Privacy Policy
At BRB Wealth Management Ltd we are committed to protecting and respecting your privacy.
This Policy explains when and why we collect personal information about people who visit our website or seek our services, how we use it, the conditions under which we may disclose it to others and how we keep it secure.
We may change this Policy from time to time so please check this page occasionally to ensure that you are happy with any changes. By using our website, you are agreeing to be bound by this Policy.
Any questions regarding this Policy and our privacy practices should be sent by email to info@brbwm.co.uk or by writing to Neil Hart, BRB Wealth Management Ltd, Bradwell House, 16 – 18 King Street, Newcastle-under-Lyme, Staffordshire, ST5 1EJ. Alternatively, you can telephone 01782 204205.
Introduction:
To provide financial planning services, we need to collect and keep personal information about you. We must follow the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use & Access) Act 2025. This notice explains how we use your data and your rights under the law.
Who we are:
We are responsible for your personal information and are registered with the Information Commissioner’s Office (ICO). Our ICO registration number is Z779296X.
Why we need your data:
We use your personal data to provide financial planning services and advice, meet our legal and regulatory duties, carry out identity checks, respond to lawful requests from regulators or courts, help prevent financial crime, and manage our business, including quality checks and complaints.
Our lawful basis for processing (summary)
What we use your data for & UK GDPR lawful basis
Providing financial planning services and advice, including checking suitability and keeping your plan or portfolio up to date – Contract (needed to provide the services you ask us for)
Meeting FCA and other legal or regulatory duties, such as identity checks, anti-money laundering checks, audits, and record-keeping – Legal obligation
Responding to lawful requests from regulators, courts, or law enforcement, and helping to prevent fraud and financial crime – Legal obligation and/or legitimate interests (to protect our business, our clients, and the public)
Running and managing our business, including quality checks, complaint handling, record-keeping, and business continuity – Legitimate interests (to run our business responsibly) and/or legal obligation (where required)
Sending you direct marketing, where you have agreed to this – Consent (you can withdraw it at any time)
If we rely on your consent, for example, to use special category data for some protection or annuity quotes, you can withdraw that consent at any time by writing to us. This will not affect anything we did before you withdrew consent, but it may limit the services we can provide if that data is needed for the service you asked for.
General information about your data and your rights:
Under the UK GDPR, you have the following rights, subject to certain conditions:
• ask for a copy of your personal data
• ask us to correct inaccurate personal data
• ask us to delete your personal data in some circumstances
• ask us to limit how we use your personal data in some circumstances
• object to how we use your personal data in some circumstances, including for direct marketing
• withdraw your consent at any time where we rely on consent (this will not affect anything we did before you withdrew it)
• ask for your data in a portable format in some circumstances
• object to certain automated decisions, including profiling, and ask for clear information about how they work and what they may mean for you, where relevant
• claim compensation if you suffer harm because the data protection law has been broken
Our obligations:
• To inform you, where appropriate, of the contact details for any Data Protection Officer appointed by us.
• To inform you of the recipients or categories of recipients of data.
• To inform you of the period for which we propose to hold the data, or where this is not possible, the criteria which we will apply to data retention.
Where you exercise your right to request access to data of which you are the data subject, we will undertake to respond to you within one month of receipt of your request. There will be no charge for this service unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a fee or refuse to respond.
You can ask us to restrict how we use your personal data, or object to certain processing, in line with your UK GDPR rights. We will consider your request and respond in line with the law. Please note that we may need to continue processing where we have a legal obligation, or where it is necessary to provide the services you have asked for.
Some personal data is required so we can provide our services and meet legal or regulatory obligations. If you choose not to provide the required information, we may be unable to act for you, progress your instructions, or obtain products/quotes on your behalf.
These rights apply whether we collect your personal data directly from you or receive it from third parties.
Save in the circumstances as detailed below, we will inform you from which source the data originated and whether it came from publicly accessible sources. The information to be provided will be in accordance with the following time periods, whichever shall occur first:
• As soon as practicable after obtaining the data and in any event within 1 month
• At the time of our first communication with you, using the data
• When the data is first disclosed to another person
We do not have to give you this information in the following cases:
• Where you already have the information
• When we are legally required to keep it confidential
• Telling you would make it impossible, or seriously affect, the reason we are using the data. If this happens, we will still take steps to protect your rights and freedoms.
Recognised Legitimate Interest:
Recognised Legitimate Interest (RLI) is a lawful basis for processing data and is distinct from the existing legitimate interest category, which remains applicable and is covered within this notice.
RLI is effectively pre-approved for situations that are deemed to be in the Public Interest and do not require client consent.
The following areas are specifically covered:
• Crime Prevention
• National Security or Defence
• Public Security
• Safeguarding
• Emergencies
• Sharing personal information to help other organisations perform their public tasks or official functions
What Personal Data is Collected?
We may collect and use the following categories of personal data:
• Identity and contact details such as name, address, email, telephone and date of birth.
• Financial and employment details relevant to advice, such as income, expenditure, assets, liabilities and tax position.
• Client profile and objectives information, such as risk profile, capacity for loss, and investment objectives.
• Product and policy information such as existing pensions, investments and insurance policies.
