Offa counterparty privacy notice

We want to make sure you are informed about how we at Offa collect, use and look after your personal information.

This Privacy Notice explains how we process personal information relating to:

• Third-party vendors and service providers (including individuals acting on behalf of organisations)
• Investors and funders (including individuals and representatives of investment entities)
• Directors who are not employed by Offa (non-staff directors)
• Shareholders who are not employed by Offa (non-staff shareholders)

This includes personal information we collect directly from you, from your organisation, or from third parties as part of due diligence, onboarding, governance, ownership verification, and ongoing compliance processes.

This Privacy Notice applies to individuals who interact with Offa in a business, professional, governance, or financial capacity. Where you engage with Offa as a customer or as a member of staff, a separate privacy notice will apply.

Who we are

When we refer to Offa in this Privacy Notice we are referring to:

• Offa Operations Ltd (company number 11609468)
• Offa Finco 1 Limited (company number 12222819)
• Offa Finco 2 Limited (company number 14262691)
• Offa Finco 3 Limited (company number 13753107)
• Offa Finco 4 Limited (company number 15957570)
• Offa Finco 5 Limited (company number 15957668)
• Offa Finco 6 Ltd (company number 11774710)
• Offa Mezz 1 Ltd (company number 14374352)
• Offa Bridge Limited (company number 15305915)
• Offa Money Limited (company number 11770367)
• Offa Money Too Limited (company number 14947156)

each with its registered office at First Floor, Dominion Court, 39 Station Rd, Solihull, B91 3RT, trading as Offa.

Separately, the following entities also act as data controllers in relation to certain products or services and may act as joint controllers where applicable:

• Offa BTL Ltd (company number 15267037) (joint controller)
• Registered office: C/O Trustmoore (Uk) Ltd 120 Pall Mall, 4th Floor, London, United Kingdom, SW1Y 5EA
• Offa PGN SPV Limited (company number 16283201) (joint controller)
• Registered office: C/O Tmf Group 13th Floor, One Angel Court, London, United Kingdom, EC2R 7HJ

Each of the listed entities is registered with the Information Commissioner’s Office (ICO) as a data controller and may act as a controller of your personal information depending on the product or service provided. Where more than one entity is involved, they may act as joint controllers. Details of their respective responsibilities are available on request.

The personal information we collect

Depending on your relationship with Offa, we may collect the following categories of personal information:

Identity Information

• Full name
• Date of birth
• Nationality
• Copies of identification documents (passport, driving licence or equivalent)

Contact Information

• Address and previous addresses
• Email address and telephone number

Role and relationship information

• Position (e.g. director, shareholder, investor, vendor representative)
• Ownership interests and shareholding structure
• Company or entity affiliation
• Authority to act on behalf of an organisation

Verification and due diligence information

• Proof of address
• Sanctions, politically exposed person (PEP), and adverse media screening results
• Beneficial ownership information
• Corporate structure and control information

Financial and compliance information (where applicable)

• Source of funds and source of wealth information (particularly for investors and shareholders where relevant)
• Bank account details (where required)
• AML / CDD documentation and verification records

Governance and risk information

• Fit and proper assessments (for directors)
• Internal due diligence records
• Compliance screening outcomes
• Correspondence relating to onboarding and ongoing monitoring

How we collect your personal information

We may collect personal information:

• Directly from you (forms, onboarding documentation, correspondence, meetings)
• From your organisation or appointing entity
• From public sources (e.g. Companies House and similar registers)
• From third-party verification providers (including AML and identity verification services)
• From credit reference agencies and fraud prevention agencies (where applicable)
• From other entities within the Offa group

Where personal information is obtained indirectly, this Notice will be provided to you where required under UK GDPR.

How we use your personal information

We use your personal information for the following purposes:

Vendors and service providers

• Onboarding and identity verification
• Due diligence and risk assessment
• Contract management and administration
• Payment processing and financial administration
• Ongoing supplier risk monitoring and compliance

Investors and funders

• Investor onboarding and eligibility assessment
• AML, KYC, and source of funds/wealth checks
• Managing investment-related relationships and administration
• Regulatory and governance compliance
• Communication and reporting

Directors (non-staff)

• Fit and proper assessments and governance checks
• Identity and background verification
• Compliance with regulatory and corporate governance obligations
• Ongoing monitoring of roles and responsibilities
• Regulatory reporting and record keeping

Shareholders (non-staff)

• Verification of ownership and control structures
• Beneficial ownership assessment
• AML and financial crime prevention checks
• Compliance with corporate governance and regulatory obligations
• Maintenance of statutory shareholder records

General purposes

• Compliance with legal and regulatory obligations
• Prevention of financial crime (including fraud and money laundering)
• Protection of Offa’s legal rights and interests
• Internal risk management and business operations

Lawful basis for processing

We rely on the following lawful bases:

• Compliance with legal obligations
• Performance of a contract or steps prior to entering into a contract
• Legitimate interests (including governance, risk management, compliance, and business administration)
• Consent (where required in limited circumstances)

Where we rely on legitimate interests, these include managing our business relationships, ensuring compliance with legal and regulatory obligations, preventing financial crime, and protecting our legal rights. We balance these interests against your rights and interests.

Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal. To withdraw your consent, please contact us at Opt-out@offa.co.uk.

