Last updated: July 2026

Your right to privacy is important to us. This policy will explain your privacy rights and how we process, collect, manage and store those details and how your rights under the UK General Data Protection Regulation (UK GDPR) are adhered to.

We collect information about you so we can carry out the service we are contracted to do.

We will never pass your personal data to anyone else without telling youin this Privacy Policy

‍

Personal data we collect about you

The type of personal data we collect about you and how it is used depends on what contact you have with us, your needs, the relationship you have with us and the products and services you hold or enquire about.

The following is information which we will need to obtain about you:

• Title, name, date of birth, marital or civil status, gender, contact details, addresses, nationality. This also extends to documents that will help us to verify your identity.
• Employment and remuneration information, including salary, bonus schemes, any overtime, sick pay, other benefits and employment history.
• Bank account details, loans and other liabilities, tax information, income and expenditure, family circumstances and details of any dependents.
• Health status and history, details of treatment and prognosis and medical reports.

It can also include information which either you give to us or which we obtain about you that is relevant to the services that we are providing

We may also gather data from our website’s ‘contact us’ form, used to enquire about our services or from when you voluntarily complete client surveys.

‍

Why do we collect this data?

The main reason we collect this data is to complete the services you have entered into a contract with us for. Without knowing any of this information, we would be unable to fulfil our legal and regulatory obligations. Therefore, it is essential we collect this information.

However, we also collect this data because you will have given us consent to do so. Where required, we will, before proceeding, ask you to provide us with your consent to the processing of your data.

If we need to collect special category data (e.g. health or mental conditions, trade union membership, biometric data (verification or identification data)) we will obtain your explicit consent first.

‍

How will we collect your data?

We will collect and record your data from a variety of sources; however, we rely mostly on this information coming directly from you. We will collect this information usually over a series of meetings, but most of this will be collected during our fact-finding meeting.

We may also collect this data from third parties such as, credit checks, your employer etc.

‍

How will we store your data?

All information you provide to us is stored on our securely. We will keep copies of your data on paper files and our computer systems and approved software. Please note that this data can only be accessed by current employees of the firm or trusted contractors or suppliers. They will only access this data when they are providing you with advice or are undertaking administrative tasks.

When your data is stored on paper, it will be kept in a secure place where only authorised employees can access it.

• Paper files will be locked in a drawer or in a filing cabinet and the key/code kept in a safe place where only a limited number of people have access
• When it is no longer required, the paper files will be shredded and dealt with as ‘confidential waste’.
• Our employees will make sure paper, and printouts are not left where unauthorised people could see them, like on a printer.

When your data is stored electronically, it will be protected from unauthorised access, accidental deletion, and malicious hacking attempts:

• Data will be protected by strong passwords that are changed regularly and never shared between employees.
• Only approved removable media devices will be used for data storage, and devices will be wiped when the data is no longer required.
• Servers containing personal data will be sited in a secure location, away from general office space.
• All servers and computers containing data will be protected by approved security software and a firewall.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA). If this is the case, we will carry out thorough research first to ensure the third party had sufficient procedures in place to ensure the security and safety of your data. If they cannot evidence this, we will not conduct business with them.

‍

Sharing your data

The firm will only share your personal data where data protection law allows it, with adequate protection, and where appropriate. We will also have contracts in place to protect the security and confidentiality of your data.

When we use third-party service providers, we disclose only the personal information that is necessary to deliver the service. There will be a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes.

We will not sell or distribute your personal data to other organisations.

If we need to send your data to a destination outside the European Economic Area (EEA) we will again carry out thorough research first to ensure the third party has sufficient procedures in place to ensure the security and safety of your data and we will ensure there is a valid safeguard in place to protect the data transfer in line with applicable data protection law.

‍

Your rights

Your rights under the UK General Data Protection Regulations are briefly as follows:

• To be informed about the collection and use of your personal data,
• To have inaccurate personal data rectified, or completed if it is incomplete,
• To have personal data erased (in certain circumstances),
• To request access to information held about you,
• To request the restriction or suppression of your personal data,
• To obtain and reuse your personal data for your own purposes across different services,
• To object to the processing of your personal data in certain circumstances.

‍

How long will we hold your data?

We retain personal information only for as long as it is necessary to fulfil the purposes for which it was collected, including the delivery of our services, compliance with legal and regulatory obligations, the establishment, exercise or defence of legal claims, and the protection of our legitimate business interests.

The length of time we retain personal information is determined by considering a range of factors, including:

• The nature, sensitivity and volume of the personal information.
• The purpose for which the information was collected and whether that purpose is ongoing.
• Any contractual requirements relating to the provision of services.
• Applicable legal, regulatory, accounting, tax or professional obligations.
• Relevant limitation periods for potential legal claims.
• Industry standards, professional guidance and good practice.
• The risks associated with retaining or deleting the information.

We regularly review the personal information we hold and securely delete, anonymise or otherwise dispose of information when it is no longer required for the purposes for which it was collected or where there is no longer a legal or business need to retain it.

‍

Can I access the data you hold on me?

Yes, you can. You have the right to request a copy of your data that we hold. If you would like to receive a copy of this information, you can request a copy by contacting us at dataprotection@bhpfp.co.uk  

We will supply this information free of charge to you. However, we reserve the right to charge a reasonable fee to comply with your request if we believe it is manifestly unfounded or excessive.  

‍

Marketing

As a client of the firm, we would like to send you marketing material to keep you up to date with information we believe is important for you to know or to provide you with information on other products and services which we believe may be of interest to you. Where required, we will ask for your consent and your preferred method of contact before sending you anything. You can withdraw this consent at any time by contacting us.

‍

What if I'm unhappy with how you have processed my data?

We would be sorry to hear that you are not happy with how we have processed your data. However, if you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. You can do this by contacting dataprotection@bhpfp.co.uk  We will acknowledge complaints within 30 days as per our requirements under the Data (Use and Access) Act 2025 and will respond to your complaint in full without undue delay.

Alternatively, you can contact the Information Commissioner’s Office (ICO). You can do so by clicking on this link: - https://ico.org.uk/make-a-complaint/. You can start a live chat or call their helpline on 0303 123 1113 or write to them at this address:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF    

‍

Review of this Policy

We reserve the right to update this privacy policy at any time. We will notify you if there are any changes to this policy that materially affect how we collect, store or process your personal data.