Privacy notice
Resilience Group respects your privacy. This notice explains what we do — and, as importantly, what we do not do — with personal data on resilience.gi. Separate, more detailed privacy arrangements apply when you engage us as a client; those arrangements are provided as part of our regulated onboarding.
Effective 12 October 2026.
1. Who we are
The data controller
Resilience Group Limited is a limited liability company registered in Gibraltar (registered number 124771), with its office at Unit G02, Eurocity, Europort Avenue, Gibraltar GX11 1AA. Resilience Group Limited is the data controller for personal data processed through this website and in connection with initial enquiries made to the firm. Resilience Group Limited is authorised by the Gibraltar Financial Services Commission as a Company Manager, Professional Trustee and Foundation Councillor.
For any question about this notice, or to exercise any of the rights described below, contact us at info@resilience.gi or on +350 200 77779.
2. This website
What resilience.gi collects
This is an informational website. It is deliberately minimal in what it collects from visitors.
No forms, accounts, or newsletters
The contact page opens an email in your own mail client using a mailto: link; there is no form on this website that submits data to Resilience Group. There is no account sign-up, no login, no newsletter and no subscription. If you email us, the personal data you provide is processed as described in section 3 below.
Advertising cookies, only with your consent
We advertise Resilience Group online through advertising platforms such as Google (Google Ads), OpenAI (adverts in ChatGPT), LinkedIn and Meta. Our marketing agency manages these campaigns for us. If you choose “Accept all” in the cookie banner, we load those platforms’ tags through Google Tag Manager for two purposes: (1) measurement — to tell whether an advert led to a visit or an enquiry; and (2) advertising audiences — to add your browser to lists of people who have visited our site, so that we can show you our adverts later on those platforms (“remarketing”). These tags may set cookies (for example Google’s _gcl_…, LinkedIn’s li_fat_id or Meta’s _fbp) and send the platform the pages you viewed, the fact that you arrived from an advert and, if you send an enquiry, that an enquiry was made. We do not send them the content of your enquiry, your name or your email address. Each platform also processes this data under its own privacy policy and may combine it with what it already knows about you if you have an account with it. These platforms may process data outside Gibraltar, including in the United States (see section 5). We set audience lists to expire no later than 13 months after your last visit, and the banner asks you again after 13 months. If you choose “Analytics only” or “Reject all”, none of these tags load, and choosing either later removes the advertising cookies already set on this site (the platforms’ own cookies on their domains are controlled through your account settings with them). We do not sell personal data. Our legal basis is your consent. See the privacy policies of Google, OpenAI, LinkedIn and Meta.
Preferences stored in your browser
If you use the light/dark theme toggle, your preference is stored in your browser's local storage under the key resilience-theme. Your analytics choice is stored under the key fe-consent. Neither is a cookie; both stay on your device, are not received by Resilience Group, and can be cleared at any time from your browser settings.
Google Analytics, only with your consent
We use Google Analytics 4 (property G-NRK2HMPE4L) to count visits and see which pages are read. Analytics is off until you say yes. The first time you open a page, a banner offers “Accept all”, “Analytics only” and “Reject all”, given equal weight; either of the first two allows analytics cookies. Until you accept, Google Consent Mode is set to “denied”, so no analytics cookies are set; the Google tag still loads and may send Google a cookieless signal that a page was viewed, with no identifier stored in your browser. If you accept, Google Analytics sets its first-party cookies (_ga and _ga_…). Advertising signals, including ad personalisation, stay denied unless you choose “Accept all” (see above). The control in the footer reopens the banner; choosing “Reject all” later removes the analytics and advertising cookies already set, and “Analytics only” removes the advertising ones. Our legal basis is your consent. Google may process this data outside Gibraltar, including in the United States (see section 5). See Google's privacy policy and how Google uses information from sites that use its services.
Privacy-preserving site analytics (Cloudflare Web Analytics)
We use Cloudflare Web Analytics to understand aggregate site usage — page views, referrers, country-level location, and general device or browser type. Cloudflare Web Analytics is designed to be privacy-preserving: it does not use cookies, does not fingerprint visitors, and does not track individuals across sites. Because it does not use cookies or identify visitors, it runs whatever analytics choice you make. See Cloudflare's privacy policy and Web Analytics overview for further detail.
Hosting logs at the edge
The site is served by Cloudflare Pages. In common with any website host, Cloudflare automatically processes standard technical request data (including your IP address, user-agent, and the URL requested) for the short time needed to deliver pages, prevent abuse, and defend against attack. Cloudflare acts as our processor for that activity. We do not receive individual visitor logs.
