Last revised: 10th August 2020
HFMC Wealth takes the privacy and security of your personal information very seriously. We will only use your personal data to administer your account and to provide the products and services that you have requested from us.
However, from time to time we would like to contact you
HFMC Wealth and the entities listed as data controllers below (together referred to as “we” or us”) are committed to protecting and respecting your privacy.
This notice sets out the basis on which any personal data we collect from you, or that you or third parties provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
For the purpose of the Data Protection Act 1998, the data controller in respect of the HFMC Wealth website (www.hfmcwealth.com) is as follows:
The data controller for HFMC Wealth Ltd, (incorporated in England and Wales as a limited company Registered Number: 01911493)
The data controller for HFMC Wealth Partners LLP (incorporated in England and Wales as a limited liability company partnership Registered Number OC309139)
The data controller for HFMC Wealth Management Ltd (incorporated in England and Wales as a limited company Registered Number 02355062)
The data controller for Mauleverer Money Management Ltd, an appointed representative of HFMC Wealth Ltd, (incorporated in England and Wales as a limited company Registered Number 02166924)
The data controller for Aspinalls Family Office LLP (a partnership registered in England and Wales under company number OC350440).
The data controller for Aspinalls Private Clients Ltd (a company registered in England and Wales under company number 08637053).
The data controller for HFMC Private Client Services Ltd (a company registered in England and Wales under company number 05993367.
The above named are part of the HFMC Wealth Group of Companies and their registered office address is Russell House, 140 High Street, Edgware, Middlesex, HA8 7LW
The data controller for HFMC Asset Management Ltd (a company registered in England and Wales under company number 03891979, whose registered office is also at Russell House, 140 High Street, Edgware, Middlesex, HA8 7LW)
By visiting the HFMC Wealth website or using our mobile and/or tablet apps (collectively referred to as “our sites”) you are accepting and consenting to the practices described in this notice.
Your rights in relation to information we may collect from you
Subject to certain limitations on certain rights, you have the following rights in relation to your information, which you can exercise by writing to Mark Waller, HFMC Wealth, HFMC House, New Road, Weybridge, Surrey, KT13 9BW, or you can email us, or call us on 01932 870 000:
- to request access to your information and information related to our use and processing of your information;
- to request the correction or deletion of your information;
- to request that we restrict our use of your information;
- to receive information which you have provided to us in a structured, commonly used and machine-readable format (e.g. a CSV file) and the right to have that information transferred to another data controller (including a third-party data controller);
- to object to the processing of your information for certain purposes (for further information, see the section below entitled Your right to object to the processing of your information); and
- to withdraw your consent to our use of your information at any time where we rely on your consent to use or process that information. Please note that if you withdraw your consent, this will not affect the lawfulness of our use and processing of your information on the basis of your consent before the point in time when you withdraw your consent.
In accordance with Article 77 of the General Data Protection Regulation, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation.
For the purposes of the UK, the supervisory authority is the Information Commissioner’s Office (ICO), the contact details of which are available here.
Further Information about your rights
The above rights are provided in summary form only and certain limitations apply to many of these rights. For further information about your rights in relation to your information, including any limitations which apply, please visit the following pages on the ICO’s website:
You can also find out further information about your rights, as well as information on any limitations which apply to those rights, by reading the underlying legislation contained in Articles 12 to 22 and 34 of the General Data Protection Regulation, which is available here
Information we may collect from you
We may collect and process the following data about you when you engage us for financial planning, financial advice, mortgage advice, employee benefit services, investment management services and Tax Compliance services. This information will relate to your personal and financial circumstances. It may also include special categories of personal data such as data about your health, if this is necessary for the provision of our services:
- Information you give us. You may give us information about you by filling in forms on our websites, by meeting with us face to face, or by corresponding with us by phone, email, in writing or otherwise. This includes but is not limited to information you provide when you engage with us for our advice services, request quotations, register for email alerts, request literature, or sign-up for newsletters. The information you give us may include your name, address, email address and other contact information, financial and debit card information as well as other personal information and (if applying for employment) relevant information about your qualifications and work experience.
- We may additionally request contact information from clients and visitors that attend HFMC Wealth premises. We may share this contact information with NHS Test and Trace to help minimise the transmission of COVID-19 and support public health and safety should it become appropriate to do so. Where we have recorded details relating to a visit to our office we will delete this information after a period of 21 days.
- Information we collect about you. When you visit our sites, we may automatically collect the following information:
- Technical information, including the Internet Protocol (IP) address used to connect your computer to the internet, your login information, your geographic location, browser type and version, browser plug-in types and versions, operating system and platform; and
- Information about your visit, including the source of your visit, the full click path, mouse movement, through our sites (including date and time); services you viewed, searches made on our sites, page response times, download errors, length of visits to certain pages, page interaction information (such as page scrolling, mouse clicks, mouse movements and keyed text), and methods used to browse away from the page. This information may be collected using a website recording service.
