Who we are
Carlson Wealth Management Ltd (“we”, “us”, “our”, the “Firm”) is the controller responsible for Your Personal Data.
Registered in England and Wales, company number 9408222. Registered office: 35 Maindy Road, Cardiff, CF24 4HL. Authorised and regulated by the Financial Conduct Authority; on the Financial Services Register under reference 673112.
Telephone: 02921 051538
Email: steve@carlsonwealthmanagement.co.uk
For any data protection query please contact us and ask for the person responsible for data protection.
Why should you read this document?
During the course of dealing with us, we will ask you to provide detailed personal information relating to your circumstances, your financial situation and, in some cases, your health and family health history (Your Personal Data).
This document explains what we do with Your Personal Data and the rights you have in relation to it.
What do we mean by “Your Personal Data”?
Your Personal Data means any information that describes or relates to your personal circumstances. It may identify you directly (for example your name, address, date of birth, National Insurance number) or indirectly (for example your employment situation, your physical and mental health history, or other information associated with your cultural or social identity).
In the context of assisting you with your financial affairs, Your Personal Data may include:
Title, names, date of birth, gender, nationality, civil/marital status, contact details, addresses and documents necessary to verify your identity.
Employment and remuneration information (including salary, bonus schemes, overtime, sick pay and other benefits) and employment history.
Bank account details, tax information, loans and credit commitments, personal credit history, sources of income and expenditure, family circumstances and details of dependants.
Health status and history, details of treatment and prognosis, and medical reports (see the section below on special category data).
Any pre-existing products and the terms and conditions relating to them.
The basis on which our Firm will deal with Your Personal Data
When we discuss your financial affairs with you, we do so on the basis that both parties are entering a contract for the supply of services. To perform that contract and to arrange the products you require, we use Your Personal Data for the purposes set out in this notice.
Before that contract begins, or after it has ended, we may also use Your Personal Data where it is in our legitimate business interest to do so and your rights are not overridden. For example, we may need to respond to requests from product providers, insurers or our Compliance Service Provider relating to the advice we have given you, or to contact you for feedback on our service.
On occasion we will use Your Personal Data to meet responsibilities we owe our regulator, the Financial Conduct Authority, or to comply with any other legal or regulatory obligation to which we are subject.
Special category data and criminal disclosures
Where you ask us to assist with insurance, in particular life insurance and insurance that may help in the event of accident or illness, we will ask about your health and medical history, and may ask about your ethnic origin (Your Special Data). We record and use Your Special Data to make enquiries of providers about products that may meet your needs and to advise you on their suitability.
The arrangement of certain insurance may involve you disclosing information about historic or current criminal convictions or offences (“Criminal Disclosures”), which is relevant to insurance activities such as underwriting, claims and fraud management.
We process Your Special Data in reliance on the conditions in Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (including the condition relating to insurance), and any Criminal Disclosures in reliance on Article 10 of the UK GDPR and the corresponding conditions in that Schedule. Such information must be capable of being exchanged between insurance intermediaries such as our Firm and insurance providers so that customers can secure the protection their needs require.
If you have parental responsibility for children under the age of 13, it is likely we will record information relating to those children, potentially including their Special Data.
How do we collect Your Personal Data?
We collect and record Your Personal Data from a variety of sources, but mainly directly from you, during our meetings or conversations and in writing, including by email.
We may also obtain some information from third parties, for example credit checks, information from your employer, and searches of information in the public domain such as the electoral roll.
Where we use a technology solution to help collect Your Personal Data (for example software that verifies your credit status), we will only do so with your consent for us or our nominated processor to access your information in that way.
For electronic identity checks we do not require your consent, but we will tell you how such software operates and the purpose for which it is used.
What happens to Your Personal Data when it is disclosed to us?
In handling Your Personal Data, we will:
Record and store it in our paper files, on our mobile devices and on our computer systems (for example email, hard drives and cloud facilities). This information is accessed only by people within our Firm, and only when necessary to provide our service to you and to carry out associated administration.
Submit it to product providers and insurers, in paper form or online via a secure portal, where this is necessary to progress an enquiry or application made on your behalf and to deal with related questions.
Use it to respond to queries about your financial affairs and to keep you informed of developments relating to your products or policies of which we become aware.
Our use of artificial intelligence (AI) tools
To help us work efficiently and support the service we provide, we use a third-party AI tool (Claude, provided by Anthropic) to assist with tasks such as research, drafting documents, summarising information and general administration.
Where necessary for such a task, a limited amount of Your Personal Data may be processed using this tool; we include only what is needed and keep this to a minimum.
We do not use AI to make automated decisions about you, your finances or the advice we give. All advice and recommendations are made by a qualified adviser, and a member of our team reviews and checks anything the tool produces before it is used.
The AI provider acts as our data processor under a written agreement and does not use Your Personal Data to train its AI models.
Sharing Your Personal Data
From time to time Your Personal Data will be shared with:
Product providers and insurers.
Third parties who we believe can assist with your enquiry or support your identified needs. These may include our Compliance Advisers, product specialists, and providers of legal services such as estate planners, where we believe this is required by your particular circumstances.
Our technology and administration providers acting as our processors (for example secure cloud, email and the AI tool described above).
In each case Your Personal Data is shared only for the purposes set out in this notice, that is, to progress your enquiry and to provide our professional services.
This sharing does not entitle those third parties to send you marketing or promotional messages.
International transfers
Most of Your Personal Data is stored and processed within the UK.
In limited circumstances it may be transferred outside the UK, for example where a technology provider we use (such as the AI provider described above) is based overseas.
Where this happens we ensure an approved safeguard is in place, such as the UK Addendum to the Standard Contractual Clauses issued by the Information Commissioner, so that Your Personal Data continues to receive a level of protection equivalent to that required under UK law.
Security and retention of Your Personal Data
Your privacy is important to us and we keep Your Personal Data secure in line with our legal responsibilities, taking reasonable steps to safeguard it against unlawful or malicious access.
We also ask you to take reasonable steps to protect your own privacy when sending information to us, for example by not sending confidential information over unprotected email, ensuring attachments are password-protected or encrypted, and using secure postage when sending original documents.
We retain Your Personal Data, electronically or in paper form, for a minimum of 6 years; where we have a legal right or obligation to keep it for longer, we may retain records for longer or indefinitely.
Working material held only to carry out a specific task is kept only for as long as needed for that task.
Your rights in relation to Your Personal Data
You can:
Request copies of Your Personal Data under our control.
Ask us to explain further how we use Your Personal Data.
Ask us to correct or delete Your Personal Data, or to restrict or stop using it (we will explain at the time the extent to which we can do this).
Ask us to send an electronic copy of Your Personal Data to another organisation, should you wish.
Change or withdraw any consent you have given us, including any consent to market to you in future
How to contact us about the use of Your Personal Data
If you have any questions or comments about this document, or wish to exercise any of your rights, please contact us using the details above and ask for the person responsible for data protection.
If we believe we have a legal right not to deal with your request, or to deal with it differently from how you have asked, we will tell you at the time.
Please also contact us as soon as possible if you become aware of any unauthorised disclosure of Your Personal Data, so that we can investigate and meet our own regulatory obligations.
If you have any concerns or complaints about how we have handled Your Personal Data, you may complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), via:
https://ico.org.uk/global/contact-us/
or by writing to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF