us to meet our legal or regulatory obligations, e.g., to send you annual statements, tell you about changes to Terms and Conditions or for the detection and prevention of financial crime

The Personal Information we collect and use will differ depending upon the contractual arrangement advisory firms choose to operate under when subscribing to ebi’s services.

The Personal Information we collect includes;

• General data – name, date of birth and country of residence
• Contact data – address, telephone number, e-mail address and IP address
• Identification data – government issued identification and national insurance number
• Fraud and sanctions related data – information obtained as result of our investigations, i.e. sanctions screening
• Financial data – payment information (if applicable), investment details such as portfolio numbers, balances, transaction history etc
• Telephone recordings and online chat transcripts – information obtained during recording of telephone calls or online chats with ebi staff members.
• Communication and interaction data – information about your contact and interactions with us, including meetings, telephone calls, emails, letters and other correspondence.
• Website and device data – information collected automatically when you visit or use our websites, including through cookies and similar technologies, such as IP address, device information, browser information and website usage data.
• Third Parties – ebi will also hold data relating to third parties that we currently have or previously have had commercial relationships with as well as holding data relating to ebi current or previous employees.

Children are not able to purchase products or services from us directly, and our services are not designed to be accessed by children. However, on instruction from a parent, guardian or other eligible registered contact, a child may be named as a beneficiary under certain trust arrangements or hold a Junior ISA. In these circumstances, we may collect limited personal information about the child, such as their name and date of birth, where necessary to administer the relevant arrangement or account.

4. Why we collect and use your information

We may obtain personal information from a number of sources, including directly from you, from advisory firms, from investors and from relevant third parties.

We may collect personal information:

• directly from advisory firms when they subscribe to or use our services;
• directly from investors who contract with ebi under Reliance on Others, including information provided through application forms;
• directly from investors who invest in funds managed by ebi, where personal information is required to administer, manage or support their investment;
• from non-financial professionals through our ‘Who are ebi?’ webpage;
• during telephone conversations with us;
• from emails, letters and other correspondence you send to us;
• during meetings with our business development or relationship managers;
• when you register for or attend one of our events;
• when you participate in research surveys designed to help us understand your needs and improve our products and services;
• from third parties where there is a genuine and lawful need for the information;
• from publicly available websites, registers and databases, including the Financial Conduct Authority (FCA) Register; and
• from business directories and other commercially or publicly available sources, for example to verify or update the information we hold about you, improve contact details or help us contact you where our existing information is incomplete or out of date.

5. Who we share your information with and why

We may pass your information to third party service providers, agents and other associated organisations for the purpose of completing tasks and providing services to you on our behalf.

This may include:

• Your adviser, co-trustees, where sharing is necessary in connection with the product or service you have with us.
• Third-party service providers and suppliers that support us in delivering and improving our products and services, such as technology providers, consultants, professional advisers and other specialist service providers.
• Our regulators and supervisory authorities, including the Financial Conduct Authority (FCA) and the Information Commissioner’s Office (ICO), where required.
• Law enforcement agencies and other authorised bodies, where disclosure is required or permitted for the prevention, detection or investigation of crime, fraud or other unlawful activity.
• Other organisations or professional advisers, where necessary to comply with legal obligations, establish or defend legal claims, or support the operation of our business.

Where we use third-party service providers to process personal information on our behalf, we require them to handle that information securely, only for the agreed purposes and in accordance with applicable data protection law.

To comply with our regulatory obligations, we may also share your personal information with SmartSearch and credit reference agencies to verify your identity and carry out anti-money laundering checks. Further information about how credit reference agencies process your personal data is available in the Credit Reference Agency Information Notice (CRAIN).

However, when we use third party service providers, only the Personal Information that is necessary to deliver the service is shared. Please be assured that we will not release your Personal Information to third parties beyond the firm for them to use for their own direct marketing purposes, unless you have requested us to do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crimes.

• We will not sell your information to third parties.
• We will not share your information with third parties for marketing purposes if you are a financial professional.
• If you are a non-financial professional your information will be shared for marketing purposes, when explicit consent is obtained, with recognised financial advisers.

If you would like further details of the strategic partners we may share your Personal Information with, please contact us.

6. What ebi does with your Personal Information

Information collected is used for future communications and to ensure ebi can provide our services to the data subject.

We may use client data for Management Information purposes, account management and adherence to the terms specified within ebi agreements.

