Privacy Policy
Introduction
Your privacy and trust are important to us and this Privacy Policy (“Policy”) provides important information about who we are, how and why we collect, store, use and share personal data, your rights in relation to your personal data, and how to contact supervisory authorities and us in the event you have a complaint. All firms listed below are registered with the Information Commissioner’s Office (ICO) with their corresponding ICO registration number.
Attivo Group Ltd (“Attivo”) is Registered in England and Wales under Company Registration Number (‘CRN’): 05547209 (ICO: Z9623803). Registered office: Honeybourne Place, Jessop Avenue, Cheltenham, GL50 3SH.
Its wholly owned subsidiaries include:
Attivo Private Clients Ltd (CRN: 13249033) (ICO: ZB420825)
Principal firms – authorised and regulated by the Financial Conduct Authority (FCA) with corresponding firm reference numbers (FRN): Can be viewed at: www.fca.org.uk/register
Attivo Financial Services Ltd (CRN 05927588) (FRN 462105) (ICO: Z9702665), Attivo Financial Ltd (CRN 06789067) (FRN 497130) (ICO: Z1755699), Appointed Representatives of Attivo Financial Services Ltd, Attivo Financial Planning Ltd (CRN 05747914) (FRN 451967) (ICO: Z9623820)
The Attivo family of firms also includes The Finance Roome Ltd (CRN 05901651) trading as Attivo Mortgage and Protection, which is authorised and regulated by the Financial Conduct Authority (FRN 745454) (ICO: Z9579495). It shares the same registered office as the Attivo Group: Honeybourne Place, Jessop Avenue, Cheltenham, GL50 3SH.
(References to “Attivo” “we” or “us” relates to the Attivo family of firms as listed above. Attivo is the controller for the personal information we process.)
This Policy applies to personal information which we process in the course of doing business including information processed through Attivo’s website and the services we provide (collectively, our “Services”). Please read this Policy carefully and contact us if you have any questions about our privacy practices or your personal information choices. It is important that you check back often for updates to this Policy. If we make changes we consider to be important, we will let you know by placing a notice on our website and/or contacting you using other methods such as email.
This Policy was last updated in April 2026.
Purpose of Processing
We may process personal information about you in different ways depending on our relationship with you. These relationships are categorised below. Please see the relevant section for each category.
- Client and former client
- Client from a different financial adviser firm acquired by Attivo
- Client of a company or business Attivo has sold
- Client Firm – for corporate benefits
- Spouse / Partner of a client or former client
- Trustee, Attorney and Deputy
- Supplier (including employees of suppliers) and Prospectives (both client and supplier)
- Employee, former employee, relative of either
- Third Parties and Others
Business relationship categories
Clients and former clients
We will collect, store and use your personal information (“personal data”) during our business relationship with you. The types of data we will collect are listed in the table below, along with its source, our reasons and lawful basis for processing.
Where data is held by us as a principal firm, this policy should be read in conjunction with the privacy policy of the appointed representative.
Former client or client of another firm
- Former client of a financial adviser firm with whom we entered into a commercial arrangement and you ceased to be a client either before or after we entered into that commercial arrangement.
When we bought a financial adviser firm data that was held by that firm may be transferred to us as part of that transaction. Where you were a client of that firm and became a client of Attivo your personal data was transferred to us as part of that transaction. Please see the table above of the types of data and reasons for processing.
For those individuals who were a former client of the financial adviser firm, or an existing client of that firm but did not become a client of Attivo your personal data will be stored with that financial adviser firm in accordance with their privacy policy. Any questions you may have about your data should be directed to your previous financial adviser firm.
Former client of a company or business we have sold
When we sell a company or business that originally provided you with financial products and/or services (“Previous Business”) and you subsequently become a client of that new company, your personal data may be transferred to that new company or business as a result of that transaction. If you do not become a client of the new company and you cease to be a client of Attivo, we will retain your personal data that was collected as part of the Previous Business for the purpose and length of time mentioned in the table below.
Lawful basis:
Contract – Our main basis for processing your data is because it is necessary for the performance of our contract with you.
Legal Obligation – As data controllers we have a legal obligation to process personal data relating to your identity to comply with anti-money laundering regulations.
