Introduction: 

To provide financial planning services, we need to collect and keep personal information about you. We must follow the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use & Access) Act 2025. This notice explains how we use your data and your rights under the law. 

Who we are: 

We are responsible for your personal information and are registered with the Information Commissioner’s Office (ICO). Our ICO registration number is ZC110061. 

Why we need your data: 

We use your personal data to provide financial planning services and advice, meet our legal and regulatory duties, carry out identity checks, respond to lawful requests from regulators or courts, help prevent financial crime, and manage our business, including quality checks and complaints. 

Our lawful basis for processing (summary) 

What we use your data for 

Providing financial planning services and advice, including checking suitability and keeping your plan or portfolio up to date 

Meeting FCA and other legal or regulatory duties, such as identity checks, anti-money laundering checks, audits, and record-keeping 

Responding to lawful requests from regulators, courts, or law enforcement, and helping to prevent fraud and financial crime 

Running and managing our business, including quality checks, complaint handling, record-keeping, and business continuity 

Sending you direct marketing, where you have agreed to this 

 UK GDPR lawful basis 

Contract (needed to provide the services you ask us for) 

Legal obligation 

Legal obligation and/or legitimate interests (to protect our business, our clients, and the public) 

 Legitimate interests (to run our business responsibly) and/or legal obligation (where required) 

Consent (you can withdraw it at any time) 

If we rely on your consent, for example to use special category data for some protection or annuity quotes, you can withdraw that consent at any time by writing to us. This will not affect anything we did before you withdrew consent, but it may limit the services we can provide if that data is needed for the service you asked for. 

General information about your data and your rights: 

Under the UK GDPR, you have the following rights, subject to certain conditions: 

ask for a copy of your personal data 

ask us to correct inaccurate personal data 

ask us to delete your personal data in some circumstances 

ask us to limit how we use your personal data in some circumstances 

object to how we use your personal data in some circumstances, including for direct marketing 

withdraw your consent at any time where we rely on consent (this will not affect anything we did before you withdrew it) 

ask for your data in a portable format in some circumstances 

object to certain automated decisions, including profiling, and ask for clear information about how they work and what they may mean for you, where relevant 

claim compensation if you suffer harm because data protection law has been broken 

Our obligations: 

To inform you, where appropriate, of the contact details for any Data Protection Officer appointed by us. 

To inform you of the recipients or categories of recipients of data. 

To inform you of the period for which we propose to hold the data, or where this is not possible, the criteria which we will apply to data retention. 

Where you exercise your right to request access to data of which you are the data subject, we will undertake to respond to you within one month of receipt of your request.  There will be no charge for this service unless the request is manifestly unfounded or excessive in which case we reserve the right to charge a fee or refuse to respond. 

You can ask us to restrict how we use your personal data, or object to certain processing, in line with your UK GDPR rights. We will consider your request and respond in line with the law. Please note thatwe may need to continue processing where we have a legal obligation, or where it is necessary to provide the services you have asked for. 

Some personal data is required so we can provide our services and meet legal or regulatory obligations. If you choose not to provide required information, we may be unable to act for you, progress your instructions, or obtain products/quotes on your behalf. 

These rights apply whether we collect your personal data directly from you or receive it from third parties. 

Save in the circumstance as detailed below, we will inform you which source the data originated from and whether it came from publicly accessible sources.  The information to be provided will be in accordance with the following time periods, whichever shall occur first: 

As soon as practicable after obtaining the data and in any event within 1 month 

At the time of our first communication with you using the data 

When the data is first disclosed to another person 

We do not have to give you this information in the following cases: 

Where you already have the information 

When we are legally required to keep it confidential 

Telling you would make it impossible, or seriously affect, the reason we are using the data. If this happens, we will still take steps to protect your rights and freedoms. 

Recognised Legitimate Interest: 

Recognised Legitimate Interest is a lawful basis for processing data and is distinct from the existing legitimate interest category which remains applicable and is covered within this notice. 