The main purposes for which we use Personal Information are to;

• Communicate with you
• Process payments for services we have provided
• Provide our ongoing services
• Perform any legal obligations required of us
• Carry out our obligations arising from any contract entered by you and ebi
• Provide information to platforms for the purpose of arranging investment solutions
• Meet regulatory obligations

The ebi website may collect and use your personal information in order to operate and improve the services it provides. These uses include making the website or service easier to use by eliminating the need for you to repeatedly enter the same information and performing research and analysis aimed at improving our products, services and technologies.

7. Non-personal information

We may also capture non-personal information, which is defined as data in a form that does not hold a direct association with any specific individual user. We may capture, use, transfer, and disclose non-personal information for any purpose.

We may collect information such as language, and the time zone where our website is used so that we can better understand usage habits and improve our products, services, and advertising. This information will always be used in an aggregated form and be used to help us provide more useful information to our users and to understand which parts of our website, products, and services are of most interest. Aggregated data is considered non-personal information.

If for any reason we do combine non-personal information with personal information the combined information will be treated as personal information for as long as it remains combined and as such be applicable to the terms describing our handling of personal information.

8. Marketing and analytics

ebi will make appropriate contact with you to provide the agreed services. ebi will not contact you for marketing purposes by post, email, phone or text message unless you have given your prior consent, or where you are a business contact and we are permitted to do so under applicable data protection and electronic marketing laws, including the Privacy and Electronic Communications Regulations (PECR). You can opt out of receiving marketing communications from us at any time. Subscribed members can change marketing preferences at any time by contacting enquiries@ebi.co.uk.

8.1 Use of ‘cookies’

A cookie is a small piece of data sent from a website and stored locally in a website visitor’s web browser. Cookies were designed to be a unified and reliable mechanism for websites to remember the state of the website, or any pertinent activity the user had taken in the past. This can include accessibility preferences, logging in, shopping cart items or a record of which pages were visited by the user etc.

To make full use of the personalised features of our website, your web enabled device will need to accept cookies, as we can only provide you with the personalised features of this website by using them.

ebi’s cookies do not store any sensitive information, they simply hold the ‘key’ that once you’re logged in, is associated with this information. However, if you would prefer to disable cookies, you can switch them off by setting your bowser preferences. Turning cookies off may result in a loss of functionality when using ebi’s website. See the Cookie Policy for more information.

8.2 Remarketing Advertising

ebi use remarketing audiences to advertise its services online. These audiences include past visitors to the ebi website.

Third party vendors, such as Google, may use this information to provide you with advertisements that are customised to your particular preferences, including for companies that are not affiliated with ebi. You may see these advertisements on ebi’s website and 3rd party Apps and websites, and across different devices you use.

Third party vendors or advertising networks may collect IP addresses, unique device identifiers (UDIDS), browser type, operating system, time zone, country, referring pages, and other information through the use of cookies, web server logs and pixel tags from your visits to ebi’s website.

You can revoke your consent to ad personalisation by Google here.

8.3 Links to other websites

ebi’s website may contain links to other websites run by other organisations. This privacy policy applies to ebi’s website only, so we encourage you to read the privacy policies and practices of other sites even if you access them using links from our website.

In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owner and operators of that third-party site and recommend that you check the policy of that third-party site.

9. Where your information is processed

We take information and system security very seriously and we strive to always comply with our obligations. We usually process your information within the UK, however, sometimes third parties we work with may process your information in countries outside of the UK, for example Zoho Corporation (ebi’s third party CRM provider) process personal data in the EU.

Where your information is transferred outside the UK, we ensure this is done in accordance with UK data protection law. This means transfers are made either to a country that the UK government has assessed as providing an adequate level of data protection (an ‘adequacy decision’), such as the EU, which currently benefits from this status, or, where no adequacy decision applies, under a legally recognised safeguard such as the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which impose contractual obligations on the receiving party to protect your information to a UK GDPR-equivalent standard.

10. How we protect your information

We are committed to keeping your personal information secure and apply appropriate technical and organisational measures to protect it. These safeguards apply to personal information held in any format, including electronic records, paper files and other media.

We use security controls designed to reduce the risk of accidental loss, unauthorised access, misuse, alteration or disclosure of personal information. Additional protections are applied where information is sensitive or confidential, including when it is stored or transmitted electronically.

Our employees receive regular data protection and information security training to help ensure personal information is handled securely and in accordance with our legal and regulatory obligations.