Consent – Where we process sensitive information about you, we will obtain your consent.
Legitimate Interest – The sharing of your data may be necessary in relation to instances of fraud or credit risk. We may process your data for marketing purposes, but only where you would reasonably expect us to use your data in this way and that such processing does not have an impact on you in a way that would make this processing unfair.
We will not send you general marketing information as part of a group emailing campaign unless you have consented to being contacted in this way.
Recognised legitimate interest – The processing is necessary for one of the pre-approved purposes. These are:
- safeguarding “vulnerable” people;
- responding to emergencies;
- preventing or investigating crime;
- national security, public security and defence;
- and responding to requests made by bodies acting in the public interest, for processing by those bodies for purposes laid down in law (for example, to help a government agency discharge its duties and functions).
| Data Protection & Privacy – Types of Data Held | ||||
|---|---|---|---|---|
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
| Basic personal data: Name, Date of birth, Gender, Marital status, Contact details (home address, email address, phone number), National Insurance number, Criminal records and health information | At the beginning of our business relationship with you. When you ask or receive a service from us. | To provide a service and/or arrange a product for you. Sensitive information (such as details about your health) may be gathered in the course of arranging insurance contracts. To communicate with you and answer questions or provide you with information before, during and after our business relationship has ended. Review our performance and deal with any issues or complaints during and after completion of our contract. | Performance of the contract, legal obligation, legitimate interest, recognised legitimate interest. | Life of the contract plus 15 years after the end of the business relationship. |
| Proof of identity and residence data | At commencement of our contract with the trust. For attorneys and deputies on production of a power of attorney, deputyship / court order or on the instruction of our client and upon any change in circumstance – such as name / trustee / attorney / address change. | To verify the identity of our clients. For security reasons and compliance of anti-money laundering regulations and our obligations to our client. | Legal obligation. | Life of the contract plus 15 years after the end of the business relationship. |
| Information contained in any electronic verification check | From identification and verification checking agencies. Collected when an electronic verification check is undertaken. | To verify the identity of our clients. For security reasons and compliance of anti-money laundering regulations. | Legal obligation. | Life of the contract plus 15 years after the end of the business relationship. |
| Family details: Partner (spouse / civil partner, person live with as your partner), Dependents, Beneficiaries | At commencement of our contract with you and during our business relationship with you. Completion of an application for a product we arrange for you. | To provide a service and/or arrange a product for you. To provide the financial provider with information they require. | Performance of the contract and recognised legitimate interest. | Life of the contract plus 15 years after the end of the business relationship. |
| Information on your health can include: physical, mental, family, medical history | At commencement of our contract with you. During our business relationship. Completion of an application for a product we arrange for you. | To provide a service and/or arrange a product for you. To provide the financial provider with information they require. | Consent and recognised legitimate interest. | Life of the contract plus 15 years after the end of the business relationship. |
“
Client firms – for Corporate Benefits
When we provide our Corporate Benefit service to your firm, we collect personal data relating to your employees, directors, officers, together with beneficiaries and dependants under employee benefit schemes. The types of data collected and purpose for processing is contained in the table below.
Lawful basis:
Contract – Our main basis for processing your data is because it is necessary for the performance of our contract with your firm.
Legal Obligation – As data controllers we have a legal obligation to process personal data relating to the verification of your firm in order to comply with anti-money laundering regulations.
Consent – Where we process sensitive information about any employee as pat of our service to your firm, we will require explicit consent from the data subject. We will rely on you as the employer to obtain such consent.
Legitimate Interest – The sharing of your data may be necessary in relation to instances of fraud or credit risk. We may process personal data for marketing purposes, but only where you would reasonably expect us to use this data in this way and that such processing does not have an impact on the individual in a way that would make this processing unfair.
We will not send individual general marketing information as part of a group emailing campaign unless you have consented to being contacted in this way or you are a “corporate subscriber” as defined under Privacy and Electronic Communications Regulations (PECR) and reasonably expect to be contacted in this way.