RLI is effectively pre-approved situations that are deemed to be in the Public Interest and do not require client consent. 

The following areas are specifically covered: 

Crime Prevention 

National Security or Defence 

Public Security 

Safeguarding 

Emergencies 

Sharing personal information to help other organisations perform their public tasks or official functions 

What Personal Data is Collected? 

We may collect and use the following categories of personal data: 

Identity and contact details such as name, address, email, telephone and date of birth. 

Financial and employment details relevant to advice such as income, expenditure, assets, liabilities and tax position. 

Client profile and objectives information such as risk profile, capacity for loss, investment objectives. 

Product and policy information such as existing pensions, investments and insurance policies. 

Regulatory and due diligence information such as identity verification and AML checks. 

Correspondence and records of advice, meetings and decisions such as  suitability reports, notes and call recordings where applicable. 

How is Personal Data Collected? 

We collect personal data directly from you via various forms of contact, including (but not limited to)  meetings, telephone calls, email, forms, applications and online portals. 

We may also receive personal data from third parties where necessary for the services, such as product providers, platforms, your employer (where relevant), professional advisers, credit reference agencies, fraud prevention agencies, and public sources (e.g. Companies House) where appropriate. 

We may need to collect sensitive personal data (special category data) including information about your health, ethnic origin, or criminal prosecutions from you and third parties such as employers and credit reference agencies, fraud prevention agencies and other similar organisations in order to provide you with the services, for example where you require advice on protection or annuity products.  

In some cases, such as protection or annuity advice, we may need health information and/or information about criminal convictions/offences to obtain terms or quotes on your behalf. Where we process special category data, we will only do so with your explicit consent for the relevant purpose, unless another lawful condition applies (for example, to establish, exercise or defend legal claims). 

Holding your data: 

We undertake to review the data we hold on you on a regular basis to ensure compliance with data protection law.  In the course of any review, we will: 

Delete any data which is trivial or transitory in nature, or which in our opinion is no longer required for the purposes set out above. 

Update the data to ensure that any errors or inaccuracies are corrected. 

Archive data as detailed below. 

Subject to the data retention periods, as detailed below, securely delete the data when it is identified that we no longer need to hold it. 

If we use AI-enabled tools or third-party service providers to support our services, your data may be processed and/or stored by those providers on our behalf. Where this involves transferring personal data outside the UK, we will ensure appropriate safeguards are in place and we will provide details on request. 

We may retain and process your data for the following periods.  In the event that more than one period applies to the same data, we will retain the data to the last such period to expire: 

We will hold any client engagement documentation (including terms of business and related documents) for a period of 6 years from the termination or expiry of the engagement unless we have been notified of any claim or circumstance which might give rise to a claim. 

We will process data relating to investments which we have provided advice on and/or arranged for you.  We will process such data throughout the entire period you remain a client of the firm and for a period of not less than 6 years following our ceasing to provide service to you in regard to those investments.  We may process your data until the date of maturation of long-term investments. 

We will keep data for as long as a regulator requires. For the Financial Conduct Authority (FCA), this is usually 6 years for most business. For Occupational Pension Schemes, including Defined Benefit Transfers and Scheme Money Purchase Transfers, we may need to keep the data indefinitely. 

We will keep data for as long as a relevant third party requires. For HMRC, this is usually 7 years. If HMRC tells us a period is still open, we will keep the data until HMRC confirms it is closed. 

If data is needed for legal proceedings, we will keep it for 6 years after the proceedings end, unless the law or a court requires us to keep it for longer. Proceedings are treated as ended when the time limit for any appeal has passed, or when a full settlement has been reached before judgment. 

Apart from the reasons above, we will only keep data for as long as needed for legal purposes. 

Archiving data: 

We will regularly review data and where such data has ceased to be Active we will archive it and process it only as Archived Data.  Any data which is deemed Archived Data will only be processed in limited circumstances. 

