Privacy and Security

Contents of this Privacy Notice:

1. Who Is Responsible For Your Personal Information?
2. What Personal Information Do We Collect?
3. How Do We Collect Your Personal Information?
4. What Are the Legal Grounds for Our Processing of Your Personal Information (Including When We Share It With Others)?
• Processing necessary to perform our contract with you
• Processing necessary to comply with our legal obligations
• Where processing is necessary for our legitimate interests
• Processing with your consent
5. How and When Can You Withdraw Your Consent?
6. Will We Share Your Personal Information With Third Parties?
7. International Transfers of Your Personal Information
8. What Should You Do if Your Personal Information Changes?
9. Profiling and Other Automated Decision Making
10. How Long is Your Personal Information Retained by Us?
11. What Are Your Rights Under Data Protection Laws?
• The right to be informed about your processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• The right to object to processing of your personal information;
• The right to restrict processing of your personal information;
• The right to have your personal information erased (the ‘right to be forgotten’);
• The right to request access to your personal information and to obtain information about how we process it;
• The right to move, copy or transfer a copy of the personal information you have provided us with (‘data portability’);
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you
12. Data Anonymization and Use of Aggregated Information
13. Future Changes to This Privacy Notice
14. Our Contact Information

Who Is Responsible For Your Personal Information?

William Blair is responsible for your personal information. Personal information is information about you or from which we can identify you. The term “William Blair” or “we”, “us” or “our” in this Privacy Notice refers to a group of companies under the brand name of William Blair, affiliates and branches. As such, the way our branches and affiliates process your personal information is also captured within this Privacy Notice, even if they have a different trading name. This Privacy Notice describes how we deal with your personal information. Specifically, your personal information will be controlled by the William Blair entity you have instructed or that is providing services or communications to you in your region.

If you have queries about this Privacy Notice or wish to exercise any of the rights mentioned in it, please contact us by referring to the contact details at the bottom of this Privacy Notice.

What Personal Information Do We Collect?

We have set out below a description of the types of personal information about you which we will process when you become a client of ours, or during the course of our corresponding with you (both when you are our client, or where you have expressed interest in becoming a client, but have not yet become one). These also include marketing initiatives, that you have either opted in to or part of an existing distribution list.

Below is a description of the different types of personal information that we will collect and process about you in different circumstances.

• personal information that we generally process regardless of how you contact us, or for what reason, includes:
• your title, full name, your contact details, including for instance your email address, home and mobile/cell telephone numbers; and/or
• your home address, correspondence address (where different from your home address) and address history (usually only for current clients, or for new clients for identification, anti-money laundering, anti-fraud and credit reference agency checks);
• If you submit an application to become a client, in the process of becoming a client or are already a client of ours, in addition to the above personal information, we may collect the following from you:
• your date and place of birth and/or age;
• financial information, including your bank account information;
• proof of identification in the form of copies of your passport, driving license or other identity documents like utilities bills;
• your tax residency and/or nationality;
• information around any financial dependants you may have;
• information around any assets and liabilities you have;
• information regarding the source/acquisition of your wealth;
• detailed information around your experience and knowledge of investments;
• information around your capacity for loss and your attitude to risk;
• personal information and contact information which you provide in correspondence with us, whether by email, written letter, or telephone call or through our online inquiry;
• system or attendance notes of meetings or calls (this will be information volunteered by you, it could include the reasons why you have decided to invest, or where your investment money has come from, by way of example); and/or
• information relating to your use of our service;
• In addition to the above, we collect the following information from you when required:
• for anti-money laundering, identity verification and negative news screening and the information returned to us from the organizations tasked with performing those checks (further information is provided below relevant to such checks);
• where you have an online account / subscription with us, such information that is used to secure your online account, the answers to security verification questions, your username and password;
• where you have tax reporting duties in other jurisdictions for which we are responsible.
• In addition to the above, depending on how you engage with us, whether it be through our website, or by visiting one of our branches, we may also collect the following information:
• if you visit one of our Branches, we may collect your physical image through our use of CCTV cameras;
• if you visit our website, we may collect your IP address and/or use cookies to gather further information about your use of our site. Please refer to the Cookie Policy available on our website.

How Do We Collect Your Personal Information?

We will generally collect personal information from you directly through discussions and taking notes, in our Application or Engagement forms, or in your correspondence with us. In addition, where you are a client of ours, or are looking to become a client of ours, we may also obtain personal information about you from other sources such as organizations which we use to perform anti-money laundering identity verification and negative news screening.

