This notice explains how Soleia Collective handles personal information when you visit this website, send us an enquiry, correspond with us, are introduced to us or become a client. If anything is unclear, email contact@soleia-collective.com.
1. Who we are
Soleia Collective is a trading name of Soleia Private Ltd, a company registered in England and Wales (company number 17520778). Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Our directors are Pierre Louw and Charlotte Louw.
Soleia Private Ltd is the controller of the personal data described in this notice, within the meaning of Article 4(7) of the UK GDPR and the EU GDPR. This covers enquiries for all our services, whichever is selected. We are registered with the Information Commissioner's Office (ICO), registration number ZC274746.
We intend to move the business to Mallorca and carry it on through a Spanish group: Soleia Meridian Group, S.L. and its subsidiaries Soleia Private, S.L.U. and Soleia Shoreside, S.L.U. Before that happens, we will tell existing clients and contacts, reissue this notice naming the new controller and explain what changes for you.
Email: contact@soleia-collective.com
We have not appointed a Data Protection Officer. On our current processing we are not required to.
2. Which law applies to us
- UK GDPR and the Data Protection Act 2018 are our lead framework, because Soleia Private Ltd is established in the United Kingdom. Our supervisory authority is the ICO.
- EU GDPR also applies to our processing of the personal data of individuals in the European Union, in particular Spain, because we offer services to people there.
- Anti-money laundering law. Our registration with the Institute of Chartered Accountants in England and Wales (ICAEW) for anti-money laundering supervision is in progress. We must comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. When the business moves to Spain, Spanish anti-money laundering law (Ley 10/2010) will apply instead.
Where the UK and EU regimes differ, we aim to meet both. Where a rule applies in only one country, we follow the rule of the country whose law applies.
3. What we collect and why
We collect personal data from you directly, from people who introduce you to us, from public sources and from our identity verification providers. We do not buy data.
3.1 The enquiry form on this website
- Your name. To identify and address you. Lawful basis: steps taken at your request before a contract (Art. 6(1)(b)).
- Your email address. To reply to you. Lawful basis: Art. 6(1)(b).
- The service area you select. To route your enquiry and prepare a relevant reply. Lawful basis: Art. 6(1)(b).
- The content of your message. To understand and answer your enquiry. Lawful basis: Art. 6(1)(b).
Where your enquiry does not lead to a contract, we keep a record of it on the basis of our legitimate interest in keeping a record of business enquiries and correspondence (Art. 6(1)(f)). You may object to that at any time. Providing this information is voluntary, but without it we cannot respond to you.
3.2 Email and other correspondence
If you email, call or message us, we process your name, contact details and anything else you choose to include, to correspond with you. Where your message relates to an engagement, or to a request to engage us, our lawful basis is Art. 6(1)(b). Otherwise, we rely on our legitimate interest in corresponding with you and keeping a record of our correspondence (Art. 6(1)(f)).
3.3 Business contacts and introductions
We keep a record of people we meet or are introduced to through our work, such as captains, brokers, management companies and private client advisers. This includes your name, role, organisation, work contact details, notes of our conversations and who introduced us. It comes from you, from the person who introduced us or from public sources such as company websites, LinkedIn and Companies House.
We use it to keep in touch, one to one, about the introduction or the work we are discussing. Lawful basis: our legitimate interest in building and maintaining business relationships (Art. 6(1)(f)). We only email you about our services if you have agreed to hear from us or you are an existing client, and every such email lets you opt out. If someone introduces you to us, we will point you to this notice within one month, usually in our first email to you. You can ask us to stop contacting you, or to delete your details, at any time.
3.4 Clients and identity checks
When you become a client, or act for one as a director, owner or authorised contact, we collect the information we need to deliver our services and to meet our legal duties. This includes your name, contact details, role, date of birth, nationality, home address, identity documents, proof of address, the source of funds and source of wealth involved with supporting documents, your answers to our onboarding questionnaires and, for companies, ownership and control details.
- Delivering our services and managing our relationship with you. Lawful basis: contract (Art. 6(1)(b)), or our legitimate interest where you act for a client company (Art. 6(1)(f)).
- Identity checks, anti-money laundering and sanctions screening. We must verify who our clients and their beneficial owners are and screen them against sanctions, politically exposed persons (PEP) and adverse media lists. Lawful basis: legal obligation under the Money Laundering Regulations 2017 (Art. 6(1)(c)). We use this information only to prevent money laundering and terrorist financing, unless the law allows otherwise.
- Biometric checks. Our identity verification provider compares a selfie and short video of you with the photo on your identity document. This creates biometric data. We only use this check with your explicit consent (Art. 9(2)(a)), which you give in the verification step, and the biometric data is deleted with the verification session. If you would rather not, tell us and we will verify you another way, for example by meeting you with your original documents or with certified copies.
- Information about criminal offences and public roles. Screening may reveal information about criminal convictions or allegations, or a public role that indicates political opinions. We process it only to decide whether we can act for a client and to meet our anti-money laundering obligations, under the conditions for preventing or detecting unlawful acts and for regulatory requirements in the Data Protection Act 2018 (Schedule 1, paragraphs 10 and 12). We keep an appropriate policy document for this processing and treat the information as strictly confidential.
If you do not provide the information needed for these checks, we cannot act for you.
3.5 Personal data we handle for our clients
In our work we may see personal data belonging to our clients' own staff, crew, investors, tenants or suppliers. Where we handle that data on a client's instructions, the client is the controller and its own privacy notice applies. We act as its processor, under the terms in our engagement letter.