3. If you contact us
Enquiry form, email, phone, and post
If you contact Resilience Group through the enquiry form on our contact page, by email at info@resilience.gi, by telephone on +350 200 77779, through an intermediary introduction, or by post, we process the personal data you provide (typically your name, contact details, employer or firm, and the content of your message) in order to respond to you and, where relevant, to assess whether we can provide services and on what terms.
Where a business relationship progresses — for example, if you become a client, or a beneficial owner, director, settlor, protector, beneficiary, authorised person, or connected party of a client structure — separate and more detailed processing follows under Resilience Group's regulated onboarding, AML/CFT, and fiduciary obligations. We provide a fuller client-facing privacy notice at that stage. This website notice does not cover that regulated processing.
Enquiry form entries are stored in Google Forms (Google acts as our service provider), and a notification is sent to the team members who handle enquiries. The form also records the page you came from and any campaign tags in the link you followed (such as utm_source), so that we know which of our pages or adverts led to the enquiry. Please do not use the form to send confidential documents or account details.
4. Legal bases
Why we may lawfully process your data
Consent
When you choose to contact us, or accept analytics cookies. You may withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal or processing based on another lawful basis.
Legitimate interests
In operating and securing this website, responding to enquiries, and administering the firm. Where we rely on legitimate interests we have considered your rights and freedoms, and you may object as described below.
Legal obligations
Applicable to a GFSC-regulated firm, including record-keeping, AML/CFT obligations under the Proceeds of Crime Act 2015, sanctions screening, and international tax reporting.
5. Recipients and transfers
Who receives personal data
Personal data received through this website and initial enquiries is accessible to the Resilience Group personnel who need it to respond to you. It may be shared with:
Group companies
Octopus International Business Services Limited (Gibraltar registered number 87177) and Rampart Corporate Services Limited (Gibraltar registered number 107474), where relevant to the services you are asking about.
Service providers
Providers we rely on to operate the firm — including our email, IT hosting, cybersecurity, and website hosting providers (including Cloudflare), Google as the provider of our enquiry form storage and, where you have accepted the relevant cookies, of our analytics; where you have chosen “Accept all”, the advertising platforms named in section 2 and our marketing agency, which manages our advertising accounts and receives campaign results but not the content of enquiries — under contractual duties of confidentiality and data protection.
Professional advisers
Our own legal, audit, and compliance advisers where necessary to obtain professional advice in connection with the firm's activities.
Authorities
Regulators, law enforcement, tax authorities, and courts, where we are required or permitted by law to share information.
Some of these recipients are located outside Gibraltar. Where personal data is transferred to a jurisdiction that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards such as standard contractual clauses, together with any supplementary measures required.
6. Retention
How long we keep personal data
Enquiry correspondence that does not result in a business relationship is retained for no longer than is necessary to respond and to record the outcome of the enquiry. Personal data collected in connection with a regulated client relationship is retained for the periods required by Gibraltar's AML/CFT and other applicable legislation (typically at least five years from the end of the relationship, and longer where a specific statutory obligation or ongoing legal claim requires it).
7. Your rights
Rights under Gibraltar data protection law
The processing described in this notice is governed by the Data Protection Act 2004 and the Gibraltar General Data Protection Regulation. Subject to the conditions and exceptions in that law, you have the right to:
Access and portability
Ask us to confirm whether we hold personal data about you, obtain a copy, and, in certain cases, receive it in a structured, commonly used, machine-readable format.
Correction and erasure
Ask us to correct inaccurate or incomplete personal data, or to erase personal data where the legal grounds for doing so are met.
Object or restrict
Object to processing carried out on the basis of legitimate interests, or ask us to restrict processing pending resolution of a query. You may also withdraw any consent you have given.
To exercise any of these rights, email info@resilience.gi. We may need to verify your identity before responding. Some rights are limited where Resilience Group is required to retain personal data by law, in particular in connection with AML/CFT record-keeping.
If you are not satisfied with how we have handled your personal data, you may complain to the Gibraltar Regulatory Authority in its capacity as Information Commissioner: gra.gi/data-protection.
8. Changes
Updates to this notice
We may update this notice from time to time. The effective date at the top of the page shows when it last changed. Where a change is material, we will flag it on the site for a reasonable period.
Questions about this notice
If anything on this page is unclear, or if you want to exercise a right, please get in touch.