Other instances where we will not receive the information directly from you include where you have been introduced to us via your third party financial intermediary or distributor who acts on your behalf or where you have been introduced to us by a third party introducer, or where we have obtained your information from marketing lists which we can lawfully use. Some of the personal information obtained from the above organizations will have originated from publicly accessible sources.

We are required to collect some personal information by law and regulation. For example, we are required to verify your identity before we can approve any client applications. In other cases, we need the information in order to provide our services to you. For example, if you request a payment to be made from your investment account to your bank account, we need your bank account information in order to do so.

Where you choose not to provide us voluntary personal information this may reduce the quality or type of service we are able to provide (for example, without providing your e-mail address, we may only be able to contact you by postal mail so our correspondence with you will be slower).

What Are the Legal Grounds for Our Processing of Your Personal Information (Including When We Share It With Others)?

Data protection laws require us to explain what legal grounds justify our processing of your personal information (this includes sharing it with other organizations). For some processing more than one legal ground will be relevant.

We mainly use the personal information we hold about you where it is necessary for us to perform our contract with you and to enable us to comply with legal obligations. Your personal information will also be used, where necessary, to pursue our own (and sometimes other third parties’) legitimate interests, provided that when we do, your own interests and fundamental rights do not override those legitimate interests. Additionally, we can also use your personal information with your consent.

Each of the above mentioned categories or reasons for processing your personal information is commonly known as a ‘legal basis’ which justifies the processing of your personal information in accordance with data protection law. However, we appreciate that the categories themselves do not provide you with a clear understanding of what that actually means. As such, we have provided further information below about what we will do with your personal information as it relates to each of these legal bases.

• Processing necessary to perform our contract with you.

  This purpose includes such processing as is necessary for us to undertake when you become a client of ours. It will also include processing that is undertaken prior to you becoming a client of ours, but which processing is necessary for us to enter into our agreement with you (i.e. during the application stage).

  The processing may include processing:

  • to communicate with you about your investment(s), product or service (e.g. periodic statements);
  • to enable us to open an account for you with us;
  • to enable us to process the subscription or redemption of your investment or withdrawal;
  • to enable payments to be made or currency to be converted for you;
  • to evidence your ownership of an investment;
  • to verify that your instructions are genuine and to process them accordingly;
  • to inform you about the performance of your investment(s);
  • to notify you about changes to your investment(s) (such as a change of name, or fund);
  • where applicable, to allow you to exercise rights in relation to your investment(s) (such as voting rights);
  • to recover any amount owed to us or a third party whose services are linked to the service we provide to you;
  • to investigate and deal with complaints or disputes;
  • to transfer your personal information to any third party who replaces William Blair as a provider of services to you; and/or
  • to share your personal information with third parties if required for, or would assist, the management of your product or service.

• Processing necessary to comply with our legal obligations.

  There are a number of laws and regulations which we are required to comply with when we provide our services to you, as well as for our general daily operations. Some of these obligations will result in the processing of your personal information. Specifically, this may include processing:

  • to verify your identity and to carry out regulatory checks (such as anti-money laundering and identity verification checks);
  • where applicable, to comply with regulatory rules to ensure our services provided to you are suitable and/or appropriate;
  • to enable a register of investors to be maintained;
  • to contact you with notices about your investments;
  • to detect, prevent and/or investigate fraud, money laundering and other financial crimes;
  • to comply with audit requests from our auditor;
  • to combat late trading and market timing practices;
  • to ensure you are eligible for a product (such as an ISA);
  • to comply with requests made by you when exercising your legal rights (such as those contained within this Privacy Notice);
  • recording incoming and outgoing calls for regulatory purposes;
  • to carry out monitoring of trades and transactions for continued compliance with our regulatory obligations (such as anti-money laundering) and to keep records of the transactions we’ve undertaken;
  • to monitor your communications and our systems to determine compliance with regulatory rules, self-regulatory practices, or procedures relevant to our business;
  • for establishment, defence and enforcement of our legal rights;
  • when, to achieve the above purposes, we share your personal information with the following categories of individuals or organizations: law enforcement agencies and governmental and regulatory bodies such as tax authorities, financial regulators/ombudsmen and non-financial regulators (depending on the circumstances of the sharing); and/or courts and to other organizations where it is necessary for the administration of justice, to protect vital interests and to protect the security or integrity of our business operations; third parties who assist us with carrying out anti-money laundering, identity verification and negative news screening, and such other professional service providers who we use to assist us to comply with these obligations (such as lawyers, accountants, auditors, consultants and other similar professionals); and third parties to whom we owe a legal obligation to provide specified information.

• Where processing is necessary for our legitimate interests.

