Client Privacy Notice

Privacy Notice and Consent

This Privacy Notice explains how Legacy Wealth Management Limited (“Legacy”, “we”, “us” or “our”) collects, uses, stores and shares your personal data when you engage us for financial planning and advice services. It also describes your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.  

We take your privacy seriously. Please read this notice carefully so that you understand how and why we use your personal data. The Summary below highlights key points for ease of reference only. The Full Privacy Notice contains the complete information about how and why we use your personal data.

Summary

Who we are
Legacy Wealth Management Limited, of 15-17 Chichester Street, Belfast, BT1 4JB is the data controller responsible for your personal data. Our Data Protection Lead is Gillian Rea (Operations Director), who can be contacted at gillianr@legacywm.co.uk or by writing to us at the address above.

Your rights
You have the right to object to how we process your personal information. You also have the right to access, correct, sometimes delete and restrict the personal information we use. In addition, you have a right to complain to us and to the data protection regulator. Contact details are shown here.

Your privacy rights are detailed more fully on the following pages.

How we gather and use personal information

We collect personal data about you so that we can provide regulated financial advice, arrange financial products on your behalf, and meet our legal and regulatory obligations. We normally collect this information directly from you during meetings, by telephone, by post or by other means. We may also receive information about you from third parties, such as investment, pension or insurance providers (where you have authorised them to share information), your professional advisers (where you have authorised them to share information), or from product providers as part of the ongoing servicing of your plans.

We use this information to analyse your current and future financial needs, to ensure that our advice is suitable to your circumstances, and to comply with our regulatory obligations as an FCA-authorised firm

We use this information to analyse your current and future financial needs so that we can ensure that any subsequent advice takes due account of, and is suitable to, your circumstances. We will not share your information with any other party except as indicated in this Privacy Statement or where required to do so by any statutory, governmental or regulatory body for legitimate purposes. 

Sharing and transferring personal information
Where necessary for the provision of our services, or to comply with legal or regulatory obligations, we may share your personal data with third parties. The categories of third party with whom we share your data are set out in the Full Privacy Notice section below.

We will inform you of the specific product or service providers we recommend in our suitability report. In the course of providing our services, it may be necessary for us to transfer your personal data to organisations located outside of the United Kingdom (for example, some insurers are based in the Isle of Man). Where such transfers occur, we will ensure that appropriate safeguards are in place, which may include the use of UK-approved International Data Transfer Agreements (IDTAs), the UK Addendum to EU Standard Contractual Clauses, or transfers to countries that have been deemed to provide an adequate level of data protection by the UK Government. You can request further information about these safeguards by contacting us using the details set out in this notice.

Special Category Data
In order to arrange life or critical illness cover, or Discounted Gift Trust applications on your behalf, we may need to collect and process health information (which is classified as ‘special category’ personal data under Article 9 UK GDPR). This includes medical history, lifestyle factors, pre-existing conditions, and underwriting disclosures obtained through medical questionnaires. We process this data on the basis of your explicit consent (Article 9(2)(a) UK GDPR). Your consent will be sought separately at the point of collection and you have the right to withdraw it at any time. However, please note that withdrawal of consent may affect our ability to arrange protection or insurance products on your behalf. Where we write to your GP on behalf of an insurer, we do not receive copies of your medical notes — these are sent directly from your GP to the insurer.

Keeping personal information
We retain your personal data in line with our regulatory and legal obligations. For most client data, this means six years after the end of the client relationship. Certain records (for example, pension-related records) may be retained for longer where required by law or regulation. After the applicable retention period, your data will be securely deleted or anonymised. For further detail, please refer to our Data Retention Policy, a copy of which is available on request.

Purposes and lawful bases for processing
We process your personal data for the following purposes and on the following lawful bases:

  • Provision of financial advice and ongoing servicing: including suitability assessments, portfolio recommendations, reviews, and arranging financial products on your behalf. Lawful basis: Performance of a contract with you (Article 6(1)(b) UK GDPR).

  • Regulatory compliance, anti-money laundering and financial crime prevention: including identity verification, sanctions screening, complaints handling, FCA Consumer Duty obligations, and audit and monitoring activities. Lawful basis: Legal obligation (Article 6(1)(c) UK GDPR).

  • Processing of health data for insurance and protection applications: collecting and sharing medical questionnaire information with insurers for underwriting purposes. Lawful basis: Performance of a contract with you (Article 6(1)(b) UK GDPR) and our legitimate interests in facilitating access to protection and insurance products that meet your needs (Article 6(1)(f) UK GDPR). Special category condition: Explicit consent (Article 9(2)(a) UK GDPR). Your explicit consent will be sought separately before this processing takes place.

  • Client communications and marketing: service updates, newsletters, and marketing activities. Lawful basis: Consent for direct marketing communications (Article 6(1)(a) UK GDPR); legitimate interests for service-related communications (Article 6(1)(f) UK GDPR). Legitimate interest: Maintaining client relationships and providing relevant service information. You have the right to opt out of marketing communications at any time.

    • Supplier and adviser relationship management: contract administration, due diligence, and oversight of professional counterparties. Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR), legal obligation (Article 6(1)(c) UK GDPR) and our legitimate interests in managing suppliers, advisers and professional counterparties (Article 6(1)(f) UK GDPR).

Where we rely on legitimate interests as our lawful basis, we have carried out a balancing assessment to ensure that our interests do not override your rights and freedoms. You may request details of these assessments by contacting our Data Protection Lead.

Complaints
If you believe your rights in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 have been infringed, you have the right to complain to the Information Commissioner’s Office (ICO).

Full Privacy Notice 

Introduction

This Full Privacy Notice contains the full information about your privacy rights and how we gather, use, share, retain and protect your personal information.

Who we are and how to contact us

Legacy Wealth Management Limited, of 15-17 Chichester Street, Belfast, BT1 4JB, is the data controller responsible for your personal data. Our Data Protection Lead is Gillian Rea (Operations Director), who can be contacted at gillianr@legacywm.co.uk or by writing to Legacy Wealth Management Limited, 15-17 Chichester Street, Belfast, BT1 4JB.

This notice applies to clients, prospective clients and individuals whose personal data we process in connection with our financial planning and advice services. It does not apply to current or former employees, workers or contractors, who are covered by Legacy’s separate Employee Privacy Notice.

Your Privacy Rights

You have the right to see what personal information we hold about you and you can ask us to correct inaccuracies, delete or restrict personal information or ask for some of your personal information to be provided to someone else. You have the right to object to how we use your personal information. If you need to contact us in relation to any of your rights, or wish to make a complaint about how we have used your personal information, you can use the contact details set out in this notice. You also have the right to complain to the Information Commissioner’s Office.   

  • Right to withdraw consent: Where you have given us your consent to use personal information, you can withdraw your consent at any time. 

  • Access to your personal information: You can request access to a copy of your personal data that we hold about you (commonly known as a ‘subject access request’). We will not normally charge for providing this information.

  • Portability: You can ask us to provide you or a third party with some of the personal information that we hold about you in a commonly used electronic form.

  • Rectification: You can ask us to change or complete any inaccurate or incomplete personal information held about you.

  • Erasure: You can ask us to delete or remove your personal data where there is no good reason for us continuing to process it, where you have withdrawn consent (where consent was the lawful basis), or where we have unlawfully processed your data. Please note that we may not always be able to comply with your request due to legal or regulatory retention requirements.

  • Right to object: You can object to our processing of your personal data where we rely on legitimate interests and there is something about your particular situation which makes you want to object to that processing. You also have the right to object at any time to processing for direct marketing purposes, and you can opt out of receiving marketing communications at any time.

  • Restriction: You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.

  • Right to object to automated decision-making: We do not make decisions about you based solely on automated processing that would produce legal or similarly significant effects. Where we use algorithmic tools to support risk profiling or suitability assessments, these are used as part of a wider, human-led advice process. If this position were to change, we would notify you and provide you with your rights under data protection law.