Recognised legitimate interest – The processing is necessary for one of the pre-approved purposes. These are:
- safeguarding “vulnerable” people;
- responding to emergencies;
- preventing or investigating crime;
- national security, public security and defence;
- and responding to requests made by bodies acting in the public interest, for processing by those bodies for purposes laid down in law (for example, to help a government agency discharge its duties and functions).
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
|---|---|---|---|---|
| ID and contact info Full name; Address; Email address; Date of birth; NI number; Employee ID;Employment info Employer name; Job title; Salary and remuneration details; Employment status and historyFinancial Info Pension contributions and entitlements Investment holdings (where applicable); Bank account details (for benefit payments)Benefit and Scheme Info Pension scheme membership details; Insurance benefits (e.g. life assurance, income protection); Beneficiary nominations; Contribution levels and selectionsHealth Data Medical history (for underwriting insurance policies); Health declarationsTechnical Data IP address; System access logs (where using online platforms) |
We collect personal data at various stages, including onboarding, the client firm; scheme set-up and enrolment and ongoing scheme administration. Data is also collected from third party sources – such as employers (our client firm), pension providers, insurers, and platform providers; regulatory or compliance checks (where applicable). | As part of providing a Service to our client firm. To provide financial advice, manage and arrange employee benefit and insurance based schemes. To improve our services, grow our business and explore new business opportunities. To communicate with you and answer questions or provide you with information. To comply with our legal and regulatory requirements. | Performance of the contract; legal obligation; legitimate and recognised legitimate interest; Consent – where health information is required. | Life of the contract plus 15 years after the end of the business relationship |
Partners (and ex-partners) of clients and former clients
When providing financial services to our clients, where relevant, we will obtain information about their family; their partner and their children. If you are a partner or ex-partner of a client or former client of Attivo please see the table below of the types of data collected and our reasons for processing.
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
|---|---|---|---|---|
| Basic personal data: Name, Date of birth, Gender, Marital status, Contact details, (home address, email address if same as client, phone number) and where relevant health information. | At the beginning and during the course of our business relationship with the client (your partner/ex-partner) – when the client requested or received a service from us. | To provide a service and/or arrange a product for the client (and where relevant their family). Such as investments or protection products that benefit both the client and their family. Personal data will be used to answer questions, provide information before, during and after our business relationship has ended. Also used to deal with any issues or complaints during and after completion of our contract with the client. | Consent, legitimate interest and recognised legitimate interest. These interests extend to the performance of our contract with the client and services we believe may be of interest to you. | Life of contract with the client plus 15 years after the end of the business relationship. |
Trustees, Attorneys and Deputies
When you act in the capacity of a trustee, or on behalf of a client as an attorney or deputy we will collect your personal data for the purposes of verification.
Lawful basis:
Contract – Our main basis for processing your data is because it is necessary for the performance of our contract with you.
Legal Obligation – As data controllers we have a legal obligation to process personal data relating to your identity to comply with anti-money laundering regulations.
Consent – Where we process sensitive information about you, we will obtain your consent.
Legitimate Interest – The sharing of your data may be necessary in relation to instances of fraud or credit risk. We may process your data for marketing purposes, but only where you would reasonably expect us to use your data in this way and that such processing does not have an impact on you in a way that would make this processing unfair.
We will not send you general marketing information as part of a group emailing campaign unless you have consented to being contacted in this way.
Recognised legitimate interest – The processing is necessary for one of the pre-approved purposes. These are:
- safeguarding “vulnerable” people;
- responding to emergencies;
- preventing or investigating crime;
- national security, public security and defence;
- and responding to requests made by bodies acting in the public interest, for processing by those bodies for purposes laid down in law (for example, to help a government agency discharge its duties and functions).
