Last reviewed September 2026
This notice explains how we collect and use your personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about it, please get in touch — we’re happy to talk it through.
What we collect
Your finances, circumstances, objectives and other relevant details.
How we use it
Solely for the purposes you provided it for. Never for marketing.
Your rights
Ask for a copy, correct inaccuracies, or ask us to stop processing.
What we collect, and what we do with it
To provide financial advisory services for you, we need to obtain some of your personal information concerning your finances, circumstances, objectives and other relevant details. We collect, store and process this information, and we use it to provide the services you have requested.
Our legal basis for processing
We collect, control and process your personal information because this is necessary to provide you with information you have requested, to answer any queries you may have, and to deliver our services to you. Contractual necessity (UK GDPR Article 6(1)(b)) is therefore the lawful basis for collecting, controlling and processing your personal details.
Where we collect personal data relating to your employees or service providers, we rely on legitimate interests (UK GDPR Article 6(1)(f)) — specifically, our legitimate interest in delivering the financial advisory services you have requested.
For special category (sensitive) personal data, we rely on your explicit consent (UK GDPR Article 9(2)(a) and DPA 2018 Schedule 1), except where we are using the data for insurance underwriting purposes, in which case we rely on the insurance condition under DPA 2018 Schedule 1, Part 2, paragraph 20.
Where we are advising on or arranging insurances, investment bonds, pensions or other insurance-based products, we need to collect and potentially share such information with providers.
Sensitive personal data
Some categories of personal data are treated as sensitive under data protection law. These are:
Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data
Data concerning health
Data concerning sex life or sexual orientation
We would always discuss the need for sensitive data with you before you provide it.
If we cannot obtain the information we need
If you do not provide the personal information we request, we may be unable to provide you with financial advice or the services you have asked for, as we would be unable to properly assess your circumstances, objectives, or suitability for a recommendation.
Who we share your data with
In the course of our work with you we will share your personal data with product and service providers. We may also share your data with compliance monitoring and support organisations and regulatory bodies, who are also ‘Data Controllers’ unless otherwise indicated before we share any of your data. Where appropriate, we may share data with your accountants and/or solicitors if it is necessary for delivering our best service.
We also use external data processors that hold information for the following purposes:
Secure file sharing
Data backup
Dissemination of information
Compliance monitoring
Otherwise we will not share your personal information with other companies without your express authority, except if our firm is sold or where we are required to do so by law. For example, if you ask us to introduce you to another firm, we will pass your data to that firm for that specific purpose with your consent. We will do this once, and you would need to consent again for us to repeat it.
Marketing
The information we collect about you is used solely for the purposes for which it was provided. We will never use your data, or share it, for marketing purposes.
Transfers outside the UK
Should any processor hold or process data on our behalf outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR. Where data is transferred to the US, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”) where the receiving organisation is certified, or on UK International Data Transfer Agreements (IDTAs) or UK Standard Contractual Clauses where it is not. Transfers to other non-UK jurisdictions will only be made where the UK has issued an adequacy decision, or where equivalent contractual safeguards are in place.
How long we keep your data
We will keep your personal data throughout our business relationship. At the end of our contractual relationship with you, we are required under FCA rules to retain records for a minimum of five years from the date the relationship ends — or longer for certain products, such as pension transfer advice, which we retain indefinitely, in line with FCA guidance.
We may retain data for longer than these minimum periods where we reasonably consider it necessary to defend against, or bring, a legal claim. Where we no longer need regular access to your data, we will transfer it to secure archive storage to reduce unnecessary ongoing processing.
Your rights over your data
Under data protection law you have the right to ask us for a copy of the information we hold about you, and to have any inaccuracies corrected or removed. You may also ask us to delete or cease processing all personal data held by us, or by any processor with whom we have shared your data. We may not always be able to comply with a request for deletion, but you can ask us to cease processing your data.
In addition, you have the right to be informed about the data we collect, where it is located, and with whom it is shared.
Automated decision-making
We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you without human involvement.
Data protection queries
We have not appointed a formal Data Protection Officer, as we are not required to do so under UK GDPR. Data protection queries should be directed to the contact below.
Complaints
The UK Information Commissioner’s Office is our supervising authority, and you can refer any complaints about data protection to them. See ico.org.uk for more information.
Data protection contact
For any queries about data protection, please contact:
CONTACT NAME
Adam Downes
ADDRESS
16 Blackfriars Street, Manchester, M3 5BQ
TELEPHONE
0113 526 6827
Pura Vida Financial Planning is registered with the Information Commissioner’s Office (ICO) under registration number ZB044656. We review this notice periodically to reflect changes in our services and in data protection law.