  • Right to complain: You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO) at ico.org.uk/global/contact-us. We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

Categories of personal data we process

We process the following categories of personal data about you:

  • Identification and contact details: name, address, telephone number, email address, date of birth, National Insurance number.

  • Financial information: income, expenditure, assets, liabilities, bank account details, tax status, pension details, existing financial products and investment portfolio information.

  • Investment objectives and risk profile: your investment goals, risk tolerance, capacity for loss, and suitability assessment data.

  • Correspondence and records of advice: suitability reports, meeting notes, telephone call records, and written correspondence.

  • Health information (special category data): medical history, lifestyle factors, pre-existing conditions, and underwriting disclosures, where relevant to life assurance, critical illness cover,, or Discounted Gift Trust applications. This data is only processed with your explicit consent.

  • Regulatory and compliance data: identity verification documents, source of wealth and funds information, transaction history, and regulatory correspondence.

  • Marketing and communications preferences: contact preferences, consent records, and engagement history.

How we gather your personal information

We obtain personal information: 

  • directly from you, usually in a face to face meeting but potentially also by telephone or other means; 

  • from other organisations such as investment/pension/insurance providers, where you have provided authority for them to share information relating to your existing plans;

  • from your professional advisers, where you have provided authority for them to share information.

We may also obtain some personal information from recording calls or meetings or by making contemporaneous notes of calls or meetings.

How we use your personal information

We use your personal data for the purposes and on the lawful bases set out below. Where we rely on legitimate interests, we have considered whether our interests are overridden by your rights and freedoms, and you may request further information about that assessment by contacting our Data Protection Lead.

  • Provision of financial advice and ongoing servicing: We process your personal data to assess your circumstances, analyse your current and future financial needs, prepare suitability assessments and portfolio recommendations, arrange financial products on your behalf, and provide reviews and ongoing servicing. Our lawful basis is performance of a contract with you (Article 6(1)(b) UK GDPR).

  • Regulatory compliance, anti-money laundering and financial crime prevention: We process your personal data for identity verification, sanctions screening, source of wealth and funds checks, complaints handling, FCA Consumer Duty obligations, audit and monitoring activities, and other legal or regulatory requirements. Our lawful basis is legal obligation (Article 6(1)(c) UK GDPR).

  • Insurance and protection applications: Where you ask us to arrange life assurance, critical illness cover, or Discounted Gift Trust applications, we may process and share health information required for underwriting. Our Article 6 lawful bases are performance of a contract with you (Article 6(1)(b) UK GDPR) and our legitimate interests in facilitating access to insurance and protection products that meet your needs (Article 6(1)(f) UK GDPR). Our Article 9 condition for health data is your explicit consent (Article 9(2)(a) UK GDPR), which we will seek separately before this processing takes place.

  • Client communications and marketing: We may process your contact details and communications preferences to send service updates, newsletters and marketing communications. Our lawful basis is consent for direct marketing communications (Article 6(1)(a) UK GDPR) and our legitimate interests in maintaining client relationships and providing relevant service information for service-related communications (Article 6(1)(f) UK GDPR). You can opt out of marketing communications at any time.

  • Technology, IT security, business administration and supplier management: We process personal data to operate our client systems, document storage, communications, cyber security, device management, credential management, managed IT support, accounting and administrative functions, and to carry out due diligence and oversight of suppliers, advisers and professional counterparties. Our lawful bases are performance of a contract (Article 6(1)(b) UK GDPR), legal obligation (Article 6(1)(c) UK GDPR) and our legitimate interests in operating, securing and managing our business and service provider relationships (Article 6(1)(f) UK GDPR).

  • Legal claims, corporate transactions and business continuity: We may process and share personal data where necessary to establish, exercise or defend legal claims, obtain legal advice, respond to regulators or courts, or in connection with a merger, acquisition, sale, restructure or similar transaction involving our business. Our lawful bases are legal obligation (Article 6(1)(c) UK GDPR) and our legitimate interests in protecting our legal rights and ensuring business continuity (Article 6(1)(f) UK GDPR).

