Privacy Notice

1. Introduction

Acacia Wealth Limited (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal information with care, transparency, and respect.

This Privacy Notice explains how we collect, use, share, and store your personal information. It applies to everyone whose data we process, including:

• Current and prospective clients
• Family members, dependants, and beneficiaries whose information is provided to us by a client
• Individuals who connect with us through social media platforms or other professional networks
• Visitors to our website at www.acaciawealth.co.uk
• Recruitment candidates and applicants

Please read this notice carefully. It is the single source of truth for how Acacia Wealth handles personal information, whether you are a client, a prospective client, or otherwise interacting with us.

If you have any questions, please contact: Tyron Edmonds, Managing Director, Acacia Wealth Limited, 7 Bell Yard, London WC2A 2JR. Email: Tyron.Edmonds@acaciawealth.co.uk.

2. Who We Are

Acacia Wealth Limited is the data controller for the personal information described in this notice. This means we determine the purposes and means of processing your personal information and are responsible for its lawful and fair use.

We are authorised and regulated by the Financial Conduct Authority (FCA Reference: 504742). You can verify our registration at www.fca.org.uk/register or by calling the FCA on 0800 111 6768.

We are registered with the Information Commissioner’s Office (ICO) as a data controller.

3. What Personal Information We Collect

The personal information we collect depends on your relationship with us. We collect only what is necessary for the specific purpose.

3.1 Clients and Prospective Clients

When we provide or propose to provide financial planning services, we may collect:

• Identifying information: full name, date of birth, gender, nationality
• Contact details: home address, email address, telephone numbers
• Identity verification documents: passport, driving licence, national identity card, utility bills, bank statements
• Employment information: employer, job title, employment history, professional qualifications
• Financial information: income and outgoings, assets and liabilities, existing pensions and investments, bank account details, tax information
• Investment profile information: attitude to investment risk, capacity for financial loss, investment objectives, time horizon
• Family circumstances: marital status, dependants, beneficiaries, inheritance expectations
• Health and medical information: where relevant to financial planning, for example in relation to protection planning, capacity assessments, or suitability for certain products (see Section 4)
• Information about your family members: names, ages, relationships, and financial circumstances of spouses, partners, dependants, and other beneficiaries where relevant to the advice (see Section 3.2)
• Communications: notes of meetings and telephone calls, correspondence, emails
• Source of funds and source of wealth information required under anti-money laundering regulations

3.2 Family Members, Dependants, and Beneficiaries

When a client provides us with information about their family members, dependants, or beneficiaries, we process that information in order to provide appropriate advice. This may include:

• Names, dates of birth, and relationships of spouses, partners, children, or other dependants
• Financial circumstances of family members where relevant to planning (for example, a spouse’s income when assessing household financial needs)
• Health information where it is relevant to protection planning or to understanding financial vulnerability

If you are a family member or beneficiary whose data has been provided to us by a client, you have the same rights under this notice as any other individual.

3.3 LinkedIn Connections and Prospective Clients

Where we connect with you through social media platforms or other professional networks, we may process:

• Your name and professional profile information (job title, employer, professional background)
• Your URL and connection status
• The date and source of the connection
• Any correspondence between us

We use this information to determine whether our services may be of interest to you and to communicate with you. We do not submit identifying prospect data to AI tools at the outreach drafting stage; any AI-assisted drafting at this stage uses generic, non-identifying content only.

Article 14 notice: If we have collected your information from social media platforms or another third-party source rather than directly from you, we are required by UK GDPR Article 14 to inform you of this within one month of collection or at first contact, whichever is earlier. This notice, or a link to it, will be included in our first communication with you.

