Website Privacy Notice

This privacy notice explains how TFP Financial Planning Ltd (“TFP”, “we”, “us”, “our”) collects and uses your personal information when you use our website, contact us, apply for a job, pay an invoice, or otherwise interact with us.

Who we are (data controller) and how to contact us

TFP Financial Planning Ltd is the “data controller” for the personal information described in this notice — this means we decide how and why we use it.

TFP Financial Planning Ltd is registered in England & Wales (Company number: 08068582), is authorised and regulated by the Financial Conduct Authority, and is registered with the Information Commissioner’s Office under registration number ZA185822.

Contact

If you have questions, want to exercise your rights, or want to complain, contact us using the details below.

FAO: Data Controller
TFP Financial Planning Ltd
65B High Street, Maldon, Essex, CM9 5EP
Telephone: 01621 851563
Email: team@tfp-fp.com

Personal information we collect

The personal information we collect depends on how you interact with us. This can include:

• Identity and contact details (e.g. name, email address, telephone number, address/postcode).
• Enquiry and correspondence information (e.g. the content of messages you send us, and our responses).
• Service-related information that you choose to provide (e.g. information about your needs and the services you’re interested in).
• Application information if you apply for a job (e.g. CV and recruitment-related information).
• Payment information if you pay an invoice by card (see “Payments” below).
• Technical information (e.g. IP address, browser/device information, and logs) — see “Technical information” below.

How we collect your information

We collect personal information when you enter it on our website (e.g. via contact forms), communicate with us by email or phone, download our digital content, apply for a job, or pay an invoice. We also collect some technical information automatically when you use our website (see “Cookies and similar technologies”).

Technical information

When you use our website, we may automatically collect technical information such as IP address, device and browser information, and how you navigate our site. We use this to operate, secure and improve our website and services. Some of this collection uses cookies or similar technologies (see “Cookies and similar technologies”).

Payments (paying an invoice)

If you pay an invoice by debit or credit card, we process information needed to take payment (e.g. payer name, billing address, and card/payment details). Card payments are processed securely by our payment provider. We do not store full card details ourselves. The payment provider will act as a separate controller or processor for certain payment information under its own terms and privacy information.

Why we use your information and our lawful bases

UK data protection law requires us to have a “lawful basis” for using your personal information. We use your personal information for the purposes set out in the table below.

Special category data

We do not ask you to provide special category data (such as health information) via our website. However, you may choose to include sensitive information in messages you send us. Where you become a client, we may need to process special category data — for example, health information for protection or annuity advice. We will only do so where the law allows, including where you have provided explicit consent or where it is necessary for legal or regulatory obligations.

Where we collect your information from

We usually collect personal information directly from you. In some cases, we also collect personal information from third parties, such as:

• Professional advisers you authorise (e.g. solicitor, accountant).
• Product providers and platforms (e.g. pension providers, insurers, investment platforms).
• Identity verification and fraud prevention providers.
• Credit reference agencies (where used).
• Publicly available sources (e.g. Companies House, professional registers).

Whether you have to provide personal information

Where we are providing financial planning services, we may need certain personal information to enter into and perform a contract with you and to meet legal and regulatory obligations. If you do not provide the information we request, we may not be able to provide our services, respond fully to your enquiry, or meet our legal obligations.

Who we share your information with

We may share your personal information with the following categories of recipients where necessary for the purposes described in this notice. Full names, addresses and contact details of named third parties are available on request:

• Compliance and training providers — Compliance and Training Solutions Ltd.
• IT and technology providers — including PC Help Essex Ltd and our customer-relationship management (Plannr) and document storage providers.
• Approved AI providers — see “How we use AI” below for the list of providers and what they process for us.
• Product providers, platforms and pension trustees — where we arrange or administer products on your behalf.
• Professional advisers — our accountants, lawyers and auditors where appropriate.
• Regulators and law enforcement — including the FCA, ICO, HMRC and the courts where required or permitted by law.
• Third parties involved in business transactions — if we are acquired, merge or restructure, your information may form part of the assets transferred. We will notify you in advance of any such transfer where required.

When we use suppliers to process personal information on our behalf, we require them to protect it under a written agreement and to use it only for the services they provide to us.

How we use AI

We use artificial intelligence (AI) tools to help us run our business and serve our clients more effectively. AI assists our team — it does not replace them. Every AI output that touches a client (directly or indirectly) is reviewed and validated by a qualified member of our team before it is used.

What we use AI for

• Drafting and editing internal communications, reports and policy documents
• Research, summarisation and ideation on publicly available information
• Preparing meeting notes, transcriptions and action logs
• Drafting content such as articles, newsletters, video and podcast scripts
• Supporting financial planning analysis (such as scenario modelling, cash flow inputs and initial client summaries) — always reviewed by a qualified adviser before use with you
• Drafting suitability reports for adviser review (never as a final output without adviser sign-off)
• Powering certain client-facing tools (such as our retirement discovery tools and spending profile assessments) — with clear disclosure within the tool itself

Which AI providers we use

Our approved AI providers currently include:

We maintain an internal register of approved AI tools and only use commercial-grade or enterprise versions with appropriate data protection commitments where personal data is processed.

