Data Protection Policy

Data security practices

• Information is transmitted over encrypted connections
• Client documents are stored in private storage that is not publicly reachable
• Access to files is granted through short-lived, individually authorised links
• Systems are monitored, and activity on client records is logged

Access controls

Access is role-based. Client accounts can see only their own applications, documents and correspondence. Staff roles — adviser, operations, administrator — receive only the access their function requires, and administrative capability is restricted to a small number of authorised individuals.

Storage procedures

Client records and uploaded documents are held on managed infrastructure within our secure backend, protected by database-level access rules that are enforced on every request. Records are backed up as part of routine platform operation and restored only by authorised personnel.

Confidentiality

Client information is treated as confidential at all times. It is discussed only where necessary to progress the matter, shared with third parties only with a lawful basis or your instruction, and never used for purposes unconnected with the service you have asked us to provide.

Staff responsibilities

• Access client information only where there is a genuine need to do so
• Keep credentials secure and never share accounts
• Report any suspected data incident immediately so it can be investigated
• Follow retention and disposal instructions when a matter concludes
• Complete data protection awareness training appropriate to their role

Incidents

Suspected incidents are investigated without delay. Where an incident is likely to affect your rights, we will inform you and, where required, notify the Information Commissioner's Office.