3.6 Technical and analytics data
This site, including the enquiry form, is hosted and served by Cloudflare. Cloudflare creates server and security logs automatically, typically including IP address, date and time of request, the pages requested, referring page and browser or device identifiers. We rely on our legitimate interest in operating the site securely, preventing abuse and keeping it available (Art. 6(1)(f)).
If you accept analytics cookies, we use Google Analytics to understand how the site is used: the pages visited, time on the site, the site that referred you, your approximate location (country or city) and your device and browser. Google Analytics gives us aggregate statistics only and does not show us your IP address. Our lawful basis is your consent (Art. 6(1)(a)), which you can withdraw at any time through the Cookie settings link.
3.7 What we do not do
- We do not make decisions about you based solely on automated processing. Our identity checks use automated tools, but one of us reviews every result.
- We do not sell, rent or trade personal data.
- We do not operate accounts, logins, payment processing or user-generated content on this site.
- We do not use advertising, remarketing or cross-site profiling technologies, and we only use analytics with your consent. We do not operate a mailing list or send bulk marketing emails.
If that changes, we will update this notice first.
4. Cookies
We use cookies that are strictly necessary to deliver this website and keep it secure. These do not need your consent. Only if you accept, we also use Google Analytics cookies to understand how the site is used. We do not use advertising, remarketing or cross-site profiling technologies. You can change your choice at any time through the Cookie settings link at the bottom of every page, or block or delete cookies through your browser settings, though blocking strictly necessary cookies may stop parts of the site working. See our Cookie Policy for the detail.
5. Who we share your data with
- Service providers who process data on our instructions: Cloudflare (hosting, content delivery and enquiry-form processing), Resend (delivery of enquiry emails), Google (Google Workspace for email and file storage, and Google Analytics where you consent) and Adobe (electronic signing of engagement letters). Each is engaged under a written contract.
- Identity verification providers who run our identity, company, sanctions and PEP checks on our instructions: Didit (Spain) and Veriphy (United Kingdom). Each is engaged under a data processing agreement. Didit may also use limited pseudonymised data, as an independent controller, to detect fraud and protect the security of its service.
- Professional advisers and insurers: our lawyers, accountants and professional indemnity insurers, where necessary and under a duty of confidence.
- Regulators, law enforcement and courts: including our anti-money laundering supervisor (ICAEW, once our registration is confirmed) and the National Crime Agency, where the law requires us to disclose. In some cases the law does not allow us to tell you that we have done so.
- A successor business: the Spanish Soleia companies when the business moves to them, as described in section 1.
We do not share your data with anyone for their own marketing.
6. International transfers
Some of our providers may process data outside the United Kingdom, including in the European Economic Area and the United States. Transfers between the UK and the EEA are covered by the European Commission's adequacy decisions for the UK, renewed in December 2025, and by UK adequacy regulations covering the EEA. For transfers to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified. For any other country, we rely on an adequacy decision, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.
7. How long we keep your data
- Enquiries that do not become engagements, including related emails: 12 months from last contact.
- Business contacts and introductions: 2 years from last meaningful contact.
- Client records and engagement files: the engagement, then 6 years from its end.
- Identity checks and anti-money laundering records: 5 years from the end of the client relationship, or from the date of the check if we did not go on to act, as the Money Laundering Regulations 2017 require.
- Other email correspondence: 5 years from last contact.
- Data protection complaints: 3 years from closing the complaint.
- Server and security logs: kept by Cloudflare for a short period under its own retention policy (cloudflare.com/privacypolicy).
- Website analytics (only with your consent): 2 months in Google Analytics; analytics cookies expire after 13 months.
At the end of each period we delete or anonymise the data, unless the law requires us to keep it longer. When the business moves to Spain, Spanish law will require anti-money laundering records to be kept for 10 years, and we will update this notice.
8. How we protect your data
We apply technical and organisational measures appropriate to the risk. These include HTTPS encryption on the site, restricted access to client and contact records, device encryption, multi-factor authentication on our business accounts and collecting no more than we need. Identity and anti-money laundering records are kept in restricted folders that only our directors can access.
No transmission over the internet is completely secure. Please do not send confidential financial, identity or crew documents through the website enquiry form or by email. Clients send identity documents through our verification providers' secure links. For anything else, ask and we will provide a secure route.
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have data erased in certain circumstances
- restrict our processing in certain circumstances
- receive your data in a portable format, where applicable
- object to processing based on legitimate interests
- withdraw consent at any time, where we rely on consent
To use any of these, email contact@soleia-collective.com. We will respond within one month, or within three months for complex requests, and tell you if we need longer. We carry out reasonable and proportionate searches for your data. If we need to confirm your identity or clarify your request, the time limit starts once we have what we need. There is no charge unless a request is manifestly unfounded or excessive.
Some rights are limited by law. For example, we cannot delete anti-money laundering records before the retention period in section 7 ends, and we may be unable to tell you about some screening results where that could prejudice the prevention or detection of crime. If you withdraw consent to the biometric check, we will verify your identity another way.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first by emailing contact@soleia-collective.com with "Data protection complaint" in the subject line. We will acknowledge your complaint within 5 working days and aim to give you a full answer within one month.
You also have the right to complain to a supervisory authority:
- United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk
- Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid. aepd.es
- Or the supervisory authority in the EEA country where you live or work.
11. Changes to this notice
We will post any changes on this page and update the date at the top. Where a change is material, we will say so, and tell clients directly.