Where we need personal data to provide regulated financial advice, arrange financial products, verify your identity, comply with legal or regulatory obligations, or administer our relationship with you, failure to provide the relevant information may mean that we cannot provide advice, arrange products or continue to service your plans. Where you withdraw consent for health data processing, this may affect our ability to arrange protection or insurance products on your behalf.

Sharing and transferring personal information 

Where necessary to the provision of our service, we may share your personal information with third parties. The categories of third party are listed below.

  • Insurance Providers

  • Pension Providers

  • Annuity providers

  • Investment Providers

  • Investment Platforms

  • Providers of pension transfer comparison reports

  • Compliance Advisers

  • Legal Advisers

  • CRM, back-office, client-servicing and advice platform providers

  • Client onboarding, proposal, electronic signature and other third-party software providers

  • Regulators (including the FCA and HMRC, where required)

  • Cloud hosting, document storage, collaboration, email security, cyber security, device management, credential management and managed IT support providers

We will confirm the actual product or service providers with whom we will share your information when we have identified the providers that we recommend you use. This will usually be done in our suitability report. We also use third party processors and sub-processors to host systems, store documents, operate client platforms, support communications and maintain IT, cyber security and business administration functions. Where a third party processes personal data on our behalf, we require it to process that data only for specified purposes, in accordance with our instructions and under appropriate contractual and security obligations.

International transfers

Some product providers, service providers, processors or sub-processors may process personal data outside the United Kingdom or the European Economic Area, including where systems or support services are provided on a global basis or where an insurer or product provider is located in another jurisdiction. Where we transfer personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place, which may include the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or transfer to a country that has been recognised by the UK Government as providing an adequate level of protection. You can request further information about those safeguards by contacting us.

Use of technology and automated decision-making

We may use technology tools, including AI-assisted tools, to support our operations and the delivery of our services (for example, to assist in drafting communications or documentation, or to support internal compliance and quality assurance processes). Where we use such tools, all outputs are reviewed and approved by a qualified human adviser or compliance officer before being issued or acted upon. We do not use your personal data to train third-party AI models.

We do not carry out any solely automated decision-making that produces legal or similarly significant effects on you without human involvement. If this position were to change, we would update this notice and inform you of your rights under data protection law.

Data security

We have implemented appropriate technical and organisational security measures to protect personal data against accidental loss and unauthorised access, use, alteration or disclosure. These measures include role-based access controls, encryption where appropriate, secure cloud systems, access logging, secure transmission methods and staff training. We also maintain procedures to assess and respond to suspected personal data breaches, including notifying affected individuals and the ICO where legally required.

Data retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. For most client data, this is six years after the end of the client relationship, in line with FCA regulatory requirements and applicable limitation periods. Records relating to pensions or complaints may be retained for longer where required. Health data processed for insurance applications is retained in line with our Data Retention Policy. After the applicable retention period, your data will be securely deleted or anonymised.

Consent for processing of health data

Where we need to process your health data for the purposes of arranging life or critical illness cover, or Discounted Gift Trust applications, we will ask for your explicit consent at the relevant time. This consent is separate from, and in addition to, the other lawful bases on which we process your personal data (as described above). We will use health data collected for insurance and protection applications only for those purposes unless we obtain fresh consent or another lawful basis and special category condition applies.

You can withdraw your consent to the processing of your health data at any time by contacting our Data Protection Lead at gillianr@legacywm.co.uk or by writing to us at the address shown at the top of this notice. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Except where we obtain your consent for direct marketing communications, or your explicit consent for health data processing, your personal data is processed on the basis of contract performance, legal obligation or legitimate interests (as described above).

Changes to this notice

We may update this notice from time to time. If we make material changes to how we process your personal data, we will provide an updated copy or otherwise notify you as appropriate.

Last updated: 12th August 2026