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
|---|---|---|---|---|
| Basic personal data, name, date of birth, gender, marital status, Contact details (home address, email address, phone number) | At the beginning of our business relationship with you. When you ask or receive a service from us. | To provide a service and/or arrange a product for you. To communicate with you and answer questions or provide you with information before, during and after our business relationship has ended. Review our performance and deal with any issues or complaints during and after completion of our contract. | Performance of the contract of the trust or client. Legal obligation, legitimate interest and recognised legitimate interest. | Life of the contract plus 15 years after the end of the business relationship |
| Proof of identity and residence data | At commencement of our contract with the trust. For attorneys and deputies on production of a power of attorney, deputyship / court order or on the instruction of our client and upon any change in circumstance – such as name / trustee / attorney / address change. | To verify the identity of the individual. For security reasons and compliance of anti-money laundering regulations and our obligations to our client. | Legal obligation | Life of the contract plus 15 years after the end of the business relationship |
| Information contained in any electronic verification check (Trustees only) | When consent has been given by the Trustee – From identification and verification checking agencies. Collected when an electronic verification check is undertaken | To verify the identity of the individual. For security reasons and compliance of anti-money laundering regulations. | Legal obligation | Life of the contract plus 15 years after the end of the business relationship |
| Information from your devices: IP address – details that identify your device. Cookies – small text files placed on your device when you visit a webpage. See our cookie policy | When you use our website. From Google Analytics | To help us understand how people interact with our website. To communicate with you and provide you with relevant marketing and other information. To collect visitor behaviour patterns. | Legitimate interest | Please refer to our Cookie policy |
| Financial information. Details about the trust’s assets and liabilities. | At commencement of our contract with the trust and during the course of our business relationship with you, including any recorded meetings. From product providers when we request information about products the trust holds. | To have a better understanding of the financial needs and objectives of the trust. To provide a service and/or arrange a product for you. | Performance of the contract; legitimate and recognised legitimate interest (necessary purpose, training, monitoring, complaint handling, compliance audits). | Life of the contract plus 15 years after the end of the business relationship. |
Suppliers and Prospectives
(includes both existing suppliers, prospective suppliers and prospective clients).
We will process personal data including contact details of our suppliers and where appropriate, employees of the supplier involved in the delivery of goods or services. Such processing will be in accordance with our contract with you. We will collect and store data obtained on receipt of a contact or from completing an enquiry submission on our website.
Lawful basis:
Contract – Processing of your data may be necessary for the performance of the contract between you as a supplier and Attivo.
Legitimate Interest – We may process your data for marketing purposes, but only where you would reasonably expect us to use your data in this way and that such processing does not have an impact on you in a way that would make this processing unfair.
We will not send you general marketing information as part of a group emailing campaign unless you have consented to being contacted in this way or you are a “corporate subscriber” as defined under Privacy and Electronic Communications Regulations (PECR) and reasonably expect to be contacted in this way.
Recognised legitimate interest – The processing is necessary for one of the pre-approved purposes. These are:
- safeguarding “vulnerable” people;
- responding to emergencies;
- preventing or investigating crime;
- national security, public security and defence;
- and responding to requests made by bodies acting in the public interest, for processing by those bodies for purposes laid down in law (for example, to help a government agency discharge its duties and functions).
Retention of data enables us to review your performance if any complaints or issues arise after completion of the contract.
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
|---|---|---|---|---|
| Supplier / Employee of supplier’s personal data i.e. name, address, work contact details (telephone number, email address) | This data would be collected at commencement of our contact with you and when we ask/receive a service from you. | To communicate with you and prospective clients. | Legitimate interest and recognised legitimate interest. Performance of our contract | Six years from completion of our contract |
| Prospectives: | ||||
| Basic personal data: limited but could include name, contact details (home / work address, email address, phone number) | When you use our website. From a mutual contact or bought-in marketing lists. | To grow our business and explore new business opportunities. To communicate with you and answer questions or provide you with information. Legitimate interest | Legitimate interest and recognised legitimate interest. | Limited data collected from our website is retained for a maximum period of 3 years. Where data is collected from bought in lists the retention period is determined in the agreement between Attivo and the supplier (usually 12 months). |
| Information from your devices: IP address – details that identify your device. Cookies – small text files placed on your device when you visit a webpage. See our cookie policy | When you use our website | To help us understand how people interact with our website. To communicate with you and provide you with relevant marketing and other information | Legitimate interest and recognised legitimate interest. | See our cookie policy |
| Your preferences for communicating and receiving marketing information | When you use our website or during our communications with you. | To communicate and send you marketing information. To grow our business and explore new business opportunities with you. | Legitimate interests | For a maximum period of 3 years. |
Employees
Employees and former employees or relatives of either.
