Privacy Notice
Effective date: 8 July 2026
This Privacy Notice explains how Andarma Metals & Mining Partners Ltd ("Andarma", "we", "us" or "our") collects and uses personal data, the lawful bases on which we rely, how long we retain information, and the rights available to individuals under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).
It applies to visitors to our website, people who contact us, professional and business contacts, representatives of existing or prospective counterparties, suppliers and advisers, and individuals whose information we process in connection with our corporate, advisory, origination, diligence, compliance or transaction-related activities.
At a glance
- We collect only the personal data reasonably needed for our business, website, communications and legal or compliance obligations.
- We do not sell personal data.
- We do not use personal data for solely automated decisions that produce legal or similarly significant effects.
- You may object to direct marketing at any time.
- Non-essential cookies or similar technologies should be controlled through the website cookie preference tool.
1. Who we are and how to contact us
Andarma Metals & Mining Partners Ltd is the controller responsible for the personal data covered by this Notice. Our company details appear at the start of this document.
We have not appointed a statutory data protection officer. Questions, requests or concerns about our use of personal data should be sent to info@andarmapartners.com.
2. Personal data we may collect
Depending on how you interact with us, we may collect the following categories of personal data:
- Identity and professional details: name, job title, employer, professional biography, directorships, qualifications and professional interests.
- Contact details: business email address, telephone number, postal address and communication preferences.
- Communications: emails, messages, meeting notes, call records, contact-form submissions and correspondence with us.
- Business and transaction information: information connected with a company, asset, project, mandate, opportunity, investment thesis, due-diligence process or commercial relationship in which you are involved.
- Relationship information: introductions, source of contact, areas of interest, relevant relationships and records of prior interactions.
- Compliance and verification information: identification documents, date of birth, nationality, residency, ownership or control information, source-of-funds or source-of-wealth information, sanctions and politically exposed person screening results, adverse media checks and other information required for KYC, AML, anti-bribery, conflicts or regulatory purposes, where applicable.
- Financial and contractual information: payment details, invoices, contractual records, fee arrangements and information needed to administer a business relationship.
- Website and device information: IP address, device and browser information, pages visited, referral source, dates and times of access, security logs and cookie or consent preferences.
- Marketing information: records of invitations, publications or updates sent to you, your responses and any objection or opt-out.
- Recruitment information: CV, employment history, education, references, remuneration information and right-to-work information where you apply for a role or submit a professional profile.
We do not seek to collect special category data or criminal offence data through the general website. However, such information may be processed where it is relevant and lawful for a specific compliance, legal, employment or regulatory purpose, with appropriate safeguards.
3. How we collect personal data
We may collect personal data:
- directly from you, including through email, meetings, telephone calls, the website contact function, event registrations or documents you provide;
- from your employer, colleagues, advisers, introducers, counterparties or other professional contacts;
- from publicly available and professional sources, including company websites, Companies House, market announcements, stock-exchange filings, professional directories, industry databases, conference materials and professional networking platforms;
- from compliance, sanctions, identity-verification, credit-reference, fraud-prevention or due-diligence providers, where appropriate;
- from our website, hosting, security, analytics or communications systems; and
- from advisers, technical consultants, transaction participants and other organisations involved in an actual or prospective engagement or transaction.
Where we obtain personal data from another source, we will provide privacy information where required and reasonably practicable, subject to applicable legal exemptions.
4. Why we use personal data and our lawful bases
The lawful basis depends on the particular purpose and context. We may rely on more than one lawful basis where appropriate.
| Purpose | Typical data | Lawful basis | Typical retention |
|---|---|---|---|
| Responding to enquiries and developing professional relationships | Identity, contact, communications, relationship and business information | Legitimate interests; steps requested before a contract | Usually 24 months after last meaningful contact, unless a longer period is justified |
| Evaluating, originating and supporting corporate, strategic or transaction-related opportunities | Identity, professional, business, transaction, communications and relationship information | Legitimate interests; contract or pre-contract steps | Normally 7 years after the relevant engagement or transaction closes or ends |
| Entering into and administering contracts, mandates and supplier arrangements | Identity, contact, contractual, financial and communications information | Contract; legitimate interests; legal obligation | Normally 7 years after the relationship ends |
| Due diligence, KYC, AML, sanctions, conflicts, fraud prevention and regulatory compliance | Identity, ownership, verification, compliance, financial and publicly sourced information | Legal obligation where applicable; legitimate interests; substantial public interest or other condition where required | Normally 5 years after the relationship or transaction, or longer where law, regulation or a hold requires |
| Operating, securing and improving the website and systems | Device, usage, logs, security and cookie preferences | Legitimate interests; consent where required for non-essential technologies | Security logs generally up to 12 months; cookie periods as stated in the Cookie Policy |
| Sending relevant corporate or sector communications and invitations | Identity, contact, employer, interests, communications and preferences | Legitimate interests for appropriate B2B communications; consent where required by PECR | Until objection or opt-out; suppression record retained to respect the choice |
| Establishing, exercising or defending legal rights and managing risk | Any information relevant to the issue | Legal obligation; legitimate interests; legal claims condition where applicable | For the life of the matter and normally 7 years after closure |
| Recruitment and professional resourcing | Identity, contact, CV, employment, references and right-to-work data | Pre-contract steps; legitimate interests; legal obligation | Usually 12 months for unsuccessful applications; longer with consent or where legally required |
Legitimate interests means our interests, or those of a third party, in operating and developing a specialist metals and mining business, maintaining professional relationships, evaluating opportunities, protecting systems and information, preventing misconduct and managing legal and commercial risk, provided those interests are not overridden by the rights and interests of the individual.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. If you do not provide requested information
You are generally free not to provide personal data. However, certain information may be necessary for us to respond to an enquiry, enter into or perform a contract, conduct due diligence, satisfy legal or compliance requirements, or assess whether we can engage with a person or organisation. If required information is not provided, we may be unable to proceed with the relevant relationship, engagement or transaction.
