Review draft for this website preview. The complete existing Dunedin Financial privacy notice is reproduced below. A website-specific update remains subject to principal review. This preview uses links to the existing Google Forms appointment request and to WhatsApp, rather than an on-site enquiry form. There are no embedded analytics, advertising or chat services. See Cookies & storage for the preview's implementation. Please keep sensitive documents and medical information out of an initial enquiry.

PRIVACY NOTICE

Dunedin Financial understands its obligations in regards to your fundamental right to a private life and has implemented systems and controls to ensure your rights and freedoms are protected.

Dunedin Financial undertakes to meet its obligations under the Data Protection Act, the Privacy and Electronic Communications Regulations and the UK General Data Protection Regulation (UK GDPR).

Dunedin Financial will support customer understanding by ensuring any communication meets the information needs of customers and any person with a vulnerability is not disadvantaged with the use of format, layout, fonts and language used. Text should be easy to read and without jargon.

WHAT PERSONAL DATA DO WE COLLECT?

Dunedin Financial will collect the following data, dependent upon the financial service required:

Name, address, contact telephone numbers, email address, bank statements, passport, council tax and utility bills, driving licence, benefit statements, shotgun licence, payslips, criminal record information, existing pension information, life cover information, investment information, details of assets and liabilities, health information – life policies and long-term care information – annual expenditure and any other existing relevant policy.

Different variations of data are required for each product so we may not be required to collect all of the data listed above for all products.

HOW WE COLLECT YOUR PERSONAL DATA

You directly provide Dunedin Financial with the personal data we collect by the following methods:

Original physical copy, scanned certified email copy, scanned certified postal copy.

WHO WILL PROCESS YOUR PERSONAL DATA?

Access to your personal data is permitted only for those employees who require it to fulfil their responsibilities on your behalf. Your personal data will be initially processed by Dunedin Financial. Your personal data will be further processed by The Whitechurch Network Ltd who acts as our Principal for regulatory purposes. In the event of incapacity of your adviser, your data will be shared with an authorised locum adviser of The Whitechurch Network Ltd in order to carry out the responsibilities within your service agreement. All parties will process your personal data in accordance with this Privacy Notice. All parties are subject to information security training to enforce and communicate best practice when handling information.

WHAT HAPPENS IF WE WANT TO PROCESS YOUR PERSONAL DATA FOR OTHER REASONS?

Though there are some legal exceptions, if we wish to process your personal data for any other unrelated purpose than those we have informed you about we will notify you.

WHAT ARE THE CONSEQUENCES IF YOU DO NOT PROVIDE YOUR PERSONAL DATA?

Your personal data is essential to enable us to take steps at your request prior to entering into a contract or to perform a contract to which you are a party. Without this information we will not be able to proceed to provide any financial service. Processing will only occur whereby it is necessary to protect the vital interests of our client.

WHAT MAKES THE PROCESSING LAWFUL?

The lawful basis for the processing of your personal data as per Article 6(1) of the GDPR is:

· Consent. You can remove consent at any time by contacting our Data Protection Representative (details below)
· Necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract
· For compliance with a legal obligation to which we are subject
· For the purposes of the legitimate interests pursued by us.

KEEPING YOUR PERSONAL DATA UP TO DATE

We will record your information exactly as you provide it. You may ask us to update it at any time and we will action your request promptly and notify relevant third parties of any changes.

WHAT ABOUT SENSITIVE PERSONAL DATA?

We will only process sensitive personal data, such as data concerning health, with your explicit and informed consent for specific processing activities. In such cases you will be asked to sign a separate consent form to evidence this and that you understand the purpose(s) of the processing of such data. Your consent may be withdrawn at any time. The processing is in order to:

· to carry out obligations in respect of FCA requirements
· To carry out obligations in respect of financial application requirements on your behalf
· to protect your vital interests e.g. we may pass on information about medical conditions to paramedics if you are unable to give consent due to illness.

Sensitive personal data may include data revealing racial or ethnic origin, data concerning health or data relating to criminal convictions or offences.

HOW WILL WE FURTHER USE YOUR PERSONAL DATA (OUR LEGITIMATE INTERESTS)?

· To contact you to ensure that our records of your personal information are correct and up to date
· To respond to questions or complaints you may have about our services
· To update you with changes in our terms
· For statistical or research analysis relating to the performance of our business or that of our principal and understanding the changing needs of our clients
· To review, improve and develop services we offer or handle complaints
· To pursue debts or unpaid fees
· To evidence company practices, for example to fulfil our legal requirement to provide independent audit undertakings.
· To evidence the standards and processes carried out conform to the company’s ethical standards and expectations
· To protect the business from risks which might be introduced by an individual.

You have the right to object to processing for these purposes and we shall cease unless we can show we have compelling legitimate grounds to continue.