Personal data of our employees or former employees is processed in the performance of our contract of our employment with you. A separate Privacy Policy for Employees exists for this purpose.
We may process personal data about your spouse, civil partner or other family member / friend where you have provided this information to us in connection with an employee benefit or emergency contact. The employee will be responsible for notifying that person and obtaining any relevant consent.
Prospective Employee or Referee of an Employee
If we have received your details in response to a recruitment initiative, we will store the personal information that either you, your recruitment agent or another third party has provided. Please see our separate Privacy Policy for Prospective Employees for more details.
Unless you request us not to do so, we may contact those individuals you have provided as referees or former employers. This contact may be made by telephone, email or post. We will only do this if we have your express permission to contact them in this way.
Where you have provided us with personal information about a referee or a previous employer, it is your responsibility to inform that person that you have provided us with their details and that we will be processing it in connection with your employment application. Our contact details can be found at the end of this policy.
Third Parties and Others
You are a third party with whom we are in contact during the delivery of services to our clients or the possible delivery of services to prospective clients.
We will process personal data including contact details of those third parties with whom we are in contact during and in relation to our Services to our clients, or prospective clients. The personal data we obtain can be as a result of interaction between you and our client, a supplier, an introducer or by other means.
We have received your information from a third party
If we have received your personal information from a third party, for example an introducer, the third party will normally be the controller in relation to your personal information and we will be processing it on their behalf. The third party should inform you when they share your personal data. You are advised to view their privacy policy.
Where you have been introduced by a third party and introductory remuneration is in place, we will share necessary personal data with that third party in order to make relevant payments and enable them to reconcile their records.
If you become a client or a prospective client as a result of an introduction, Attivo will become a controller in relation to your personal information. Please see table above ‘Clients and former clients’.
Executors or Administrators of a deceased client
In the event of a client’s death and to facilitate the distribution of the estate we will process personal data of each executor or administrator. The personal data we obtain will be that detailed on the grant of probate and verification of identity.
You are or have been a member of a property syndicate where we are the syndicate coordinator.
If you are a client and have agreed to become a member of a property syndicate administered by us, (such as a Self Invested Personal Pension – SIPP) then we will collect and store your personal information including contact details for the purpose of administering and performance of our contract with you and the property syndicate.
We have received your information from an employee or prospective employee. Or your relationship is not covered by any of the above.
We may hold your contact details and personal information as a result of an interaction between you and Attivo, or our employees or prospective employees. This interaction could be as a result of entry to a competition, attendance at an event hosted or supported by Attivo, potential business acquisition or disposal and/or the introduction of new business to Attivo.
Lawful basis:
Contract – Processing is necessary for the performance of our contract with you and / or the property syndicate.
Legitimate Interest – We may process your data when it is required as part of our Services to our client. Processing may also be for research and marketing purposes, but only where you would reasonably expect us to use your data in this way and that such processing does not have an impact on you in a way that would make this processing unfair.
We will not send you general marketing information as part of a group emailing campaign unless you have consented to being contacted in this way or you are a “corporate subscriber” as defined under Privacy and Electronic Communications Regulations (PECR) and reasonably expect to be contacted in this way.
Recognised legitimate interest – The processing is necessary for one of the pre-approved purposes. These are:
- safeguarding “vulnerable” people;
- responding to emergencies;
- preventing or investigating crime;
- national security, public security and defence;
- and responding to requests made by bodies acting in the public interest, for processing by those bodies for purposes laid down in law (for example, to help a government agency discharge its duties and functions).
