Privacy Policy

Introduction

To provide financial planning services, we need to collect and keep personal information about you. We must follow the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use & Access) Act 2025. This notice explains how we use your data and your rights under the law.

Who we are

We are responsible for your personal information and are registered with the Information Commissioner’s Office (ICO). Our ICO registration number is ZA101296.

Why we need your data

We use your personal data to provide financial planning services and advice, meet our legal and regulatory duties, carry out identity checks, respond to lawful requests from regulators or courts, help prevent financial crime, and manage our business, including quality checks and complaints.

Our lawful basis for processing

What we use your data for	UK GDPR lawful basis
Providing financial planning services and advice, including checking suitability and keeping your plan or portfolio up to date	Contract (needed to provide the services you ask us for)
Meeting FCA and other legal or regulatory duties, such as identity checks, anti-money laundering checks, audits, and record-keeping	Legal obligation
Responding to lawful requests from regulators, courts, or law enforcement, and helping to prevent fraud and financial crime	Legal obligation and/or legitimate interests (to protect our business, our clients, and the public)
Running and managing our business, including quality checks, complaint handling, record-keeping, and business continuity	Legitimate interests (to run our business responsibly) and/or legal obligation (where required)
Sending you direct marketing, where you have agreed to this	Consent (you can withdraw it at any time)

If we rely on your consent, for example to use special category data for some protection or annuity quotes, you can withdraw that consent at any time by writing to us. This will not affect anything we did before you withdrew consent, but it may limit the services we can provide if that data is needed for the service you asked for.

Your rights

Under the UK GDPR, you have the following rights, subject to certain conditions:

• Ask for a copy of your personal data
• Ask us to correct inaccurate personal data
• Ask us to delete your personal data in some circumstances
• Ask us to limit how we use your personal data in some circumstances
• Object to how we use your personal data in some circumstances, including for direct marketing
• Withdraw your consent at any time where we rely on consent (this will not affect anything we did before you withdrew it)
• Ask for your data in a portable format in some circumstances
• Object to certain automated decisions, including profiling, and ask for clear information about how they work and what they may mean for you, where relevant
• Claim compensation if you suffer harm because data protection law has been broken

Our obligations

• To inform you, where appropriate, of the contact details for any Data Protection Officer appointed by us.
• To inform you of the recipients or categories of recipients of data.
• To inform you of the period for which we propose to hold the data, or where this is not possible, the criteria which we will apply to data retention.

Where you exercise your right to request access to data of which you are the data subject, we will undertake to respond to you within one month of receipt of your request. There will be no charge for this service unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a fee or refuse to respond.

You can ask us to restrict how we use your personal data, or object to certain processing, in line with your UK GDPR rights. We will consider your request and respond in line with the law. Please note that we may need to continue processing where we have a legal obligation, or where it is necessary to provide the services you have asked for.

Some personal data is required so we can provide our services and meet legal or regulatory obligations. If you choose not to provide required information, we may be unable to act for you, progress your instructions, or obtain products or quotes on your behalf.

These rights apply whether we collect your personal data directly from you or receive it from third parties.

Save in the circumstance as detailed below, we will inform you which source the data originated from and whether it came from publicly accessible sources. The information to be provided will be in accordance with the following time periods, whichever shall occur first:

• As soon as practicable after obtaining the data and in any event within 1 month
• At the time of our first communication with you using the data
• When the data is first disclosed to another person

We do not have to give you this information in the following cases:

• Where you already have the information
• When we are legally required to keep it confidential
• Telling you would make it impossible, or seriously affect, the reason we are using the data. If this happens, we will still take steps to protect your rights and freedoms.

Recognised Legitimate Interest

Recognised Legitimate Interest is a lawful basis for processing data and is distinct from the existing legitimate interest category which remains applicable and is covered within this notice.

RLI is effectively pre-approved situations that are deemed to be in the Public Interest and do not require client consent. The following areas are specifically covered:

• Crime Prevention
• National Security or Defence
• Public Security
• Safeguarding
• Emergencies
• Sharing personal information to help other organisations perform their public tasks or official functions

What personal data is collected

We may collect and use the following categories of personal data:

• Identity and contact details such as name, address, email, telephone and date of birth
• Financial and employment details relevant to advice such as income, expenditure, assets, liabilities and tax position
• Client profile and objectives information such as risk profile, capacity for loss, investment objectives
• Product and policy information such as existing pensions, investments and insurance policies
• Regulatory and due diligence information such as identity verification and AML checks
• Correspondence and records of advice, meetings and decisions such as suitability reports, notes and call recordings where applicable

How personal data is collected

We collect personal data directly from you via various forms of contact, including (but not limited to) meetings, telephone calls, email, forms, applications and online portals.

We may also receive personal data from third parties where necessary for the services, such as product providers, platforms, your employer (where relevant), professional advisers, credit reference agencies, fraud prevention agencies, and public sources (e.g. Companies House) where appropriate.

We may need to collect sensitive personal data (special category data) including information about your health, ethnic origin, or criminal prosecutions from you and third parties such as employers and credit reference agencies, fraud prevention agencies and other similar organisations in order to provide you with the services, for example where you require advice on protection or annuity products.