PROCESSING WHEN PERFORMING A TASK CARRIED OUT IN THE PUBLIC INTEREST

We will use your personal data to protect members of the public against dishonesty, money laundering or fraudulent activities. This must necessarily be carried out without your explicit consent to ensure this function is not prejudiced. Part of this processing involves verifying your identity using third parties such as GB Group Plc or Creditsafe Business Solutions Ltd.

WHAT PERSONAL DATA IS REQUIRED?

We only collect data that is necessary to carry out the purposes listed above. This includes data you supply and data we receive from reference agencies. Where practical and lawful we will inform you about any of your personal data we receive from third parties that you may be unaware of.

HOW SECURE WILL YOUR PERSONAL DATA BE?

We will ensure that your data is only accessible to authorised people in our firm and will remain confidential at all times. Appropriate security measures are in place to prevent unauthorised access, alteration, disclosure, loss, damage or destruction of your information.

If we have a contract with another organisation to provide us with services or a service on our behalf to process your personal information, we’ll make sure they give reassurances regarding appropriate security measures in place and only process your data in the way we’ve authorised them to. These organisations won’t be entitled to use your personal data for their own purposes. If necessary, our security teams will check them to make sure they meet the security requirements we’ve set.

Please contact our Data Protection Representative below if you would like further information.

We may share your data with:

· Appropriate staff such as those who carry out financial or compliance functions.
· Organisations that need your data because we are required to provide it by law (e.g. The FCA, ombudsman services, HMRC, etc…
· Organisations that help us process your personal data to establish your personal characteristic. This is necessary if we are to provide you with the best possible advice and service.
· Organisations that carry out credit references or identity checks such as GB Group Plc or CreditSafe Business Solutions Ltd. These organisations may keep a record of the information and may disclose the fact that a search of its records was made to its other customers for the purposes of assessing the risk of giving credit, to prevent fraud and to trace debtors.
· Sometimes other authorised firms with specialist advisers, such as pension specialists or paraplanners, who assist us in providing suitable financial advice and services. You will be provided with their details if this applies.
· Law enforcement agencies, courts or other public authorities if we have to, or are authorised to by law.
· Product providers we use to provide financial services.
· Where we or our Principal go through a business transaction, such as a merger, being acquired by another company or selling a portion of its assets, your data will, in most instances, be part of the assets transferred.

TRANSFERRING YOUR PERSONAL DATA OUTSIDE THE UK / EUROPEAN UNION

We do not usually transfer any of your personal data outside of the UK or EU except when we need to perform pre-contractual measures (credit and identity checks) or because the checks we request are necessary for important reasons of public interest.

Some companies, like Creditsafe Business Solutions Ltd, may transfer data outside of the EU to countries which do not, in the view of the EU Commission, offer an adequate level of protection. In such cases Creditsafe encrypts any data it sends to other agencies and only transfers information necessary to carry out checks.

(A list of countries used to perform checks include Germany, Netherland, Belgium, France, Sweden, Norway, Finland, Luxembourg, Switzerland, Liechtenstein, Spain, USA, Estonia, Latvia, Lithuania, Poland, Slovakia, Czech Republic, Hungary, Slovenia, Bosnia, Serbia, Montenegro, Croatia, Macedonia, Kosovo, Albania, Bulgaria, Romania, Ukraine, Austria, Denmark, Moldova, Portugal, Italy, Canada, Brazil, Greenland, China, India, Australia, Russia, South Korea, Taiwan, Mexico, South Africa, New Zealand, Hong Kong, UK.)

Furthermore, we will occasionally use third parties for the processing of personal data in third countries. However, we shall put in place appropriate safeguards such as SCC’s and IDTAs in compliance with Article 46 to ensure your data is safe before such transfers.

WHAT ABOUT DIRECT MARKETING?

Dunedin Financial does not use your personal data for direct marketing. We do not send you marketing communications, and we do not share your personal data with product providers or anyone else for their marketing activities. We use your details only for the purposes described in this notice, such as responding to your enquiry and providing the financial services you ask us for.

Marketing update. This section reflects Dunedin Financial's no-marketing policy and replaces the direct-marketing wording in our previous privacy notice. Your other data protection rights described in this notice are unchanged.

TELEPHONE & VIDEO CALL RECORDING

In line with The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 we may record incoming or outgoing telephone and video conversations for the following purposes:

· Establishing facts and evidence for business transactions
· Ensuring compliance with regulatory or self-regulatory practices
· Ascertaining and demonstrating that standards are being met
· Preventing or detecting crime
· Investigating or detecting the unauthorised use of that or any other telecommunication system
· Safeguarding the effective operation of the telecommunications system.

HOW LONG WILL WE KEEP YOUR PERSONAL DATAFOR?