Our AI safeguards

• Recording meetings: where we use AI to record or transcribe a meeting, we will ask you first. You can ask us not to, or to stop, at any time – we will simply take notes the traditional way.
• Written policy and governance: we have an AI Policy & Governance Framework that all staff must follow, with annual review and oversight by our Compliance Officer.
• No public AI tools with your data: we do not enter client personal data into public or free-tier AI tools.
• Data Processing Agreements: where AI providers process personal data on our behalf, we put written data processing agreements in place and configure those tools so that your data is not used to train their models.
• No solely automated decisions: we do not make decisions about you that have legal or similarly significant effects based solely on automated processing. AI does not produce regulated financial advice without full adviser review and sign-off.
• Explainability: we will always be able to explain in plain English the basis of any output that materially affects advice given to you. “The AI said so” is never an acceptable answer.
• Fair treatment: we monitor AI outputs for accuracy, bias and consumer harm in line with our Consumer Duty obligations, with particular care for vulnerable clients.

If you have any questions about how we use AI, please contact us at team@tfp-fp.com.

International transfers

Some of our suppliers (including some of our AI providers) host or process personal information outside the UK, in countries including the United States and within the European Economic Area. Where we transfer your personal information outside the UK, we put appropriate safeguards in place — such as UK adequacy regulations or the UK International Data Transfer Agreement (or equivalent contractual safeguards approved under UK GDPR) — so that your information receives an essentially equivalent level of protection.

How long we keep your information

We keep personal information only for as long as necessary for the purposes described in this notice, including to meet legal, regulatory, accounting and reporting requirements. Retention periods vary depending on what the information is and why we have it. For example:

• Website enquiries: we typically keep enquiry records for up to two years unless they become client records.
• Client and advice records: we keep these for as long as needed to provide services and for the periods required by law and financial services regulation. In most cases this is at least 6 years from the end of our relationship; for Defined Benefit Transfers and Scheme Money Purchase Transfers we retain records indefinitely.
• HMRC-related records: we keep these for at least 7 years.
• Recruitment: if you apply for a job, we keep application information for as long as needed to manage recruitment and for a reasonable period afterwards.
• Marketing suppression: if you ask us not to contact you, we may keep limited information (e.g. your email address) so we can record and respect your preferences.

Where we cannot specify an exact period, we use criteria such as the volume, nature and sensitivity of the information, the purposes for which we use it, and legal and regulatory requirements.

Your data protection rights

You have rights over your personal information. These rights are not absolute and may apply only in certain circumstances. You can exercise your rights by contacting us using the details above. We may need to request information to confirm your identity.

• Access — request a copy of your personal information.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure — ask us to delete your information in certain circumstances.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Object — object to our use of your information where we rely on legitimate interests; you can also object to direct marketing at any time.
• Data portability — request to receive certain information in a structured, commonly used format, or have it sent to another provider (where applicable).
• Withdraw consent — where we rely on consent, you can withdraw it at any time.
• Object to automated decisions — object to decisions taken by solely automated means and ask us to explain the basis of any output that materially affects you.

We normally respond within one calendar month. There is no charge for this service unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable fee or refuse to respond.

Marketing

We may send you marketing by email, text, phone, post or in-app notifications where permitted by law. You can opt out of marketing at any time by using the unsubscribe option in the message or by contacting us. If you opt out, we may still send you non-marketing messages — for example, about a service you have requested or to meet our legal obligations.

Automated decision-making and profiling

We may use limited profiling to understand engagement with our marketing (for example, whether emails are opened or links clicked) so we can tailor content. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. AI is used to support — not replace — the judgement of our advisers. See “How we use AI” above.

Cookies and similar technologies

We use cookies and similar technologies (e.g. pixels and device storage) on our website. Some are strictly necessary to make the site work. Others help us analyse performance and improve the site or support marketing.

Your choices

You can control cookies through your browser settings and, where available, our cookie settings tool/banner. Where required, we will ask for your consent before placing non-essential cookies on your device.

Cookie categories

• Strictly necessary — needed for the website to function.
• Analytics — help us understand how the website is used and improve it.
• Functional/preferences — remember your settings (where used).
• Marketing — help deliver and measure marketing (where used).

Changes to this privacy notice

We may update this privacy notice from time to time. We will post the updated version on our website and, where appropriate, notify you by email if we have your email address. This notice was last updated in August 2026.

Complaints

If you have concerns about how we use your personal information, please contact us first using the details above.

You also have the right to complain to the UK Information Commissioner’s Office (ICO):

• Telephone: 0303 123 1113

Online: www.ico.org.uk

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF