How personal information is handled.

Last updated: September 8, 2026. The data controller is Corvenhall Trust, trading as Corvenhall Trust, reachable at [email protected]. Replace the legal-entity placeholder with verified information before launch.

Information we collect

When you submit a form, we collect your first name, last name, email address and mobile telephone number. If a message or application function is offered, we also collect its content.

Our systems may receive IP address, device and browser information, referring page, timestamps, campaign parameters and records needed to protect the form from abuse. Account providers may request identity, financial and transaction information through a separate secure process.

How we use information

We use contact information to respond to your request, explain available services, support onboarding and maintain a record of the conversation. Technical information supports website delivery, security, fraud prevention, diagnostics and proportionate analytics.

Where you become a client, the responsible provider uses relevant records to perform the contract, administer the account and meet legal obligations. Marketing communications are sent only where permitted, and consent is requested separately when required.

Legal bases and regional requirements

Processing may be necessary to take steps at your request, perform an agreement, comply with law or pursue legitimate operational and security interests. Consent is used where the activity requires it and may be withdrawn subject to legal limitations.

Recipients

Information may be shared with the verified account or licensed service provider, affiliated service companies, hosting and communications suppliers, identity-verification vendors, professional advisers, regulators or law-enforcement bodies where authorised or required.

Each recipient should receive only the information necessary for its role. We do not sell contact details as a stand-alone product.

Retention

Unsuccessful general enquiries are normally retained only as long as needed to respond and document the interaction. Onboarding, identity and transaction records may be retained for periods required by the responsible provider's legal obligations.

Security logs are retained for a proportionate period needed to investigate incidents and protect services. Complaint records may be retained through the complaint lifecycle and any legally required period afterward.

International processing

Technology suppliers may process information outside your province, state, Canada or Australia. Information in another jurisdiction can be subject to that jurisdiction's lawful access rules. Contractual and organisational measures should be used where appropriate.

Security

Reasonable administrative, technical and physical safeguards are used according to the sensitivity and context of the information. No transmission or storage method can be promised completely secure.

Your rights

Subject to applicable law, you may request access to personal information, correction of inaccurate records, information about use and disclosure, or withdrawal of consent. Deletion, restriction or objection requests may be limited by recordkeeping, legal-claim or security requirements.

Cookies and analytics

Essential storage may support language, form and security functions. If non-essential analytics or advertising technology is added, the production site should present the required notice and controls before those technologies operate.

Children

The website is intended for adults able to enter financial-service agreements. We do not knowingly invite children to create an investment account.

Contact and complaints

Send privacy questions to [email protected]. Include enough detail to identify the relevant interaction, but do not email identity documents unless directed to a secure channel.

Policy changes

We may update this policy when services, providers or legal requirements change. The revised date identifies the version in effect from publication.

Accuracy and account updates

Please provide accurate contact information and tell the responsible provider when material account details change.

Keeping information current supports account recovery, transaction review and delivery of important notices.

We may ask you to confirm information when a record appears incomplete, inconsistent or outdated.

Privacy incidents

If personal information is accessed, used or disclosed without authority, the responsible team assesses the scope, sensitivity and risk of harm.

Affected individuals and authorities are notified where required by applicable Canadian or Australian privacy law.

Contact [email protected] promptly if you believe information submitted through this website has been exposed.

Consent and verification

Where processing relies on consent, you may withdraw that consent for future processing, subject to contractual and legal limits.

Withdrawal does not affect processing already completed while valid consent was in place.

Before answering an access or correction request, we may take reasonable steps to verify the requester's identity.

This protects personal information from being disclosed to someone who is not authorised to receive it.

Questions about this notice

We aim to explain privacy practices in clear language and to address concerns in a timely way.

If a response does not resolve your concern, you may have the right to contact the appropriate Canadian privacy regulator or the Office of the Australian Information Commissioner.

The regulator that applies can depend on your province and on the organisation responsible for the relevant processing.