- Information we collect at receipt and opening of emails. From time to time when you open an email sent by us, we may automatically collect the following information:
- Technical information, including; your geographic location, browser type and version, device type and operating system and platform
- Information we receive from other sources. We may also receive information about you from third party service providers such as credit reference agencies, payment service providers, or analytics providers. We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for the purposes set out in this Privacy Notice (depending on the types of information we receive).
Information we collect from third parties
We may receive information about you from third parties. Where we receive information from a third party, we assume that they have obtained your consent prior to providing us with your information. For example, this could be a spouse providing details about their husband or wife.
The third parties from which we receive information about you will generally include other businesses and clients we work with from time to time who may recommend our services to you. These could be business in any industry, sector, sub-sector or location.
We may also receive information about you from a business that you are already contracted with, such as a pension provider, insurance company, investment company or a solicitor or accountant. We would only expect to be provided this information on request, and with your explicit permission.
It is also possible that third parties with whom we have had no prior contact may provide us with information about you.
Information we obtain from third parties will generally be your name and contact details but will include any additional information about you which they provide to us.
Our legal basis for processing
The primary legal basis that we intend to use for the processing of your data is for the performance of our contract with you. The information that we collect about you is essential for us to be able to carry out the services that you require from us effectively. Without collecting your personal data we’d also be unable to fulfil our legal and regulatory obligations.
Where special category data is required, we’ll obtain your explicit consent in order to collect and process this information.
Our legal basis for processing: necessary to perform a contract or to take steps at your request to enter into a contract (Article 6(1)(b) of the General Data Protection Regulation).
Reason why necessary to perform a contract: where a third party has passed on information about you to us (such as your name and email address) in order for us to provide services to you, we will process your information in order to take steps at your request to enter into a contract with you and perform a contract with you (as the case may be).
Legal basis for processing: consent (Article 6(1)(a) of the General Data Protection Regulation).
Consent: where you have asked that a third party to share information about you with us and the purpose of sharing that information is not related to the performance of a contract or services by us to you, we will process your information on the basis of your consent, which you give by asking the third party in question to pass your information on to us.
Legal basis for processing: our legitimate interests (Article 6(1)(f) of the General Data Protection Regulation).
Legitimate interests: where a third party has shared information about you with us and you have not consented to the sharing of that information, we will have a legitimate interest in processing that information in certain circumstances.
Uses made of the information obtained
We may use information held about you in the following ways:
- to provide you with any services and/or information you request from us (which includes carrying out any obligations arising from any contracts entered between you and us);
- to notify you about changes to our service;
- to provide you with information by post, email, telephone or otherwise about products and services of a similar nature to those you have previously purchased or expressed an interest in which are offered by our Group and which we think may be of interest to you.
- You have the right to ask us not to process your personal data for marketing purposes. You can exercise your right to prevent such processing by contacting us by phone, post or email using the details in the “Contact Us” section below.
- to administer our sites and for internal operations, including troubleshooting, data analysis, load management, testing, research, statistical and survey purposes;
- to improve our sites to ensure that content is presented in the most effective manner for you and for your computer;
- to measure or understand the effectiveness of content we serve to you and others, and to deliver relevant content to you;
- for the purposes of providing services such as ‘most popular’ information on our site;
- to obtain your feedback on a product, service or our sites via a third party appointed by us;
- to allow you to participate in interactive features of our sites, when you choose to do so; and
- as part of our efforts to keep our sites safe and secure and to prevent and detect money laundering, financial crime and other crime
Your right to object to processing of your data
You have the following rights in relation to your information, which you may again exercise by writing to Mark Waller, HFMC Wealth, HFMC House, New Road, Weybridge, Surrey, KT13 9BW, or you can email us, or call us on +44 1932 870 000:
- to object to us using or processing your information where we use or process it in order to carry out a task in the public interest or for our legitimate interests, including ‘profiling’ (i.e. analysing or predicting your behaviour based on your information) based on any of these purposes; and
- to object to us using or processing your information for direct marketing purposes (including any profiling we engage in that is related to such direct marketing).
You may also exercise your right to object to us using or processing your information for direct marketing purposes by:
- clicking the unsubscribe link contained at the bottom of any marketing email we send to you and following the instructions which appear in your browser following your clicking on that link;
- Sending an email to opt out, asking that we stop sending you marketing communications, including the words “OPT OUT”.
Disclosure of your information
We may share the personal data we hold about you across the Group, subject to your agreement, to enable us to better understand your needs and run your accounts in the efficient way that you expect. Your personal data may also be used by the Group for customer modelling, statistical and trend analysis, with the aim of developing and improving our products and services.
HFMC Wealth will disclose your personal information, without notice, only if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on HFMC or the site; (b) protect and defend the rights or property of HFMC (including enforcing this agreement); and, (c) act under exigent circumstances to protect the personal safety of users of HFMC, or the public
- We may disclose your personal information to members of the HFMC Group and/or affiliates including their staff and officers where it is necessary for the provision of information or services to you.
- We won’t share your information for marketing purposes with companies outside our group of companies
- We may disclose your personal information to non-affiliated subcontractors that perform support services for us.
- We may disclose your personal information to third parties in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
- We may disclose or share your personal information where we are required to do so by the courts or to comply with other legal, statutory and/or regulatory obligations including accounting and taxation requirements.
