I'm the co-founder of a UK-based startup, and we're on the cusp of raising a seed round from a number of angel investors, the majority of whom will invest as private persons.
Our lawyers advised us to conduct KYC on our angel investors. To do that, we are looking to use Amiqus, which is a UK government certified Identity Service Provider.
It's all fine and dandy as long as we store the KYC data with Amiqus. However, we may wish to eventually stop paying their monthly subscription. When we do that, we will be able to download the KYC data in PDF form and store it ourselves.
Here's the question: will we need to send a privacy notice to our investors (by that time, our shareholders) before we are able to cancel our Amiqus subscription?
I imagine that the relationship between a company and its customers is different than that between a company and its shareholders. At a minimum, I would suspect that in the latter case, the data protection requirements should be less stringent.