Privacy Policy

Important Notice: This privacy policy has been prepared for structural purposes and must be reviewed and approved by a qualified legal professional before the website is published or investor data is collected. VOYA UK Ltd accepts no liability for reliance on this document prior to legal review.

1. Who We Are

VOYA UK Ltd ("VOYA", "we", "us", "our") is the data controller responsible for your personal data collected through this website and associated platforms. VOYA UK Ltd is a company registered in England and Wales. The VOYA brand and intellectual property are owned by VOYA Holdings Ltd and are used by VOYA UK Ltd under licence. VOYA Holdings Ltd does not process investor personal data.

For all data protection enquiries, please contact us at [email protected].

2. What Data We Collect

We collect the following categories of personal data depending on how you interact with us:

3. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries submitted through our contact form
• Processing and recording investor self-certification submissions
• Managing Investor Portal access and document delivery
• Notifying the VOYA team of new investor enquiries and registrations
• Complying with applicable legal obligations
• Improving our website and services through analytics

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Consent — where you have provided explicit consent, such as ticking the confirmation checkbox on the self-certification form or accepting analytics cookies.
• Legitimate interests — for operating our business, responding to enquiries, and improving our website, where those interests are not overridden by your rights.
• Legal obligation — where processing is required to comply with applicable law.
• Pre-contractual steps — where processing is necessary to take steps at your request before entering into an agreement.

5. Data Security

All data submitted through this website is transmitted over encrypted HTTPS connections. Authentication on the Investor Portal is handled via signed JWT session tokens and credentials are never stored in plain text. Investor data is held on a managed cloud database with encryption at rest provided by the hosting infrastructure. Access to personal data is restricted to authorised personnel only.

While we take reasonable technical measures to protect your data, no method of transmission over the internet is completely secure. If you have concerns about the security of your data, please contact us at [email protected].

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal requirements. Self-certification records and investor enquiry data are retained for a minimum of five years. Contact form submissions are retained for up to two years. You may request deletion of your data at any time, subject to any overriding legal obligations.

7. Your Rights

Under UK GDPR, you have the following rights:

• The right to access your personal data
• The right to correct inaccurate or incomplete data
• The right to request erasure of your data (subject to legal obligations)
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time without affecting the lawfulness of prior processing
• The right to lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

8. Cookies

We use cookies to operate our website and, with your consent, for analytics purposes. Strictly necessary cookies are required for the website to function and cannot be disabled. Analytics cookies are only set with your explicit consent via the cookie consent banner displayed on your first visit. You can manage or withdraw your cookie preferences at any time by clicking the cookie settings link in the footer.

9. Third Parties

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We may share data with trusted service providers who process data on our behalf (such as cloud hosting providers) under appropriate data processing agreements. VOYA Holdings Ltd does not receive or process investor personal data.

10. Changes to This Policy

We may update this privacy policy from time to time. The date at the top of this page will reflect the most recent revision. Continued use of this website following any update constitutes acceptance of the revised policy.

11. Contact and Complaints

For any data protection queries, requests, or complaints, please contact VOYA UK Ltd at [email protected] or write to us at TK Offices, 134 Balcarres Road, Leyland, Lancashire, PR25 3ED.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.