In some cases such as protection or annuity advice, we may need health information and/or information about criminal convictions or offences to obtain terms or quotes on your behalf. Where we process special category data, we will only do so with your explicit consent for the relevant purpose, unless another lawful condition applies (for example, to establish, exercise or defend legal claims).

Holding your data

We undertake to review the data we hold on you on a regular basis to ensure compliance with data protection law. In the course of any review, we will:

• Delete any data which is trivial or transitory in nature, or which in our opinion is no longer required for the purposes set out above
• Update the data to ensure that any errors or inaccuracies are corrected
• Archive data as detailed below
• Subject to the data retention periods, as detailed below, securely delete the data when it is identified that we no longer need to hold it
• If we use AI-enabled tools or third-party service providers to support our services, your data may be processed and/or stored by those providers on our behalf. Where this involves transferring personal data outside the UK, we will ensure appropriate safeguards are in place and we will provide details on request.

We may retain and process your data for the following periods. In the event that more than one period applies to the same data, we will retain the data to the last such period to expire:

• We will hold any client engagement documentation (including terms of business and related documents) for a period of 6 years from the termination or expiry of the engagement unless we have been notified of any claim or circumstance which might give rise to a claim.
• We will process data relating to investments which we have provided advice on and/or arranged for you. We will process such data throughout the entire period you remain a client of the firm and for a period of not less than 6 years following our ceasing to provide service to you in regard to those investments. We may process your data until the date of maturation of long-term investments.
• We will keep data for as long as a regulator requires. For the Financial Conduct Authority (FCA), this is usually 6 years for most business. For Occupational Pension Schemes, including Defined Benefit Transfers and Scheme Money Purchase Transfers, we may need to keep the data indefinitely.
• We will keep data for as long as a relevant third party requires. For HMRC, this is usually 7 years. If HMRC tells us a period is still open, we will keep the data until HMRC confirms it is closed.
• If data is needed for legal proceedings, we will keep it for 6 years after the proceedings end, unless the law or a court requires us to keep it for longer. Proceedings are treated as ended when the time limit for any appeal has passed, or when a full settlement has been reached before judgment.
• Apart from the reasons above, we will only keep data for as long as needed for legal purposes.

Archiving data

We will regularly review data and where such data has ceased to be Active we will archive it and process it only as Archived Data. Any data which is deemed Archived Data will only be processed in limited circumstances.

All storage of data, whether Active Data or Archived Data, will be in accordance with good industry practice and will be undertaken in accordance with organisational systems and procedures, which will be regularly reviewed, to maintain the security of data.

Data portability

When our services end, you can ask us in writing to give you the data you provided in a structured, commonly used, machine-readable format, or to transfer it to another data controller you name. We may still keep copies where we are allowed or required to do so for the reasons set out above.

Whom we may share your data with

In order to carry out our legitimate business and to provide you with financial planning services, we have entered into agreements with and will share your information with the following companies, for the purposes of Compliance, IT systems security, data management and control and auditing. Full details of these companies’ addresses and contact details are available on request:

• Our Compliance Consultants — Compliance and Training Solutions Ltd
• Verve Paraplanning Services (Report writing)
• 4Admin (Administrative Support Services)
• Intelliflo (Back Office service provider)
• M-Tech (IT service provider)
• IRESS Exchange (Technology service provider)

Some organisations we share your data with, including product providers and platforms, may act as independent data controllers; please see their own privacy information for details.

Potential Business Transfers

In the event that our firm is involved in a merger, acquisition, sale of assets, or other business transaction, your personal data may be part of the assets transferred. Any such transfer will comply with applicable data protection laws, and the receiving party will continue to handle your personal data in accordance with this Privacy Notice, or an updated notice provided at the time of transfer. We will notify you in advance of any such transfer, providing details of the acquiring entity and any changes to how your data will be processed, if applicable.

Cookies and website tracking

When you visit our website, we use cookies and similar technologies to help it function and to understand how it is being used. This includes Google Analytics to measure site performance and traffic, and Google reCAPTCHA to protect our contact forms from automated submissions.

For full details of the cookies we use, how long they are stored, and how to manage your preferences, please see our Cookie Policy.

How to make a data protection complaint

If you think we have not handled your personal data properly, please contact:

Tell us what happened, when it happened, and what you would like us to do to put things right.

• We will acknowledge your complaint within 30 days.
• We will investigate, keep you updated, and tell you the outcome without undue delay.

If you are not satisfied with our response, you can also complain to the Information Commissioner’s Office (ICO):

• Online: www.ico.org.uk
• Phone: 0303 123 1113

Marketing

We do not take part in any marketing that would involve the use of your personal data. We will not use your data for marketing purposes of any sort unless you have expressly given us your prior consent. The use of your data as detailed in the remainder of this notice is not affected by whether you choose to consent to the use of data for marketing purposes.

Changes to this Privacy Notice

If any provision, or part thereof, of this Privacy Notice is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the remainder of this Privacy Notice will remain in force.

If data protection law changes after the date of this Privacy Notice and we need to update how we describe our data retention, portability or other processing activities, we will update this Privacy Notice as appropriate to reflect those changes and to ensure ongoing compliance with data protection law. Where appropriate, we will provide you with the updated version.

Acknowledgement

We take your privacy very seriously and will only use your personal information and data to administer the services we have agreed to provide you with, including, but not limited to, any products or contracts for investments, pensions, life cover or mortgages you have made or entered into through our firm.