3.4 Website Visitors

When you visit our website at www.acaciawealth.co.uk, we may collect:

• Technical information: IP address, browser type, operating system, referring URL, pages visited, time and date of visit
• Contact form submissions: name, email address, telephone number, and any message you choose to submit
• Cookie data: see Section 12 for details of the cookies we use and how to manage them

3.5 Recruitment Candidates

If you apply for a role with Acacia Wealth, we may collect:

• Name, contact details, and address
• CV, covering letter, and application form responses
• Employment history, qualifications, and professional credentials
• References and information from background checks (where applicable)
• Right to work documentation
• Interview notes and assessment records

4. Special Categories of Personal Data

Certain categories of personal information require additional protection under UK GDPR Article 9. We may process the following special category data:

• Health and medical information: where you disclose a medical condition, disability, or health history relevant to financial planning, protection advice, or vulnerability assessment
• Health information about family members: where relevant to advice provided to a client (for example, a dependant’s medical condition affecting a client’s financial planning needs)

We will only collect special category data where it is genuinely necessary for the advice or service we are providing, and we will always seek your explicit consent before doing so. You have the right to withdraw consent at any time.

We do not routinely collect data about racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, or sexual orientation, unless you voluntarily disclose such information and it is directly relevant to the service provided.

5. How We Collect Your Personal Information

We collect personal information:

• Directly from you: in meetings, by telephone, by email, through our website contact form, or through completed forms and questionnaires including fact-finds
• From third parties with your authority: existing pension and investment providers, insurance companies, other financial advisers or solicitors
• From professional networks: LinkedIn and similar platforms, where you are a prospective client or business contact
• From publicly available sources: the electoral roll, Companies House, the FCA register, HM Treasury sanctions lists, and other public records
• From anti-money laundering and identity verification services
• From your employer or trustee: where relevant to the services provided

Where we collect information from third parties, we will tell you the source of the information the first time we communicate with you.

6. How We Use Your Personal Information

The list below sets out the purposes for which we use your personal information and the lawful basis for each, including the specific condition we rely upon where we process special category data.

• To verify your identity and carry out necessary due diligence checks. Necessary to enter into your client agreement; compliance with our legal and regulatory obligations; and, for special category data, the substantial public interest in meeting regulatory requirements, your explicit consent, or the establishment of legal rights.
• To deliver financial planning services in line with your client agreement. Necessary to enter into or perform your agreement, with your explicit consent where special category data is involved.
• To undertake annual and ongoing suitability reviews of your financial arrangements. Necessary to perform your client agreement and to ensure we provide services appropriate to your circumstances, with your explicit consent where special category data is involved.
• To detect, prevent and investigate fraud and financial crime. Necessary to perform your client agreement, our legitimate interest in preventing financial crime, and the substantial public interest in preventing or detecting unlawful acts.
• To meet our legal and regulatory obligations as an FCA-regulated firm. Compliance with our legal obligations and, where relevant, the substantial public interest in meeting regulatory requirements.
• To correspond with you and handle any complaints you raise. Necessary to perform your client agreement, comply with our legal and regulatory obligations, and establish, exercise or defend legal rights.
• To monitor and improve the quality and security of our services, including through recorded calls and client satisfaction surveys. Our legitimate interest in developing and improving the products and services we offer.
• To support the day-to-day running of our business, including record keeping, business planning, internal audit and management reporting. Our legitimate interest in running our business efficiently and effectively.
• To arrange and maintain appropriate professional indemnity and other insurance cover. Our legitimate interest in maintaining appropriate insurance.
• To send you marketing communications where you have given your consent. Your explicit consent.
• To send you selected marketing communications by post, telephone or other means where consent is not required. Our legitimate interest in telling you about other products and services we offer.
• To produce client-facing documents including Pathway Plans, Suitability Reports, Handover Files and Plan Information Checklists. Necessary to perform your client agreement, with your explicit consent where health information is included.
• To identify and contact prospective clients through professional networks (for example LinkedIn) who may benefit from our services. Our legitimate interest in growing our client base by reaching individuals who may benefit from independent financial planning advice (see Section 6.5). A Legitimate Interests Assessment has been completed and is available in our Lawful Basis Documentation.