All storage of data, whether Active Data or Archived Data will be in accordance with good industry practice and will be undertaken in accordance with organisational systems and procedures, which will be regularly reviewed, to maintain the security of data. 

Data portability: 

When our services end, you can ask us in writing to give you the data you provided in a structured, commonly used, machine-readable format, or to transfer it to another data controller you name. We may still keep copies where we are allowed or required to do so for the reasons set out above. 

 
Whom we may share your data with: 

In order to carry out our legitimate business and to provide you with financial planning services, we have entered into agreements with and will share your information with the following companies, for the purposes of Compliance, IT systems security, data management and control and auditing.  Full details of these companies addresses and contact details are available on request: 

Compliance and Training Solutions Ltd (Compliance consultants) 

Intelliflo Ltd (back office administration program) 

Smart Search Ltd (undertakes Anti-Money Laundering identity checks electronically) 

FE Cashcalc (Cashflow modelling software) 

Defaqto (Attitude to risk software and product research software) 

Planner Pal – Recording and documenting of meetings and conversations 

Other service providers who support our regulated activities 

Some organisations we share your data with, including product providers and platforms, may act as independent data controllers; please see their own privacy information for details. 

Potential Business Transfers 

In the event that our firm is involved in a merger, acquisition, sale of assets, or other business transaction, your personal data may be part of the assets transferred. Any such transfer will comply withapplicable data protection laws, and the receiving party will continue to handle your personal data in accordance with this Privacy Notice, or an updated notice provided at the time of transfer. We will notify you in advance of any such transfer, providing details of the acquiring entity and any changes to how your data will be processed, if applicable. 

How to make a data protection complaint to us 

If you think we have not handled your personal data properly, please contact: 

Name: Neil Emburey 

Address: 15 Gardner Way, Chandlers Ford, Hants, SO53 1JJ. 

Telephone No: 02382 252341  

Email: neil@emberswm.co.uk  

Tell us what happened, when it happened, and what you would like us to do to put things right. 

We will acknowledge your complaint within 30 days. 

We will investigate, keep you updated, and tell you the outcome without undue delay. 

If you are not satisfied with our response, you can also complain to the Information Commissioner’s Office (ICO) using the contact details below: 

Online: www.ico.org.uk 

Phone: 0303 123 1113 

Marketing: 

From time to time, we may wish to contact you with details of other investment, pension or financial products and/or services which we think may be of interest and/or beneficial to you.  We will obtain your consent (or wish to opt out) via our Client Agreement.  

We will not use your data for marketing purposes of any sort unless you have expressly given us your prior consent.  The use of your data as detailed in the remained of this agreement is not affected by whether you choose to consent to the use of data for marketing purposes. 

We will not pass on your details to other Investment, Pension or Financial Institutions within the UK without obtaining your express permission to do so, prior to any communication being issued. 

Please note that you may withdraw your consent to marketing at any time by giving us notice in writing. 

Changes to this Privacy Notice: 

If any provision, or part thereof, of this Privacy Notice is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the remainder of this Privacy Notice will remain in force. 

If data protection law changes after the date of this Privacy Notice and we need to update how we describe our data retention, portability or other processing activities, we will update this Privacy Notice as appropriate to reflect those changes and to ensure ongoing compliance with data protection law. Where appropriate, we will provide you with the updated version. 

Declaration and consent: 

We take your privacy very seriously and will only use your personal information and data to administer the services we have agreed to provide you with, including but not limited to any products or contracts for investments, pensions, life cover or mortgages you have made or entered into through our firm. 

By signing our Client Agreement you are confirming your agreement to these terms. Furthermore, by signing the Client Agreement you are also confirming your marketing preferences as detailed in the ‘Marketing’ section of the declaration, whereby you have given your consent, or otherwise, for us to contact you about additional products and services. 

You further acknowledge, by signing the Client Agreement, that you have been made aware of, and give your consent to, this firm’s policy on sharing your data with other companies as detailed in the ‘Whom we may share your data with’ section of this agreement.