Privacy notice
This notice applies to website enquiries, communications and services provided under the First Offshore Ltd brand. It reflects the UK GDPR, the Data Protection Act 2018 and amendments made by the Data (Use and Access) Act 2025.
Who controls your information
For website enquiries, the controller is ICG COMMONWEALTH LAW FIRM LTD, company number SC529639, registered office: Exchange Tower, 19 Canning Street, Edinburgh, Scotland, EH3 8EG, trading under the First Offshore Ltd brand. If a proposal or engagement letter names another service company, that company controls information for that service as explained in the engagement documents.
For privacy questions, email [email protected]. Questions about client identification and AML may be sent to [email protected].
Information we collect
For an initial enquiry, we normally need your name, contact details, country of residence and a description of the service. For an order, we may need a passport, proof of address, tax number, company and ownership information, CV, contracts, payment information, source of wealth and source of funds.
We may also receive website technical data, correspondence, payment records and documents from your authorised representative, registered agent, bank, EMI, public registry or another provider involved in the agreed service.
Purposes and lawful bases
We use information to answer enquiries, prepare quotations, enter into and perform a contract, form or transfer a company, organise accounting and annual maintenance, and prepare a corporate account application.
The lawful basis depends on the activity. It may be steps before a contract, performance of a contract, a legal obligation, our legitimate interests in running and protecting the business, preventing fraud and maintaining security, or consent where the law requires it.
Due diligence, KYC and AML
Corporate and account services require identification of owners and controlling persons. Documents may be used for KYC/KYB, sanctions screening, source of wealth and source of funds review, and responses to a registered agent, bank, EMI, auditor or competent authority.
Information about politically exposed persons, sanctions, legal proceedings or suspected offences is processed only where there is a lawful basis and only to the extent needed for the service or a legal duty.
Who receives information
Access is limited to staff and specialists who need the information for the order. Information may be shared with group companies, registered agents, banks, EMIs, accountants, auditors, notaries, translators, couriers, IT providers and public authorities where required for the service or by law.
Each recipient receives the information needed for its part of the work. Professional providers may act as separate controllers and issue their own privacy notices.
International transfers
First Offshore Ltd services involve several countries, so documents may be transferred outside the UK. Transfers use applicable adequacy regulations, contractual safeguards or another lawful UK GDPR mechanism. We can identify the country and provider used for a specific service on request.
Retention and security
We keep correspondence and documents for as long as needed to perform the service, protect contractual rights and meet tax, corporate and AML duties. KYC and AML records are normally retained for the period required after the relationship or transaction ends. A longer period may apply where required by law, a dispute or a competent authority.
We use access controls, secure transfer methods, backups and organisational measures. Send confidential documents through the channel agreed with your specialist rather than the public website form.
Your rights and complaints
Where the law applies, you may request access, correction, erasure, restriction, portability or object to processing. Consent can be withdrawn for future processing. UK rules also require a clear process for data protection complaints.
Email [email protected] with your name, contact details and request. We may ask for information needed to confirm identity. You may also complain to the Information Commissioner’s Office.
Cookies and communications
The website may store technical information needed for forms, language choice and security. Where non-essential cookies or analytics are used, the required consent mechanism will apply. Marketing messages are sent on the basis of permission or an existing business contact and can be stopped through the message link or by reply.