6.1 Providing Financial Planning Advice

The primary purpose for which we process your personal information is to provide you with personalised financial planning advice and services in accordance with our service and fee agreement. This includes:

• Analysing your financial circumstances and objectives
• Preparing Suitability Reports, Pathway Plans, Plan Information Checklists, and Handover files
• Researching and recommending suitable financial products
• Implementing agreed recommendations with product providers
• Conducting ongoing review services (where agreed)

We may use AI-assisted drafting tools (currently Anthropic Claude, operating under our Claude for Work subscription, and Ningi, our back-office system, which includes built-in AI-assisted drafting functionality) to support the preparation of client documents such as Pathway Plans, Suitability Letters, Plan Information Checklists, and meeting notes. Where we do so, only the personal information necessary for the specific document is submitted, and all AI-generated outputs are reviewed and approved by a qualified adviser before use. We do not use AI to make suitability decisions; all recommendations reflect our independent professional judgement.

6.2 Regulatory and Legal Compliance

We are required by law and FCA regulation to collect and retain certain personal information. This includes:

• Anti-money laundering checks and identity verification (required under the Money Laundering Regulations 2017)
• Maintaining records of advice provided and the basis for recommendations (required under FCA COBS rules)
• Sanctions screening and politically exposed persons checks
• Responding to regulatory requests from the FCA, the Financial Ombudsman Service, and other authorities
• Complying with tax reporting obligations including HMRC reporting

6.3 Business Operations and Administration

We process personal information for the following internal business purposes, on the basis of our legitimate interests in running a well-governed advice business (UK GDPR Article 6(1)(f)):

• Maintaining business records and client files
• Reviewing and undertaking business analysis of the products and services we offer
• Producing management information and business performance reports
• Supporting internal and external audit processes
• Quality assurance and file review to maintain advice standards

We have assessed that these legitimate interests are proportionate and do not override your privacy rights.

6.4 Marketing and Client Communications

Where you are an existing client, we may send you relevant financial planning information including market commentary, budget updates, and other content we reasonably believe may be of interest to you. We do this on the basis of our legitimate interests in maintaining an ongoing client relationship (UK GDPR Article 6(1)(f)). Where we contact prospective clients for marketing purposes, we rely on your consent (Article 6(1)(a)).

You can opt out of marketing communications at any time by contacting us or following the unsubscribe link in any marketing email we send. Opting out will not affect our ability to contact you in connection with ongoing advice services.

6.5 LinkedIn Prospecting and Business Development

Where we connect with prospective clients through LinkedIn, we process professional profile information to determine whether our services may be of interest. Our first message to a new connection will include or link to this Privacy Notice so you can understand how we use your information and exercise your rights.

We rely on legitimate interests (Article 6(1)(f)) as our lawful basis for this processing. Our legitimate interest is to grow our client base by reaching individuals who may benefit from independent financial planning advice. We have assessed that this interest does not override your privacy rights: we use only publicly available professional information, we provide a clear opt-out at first contact, and we do not submit identifying prospect data to AI tools at the outreach stage. A Legitimate Interests Assessment supporting this basis has been completed and is recorded in our Lawful Basis Documentation.

• If you do not wish to be contacted, please tell us and we will remove you from our prospecting records immediately.

6.6 Website, Communications, and Enquiries

We use information submitted through our website or by email to respond to your enquiries and to improve our services. We use analytics tools (including Google Analytics) to understand how our website is used. Analytics data is collected via cookies — please see Section 12 for how to manage your cookie preferences.

6.7 Recruitment

We use recruitment information to assess your suitability for a role, verify your credentials, and comply with employment law obligations. We rely on legitimate interests and the necessity to take steps prior to entering an employment contract as our lawful basis.

6.8 Safety, Security, and Dispute Resolution

We may process personal information where necessary to protect the safety and security of our clients, staff, and business, to prevent and investigate fraud, and to defend or bring legal claims.

7. Who We Share Your Personal Information With

We do not sell your personal information. We share it only where necessary for the purposes described in this notice.

