Privacy Policy

Last updated: June 2026

About us & how to contact us

Smith & Pinching (“we”, “us”, “our”) is an independent financial adviser, offering advice, recommendations, and services in relation to investments, pensions, protection, home finance products, and investment management services (“products and services”) to retail clients.

If you have any questions or concerns about this Notice, or require more information, please contact Jerry Ware (Associate Director) as follows:

295 Aylsham Road, Norwich, NR3 2RY
01603 789966
[email protected]

The purpose of this notice

When providing you with products and services, we will collect and process information that is commonly known as personal data. This Notice describes how we collect, use, share, retain and safeguard personal data. It also sets out your rights. We explain these later but, in summary, they include your right to know what data is held about you, how it is processed, and how you can place restrictions on its use. We will process your personal data in line with:

• The UK’s updated Data Protection Act 2018, which was initially the UK’s enactment of the EU General Data Protection Regulation (‘EU GDPR’).
• The UK retained provisions of the EU GDPR (‘UK GDPR’) (retained by virtue of the European Union (Withdrawal) Act 2018).
• Regulations based on wider EU legislation (e.g. the Privacy and Electronic Communications Regulations (EC Directive) 2003 (PECR)) and future updates.
• Wider guidance from the Information Commissioner’s Office.

What is personal data?

Personal data is information relating to an identified or identifiable natural person. For example, an individual’s name, age, address, date of birth, gender, and contact details.

Personal data may contain information which is known as special category personal data. For example, an individual’s health, racial or ethnic origin, or sexual orientation.

Personal data may also contain information relating to criminal convictions and offences. For the purposes of safeguarding and processing this data responsibly, it is treated in the same manner as special category personal data, where we are legally required to comply with specific data processing requirements.

What personal data we collect & how we collect it

We will collect your personal data when you request information about our services, client events, promotions and campaigns, or when you seek to purchase products and services through or from us. The personal data we collect will depend on our relationship with you at the time. For example, we will collect more detailed information if you have recently become a client and are investing with us than we would if you are not a client and are simply making an enquiry about our services.

To enable us to provide you with the right product or service we will collect personal data about you which may include the following:

• Basic personal details such as your name, address, email address, telephone number, date of birth or age, gender, marital status.
• Information about your income and employment, including job title, and business description.
• Information about your current investments, pensions, protection arrangements, and home finance arrangements.
• Information about your investment, pension, protection, and home finance needs and objectives.
• Your bank details.
• Information captured during recordings of our telephone calls.
• Your marketing preferences.
• Special category personal data. This may include information relating to your:
  • Sexual orientation.
  • Sex life.
  • Trade union membership.
  • Political or religious views.
  • Health data.
  • Genetic and biometric data, where processed to uniquely identify an individual.

We may also have to collect data relating to criminal convictions and offences.

We only collect and process special category personal data where it is critical for the delivery of a product or service and without which the product or service cannot be provided. We will require your consent to process this data in order to provide the product or service you have requested.

If you object to the collection, sharing and use of your personal data or special category personal data we may be unable to provide you with our products and services.

We will obtain your personal data directly from you or someone else acting on your behalf in several ways, including:

• Via your use of our website, such as asking us a question or sending us your CV if enquiring about a job.
• Requesting or obtaining a quotation.
• Completing hard copy or online paperwork, such as applications, declarations, and medical questionnaires.
• Completing online contact forms.
• Via the telephone, email, post, or social media.
• Face to face.
• We may ask you to provide Letters of Authority to allow us to obtain information about you from providers.

How we may use your personal data

We may use your personal data to (list not exhaustive):

• Basic personal details such as your name, address, email address, telephone number, date of birth or age, gender, marital status.
• Administer documentation relating to our services, and products we seek to arrange for you.
• Arrange meetings and financial reviews.
• Send you reports and updates.
• Provide you with fee payment options.
• Contact you regarding products or services you have not taken up.
• Maintain our records.
• Confirm your identity and prevent fraud.
• Investigate and resolve any complaints.
• Verify the information you provide.
• Undertake internal quality monitoring and external audits.
• Carry out market research, statistical analysis, and client profiling.
• Obtain and maintain professional indemnity insurance.
• Report to regulatory authorities.