Our computer systems are built to a security baseline as described by internal IT policies. This includes full disk encryption, smartcard-based authentication, with aggressive automatic screen locking. Our employees undertake annual information security training, as well as ad-hoc refreshers throughout the year, that is orientated around protecting your data. Our security controls align to industry standards and good practice, providing a control environment that effectively manages risks to the confidentiality, integrity, and availability of your information.

We do not retain any paper records. Paper-based documents that are received are scanned and stored within our systems where required. The paper copies are then destroyed.

Further information on how we store personal information is available upon request.

11. How long we keep your information

To provide your product or investment, and meet our legal and regulatory obligations, we keep your personal information and copies of records we create (e.g., calls with us) while you are a client or customer of ours.

Even when you no longer have a relationship with us, we are obligated to keep information for different legal and regulatory reasons. The length of time will vary, and we regularly review our retention periods to make sure they comply with all laws and regulations

12. Your rights in relation to your information

You have statutory rights under data protection laws which you may exercise in certain circumstances. These are:

Right to be informed about how and why we are processing your personal information
• You have a right to receive clear and easy to understand information on what personal information we process and why and who we share it with via this Privacy Notice

Right of access to personal information relating to you
• You have the right of access to your information. If you wish to receive a copy of the information we hold on you, you may make a data subject access request (DSAR).
• If you would like to submit a DSAR please contact us via the contact details found in the How to contact us section.

Right to request rectification of inaccurate or incomplete personal information
• If your information is inaccurate or incomplete, you can request that we correct it.

Right to request erasure of your personal information
• You can ask us to delete your information where we no longer need it for the purposes we collected it. Where we use that information in pursuance of a legitimate interest, will we delete the information unless there is a compelling reason to continue to process it.
• We may not be able to erase your information where we are processing it for certain reasons, such as to comply with our legal and regulatory obligations.

Right to restrict processing of your personal information
• You can ask that we block or limit the extent of our processing of your information, for reasons you specify. We will ensure we do not process it in future for those reasons.
• We may not be able to apply the requested restriction in certain circumstances, such as where the processing is necessary to comply with our legal and regulatory obligations.

Right to data portability
• Where technically feasible, you can ask us for a copy of your information you have previously provided to us which we hold electronically. We will send you this in a structured, commonly used, and machine-readable format (e.g. csv file).
• You can also ask us to transfer your information to another organisation directly.
• This right only applies to information we process where it is necessary to provide the product or service you have requested, or where we rely on your consent.

Right to object to processing of your personal information
• You can object our processing of your information for direct marketing purposes.
• You can also object in certain circumstances where we process you information based on your legitimate interests, or the legitimate interest of another party, and there is no compelling reason for this to continue.

Right to not be subject to automated decision-making including profiling
You have the right to ask ebi to:
• give you information about our processing of your information.
• request human intervention or challenge a decision where our processing is solely automated.
• conduct regular checks to make sure that our automated decision making and profiling processes are working as they should.

If you wish to exercise any of the rights noted above, please contact us. We may ask you for proof of identity when you make a request to ensure we only disclose information to the right individual.

We aim to respond to all valid requests within one month. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.

Where we obtain your data other than directly from you, you will have the same or equivalent rights to those set out above.

13. How to make a complaint

We will always strive to collect, use, and safeguard your information in line with data protection laws. If you do not believe we have processed your information as set out in our Privacy Notice, please let us know immediately and we will do our utmost to make things right.

Individuals can make a data protection complaint to ebi through any of the channels below.

• By email: complaints@ebi.co.uk
• By post: Data Protection Complaints, ebi Portfolios Ltd, Suite 7, Beecham Business Park, Northgate, Aldridge, WS9 8TZ
• By telephone: 01922 472 226 (ask to be put through to the Compliance team)

We will acknowledge your Data Protection Complaint within 30 days of receipt, and investigate and respond without undue delay.

Whilst we encourage you to contact us in the first instance and we will seek to resolve any concerns promptly, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time by means of the helpline 0303 123 1113 or online form.

14. How to contact us

If you have any questions regarding this Privacy Notice or the information we collect or use about you, please contact:

ebi Data Protection Officer
ebi Portfolios Ltd, Suite 7,
Beecham House,
Beecham Business Park,
Northgate,
Aldridge,
West Midlands,
WS9 8TZ.

Telephone: 01922 472226.

email to enquiries@ebi.co.uk