  This will include processing which, on balance, we consider is in our legitimate interests and which do not cause you undue prejudice. Our legitimate interests are:

  • recording incoming and outgoing calls for training, monitoring, and security purposes, as well as to keep an accurate record of any instructions received from you in relation to your investments (this would be relevant where calls are not legally required to be recorded, but where we will record them anyways for the purposes listed above);
  • administering and managing your investment account(s) and services relating to that, including, where necessary, updating your records and taking steps to update your contact address so we can contact you about your account;
  • testing the performance of our products, services and investments to ensure that we are managing our clients, and your investments, to their best potential;
  • to adhere to guidance and best practice under the regimes of governmental and regulatory bodies such as tax authorities, financial regulators/ombudsmen and non-financial regulators;
  • for management and audit of our business operations including accounting. This includes allowing other William Blair group entities to conduct audits into our processes;
  • to determine the target market for our existing and future products (e.g. determining whether a product is meeting the needs of investors generally);
  • to contact you when we have updated this Privacy Notice and consider that it is necessary to advise you about any changes to the way we are processing your personal information;
  • for marketing communications (where it is lawful for us to do so and where you have not objected to the use of our personal information for these purposes);
  • for some of our profiling, in particular where this does not have a legal effect or otherwise significantly affects you, which is done to provide you with options and a better understanding of your risk and cash flow profile (discussed further below);
  • when, to achieve the above purposes, we share your personal information with the following categories of individuals or organizations: our legal and other professional advisers, auditors; governmental and regulatory bodies such as tax authorities, financial regulators/ombudsmen and non-financial regulators (depending on the circumstances of the sharing); tax authorities who are overseas for instance if you are subject to tax in a different jurisdiction, we may share your personal information directly with relevant tax authorities (instead of through the local authority); other organizations and businesses who provide services to us under contract such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions; buyers and their professional representatives as part of any restructuring or sale of our business or assets; third parties who we use to assist with identity verification checks; and/or market research organizations who help us to develop and improve our products and services.

• Processing with your consent

  Unlike the uses described above, sometimes we rely on your consent to use your personal information. Where we do, we will provide you with further information about the purposes of the processing at the time we ask for your consent.

How and When Can You Withdraw Your Consent?

You have the right to withdraw your consent at any time by either contacting your Firm Contact, via various electronic means or contacting us using the contact information provided below. If you do withdraw your consent, this will mean that we will stop similar future processing. However, the withdrawal of your consent will not invalidate any processing which we previously undertook before you withdrew your consent.

Please note, where we rely on another lawful reason to process your personal information, withdrawing your consent will not affect that processing (such as where the processing is necessary for our performing our contract with you, or where we must process your personal information to comply with law, as described above) and we will continue to process your personal information for those purposes notwithstanding the fact that you have withdrawn your consent for one of the above listed purposes.

Will We Share Your Personal Information With Third Parties?

There are times when we are either mandated by law to disclose your personal information to third parties (such as tax authorities), additionally, we contract third parties to help us run our business and where we do so, we will also disclose your personal information to those third parties. Where we contract third parties to assist us to provide our services, we will always do so subject to appropriate contracts and safeguards being put in place.

We will never sell, rent or trade your personal information to an outside company. We will share your personal information with others who have a duty to keep it secure and confidential, and where we have a lawful reason for doing so, as explained in section 4 above. The categories of organizations that we will share your information with are:

• our service providers, agents and sub-contractors who assist us to provide our services and process information on our behalf, such as where we engage with a third party to run the day-to-day business of our Branches, IT and communications service providers, customer records management providers (who assist us in managing customer records);
• financial modelling services which are used to provide you with financial illustrations and comparison service providers who help us determine what products may be available for you depending on your specific circumstances;
• product and financial service providers from whom we acquire products, whether on your behalf or in your own name with our assistance, who will require specific information (for example, fund companies, insurance companies and pension companies);
• firms that work with us which are independently accredited wealth management providers who use our platform and some of our services to provide financial advice to you. These firms are not part of William Blair, but we work with them and they will sign you up to be a client of William Blair so that we are able to process your personal information for the purposes set out in this Privacy Notice;
• professional advisors, such as lawyers, accountants, actuaries;
• an organization who we may transfer our rights and duties to in the event of a corporate transaction (e.g. if we restructure or sell our business); and/or
• a William Blair group company.

We can also share your information with regulators and authorities in connection with their duties (such as crime prevention), and/or in connection with our compliance with legal and/or regulatory obligations.

Unless a third party is our service provider (such as our communications service provider), we cannot control all use of your personal information by some third parties who we may be required to share your information with (such as regulators), as they will process your personal information for their own specific purposes. As such, where your personal information has been shared with another data controller entity, you will have rights over how that third party handles your personal information and you can and should contact those parties directly if you want to exercise your rights in relation to those third party’s uses of your personal information.