We may process your personal data for several different purposes, each of which requires a legal basis. We will generally rely on the following legal bases:

• We need to use your personal data to enter into or fulfil our contractual obligations to you, that being the delivery of products and services to you as agreed with you.
• We have a genuine business need to use your personal data for reasons, for example keeping records of products and services we arrange or provide.
• We have a legal or regulatory obligation to use your personal data, for example our regulators impose certain record-keeping rules which we must adhere to.

When the personal data that we process is classed as special category personal data, we will have one of the following additional legal grounds for such processing:

• It is in the substantial public interest. For example, mortgage providers may ask about criminal convictions and offences to prevent and detect mortgage fraud.
• It is necessary to establish, exercise or defend our legal rights. For example, if legal proceedings are being brought against us or we want to bring a legal claim ourselves.
• It is normal that we would ask or find out about your health in the majority of planning exercises we may carry out, whether for a one-off piece of advice or an ongoing relationship between us.
• Where we collect personal data directly from you, we are known as a “data controller”. This is an individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data. This means that providers of investment, pension, protection, and home finance products may be joint data controllers of your personal data.

Where we use third parties to process your data purely under our instruction and not on their own behalf, these are known as “data processors”. This is an individual or organisation which processes personal data on behalf of the data controller.

Disclosing other people’s data

We may collect personal data from you about other individuals, for example spouse/partner, children, beneficiaries, staff, trustees, or someone you authorise to deal with us on your behalf. You are responsible for ensuring that you have their permission to disclose their personal data and for telling them how we will use it.

Automated decision-making

We do not generally use automated means to make decisions in relation our services or products we arrange for you. However, automated decisions may be made by third parties, for example (list not exhaustive):

• As part of the new business process, sending your information to a third party which screens your details against the HMT Sanctions Lists, and again whenever the lists change. We are informed of any full or partial matches. This is part of our anti-financial crime controls.
• Protection providers using your information, e.g. health, weight, smoking habits, medication, to determine whether your application for life or health insurance can be accepted and what the premium will be.
• Mortgage providers performing a credit search as part of their loan approval process.

You may request that the decision is reviewed by an individual decision-maker, but we cannot guarantee that this will be done.

Who we may share your personal data with

• Product providers.
• Third parties who assist in the administration and/or placement of insurance policies, such as underwriters, claims handlers, and medical professionals.
• Credit reference agencies used by home finance providers.
• Anyone who acts on your behalf in respect to any products we have arranged for you or services we provide to you.
• Fraud detection agencies and other third parties who operate and maintain fraud detection registers.
• The police and other third parties or law enforcement agencies where reasonably necessary for the prevention or detection of crime.
• Our regulator, the Financial Conduct Authority.
• The Financial Ombudsman Service if you complain.
• Insurers and insurance intermediaries who provide our own insurance, such as professional indemnity insurance.
• Our third-party services providers such as IT suppliers, payment facilitators, actuaries, auditors, lawyers, marketing agencies, document management providers, tax advisers, and review collectors.
• Third parties in connection with the sale, transfer, or disposal of our business.
• With your consent, to any other person, firm, body etc not described above.
• To any other person, firm, body etc not described above, where we are permitted or obliged to do so by law.

You may not have direct contact with any or all such parties.

Data processing activities

The six lawful bases for processing data are:

1. Contract: the processing is necessary for a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract.
2. Consent: the individual has given clear consent to process their personal data for a specific purpose.
3. Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
4. Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
5. Vital interests: the processing is necessary to protect someone’s life.
6. Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.

Data processed is identified according to the reason for processing it, and the lawful basis for processing it.

We have tried to provide lists and examples that are accurate and representative of the business that we conduct with you, whether that is in your capacity as an individual client, a corporate client, or a member of staff of a corporate client. However, these are not exhaustive – we may require more, less, or different information to provide you with advice, products, and services.

