CNL (CNL) and Floodlight Business Limited (Floodlight) respects the privacy of data subjects. This privacy notice will inform data subjects as to how we look after their personal data when they visit our website, contact us or receive notarial services from us or are signatories to documents we notarise where our relationship is with their employer or organisation they represent.

CNL is a UK company owned solely by notary Dawn Stallwood. Notarial acts are performed by Dawn Stallwood through this entity. CNL engages the services of other self-employed independent notaries on a consultancy basis. Each consultant notary engaged with CNL maintains his/her own ICO registration and is bound by the terms of this privacy policy in their processing of personal data of clients (and signatories, as applicable) in the performance of their notarial activities. Floodlight provides client liaison, legalisation co-ordination, administration and invoicing/billing/finance support to Company Notary on an outsourced basis. For the purposes of this privacy policy and GDPR, CNL and Floodlight are data controllers, but it may be the case thatFloodlight is a data processor depending on the support and co-ordination activities it performs from time to time.

1. Important information and who we are

This privacy notice aims to give data subjects information on how CNL collects and processes their personal data through their
interaction with CNL employees, consultants or agents, use of our website, including any data they may provide through our
website when they sign up to our newsletter or updates, make an enquiry about legalisation formalities or complete the contact
us form.

It is important that data subjects read or are made aware by their employer or organisation of this privacy notice together with
any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing
personal data about them so that they are fully aware of how and why we are using their data. This privacy policy supplements
the other notices and is not intended to override them.

We ask our clients to agree to this policy statement when they first deal with us and such agreement then covers future services
and engagement with CNL.

Controller
CNL is the data controller for the purposes of General Data Protection Regulation (GDPR) (collectively referred to as “COMPANY”, “we”, “us” or “our” in this privacy policy).

We have appointed a data privacy manager. Contact details: CNL, Dawn Stallwood – data privacy manager Email address:
notary@companynotary.com Postal address: Coveham House, Downside Bridge Road, Cobham Surrey KT19 0HF UK

Data subjects have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with any concerns before the data subject approaches the ICO so they should please contact us in the first instance.

Changes to the privacy notice and duty to inform us of changes This version was last updated on 13 September 2023. It is important that the personal data we hold about data subjects is accurate and current. Data subjects (or their employer representative who engages with us should please keep us informed if their personal data changes during our relationship with them (or their employer).

Third-party links
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about a data subject. We do not control these third-party websites and are not responsible for their privacy statements. When a data subject leaves our website, we encourage them to read the privacy notice of every website they have visited through us.

2. The data we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

When you provide us with information via our website, the personal information we collect from you at that time is limited to
name, email address, telephone number and the nature of your enquiry.

We may also collect certain Technical Data including internet protocol (IP) address, browser type and version, time zone setting
and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to
access this website.

Should CNL then proceed to perform notarial acts for you (or for an individual or company or organisation you represent or have
made the enquiry on behalf of), then we will collect additional personal information as follows:

• Identity Data of signatories: previous names, marital status, title, date of birth and gender, passport and/or driving licence
and/or National ID card information (including a photocopy or scan of the photo page of such identification documents).
• Contact Data of signatories: includes residential address, delivery address, email address and telephone numbers. We will
ask for a copy or scan of a recent utility bill or council tax statement confirming your residential address.
• Financial Data of signatories: includes bank account and payment card details.
• Transaction Data includes copies of the documentation we are performing notarial acts on, background information to the
transaction, including email correspondence. We may also need to see supporting evidence of a signatory’s authority to sign,
including board minutes, Wills, Power of Attorney or letter of authority. Sometimes we need to see birth, death or marriage
certificates, evidence of divorce, qualification or educational certificates.
• Representative Data: if you are arranging notarial services on behalf of your employer, organisation or individual, we will
maintain your contact information on our records as well.

It is important to point out that although you may have made the initial enquiry of CNL, you may be doing so on behalf of someone
else or the person our notary needs to meet or deal with is a different person to you. So you may or may not be the data subject.
If this is the case, then it is your responsibility to ensure:

• The data subject is aware of this Policy and our Terms of Business, both of which are available fromwww.companynotary.com;
• That you or your employer / organisation (as data controller) have full permission or other lawful basis for processing under GDPR to share their personal data with us and that the information you provide is accurate and relevant to our requirements;
• That they know how we will deal with their personal data, for what reasons we need it and why we retain it;
• That they know we may need to share some of their personal data with relevant third parties in order to complete the notarial acts and international documentation service we, together with Floodlight provide;
• Your organisation is compliant with GDPR as regards their personal data and being their data controller.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from a data subject’s personal data but is not considered personal data in law as this data does not directly or indirectly reveal their identity. For example, we may aggregate their Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with their personal data so that it can directly or indirectly identify them, we treat the combined data as personal data which will be used in accordance with this privacy policy.

It is rare for us to collect any Special Categories of Personal Data (this includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, criminal convictions and offences, information about health and genetic and biometric data). Where we do, it will most likely in connection with certifying a copy document that references such Special Categories of Personal Data or involves signing a document linked to such matters. Examples would be: a release form in connection with obtaining IVF treatment in Poland or certifying as a true copy a DBS check.

Failure to provide personal data
Where we need to collect personal data by law (including our Notarial Practice Rules and Anti-Money Laundering regulations),or under the terms of a contract to perform notarial services and the data subject fails to provide or make available that data when requested, we may not be able to perform the contract we have or are trying to enter into with the data subject or their employer, organisation or business (as the case may be).

In order to provide notarial services we need to satisfy ourselves as to the Identity, Capacity and ability to Execute of signatories
to documents we are attaching our seal and signature to.

3. How is personal data collected?
We use different methods to collect data from and about data subjects including through:
• Direct interactions. The data subject may give us their personal data by filling in forms online or by corresponding with us by post, phone, email, or meeting with our notary. We use an online practice management workflow suite of tools and resources, which includes an information form, which our notaries (employed of consultant) complete electronically on secure mobile devices (smartphone/iPad/tablet/laptop). This information is then uploaded onto our electronic storage
facility (presently Dropbox for Business, noting that we may move to another, as secure electronic storage facility if we consider appropriate for practice management purposes). We also retain a hard copy of that information form and the contact information is uploaded onto our CRM and financial management system (presently XERO).
• Automated technologies or interactions. As a data subject interact with our website, we may automatically collect Technical Data about their equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
• Third parties or publicly available sources. We may receive personal data about the data subject from various third parties and public sources, for example UK Companies House or via their employer or client (where you perform services).

4. How we use personal data
We will only use personal data of data subjects when the law allows us to and we will use such personal data in accordance with this Privacy Policy statement and GDPR.

Most commonly, we will use their personal data in the following circumstances:

• Where we need to perform the contract that we are about to enter into or have entered into with them or their employer, organisation, business or client.
• Where it is necessary for our legitimate interests (or those of a third party) and the data subjects’ interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Generally, we do not rely on consent as a legal basis for processing a data subjects personal data other than in relation to sending third party direct marketing communications to a data subject via email or text message. Data subjects have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use personal data
We have set out below, in a table format, a description of all the ways we plan to use personal data in connection with notarial acts, and which of the legal bases we rely on to do so. Note that we may process personal data for more than one lawful ground depending on the specific purpose for which we are using such data.