6. Direct marketing and professional communications
We may send carefully targeted corporate, sector or event communications to professional contacts where it is lawful and relevant to their role. For corporate recipients, this may be based on our legitimate interests. For individuals, sole traders and certain partnerships, we will obtain consent or rely on another applicable PECR permission where required.
Every marketing communication should provide a clear way to opt out. You may ask us to stop direct marketing at any time by using the unsubscribe method provided or by contacting info@andarmapartners.com. We may retain a minimal suppression record so that we continue to respect your choice.
Your right to object
You have an absolute right to object to the use of your personal data for direct marketing. You may also object to processing based on legitimate interests. In that case, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
7. Cookies and similar technologies
Our website may use cookies, local storage, scripts, tags or similar technologies. Strictly necessary technologies may be used to provide, secure or operate the website. Non-essential technologies should be used only in accordance with the choices made through the website cookie banner or preference tool and applicable PECR requirements.
Detailed information about the technologies in use, their providers, purposes and duration should be set out in a separate Cookie Policy. You should be able to revisit and change non-essential cookie choices through the “Cookie preferences” link on the website.
8. Sharing personal data
We may share personal data, where necessary and lawful, with:
- website, hosting, cloud, email, communications, CRM, data-room, cybersecurity and IT service providers;
- professional advisers, including lawyers, accountants, auditors, compliance advisers, insurers and tax advisers;
- mining, geological, engineering, environmental, commercial, financial or other technical consultants engaged for a relevant purpose;
- existing or prospective clients, counterparties, investors, lenders, industrial partners, asset owners, advisers or transaction participants where disclosure is relevant to an engagement or opportunity and subject to appropriate confidentiality and need-to-know controls;
- identity-verification, KYC, sanctions, fraud-prevention, adverse-media and due-diligence providers;
- banks, payment providers and corporate administration providers;
- regulators, courts, law-enforcement bodies, tax authorities and other public authorities where disclosure is required or appropriate; and
- a purchaser, investor, financing source or successor in connection with a corporate reorganisation, financing, sale, merger or transfer of all or part of our business, subject to appropriate safeguards.
We require service providers that process personal data on our behalf to protect it and use it only in accordance with our instructions and applicable law.
We do not sell personal data.
9. International transfers
Some service providers, counterparties or advisers may be located outside the United Kingdom, and the metals and mining sector is inherently international. Personal data may therefore be transferred to or accessed from other countries.
Where a transfer is not covered by UK adequacy regulations, we will use an appropriate lawful safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, binding corporate rules or another permitted mechanism. We may also rely on a specific legal derogation where applicable. You may contact us for further information about safeguards relevant to your data.
10. Data security
We use proportionate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption where appropriate, secure cloud services, backup, confidentiality obligations, supplier diligence and incident-response procedures.
No online or electronic system is completely secure. Please do not send highly sensitive, confidential or transaction-specific information through a general website enquiry unless appropriate safeguards have been agreed.
11. How long we keep personal data
The table in section 4 gives typical retention periods. Actual periods may vary depending on the nature of the relationship, applicable limitation periods, legal and regulatory requirements, transaction or litigation holds, and the need to establish, exercise or defend legal claims.
When personal data is no longer required, we will delete it, anonymise it or place it beyond ordinary use in accordance with our retention procedures and technical capabilities.
12. Your data protection rights
Depending on the circumstances and the lawful basis used, you may have the right to:
- request access to your personal data and information about how it is used;
- request correction of inaccurate or incomplete personal data;
- request erasure of personal data in certain circumstances;
- request restriction of processing in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain personal data in a structured, commonly used and machine-readable format and request its transfer where the right to data portability applies;
- withdraw consent at any time where processing is based on consent; and
- complain to the Information Commissioner’s Office or another competent supervisory authority.
These rights are not absolute. We may need to verify your identity and may request information needed to locate the relevant data. We will normally respond within one month, subject to lawful extensions for complex or numerous requests. We do not usually charge a fee, but a reasonable fee may apply where permitted by law for manifestly unfounded or excessive requests.
To exercise a right, contact info@andarmapartners.com.
13. Automated decision-making
We do not currently make decisions about individuals based solely on automated processing, including profiling, where the decision produces legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.
14. Children
Our website and services are directed at professional and business audiences and are not intended for children. We do not knowingly collect personal data from children through the website. If you believe a child has provided personal data to us, please contact us so that we can review and, where appropriate, delete it.
15. Complaints
We encourage you to contact us first so that we can try to resolve any concern. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; website ico.org.uk
16. Changes to this Privacy Notice
We may update this Notice to reflect changes in law, regulatory status, services, systems, suppliers or processing activities. The current version and effective date will be published on our website. If Andarma becomes authorised or regulated by the Financial Conduct Authority, this Notice will be updated to reflect the relevant regulated entity, permissions, recordkeeping, client categorisation and financial-crime requirements.
17. Contact details
Privacy enquiries and rights requests may be sent to:
Andarma Metals & Mining Partners Ltd
Apartment 66, 8 Kew Bridge Road
Brentford, England, TW8 0FD
Email: info@andarmapartners.com
Publication note: this Notice should be read with the website Terms of Use and a separate Cookie Policy describing the actual cookies and similar technologies deployed on the live website.