Client Privacy Statement

1. Who We Are (Data Controller)

Forbes Wealth Limited (trading as Spentwell) is a registered data controller under the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). We are registered in Scotland (Company No. SC620599) with registered and trading offices at 2 Hill Street, Edinburgh, EH2 3JZ. Our Financial Conduct Authority (FCA) Register Number is 838234.

Our designated Data Protection Officer (DPO) is Keith Boyes. For any queries regarding your data privacy, you can reach Keith directly at Keith@spentwell.co.uk or by telephone on 07503 335876.

2. The Information We Collect

To provide high-quality independent financial planning and satisfy our statutory anti-money laundering and regulatory obligations, we collect:

• Personal Identifiers: Legal names, date of birth, residential address, telephone, email, and passport/driver’s license documents for AML/KYC checks.
• Financial Profile: Income, expenditure, savings, tax returns, liabilities, pensions, employer benefit records, and investment statements.
• Special Category Data: Physical and mental medical disclosures collected strictly with your explicit consent when underwriting personal protection, critical illness cover, or income protection policies.
• Dependent Information: Names and dates of birth of children or vulnerable family dependents where relevant to estate or trust planning.

3. Lawful Bases for Processing

We process your data strictly under one or more of the following lawful bases:

• Contractual Performance: Necessary to draft financial plans, establish investment accounts on platforms such as Transact, and manage insurance contracts.
• Legal & Regulatory Obligations: Compliance with FCA rules, anti-money laundering (AML) directives, and HMRC statutory disclosures.
• Legitimate Interests: Managing ongoing client communication, file auditing, and ensuring professional advisory standards.

4. Data Sharing & International Transfers

We will never sell, lease, or rent your personal data to any third party for marketing purposes. Data is shared strictly on a confidential need-to-know basis with:

• Regulated platform custodians (e.g. Transact Online / Integrated Financial Arrangements Ltd).
• Authorized insurance underwriters and pension administrators.
• External compliance auditors and legal consultants bound by professional confidentiality.
• The Financial Conduct Authority (FCA) or law enforcement agencies when legally required.

All data processing and cloud storage infrastructure remain bounded strictly within the UK and the European Economic Area (EEA).

5. Data Retention & Security

We maintain appropriate physical, electronic, and procedural safeguards (including end-to-end encryption and multi-factor authentication) to protect client records. Under FCA regulations, pension and investment suitability records must be retained for a minimum of six years and, in many pension transfer matters, indefinitely to protect client fiduciary rights.

6. Your Legal Rights

Under UK data protection law, you have the right to request access to copies of your personal data, rectify inaccurate records, request deletion (subject to overriding legal and FCA record-keeping requirements), restrict processing, and request data portability.

7. Complaints to the Supervisory Authority

If you have any concerns regarding how Spentwell handles your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 | Website: ico.org.uk