• Regulatory and due diligence information, such as identity verification and AML checks.
• Correspondence and records of advice, meetings and decisions such as suitability reports, notes and call recordings where applicable.
How is Personal Data Collected?
We collect personal data directly from you via various forms of contact, including (but not limited to) meetings, telephone calls, email, forms, applications and online portals.
We may also receive personal data from third parties where necessary for the services, such as product providers, platforms, your employer (where relevant), professional advisers, credit reference agencies, fraud prevention agencies, and public sources (e.g. Companies House) where appropriate.
We may need to collect sensitive personal data (special category data), including information about your health, ethnic origin, or criminal prosecutions from you and third parties such as employers and credit reference agencies, fraud prevention agencies and other similar organisations in order to provide you with the services, for example, where you require advice on protection or annuity products.
In some cases, such as protection or annuity advice, we may need health information and/or information about criminal convictions/offences to obtain terms or quotes on your behalf. Where we process special category data, we will only do so with your explicit consent for the relevant purpose, unless another lawful condition applies (for example, to establish, exercise or defend legal claims).
Holding your data:
We undertake to review the data we hold on you on a regular basis to ensure compliance with data protection law. In the course of any review, we will:
• Delete any data which is trivial or transitory in nature, or which, in our opinion, is no longer required for the purposes set out above.
• Update the data to ensure that any errors or inaccuracies are corrected.
• Archive data as detailed below.
• Subject to the data retention periods, as detailed below, securely delete the data when it is identified that we no longer need to hold it.
• If we use AI-enabled tools or third-party service providers to support our services, your data may be processed and/or stored by those providers on our behalf. Where this involves transferring personal data outside the UK, we will ensure appropriate safeguards are in place, and we will provide details on request.
We may retain and process your data for the following periods. If more than one period applies to the same data, we will retain the data to the last such period to expire:
• We will hold any client engagement documentation (including terms of business and related documents) for a period of 6 years from the termination or expiry of the engagement unless we have been notified of any claim or circumstance which might give rise to a claim.
• We will process data relating to investments which we have provided advice on and/or arranged for you. We will process such data throughout the entire period you remain a client of the firm and for a period of not less than 6 years following our ceasing to provide service to you in regard to those investments. We may process your data until the date of maturation of long-term investments.
• We will keep data for as long as a regulator requires. For the Financial Conduct Authority (FCA), this is usually 6 years for most businesses. For Occupational Pension Schemes, including Defined Benefit Transfers and Scheme Money Purchase Transfers, we may need to keep the data indefinitely.
• We will keep data for as long as a relevant third party requires. For HMRC, this is usually 7 years. If HMRC tells us a period is still open, we will keep the data until HMRC confirms it is closed.
• If data is needed for legal proceedings, we will keep it for 6 years after the proceedings end, unless the law or a court requires us to keep it for longer. Proceedings are treated as ended when the time limit for any appeal has passed, or when a full settlement has been reached before judgment.
• Apart from the reasons above, we will only keep data for as long as needed for legal purposes.
Archiving data:
We will regularly review data, and where such data has ceased to be active, we will archive it and process it only as Archived Data. Any data which is deemed Archived Data will only be processed in limited circumstances.
All storage of data, whether Active Data or Archived Data, will be in accordance with good industry practice and will be undertaken in accordance with organisational systems and procedures, which will be regularly reviewed, to maintain the security of data.
Data portability:
When our services end, you can ask us in writing to give you the data you provided in a structured, commonly used, machine-readable format, or to transfer it to another data controller you name. We may still keep copies where we are allowed or required to do so for the reasons set out above.
Whom we may share your data with:
To carry out our legitimate business and to provide you with financial planning services, we have entered into agreements with and will share your information with the following companies, for Compliance, IT systems security, data management and control and auditing. Full details of these companies’ addresses and contact details are available on request:
• Our compliance consultants
• AI and technology service providers
• Paraplanning and administrative support providers.
• Other service providers who support our regulated activities.
Some organisations we share your data with, including product providers and platforms, may act as independent data controllers; please see their own privacy information for details.
Potential Business Transfers
If our firm is involved in a merger, acquisition, sale of assets, or other business transaction, your personal data may be part of the assets transferred. Any such transfer will comply with applicable data protection laws, and the receiving party will continue to handle your personal data in accordance with this Privacy Notice, or an updated notice provided at the time of transfer. We will notify you in advance of any such transfer, providing details of the acquiring entity and any changes to how your data will be processed, if applicable.
How to make a data protection complaint to us
If you think we have not handled your personal data properly, please contact:
Name: Neil Hart
Address: Bradwell House, 16-18 King Street, Newcastle, Staffordshire, ST5 1EJ
Telephone No. +44 1782 204205
Email: n.hart@brbwm.co.uk
Tell us what happened, when it happened, and what you would like us to do to put things right.
• We will acknowledge your complaint within 30 days.
• We will investigate, keep you updated, and tell you the outcome without undue delay.
If you are not satisfied with our response, you can also complain to the Information Commissioner’s Office (ICO) using the contact details below:
• Online: https://ico.org.uk
• Phone: 0303 123 1113
Review of this Policy
We keep this Policy under regular review. This Policy was last updated in August 2026.