DATA PRIVACY NOTICE

At Carrington, we are committed to handling your personal information lawfully, fairly and transparently in accordance with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

This privacy notice explains how we collect, use, share, store and protect your personal information, including where we use artificial intelligence (AI) or automated tools.

It also explains your rights, how you can exercise them and how to raise a complaint if you have concerns about how your personal information is handled.

Please contact us if you have any questions about our privacy policy or information we hold about you.

A Glossary of Terms can be found at the end of this document.

WHO WE ARE?

Carrington Wealth Management collects uses and is responsible for certain personal data about you. When we do so we are required to comply with data protection regulation, and we are responsible as a data controller of that personal data for the purposes of those laws.

When we mention “Carrington Wealth Management or Carrington”, “we”, “us” or “our” we are referring to Carrington Investment Consultants Limited.

Carrington is a company registered in England and Wales (company number 03193939) whose registered office is at One Chapel Place, London, W1G 0BG. Carrington Investment Consultants Limited is authorised and regulated by the Financial Conduct Authority. Carrington Investment Consultants Limited Financial Services Register number is 566 946.

We provide you with intermediary services.

THE PERSONAL DATA WE COLLECT AND USE

We collect or use your personal information when you engage us for our intermediary services. Our intermediary services include investment advice and management, financial planning and cash flow modelling.

This information will relate to your personal and financial circumstances and may include:

• Personal Identifiers – name, dates of birth, address
• Contact information – phone number, email address
• Identity information – National Insurance number, passport and driving licence
• Financial information – income, spending, investments & pensions, assets & liabilities
• Employment status & tax information
• Lifestyle information
• Health information
• Details of any vulnerability
• Details of your dependants and/or beneficiaries under a policy
• Product details
• Communications – emails, meeting notes, phone call notes

We may need to gather personal information about your close family members and dependents to provide our service to you effectively. In such cases, it will be your responsibility to ensure that you have the consent of the people concerned. You might find it helpful to show them this privacy notice and if they have any concerns, please contact us in one of the ways described previously.

We may also obtain personal data about you from third parties while providing our intermediary services. This may include information from product providers (including product details, financial information, contact information and identity information). It may also consist of information from identity verification agencies (including identity information and sanction check information).

SPECIAL CATEGORY DATA

There are certain categories of personal data that are sensitive by nature. These categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership and data concerning health. Depending on the nature of the products and services that you engage us for, we may need to obtain special categories of personal data about you.

We will need to collect special category data covering health information and lifestyle information when advising on, arranging or administering a protection product such as life insurance:

• Health information includes your medical history, including symptoms, diagnoses, procedures and outcomes, as well as information about your height and weight. This could include previous and current or persistent medical conditions and your family medical history.
• Lifestyle information includes both work and leisure behaviour patterns. Most relevant to you may be your smoker status, alcohol consumption, health, retirement age and exercise habits.

Data relating to criminal convictions or offences is also subject to additional levels of protection. During our activities relating to the prevention, detection and investigation of financial crime, we may process criminal conviction or offence information. Where we do so, we will process it for the purpose of compliance with regulatory requirements relating to unlawful acts and dishonesty.

HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information from:

• directly from clients
• during client meetings and recorded meeting notes
• emails
• telephone calls
• questionnaires
• product providers
• third-party professionals such as accountants or solicitors
• Identity verification and AML providers such as SmartSearch

WHY DO WE NEED TO COLLECT AND USE YOUR PERSONAL DATA?

Under the UK GDPR, there are seven lawful bases for processing personal information. These are the ones that we may rely on and which we may use:

• Consent
• Contract
• Legal obligation
• Legitimate interests
• Recognised legitimate interest

Our primary lawful basis for processing your personal data is the performance of our contract with you. We need to collect and use certain information about you to provide our services effectively, including understanding your financial circumstances, providing suitable advice, carrying out anti-money laundering (AML) checks, arranging products on your behalf and communicating with you. We also process your personal data where necessary to meet our legal and regulatory obligations.

In addition, we have a legitimate interest in retaining records of the services we provide to you, including where necessary, to respond to or defend potential legal claims or complaints, in line with FCA requirements and the terms of our professional indemnity insurance.

We will respond to any request you make about your data protection rights within one month. To make a request, please contact us using the contact details at the top of this privacy notice.

WHO WE MIGHT SHARE YOUR INFORMATION WITH

To deliver our services to you effectively, we may send your details to third parties such as those that we engage for professional compliance, accountancy or legal services, as well as product and platform providers that we use to arrange financial products for you. We may also send your details to third-party agencies for identity verification purposes to fulfil our obligations in respect of the prevention of money-laundering and other financial crime. Please contact us for further information if you wish to know the names of these third parties.

If you agree, we may refer you to third parties to provide specialist advice (including pension transfers), mortgage, tax and legal advice. On these occasions, we will ask for your consent before using your personal data in this way.