7.1 Financial Product and Service Providers

Where we recommend and arrange financial products on your behalf, we share the personal information necessary to implement the recommendation with the relevant provider, including:

• Pension providers
• Investment platforms and fund managers
• Protection and insurance providers
• Pension transfer analysis and comparison report providers

7.2 Technology and Support Providers

We use third-party services to support our business operations. These providers act as data processors on our behalf under written contracts that restrict their use of your data. We name a provider individually below only where it retains or processes your personal data outside the UK or EU, in which case the safeguards described in Section 8 apply. Providers that retain your data solely within the UK or EU are described by category only, as no international transfer disclosure is required for them:

• Anthropic PBC: AI-assisted drafting and analysis (Claude for Work). Anthropic processes personal data submitted to Claude on our behalf under a Data Processing Addendum. Anthropic does not use your data to train AI models. Your data is retained by Anthropic only until we delete it from Claude Projects, after which Anthropic may retain it for up to 30 days before permanent deletion. Data transfers to the USA are covered by the UK International Data Transfer Addendum (UK IDTA) and Standard Contractual Clauses.
• LinkedIn, Sales Navigator and Zeekeo: lead generation software. US-headquartered providers; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• Microsoft: email and cloud storage. US-headquartered provider; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• Google Analytics: website analytics. US-headquartered provider; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• Kit.com: email marketing platform used to send client newsletters, market commentary, and budget updates. US-headquartered provider; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• DocuSign: electronic signature and document execution platform. US-headquartered provider; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• Calendly: appointment scheduling software used for booking client and prospect meetings. US-headquartered provider; data transferred under the UK IDTA and Standard Contractual Clauses (see Section 8).
• Voyant: financial planning and cash flow modelling software. US-headquartered provider; personal data may be processed in the United States, Canada, and other countries in which Voyant operates. Data transferred under the UK International Data Transfer Addendum and Standard Contractual Clauses (see Section 8).
• IT support and managed services provider (UK/EU-based)
• Project management and client relationship tracking software (UK/EU-based)
• Investment analysis (UK-based)
• Pre-employment screening and background checking services, including DBS checks (UK-based)
• Back-office and client record management system, including native AI-assisted drafting functionality (UK-based)

7.3 Professional Advisers and Referral Partners

Where you have given authority, we may share relevant information with your solicitor, accountant, or other professional adviser in connection with a specific matter.

7.4 Regulators and Authorities

We may share personal information with the FCA, FOS, ICO, HMRC, or other regulatory and law enforcement bodies where required to do so by law or regulation.

7.5 Anti-Money Laundering Screening

We use electronic identity verification and sanctions screening services to meet our obligations under the Money Laundering Regulations 2017. These services check your information against public records, sanctions lists, and politically exposed persons databases.

8. International Transfers of Personal Data

Some of our service providers are based outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. The providers named individually in Section 7.2 (Anthropic PBC, LinkedIn, Sales Navigator and Zeekeo, Microsoft, Google Analytics, Kit.com, DocuSign, Calendly, and Voyant) fall into this category. Providers that retain data solely within the UK or EU are described by category only in Section 7.2, as no international transfer safeguard is required for them. Safeguards are achieved through:

• The UK International Data Transfer Addendum (UK IDTA) issued by the ICO under section 119A(1) of the Data Protection Act 2018
• Standard Contractual Clauses approved by the European Commission where applicable

These mechanisms ensure your data is protected to UK standards regardless of where it is processed. For more information, please contact us.

9. How Long We Keep Your Personal Information

We retain your personal information in line with our company retention policy and as required to comply with any legislation. Our standard retention periods are:

• Client advice records (suitability documentation, reports, recommendations): seven years from the end of the client relationship, in line with FCA requirements
• Client records relating to pension transfers or long-term investment advice: up to thirty years, in line with FCA guidance on long-term advice records
• Anti-money laundering records: five years from the end of the business relationship
• Correspondence and communications: seven years
• Website enquiry data: twelve months from the date of enquiry
• Recruitment candidate data (unsuccessful applicants): six months from the end of the recruitment process
• LinkedIn prospect data (where no engagement results): twelve months from connection, after which we will remove you from active processing

Where we use AI tools in connection with client work, records of the relevant submissions are maintained in our AI Submission Log for the duration of the applicable client record retention period. AI-processed data held by Anthropic is deleted within 30 days following our deletion of the relevant Claude Project.

We may retain anonymised or aggregated data beyond these periods for business analysis, provided individuals cannot be identified from the data.