Your data protection rights

You have legal rights governing the use of your personal data. These grant you the right to understand what personal data is held, for what purpose, how it is collected and used, with whom it is shared, where it is located, to object to its processing, to have the data corrected if inaccurate, to take copies of the data, to place restrictions on its processing, and to have it deleted.

These rights (listed below) are known as Individual Rights under the Data Protection Act 2018.

• The right to be informed about the personal data being processed.
• The right of access to your personal data.
• The right to object to the processing of your personal data.
• The right to restrict the processing of your personal data.
• The right to rectification of your personal data.
• The right to erasure of your personal data.
• The right to data portability (to receive an electronic copy of your personal data).
• Rights relating to automated decision-making, including profiling.

We may not be able to comply with your request (such as where this would conflict with our obligation to comply with other regulatory and/or legal requirements). However, we will respond to you, and tell you why we cannot comply with your request.

For example, your right to request erasure must be balanced against other factors, such as our regulatory and/or legal obligations which mean we cannot comply with your request. When we have no ongoing legitimate need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

We have a regulatory obligation to retain data for specified minimum periods, but there are no specified maximum retention periods. We therefore reserve the right to retain data indefinitely for the reasons given herein.

There may also be circumstances where exercising some of these rights (such as the right to erasure, the right to restriction of processing) will mean a product can no longer be provided and it may therefore result in cancellation of that product. You will therefore lose the right to bring any claim or receive any benefit, including in relation to any event that occurred before you exercised your right. Your notice terms and conditions set out what will happen in the event your notice is cancelled.

When exercising your rights, a substantial public or vital interest may take precedence over any request you make. In addition, where these interests apply, we are required by law to grant access to this data for law enforcement, legal and/or health related matters.

The flow of data within the insurance sector is complex, and we ask you to keep this in mind when exercising your rights of access. Where we may be reliant on other organisations to help satisfy your request, this may affect timescales.

You can ask to exercise your rights at any time. As mandated by law, we will not charge a fee to process these requests; however, if your request is considered to be repetitive, wholly unfounded and/or excessive, we are entitled to charge a reasonable administration fee. We will determine this at the time of the request(s).

Offshore processing activities

We store data on servers in the UK and the EU.

Our back-office client management system stores client information and documentation on servers which are located in the UK.

Email records are backed up to cloud storage via Microsoft on servers which are located in the UK.

How we protect your data

To protect your data, we use a range of organisational and technical security measures. Where we have given you (or you have chosen) a password, you are responsible for keeping this it confidential. Please do not share your password with anyone.

Within Smith & Pinching, we restrict access to your information to those who need to know it for the purposes set out above.

We use firewalls to block unauthorised traffic to our network.

Ongoing services, marketing, & online channels

Primarily, we will only contact you about products we manage for you, services we provide to you, and matters relevant to these. This may be by post, email, phone, or text message.

We may also occasionally contact you about other financial promotions or with other marketing material that we think might be appropriate for you. You can tell us to stop at any time by calling us, emailing us, or writing to us.

We may use and share information from or with online sources, such as websites and social media. This information may be used to help tailor and improve our services and communicate with you effectively, as we believe many customers use a range of media channels.

Where we use or share information from or with these sources, we will respect any permissions you have advised about how you want your information to be used.

Data we collect through cookies & similar technologies

We collect information through cookies and other similar technologies (e.g. pixel tags or links), in order to remember you when you visit one of our websites and help us improve your online experience.

These help us understand how you and others use our websites, view our products, and respond to our advertising, so we can tailor direct marketing and enhance our overall product and service offering.

When you receive direct marketing from us via email, we may use technology as described above to determine your use of and interest in our direct marketing.

When you visit one of our websites, we may record your device information, including hardware and software used, general location, when and how you interact with our websites. This information is retained for direct marketing purposes.

Data-related complaints

You have the right to complain to us about our collection and use of your personal information. To make a complaint, please contact us by email, telephone, or in writing.

You may also complain to the Information Commissioner’s Office (ICO – the UK’s data protection authority) at any time.

Please note that you may withdraw this consent at any time by notifying us at our main business address:

Smith & Pinching Financial Services Limited
295 Aylsham Road
Norwich
NR3 2RY