- In order to deliver our services to you effectively we may send your details to third parties such as those that we engage for professional compliance, accountancy or legal services as well as product and platform providers that we use to arrange financial products for you.
- Where third parties are involved in processing your data we’ll have a contract in place with them to ensure that the nature and purpose of the processing is clear, that they are subject to a duty of confidence in processing your data and that they’ll only act in accordance with our written instructions.
- Where it’s necessary for your personal data to be forwarded to a third party we’ll use appropriate security measures to protect your personal data in transit. Where we transmit data over a wireless network it is sent using WPA2 / CCMP (AES) encryption.
- To fulfil our obligations in respect of prevention of money-laundering and other financial crime we may send your details to In order to deliver our services to you effectively we may send your details to third parties such as those that we engage for professional compliance, accountancy or legal services as well as product and platform providers that we use to arrange financial products for you.
How long will we hold your data?
Where you do not enter a contractual relationship with HFMC Wealth we would expect to retain your information for a period of up to two years.
This timeframe has been selected as a reasonable time period for you to decide whether you wish to utilise the services of HFMC Wealth. Should this length of time be insufficient, and you wish to extend this period, we are then able to do so at your request.
Where you do not enter into a contractual relationship with HFMC Wealth, but a related third party does, and your data is provided with your consent and is relevant to support an assessment of ongoing suitability advice for them, and to meet our ongoing contractual obligations to them, we would expect to retain your information for a period of seven years after disengaging from us, unless there is a legal or regulatory requirements for us to maintain the data for longer.
Your personal data will be retained for as long as is necessary to enter into or perform a contract with you; or for compliance with a legal obligation under EU law or the laws of the United Kingdom; or for the establishment, exercise or defence of future legal claims, usually seven years, however for some types of business this may be longer. This will be disclosed at the time the advice is given.
Everybody has a right to erasure under the General Data Protection Regulations. However, given that HFMC Wealth operates within a regulated financial services environment it is unlikely that we will delete or remove any data from our systems once a contractual relationship has been entered into as we may be required to provide this either by the Financial Conduct Authority, The Financial Ombudsman service or in the establishment, exercise or defence of future legal claims. As such, data provided as part of a contractual relationship is likely to be retained until past the time of your death given the open-ended nature of some legal claims.
This does not impact upon your rights to rights of access, rectification, or portability of personal data. You also have the right to withdraw your consent to the procession of your data at any time.
Where we store your personal data
We store your data on our secure servers in the United Kingdom and retain it for a period of seven years after disengaging with you, or longer if the law requires. However, your data may be transferred to, stored at, and processed at a destination inside or outside the European Economic Area by our partners or service providers. By submitting your personal data, you agree to this transfer, storing or processing. We will take all reasonable steps necessary to ensure that your data is treated respectfully and securely and in accordance with this Privacy Notice.
Safeguarding your personal data
We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:
- only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
- using secure servers to store your information;
- verifying the identity of any individual who requests access to information prior to granting them access to information; and
- using Secure Sockets Layer (SSL) software or other similar encryption technologies to encrypt any payment transactions you make on or via our website.
However, the internet is an open medium and we cannot guarantee that any information you send to us by email or via our sites will not be intercepted or tampered with; any transmission is at your own risk.
Some older browsers do not allow the use of current SSL technology and we therefore recommend that you use an up to date browser. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We’d like to send you information about our products and services and those of other companies in our group which may be of interest to you. If you’ve agreed to receive marketing information, you may opt out later.
You have a right at any time to stop us from contacting you for marketing purposes or giving your information to other members of the group. If you no longer wish to be contacted for marketing purposes, please contact us by email or post, or by clicking here.
Links to external websites
Our sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies or how such websites collect and use your data. Please check these policies before you submit any personal data to these websites.
Cookies, analytics and web beacons
HFMC Wealth uses “cookies” to make parts of our website work and to collect data that helps us understand our visitors better. A cookie is a text file that is placed on your hard disk by our web page server. Cookies cannot be used to run programs or deliver viruses to your computer.
You can choose to accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully use the HFM website.
Here is a list of the main types of cookies we use, and what we use them for. We have described them using the categories recommended by the International Chamber of Commerce in the ICC UK Cookie Guide.
Strictly Necessary Cookies: These cookies are essential in order to enable you to move around the website and use its features, such as accessing the secure area of the website, accessing the forum, or commenting on our blog posts. Without these cookies the services you have asked for cannot be provided.
When we send you an email, we may track whether you have opened that email and whether you have clicked any links it may contain. This helps us measure the performance of our email campaigns. We do this by including single pixel gifs, also called web beacons, in emails we send. Web beacons allow us to collect information about when you open the email, your IP address, your browser or email client type, and other similar details.
Changes to our privacy notice
We reserve the right to revise or supplement this Privacy Notice from time to time. You should bookmark and periodically review this page to ensure that you are familiar with the most current version of this Privacy Notice and so you are aware of what information we collect, how we use it and under what circumstances we disclose it. This privacy notice was last updated on 10th August 2020.