Where special category data is processed, we rely on explicit consent and/or Article 9(2)(g) UK GDPR together with applicable Schedule 1 Data Protection Act 2018 conditions (including fraud prevention, prevention of unlawful acts, and regulatory compliance).

Failing to provide personal information

In some cases, the provision of your personal information is required by law, or is necessary for us to enter into or perform a contract or business relationship with you.

If you do not provide required information, we may be unable to:

• onboard you or your organisation
• establish or maintain a relationship with you
• comply with legal, regulatory, or governance obligations

Identity verification and due diligence

We may conduct identity verification, AML checks, and risk assessments, including:

• Sanctions and PEP screening
• Fraud prevention checks
• Verification of identity and ownership information
• Automated risk scoring (where applicable)

Where automated decision-making produces legal or similarly significant effects, you may request human review and contest the outcome.

Marketing and Industry Updates

We may use your personal information to send you industry updates, market insights, and information about new investment opportunities that we believe may be of interest to you or your organisation.

We process your data for these purposes based on:

• Legitimate Interests: Where you are an existing counterparty or representative of a corporate entity, and the updates relate to similar professional services or investment products.
• Consent: Where we are legally required to obtain your explicit opt-in (for example, for certain types of electronic marketing to individuals).

Your Right to Opt-Out: You have the right to stop receiving marketing communications from us at any time. You can do this by:We may conduct identity verification, AML checks, and risk assessments, including:

• Clicking the “unsubscribe” link in any email we send you; or
• Contacting us directly at Opt-out@offa.co.uk.

Withdrawing your marketing preference will not affect the communications we send you regarding our ongoing business relationship, such as administrative notices, transaction details, or regulatory updates.If you are making an application on behalf of another person, they must have authorised you to act on their behalf. This means you are allowed to provide their personal information with consent for us to use it, as described above. A copy of this Privacy Notice will be emailed to all applicants where an email address is provided.

Sharing your personal information

We may share personal information with:We process your data for these purposes based on:

• Other Offa group entities
• Regulatory authorities and law enforcement agencies
• Fraud prevention and identity verification agencies
• Professional advisers (legal, audit, compliance, tax)
• IT service providers and data processors
• Financial counterparties, trustees, fund administrators, and related service providers (where applicable)
• Any other parties where required by law or with your consent

International transfers of personal information

We may transfer and process your personal information outside the United Kingdom where this is necessary for the purposes described in this Privacy Notice. This may occur where we use group entities, third-party service providers, or systems and infrastructure (including cloud-based services, identity verification platforms, AML and compliance tools, and IT service providers) that are located or operated outside the UK.

Where such transfers take place, we ensure that appropriate safeguards are implemented in accordance with UK data protection law. These safeguards may include transfers to countries recognised by the UK Government as providing an adequate level of protection for personal information, the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and completion of a transfer risk assessment together with any required supplementary technical, organisational, and contractual measures.

Where personal information is shared with group companies or third-party service providers outside the UK, they act under written contractual arrangements and are required to process personal information only on our documented instructions, implement appropriate security measures, and comply with UK GDPR-aligned data protection obligations.

We take reasonable steps to ensure that international transfers do not reduce the level of protection afforded to your personal information and that it is processed securely and lawfully at all times.

International transfers of personal information

We may transfer and process your personal information outside the United Kingdom where this is necessary for the purposes described in this Privacy Notice. This may occur where we use group entities, third-party service providers, or systems and infrastructure (including cloud-based services, identity verification platforms, AML and compliance tools, and IT service providers) that are located or operated outside the UK.

Where such transfers take place, we ensure that appropriate safeguards are implemented in accordance with UK data protection law. These safeguards may include transfers to countries recognised by the UK Government as providing an adequate level of protection for personal information, the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and completion of a transfer risk assessment together with any required supplementary technical, organisational, and contractual measures.

Where personal information is shared with group companies or third-party service providers outside the UK, they act under written contractual arrangements and are required to process personal information only on our documented instructions, implement appropriate security measures, and comply with UK GDPR-aligned data protection obligations.

We take reasonable steps to ensure that international transfers do not reduce the level of protection afforded to your personal information and that it is processed securely and lawfully at all times.

How long we keep your personal information

We retain personal information only for as long as necessary.

Typically:

• Up to 6 years after the end of the relationship or role

We may retain data longer where required for:

• Legal or regulatory compliance
• Financial crime prevention
• Dispute resolution or enforcement

Where no longer required, data is securely deleted or anonymised.

Your rights

You have rights under UK GDPR, including:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (where applicable)
• Right to restrict processing
• Right to object
• Right to data portability (where applicable)
• Right to withdraw consent
• Rights relating to automated decision-making

For more information

For general enquiries, please contact us at generalenquiries@offa.co.uk or by telephone on 0121 667 7291.

For further information about how to exercise your data protection rights, please contact us at compliance@offa.co.uk.

If you are unhappy about how your personal information has been used, please refer to our complaints policy. You also have a right to complain to the Information Commissioner’s Office which regulates the processing of personal information. For more information visit www.ico.org.uk.

Contact details

Offa
First Floor,
Dominion Court,
39 Station Rd,
Solihull
B91 3RT

Telephone: 0121 667 7291
General enquiries: generalenquiries@offa.co.uk
Data protection: compliance@offa.co.uk