| Types of Data Held | When Collected | Purpose of Processing | Lawful Basis for Processing | Retention Periods |
|---|---|---|---|---|
| Basic personal data: name, contact details (home/work address, email address, phone number) | During the course of our dealings with our client and where you have a relationship with that an individual. When you use our website. When you enter a competition run by Attivo. When you attend an event hosted or supported by Attivo. On notification of the death of a client. From a mutual contact. Provided by an employee of Attivo. When you were a client or became a member of a property syndicate administered by Attivo | As part of providing a Service to our client or their estate. To grow our business and explore new business opportunities. To communicate with you and answer questions or provide you with information. As part of administering the property syndicate and associated duties | Legitimate and recognised legitimate interest. Performance of our contract with you or your estate. Where relevant, performance of the contract with the property syndicate. | Personal data collected for an executor or administrator will be retained for the life of the contract plus 15 years from the death of the client. Limited data collected from our website is retained for a maximum period of 3 years. Where data is collected from bought-in lists the retention period is determined in the agreement between Attivo and the supplier (usually 12 months). Six years from the sale of the property and the syndicate being wound up |
| Information from your devices: IP address – details that identify your device. Cookies – small text files placed on your device when you visit a webpage. See our cookie policy | When you use our website | To help us understand how people interact with our website. To communicate with you and provide you with relevant marketing and other information. | Legitimate interest | See our Cookie policy |
Where you provide us with personal information about another person
If you give us personal information about another person, you must ensure that:
- you are legally entitled to give us that information;
- the disclosure is in accordance with any applicable data protection or privacy laws; and
- such other person has also read this policy.
Storing and Sharing your data
Attivo takes data security seriously. We use appropriate technologies and procedures to protect personal data. Our information security policies and procedures are closely aligned with widely accepted international standards. They are reviewed regularly and updated as necessary to meet our business needs, changes in technology and regulatory requirements.
Any information stored on behalf of our clients is controlled and managed by Attivo. It is only made accessible to those clients, to those that our clients may authorise from time to time, Attivo staff and third parties where we have a legal obligation to share such data.
| With whom we share your personal data | Why we share it |
|---|---|
| Within Attivo Group | Our business is supported by a variety of people who are part of Attivo Group’s teams and functions, including those who are part of other companies that comprise Attivo Group. Personal information will be made available to them if necessary for the provision of Services, account administration, sales and marketing, customer and technical support, and business and product development. All of our employees within Attivo and any contractors are required to follow our data privacy and security policies when handling personal information. |
| Our business partners | We occasionally partner with other organisations to deliver Services, provide content or to host events, conferences, and seminars. As part of these arrangements, you may be a client of both Attivo and our partners. We and our partners may collect and share information about you. Attivo will handle personal information in accordance with this Policy and we encourage you to review the privacy policies of our partners to learn more about how they collect, use, and share personal information. |
| Our third-party service providers | We partner with and are supported by service providers around the UK. Personal information will be made available to these parties only when necessary to fulfil the services they provide to us, including (without limitation) software providers; IT systems; platform support; direct marketing services; cloud hosting services; advertising; data analytics; compliance providers; property management; and order fulfilment and delivery. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us.
Sometimes it may be appropriate to use third parties who process data outside of the UK. This will only apply where it is permitted under UK GDPR. We will not contract with any provider where we cannot adhere to the legal obligations of the UK GDPR. If third party is a US organisation confirmation that the organisation is certified to the ‘UK Extension to the EU-US Data Privacy Framework’ will be obtained prior to the processing of any data. Data transferred between the UK and the EEA can continue as this meets the adequacy requirements, meaning the same level of protection for data exists between these countries. |
| Product providers | Personal data may be shared with financial product providers where you have a contract with them and in compliance with data protection legislation. |
| UK regulators (FCA) and Information Commissioner’s Office (ICO) | To meet our regulatory and legal obligations and to follow best practice. |
| UK Government bodies such as HMRC, National Crime Agency | To meet our regulatory and legal obligations and to follow best practice. |
| Other third parties not listed above | We may share personal information with other third parties when we believe it is our legitimate interests, such as: – in preparation for and/or in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings); – to protect our rights, users, systems, and Services. |
Attivo shares or discloses personal information when necessary to provide Services or conduct our business operations as described in the table. When we share personal information, we do so in accordance with data privacy and security requirements. We do not sell any personal information to third parties. We may occasionally share non-personal, anonymised, and statistical data with third parties.
Where your personal data is processed
We take steps to ensure that the information we collect is processed according to this Policy and the requirements of applicable law wherever the data is located.