10. How We Protect Your Personal Information

We take the security of your personal information seriously and have implemented technical and organisational measures to protect it against unauthorised access, loss, alteration, and disclosure. These include:

• Restricted access to personal data on a need-to-know basis
• Secure email and encrypted document transfer where appropriate
• Regular staff training on data protection obligations
• Data Processing Agreements with all third-party processors
• Use of cloud storage with appropriate access controls
• Policies governing the use of AI tools, including submission logging, human review of all AI outputs, and prohibition on storing personal data outside approved systems

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by UK GDPR Article 33, and will notify affected individuals where the risk is high.

11. Your Privacy Rights

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 (together, the “UK Data Protection Laws”), you have the following rights:

• Right of access (Subject Access Request): You can request a copy of the personal information we hold about you. We will respond within one calendar month of receiving your request (or three months for complex or numerous requests). There is no charge in most circumstances.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal information we hold about you.
• Right to erasure: You can ask us to delete your personal information in certain circumstances. Note that we may be required by FCA rules or other legal obligations to retain certain records even where you request deletion; we will explain this if it applies.
• Right to restrict processing: You can ask us to pause the use of your personal information, or restrict who has access to it, in certain circumstances — for example, while you contest its accuracy, while a complaint is under investigation, or where you have objected to our use of your data.
• Right to data portability: Where we process your data by automated means and on the basis of consent or contract, you can ask us to provide it to you or to a third party in a structured, commonly used format.
• Right to object: You can object to our processing of your personal information where we rely on legitimate interests as our lawful basis. You have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where we rely on your consent (including for special category data such as health information), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to object to automated decision-making and profiling: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. Acacia Wealth does not carry out automated decision-making of this kind, and all advice and recommendations involve human judgement and review. If this position changes, you will be informed in advance and provided with your relevant rights.
• Right to complain: If you believe we have not handled your personal data correctly or you are unhappy with how we have used it, please contact us first so that we can try to resolve your complaint for you.

12. Cookies

Our website uses cookies which are small text files stored on your device to help us understand how visitors use the site and to deliver a better experience. We use the following categories of cookies:

• Strictly necessary cookies: essential for the website to function. These cannot be disabled.
• Analytics cookies: help us understand traffic and usage patterns (for example, Google Analytics). These are only set with your consent.
• Third-party cookies: some third-party services embedded on our site (for example, Calendly for appointment booking) may set their own cookies. Please refer to the relevant provider’s privacy policy for details.

When you first visit our website, a cookie consent banner will ask for your preferences. You can accept all cookies, reject non-essential cookies, or manage your preferences at any time. You can also control cookies through your browser settings; disabling all cookies may affect some features of our site. For more information about cookies and how to manage them, visit www.aboutcookies.org.

13. Marketing and Communications

We may send you information about our services and relevant financial planning topics where you have consented to receive such communications, or where you are an existing client and we rely on our legitimate interests in communicating with you. You can opt out of marketing communications at any time by contacting us or following the unsubscribe link in any marketing email.

14. Complaints about Our Handling of Your Data

If you believe we have not handled your personal data correctly, or you are unhappy with how we have used it, please contact us first so that we can try to resolve your complaint. You can raise a data protection complaint by emailing dataprivacy@acaciawealth.co.uk or writing to: Data Protection Officer, Acacia Wealth Limited, 7 Bell Yard, London WC2A 2JR.

When raising a complaint, please include:

• Your name and contact details
• A description of what has happened or what you are concerned about
• Any relevant dates, reference numbers, or correspondence
• The outcome you are hoping for, if you have one in mind

We will acknowledge your complaint within five working days and aim to resolve it within 28 days. If we cannot resolve the complaint to your satisfaction, you may contact the UK supervisory authority: Information Commissioner’s Office (ICO), www.ico.org.uk, phone 0303 123 1113. You can also write to the ICO at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Updates to This Notice

We review and update this Privacy Notice periodically to reflect changes in law, technology, our services, or our data practices. The current version is always available on our website at www.acaciawealth.co.uk. Where changes are material, we will notify existing clients directly.