The Financial Conduct Authority lays down rules relating to how long your personal data should be held for and we will keep your data to meet these requirements. We will not keep your personal data for longer than is necessary.

REQUESTING A COPY OF YOUR PERSONAL DATA WE HOLD

You may at any time ask for a copy of the personal data we hold about you – it is your legal right. We will provide you with a copy of any non-exempt personal data within one month unless we ask you for an extension of time. To protect your personal data, we will ask you to verify your identity before we release any data. We may refuse your request if we are unable to confirm your identity.

Information will be provided to you in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child.

IMPORTANT RIGHTS

You have the right, on grounds relating to your situation, at any time to object to processing which is carried out as part of our legitimate interests or in the performance of a task carried out in the public interest. We will no longer process your personal data unless we can demonstrate there are compelling legitimate grounds which override your rights and freedoms or unless processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to object at any time to processing your personal data for marketing activities. In such a case we must stop processing for this purpose.

WHAT ARE YOUR OTHER LEGAL RIGHTS?

In addition to the rights above the additional following rights:

· Where you have given consent, you have the right to withdraw previous consent to processing your personal data at any time
· You have the right to request from us access to and rectification or erasure of personal data or restriction of processing concerning your data
· You have the right to receive data you have provided to us in a structured, commonly used and machine readable format and in a concise, transparent, intelligible, and easily accessible form, using clear and plain language
· You have the right to object
· You have the right to data portability
· You have the right to lodge a complaint with the regulator (see below).

To exercise any of these rights please contact our Data Protection Representative.

HOW TO CONTACT OUR DATA PROTECTION REPRESENTATIVE

Your trust is important to us. That is why you can contact our Data Protection Representative about any data protection or marketing issues by:

• Writing to: The Data Protection Representative 14a Nelson Street, Edinburgh, EH3 6LG
• Telephoning: 07723378446
• Emailing: lee@dunedinfinancial.co.uk

HOW DO YOU MAKE A COMPLAINT TO THE REGULATOR?

• By writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• By telephoning: 0303 123 1113
• By emailing: casework@ico.org.uk
• By using their website: https://ico.org.uk/make-a-complaint/

Website features in this preview

The appointment-request button opens Google Forms. That form asks for an email address, full name, optional phone number, preferred date, preferred time slot, service type and any additional notes or questions. The request is reviewed before an appointment is confirmed.

WhatsApp links open WhatsApp; email and text links open your chosen messaging application. These services are not embedded in this website. Please read the information provided by the external service before sending personal information.

The separate on-site repayment illustration processes its figures within your browser, without submitting or saving them. The mortgage calculator page also offers optional borrowing, repayment and Stamp Duty widgets from mortgage-quote.me. These load automatically on that page unless you have turned them off. Your explicit off choice is remembered in this browser where local storage is available. Loading connects to the provider, which receives technical information such as your IP address and may process the figures you enter. See Cookies & storage for the controls and how to turn the widgets off. Dunedin Financial has confirmed that the widgets do not set cookies or use browser storage.

No marketing sign-up, online payment or account-registration feature is installed here.

How website enquiries are handled

Dunedin Financial is responsible for the enquiries you send through the contact routes on this website. You can contact our Data Protection Representative using the details above.

Appointment requests through Google Forms. We use your request to review the service or question you describe, contact you and arrange a suitable time. The lawful basis is taking steps at your request prior to entering into a contract and, for general questions, our legitimate interest in responding to questions about our services, as set out in this notice. Google operates the form service and holds the responses submitted through it. Dunedin Financial reviews the responses. If you go on to receive advice, your information is handled as described in the rest of this notice, including processing by our Principal.

Email, telephone, text and WhatsApp. We use your message to reply and arrange any next steps, on the same lawful bases as appointment requests. Your message is carried by the email, mobile or messaging service used to send it. WhatsApp applies its own terms and privacy policy.

Website hosting. This website is delivered through Cloudflare's hosting network. When you visit a page, your browser sends technical information such as your IP address and browser details, which the hosting provider may record in server logs to deliver the website and keep it secure. The lawful basis is our legitimate interest in operating a secure, working website. This website does not install analytics or advertising tools that profile visitors.

Transfers outside the UK. Google, WhatsApp and Cloudflare operate internationally and may process information outside the UK. Their own privacy information explains the safeguards they rely on. Our wider approach to transfers is described in the transfers section above.

How long enquiries are kept. An enquiry that does not lead to advice is kept only for as long as needed to respond and deal with any follow-up, in line with our commitment not to keep personal data for longer than is necessary. If you become a client, records relating to your advice are kept to meet the Financial Conduct Authority's requirements described above. Hosting logs are kept by the hosting provider under its own practices; this notice does not state a fixed period for them.

This description of website features does not replace the privacy notice above or establish that website hosting involves no personal-data processing. This notice remains a review draft for the new website.