International Transfers of Your Personal Information

There will be instances where your personal information will be transferred outside the European Union or the European Economic Area (EEA) and the United Kingdom (UK) to countries where data protection laws may not provide the same level of protection as those in the EEA and UK. If it is processed within the European Union or other parts of the EEA or within the UK, then your personal information is protected by applicable data protection standards.

Where we transfer your personal information from the EEA or the UK to a country that has not been granted an adequacy decision, including the United States, we ensure that appropriate safeguards are in place before we transfer your personal information to such a country. These safeguards include:

• The use of adequacy decisions issued by the European Commission or the UK government;
• The use of standard contractual clauses, international data transfer addenda, or other approved contractual protections; or
• Other appropriate safeguards permitted under applicable data protection laws.

As part of our business operations, we will, where it is lawful and necessary to do so, share with and/or transfer some of your personal information to other William Blair group companies. William Blair has entered into an intra-group data sharing and transfer agreement with its other various companies to ensure the secure handling of your personal information. This data sharing and transfer agreement includes provisions to protect your personal information where the other William Blair company is based outside of the EEA or UK and will meet one or more of the obligations for the secure transfer of your personal information as set out in this Privacy Notice.

What Should You Do if Your Personal Information Changes?

We will take steps to ensure that we keep your personal information accurate and up to date. However, we are reliant on you to assist us in doing this. As such, you should tell us without delay if any of your personal information changes, so that we can update our records. The contact for this purpose is your business contact. They will then inform us and we will ensure that our records are duly updated.

Profiling and Other Automated Decision Making

William Blair does not undertake any automated decision making processes which could result in a negative consequence. At every stage when we handle your personal information, there will be a human element to the interaction before any negative decision is made.

How Long is Your Personal Information Retained by Us?

We will only retain your personal information for as long as necessary to meet the reason your personal information was collected for. We need to keep your information long enough to make sure that we can provide our services to you, to comply with and/or satisfy all legal obligations including our obligations to keep records and to protect our interests.

There may be some instances where we will need to keep the information for longer periods of time after you cease to be a client of ours, depending on the nature of the data, or the purpose for the retention. In this regard, we have set out some examples of processing which we undertake and the reason why we will need to retain your personal information even after you cease to be a client of ours.

• Retention in case of queries: We will retain the personal information that we need to keep in case of queries from you (for instance, if you apply unsuccessfully for a product or service) for so long as this is required by law;
• Retention in case of claims: We will retain the personal information that we need to keep for the period in which you might legally bring claims or complain to the Financial Ombudsman against us;
• Retention in accordance to pension transfers: We will retain all personal information in relation to pension transfers advice for so long as this is required by law; and/or
• Retention in accordance with legal and regulatory requirements: We will retain the personal information that we need to keep even after the relevant contract you have with us has come to an end for so long as this is required by law.

What Are Your Rights Under Data Protection Laws?

Here is a list of the rights that all individuals have under data protection laws. They do not apply in all circumstances. If you wish to exercise any of them we will explain at that time if they are engaged or not.

• The right to be informed about our processing of your personal information;
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• The right to object to processing of your personal information;
• The right to restrict processing of your personal information;
• The right to have your personal information erased (the “right to be forgotten”);
• The right to request access to your personal information and to obtain information about how we process it;
• The right to move, copy or transfer a copy of the personal information you have provided us with (“data portability”);
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you.

To exercise your rights as set out above, please write to us at the details set out in this Privacy Notice. There is no fee for making these requests. However, if your request is excessive or unfounded, we can charge a reasonable fee or refuse to comply with it.

You have the right to complain to the data protection authority which enforces data protection laws in your location.

Data Anonymization and Use of Aggregated Information

Your personal information may be converted into statistical or aggregated data which cannot be used to re-identify you. It will then be used to produce statistical research and reports. This aggregated data will be shared and used in all the ways described in this Privacy Notice, and it may also be used in other ways not described here. However, as the information will be aggregated anonymous data that is no longer associated with you, it will no longer constitute your personal information and can therefore be used more widely than if you could still be identified from it.

Future Changes to This Privacy Notice

We reserve the right to update this Privacy Notice at any time. You will always be able to review the current Privacy Notice by visiting https://www.williamblair.com/ or by requesting a copy from your business contact.

Our Contact Information

Please contact us if you have any questions about this Privacy Notice or information we hold about you.

This Privacy Notice may be updated from time to time.
Last updated: November 6, 2025