We store information in hard copy files, which are stored in our offices and/or in archived storage space in the UK. We also store information in electronic files using cloud hosting servers on servers in the UK. We collaborate with third parties such as cloud hosting services, suppliers and technology support to serve the needs of our business, workforce, and clients. We take appropriate steps to ensure that personal data is processed, secured and transferred according to applicable law. In some cases, we may need to disclose or transfer your personal data within Attivo or to third parties in areas outside of the UK. This applies only when the processing of personal data outside of the UK deemed ‘restricted transfer’ is sent to a receiver located in a third country or territory or is an international organisation covered by UK adequacy regulations.
Your Rights
Right to access your personal data: If you request access to your personal data, we will gladly comply, subject to any relevant legal requirements and exemptions, including identity verification procedures. Before providing data to you, we will ask for proof of identity and sufficient information about your interaction with us so that we can locate any relevant data.
Right to rectification of your personal information: You have the right to correct or amend your personal information if it is inaccurate or requires updating. We will respond to requests for information and where applicable (subject to satisfying verification requirements), will correct or amend, your personal information.
Right to erasure: You also have the right to request deletion – the right ‘to be forgotten’. Please note that it is not always possible to comply with such requests due to legal requirements and other obligations and factors. Remember that you can contact us about our use of your personal information by using the “Contact Us” option on our website or let us know in writing, by email or by telephone.
Right to restrict processing: You may have the right to restrict the processing of your personal in certain circumstances. We may restrict processing where accuracy is being verified, or in terms of limiting access.
Right to data portability: You have the right to receive the personal data you have provided to us and a right to transfer this data to another controller (if this is technically feasible to do so and there are no other limitations affecting the request).
Right to object or withdraw your consent: If we are processing your personal data on the basis that you have given your consent to the processing, you have a right to withdraw your consent at any time by using the “Contact Us” option on our website or let us know in writing, by email or by telephone. Please note that it is not always possible to comply with such requests due to legal requirements and other obligations and factors.
Right to complain: You have the right to complain directly to us (the data controller) about how your personal data has been handled. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Marketing preferences: To opt out of email marketing, you can use the unsubscribe link found in the email communication you receive from us or you can use the “Contact Us” option on our website. For other forms of contact – please see our details below.
Profiling
Communication plays a key part of our business. We communicate with you directly where we feel it is appropriate to do so, or more generally via our website or other marketing platforms. Some communication is designed to gather your feedback to help us improve our services. Other marketing communication is to provide details of our services, which we believe may be of interest to you.
The processing of your personal data may involve profiling. Software may be used to obtain demographic data of our clients and / or users of our websites to help us communicate effectively and tailor our services for a better customer experience. Some profiling is used to see how you use and interact with our website and online tools. This helps us to improve our services to you.
Before we use data from profiling we check to make sure there are no legal restrictions and assess whether using the information might cause outcomes that are unfair. Where possible we will anonymise details.
If you do not want us to use your personal data for profiling, please contact us at clientservices@attivo.co.uk However, this may mean that we will not be able to provide you with our Services.
If you fail to provide personal data
Where we need to collect personal data by law such as proof of identity, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel your engagement with us but we will notify you if this is the case at the time.
Children’s privacy
We do sometimes provide services to children under 13 and will only use their personal data to enable us to provide our services to them and where the appropriate consent has been given. How we will provide our services for children and processing of their data will be discussed at our first meetings with the parent(s) or guardian(s) of the child.
We will not knowingly send any marketing information to children under 13.
Our contact details
The Privacy Officer
Attivo
Honeybourne Place
Jessop Avenue
Cheltenham
GL50 3SH
01242 585444
clientservices@attivo.co.uk
How to complain
We understand that you may have questions or concerns about this policy or our privacy practices or may wish to file a complaint. You must first raise your data protection complaint with ourselves as the data controller who holds or has processed your data.
You can make a complaint to us in person, by telephone, email or by post. Our contact details are shown above. Alternatively you can use our online complaints form below.
We will:
Acknowledge your complaint within 30 days of receipt.
Investigate and respond to you “without undue delay”.
Keep you informed of the progress and notify you of the final outcome.
If you are not happy with our response, you can escalate your complaint to the Information Commissioner’s Office (ICO). Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF