PRIVACY

Windmill Family Office Ltd is the data controller for personal information processed for WFO purposes.

Windmill Family Office Ltd

Company number 17372353

167–169 Great Portland Street

5th Floor

London W1W 5PF

United Kingdom

For the purposes of this notice, references to WFO describe Windmill Family Office Ltd when acting in its capacity as data controller.

Privacy enquiries and requests concerning personal information should be sent to:

contact@windmillfamilyoffice.com

Roger Windmill, Director of Investment & Stewardship, provides WFO-side administrative coordination for data governance and privacy requests. Statutory responsibility remains with Windmill Family Office Ltd.

The information WFO receives depends upon the Purpose and character of the relationship.

It includes, as relevant:

• names, titles and contact details;
• professional, organisational and institutional affiliations;
• the capacity in which a person acts;
• correspondence, enquiries and supporting documents;
• records of meetings, Decisions, instructions and agreed actions;
• information concerning an existing or proposed professional, commercial or institutional relationship;
• identity, ownership, Authority, compliance and diligence information;
• payment, contractual and administrative records;
• information relevant to legal rights, obligations, disputes or professional advice;
• and technical and security information generated through the operation of the website and electronic communications.

WFO receives special-category or criminal-offence information only where it is relevant, necessary and supported by an appropriate legal basis and additional condition under applicable law.

Individuals should not provide unusually sensitive personal information unless WFO has requested it or its relevance to a legitimate Purpose is clear.

WFO receives personal information:

• directly from the person concerned;
• from the organisation, family, trust, company or other body through which that person acts;
• from professional advisers, introducers and counterparties;
• from public registers, official records and professionally maintained information sources;
• and through website, email, hosting and security systems.

Where information originates from another source, WFO considers its Provenance, reliability and relevance before relying upon it.

Public availability does not create permission for indiscriminate collection, retention or use.

WFO processes personal information only where an identified Purpose and lawful basis support its use.

WFO uses information to:

• consider and respond to enquiries;
• identify the person or organisation making contact;
• assess the relevance and appropriate handling of a proposed relationship;
• maintain correspondence and relationship records;
• and administer agreed professional, institutional or commercial activity.

This processing supports WFO’s legitimate interests in conducting and protecting its affairs, responding responsibly to those who approach it and maintaining reliable institutional records.

Where an individual requests steps connected with a contract, or is personally a party to a contract, processing also takes place as necessary for those steps or for performance of that contract.

WFO uses information to support Governance, Stewardship, Decision-making, Accountability, Knowledge Management, Continuity and the preservation of appropriate Evidence.

The relevant lawful basis is WFO’s legitimate interest in maintaining a coherent, secure and accountable family-office capability, together with compliance with legal obligations where they apply.

WFO uses relevant information to:

• establish identity and Authority;
• understand ownership and control;
• conduct proportionate counterparty and professional diligence;
• prevent fraud, misrepresentation and unauthorised access;
• protect people, information, property and Capital;
• and identify legal, regulatory, reputational or security concerns.

This processing supports WFO’s legitimate interests in protecting the family, the Office, its counterparties and the integrity of its relationships. Legal obligations also apply in particular circumstances.

WFO uses information where necessary to obtain professional advice, establish or exercise legal rights, defend claims, respond to lawful Authority and comply with applicable legal, regulatory, tax, accounting or corporate requirements.

WFO relies upon consent where the relevant activity genuinely requires it. Consent is specific and withdrawable; withdrawal does not affect processing already undertaken lawfully.

WFO does not treat silence, inactivity or an unrelated relationship as consent.

Where WFO relies upon legitimate interests, those interests include:

• operating and protecting a secure private family office;
• responding to legitimate enquiries;
• establishing the identity, standing and Authority of those with whom WFO deals;
• administering professional and institutional relationships;
• maintaining accurate records and institutional memory;
• protecting family, Office and counterparty interests;
• preventing fraud, misuse and security compromise;
• conducting proportionate diligence;
• and establishing, exercising or defending legal rights.

WFO considers the necessity and proportionality of the processing and the rights and reasonable expectations of the person concerned.

WFO shares personal information only where the recipient has a legitimate need to receive it.

Recipients include, as relevant:

• authorised family members and WFO role-holders;
• legal, tax, accounting, investment, banking and other professional advisers;
• technology, communications, records, security and administrative service providers;
• counterparties and their authorised advisers during controlled diligence or a defined engagement;
• insurers, auditors and professional bodies;
• and courts, regulators, law-enforcement bodies or other lawful Authorities where disclosure is required or properly justified.

Professional and service providers receive only the information relevant to their role and remain subject to appropriate legal, contractual, professional or confidentiality obligations.

WFO does not sell personal information.

Information is not disclosed merely because it is requested. Identity, Authority, Purpose, proportionality and the appropriate disclosure channel remain controlling.

Where a service provider or professional relationship involves processing outside the United Kingdom, WFO applies the transfer mechanism required by UK data-protection law.

Depending upon the Territory and relationship, this includes an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard.

Information concerning the safeguard applicable to a particular transfer is available through the privacy contact address, subject to the protection of confidential and security-sensitive provisions.

WFO retains personal information only for as long as the Purpose for which it is held, or another proper legal, evidential, professional or institutional reason, remains.

Retention decisions take account of:

• the nature and sensitivity of the information;
• the Purpose and status of the relationship;
• legal, regulatory and professional record requirements;
• relevant limitation and claims periods;
• the need to preserve Evidence, Provenance and Decision rationale;
• Continuity and institutional-memory requirements;
• and the Risk created by further retention or premature destruction.

Information is securely deleted, anonymised or placed under appropriately restricted archival control when an active Purpose no longer remains.

Institutional or historical retention does not justify unrestricted access or unrelated reuse.

WFO applies proportionate technical and organisational controls according to the sensitivity, Value and Risk associated with the information.

The control environment includes, as appropriate:

• restricted access;
• identity and authentication controls;
• encryption in transit and at rest;
• secure records and retention arrangements;
• service-provider diligence;
• backup and Recoverability measures;
• security monitoring;
• and incident assessment and response.

Public descriptions confirm the existence and governing principles of these controls without disclosing architecture, credentials, protective arrangements or other information that creates avoidable vulnerability.

No electronic system is entirely free from Risk. WFO therefore combines preventative controls with Recoverability and appropriate response arrangements.

Depending upon the circumstances and lawful basis, individuals have rights concerning their personal information, including rights to:

• receive information about its use;
• obtain access to it;
• correct inaccurate or incomplete information;
• request erasure;
• restrict processing;
• receive eligible information in a portable form;
• and withdraw consent where consent provides the lawful basis.

These rights are subject to the conditions and exemptions established by law. WFO verifies identity and Authority before disclosing or altering protected information.

WFO does not make Decisions producing legal or similarly significant effects upon individuals solely through automated processing.

Requests should be sent to contact@windmillfamilyoffice.com.

An individual has the right to object to processing based upon legitimate interests.

WFO considers an objection against the Purpose, necessity and circumstances of the processing and stops the processing unless compelling legitimate grounds or the establishment, exercise or defence of legal claims justify its continuation.

A person who has a concern about WFO’s use of personal information should contact WFO first so that the matter receives direct consideration.

A person also has the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

United Kingdom

ico.org.uk

The public website does not use advertising cookies or behavioural analytics.

Website hosting and security infrastructure processes limited technical information, including internet-protocol addresses, request times, requested resources, device or browser characteristics and security events. WFO uses this information to deliver, protect and maintain the website and to investigate misuse or technical failure.

WFO implements appropriate notice and consent controls before activating any non-essential storage, access or tracking technology that requires them.

A public privacy notice does not create an entitlement to private family, professional, commercial or institutional information.

Detailed information is provided through the channel appropriate to the relationship and the sensitivity of the Territory. This includes relationship-specific privacy information, contractual provisions, professional terms, diligence protocols and just-in-time notices where required.

Confidentiality & Information Handling →

Diligence Request Protocol →

WFO reviews this notice when its processing, legal obligations, website capabilities or relevant professional relationships change.

The version and effective date displayed on the page identify the applicable public Time-State. Historic versions are retained where necessary to preserve the record of the information provided at an earlier time.

Effective date: 27 August 2026

Corporate Information →

Confidentiality & Information Handling →

Diligence Request Protocol →

Working with WFO →

Contact →

WFO uses personal information only for a legitimate Purpose, protects it according to its sensitivity and retains it only while an appropriate reason remains.