Where third parties are involved in processing your data we will have a contract in place with them to ensure that the nature and purpose of the processing is clear, that they are subject to a duty of confidence in processing your data and that they will only act in accordance with our written instructions. Where it is necessary for your personal data to be sent to a third party electronically, we will use appropriate security measures to protect your personal data in transit.

We never sell your personal information to anyone.

KEEPING YOUR DATA SECURE

We have appropriate security measures in place to prevent personal data from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We use Third parties that may process and store your personal data in the USA and Australia, which are located outside the European Economic Area (EEA). Such countries do not have the same data protection laws as the United Kingdom and EEA. Any transfer of your personal data will be subject to due diligence to ensure that the requirements of UK data protection law are adhered to and that sufficient processes and policies are put in place to help safeguard your data and privacy rights and give you remedies in the unlikely event of a misuse of your personal data.

MARKETING

We may use personal data we hold about you to help us identify, tailor and provide you with details of products and services from us that may be of interest to you. We will only do so where we have obtained your consent or have a legitimate business reason to do this and will do so in accordance with any marketing preferences you have provided to us.

In addition, where you provided your consent, we may provide you with details of products and services of third parties where they may be of interest to you.

You can opt-out of receiving marketing at any time. If you wish to amend your marketing preferences, please contact us:

By phone: 020 7078 4849

By email: hello@carringtonwm.co.uk

By Post:  One Chapel Place, London, W1G 0BG

In addition, you can opt-out of receiving marketing at any time by clicking the ‘unsubscribe’ link at the bottom of every email.

WHETHER INFORMATION HAS TO BE PROVIDED BY YOU, AND IF SO WHY

We will tell you if providing some personal data is optional, including if we ask for your consent to process it. In all other cases you must provide your personal data in order for us to provide you with intermediary services.

USE OF ARTIFICIAL INTELLIGENCE 

As part of our commitment to maintaining efficient, accurate and high-quality client service, we may utilise artificial intelligence (“AI”) and related technologies in the administration and operation of our business.

Such technologies may be used to assist with:

• administrative and operational tasks;
• the preparation of draft documents, reports and correspondence;
• technical and regulatory research;
• meeting transcription, summarisation and file note creation;
• drafting communications for internal review; and
• other support functions designed to improve efficiency and service

We currently utilise ChatGPT Business and Enterprise and Saturn AI, together with other appropriately governed AI tools adopted by the Firm from time to time.

AI tools are used solely as an aid to our professional activities and are not relied upon as a substitute for professional judgement. Any advice, recommendation, opinion or regulated activity undertaken on your behalf will always be reviewed, approved and delivered by an appropriately qualified and authorised adviser or member of staff. AI systems will not be used to provide automated regulated financial advice directly to clients.

Where AI-assisted tools are utilised, we will take reasonable steps to maintain the confidentiality and security of your information and to ensure that any processing complies with applicable data protection legislation and our regulatory obligations.

To assist us in maintaining accurate records, delivering efficient service and creating contemporaneous file notes, you agree that meetings, telephone calls and video conferences may be recorded and transcribed using AI-assisted transcription and summarisation technologies. Such recordings and transcripts will form part of our business records and will be retained and processed in accordance with our Data Protection and Privacy policies.

Nothing in this clause limits our responsibility to exercise reasonable skill, care and diligence in the provision of our services to you.

We do not use AI tools that use your personal information to train public models.

HOW LONG YOUR PERSONAL DATA WILL BE KEPT

We keep the personal information we need to provide our services to you, and we take reasonable steps to make sure it stays accurate and up to date. Some information must be kept minimum periods set by our regulator, the Financial Conduct Authority (FCA):

• Investment business – 5 years
• Mortgage business – 3 years
• Pension transfers and opt‑outs – kept indefinitely
• Insurance business – 3 years

We also have to keep certain records to meet UK anti‑money laundering requirements. These include identity verification documents and other information used to confirm your identity.

• We will keep this information for at least 5 years after our relationship with you
• Some records relating to transactions may be kept for longer where this is necessary to meet legal, regulatory or business requirements.

Because these are legal and regulatory requirements, we cannot delete your information before these minimum time periods have passed.

We may keep your personal information for longer if we have a legitimate business reason to do so, but we will not keep personal information for longer than necessary and will assess appropriate retention periods based on the purpose for which the information is held.

You can ask us to delete your personal information. We will do so unless we are required to keep it for legal or legitimate business reasons.

We regularly review the information we hold to ensure it is not kept for longer than necessary.

If you would like more information about how long we keep your personal information or how we decide this, please contact us.

These are minimum periods, during which we have a legal obligation to retain your records. We reserve the right to retain data for longer where we believe it’s in our legitimate interests to do so.

 

COOKIES & OTHER WEBSITES

We use cookies to:

• Understand how visitors use our website
• Help us create reports and improve our site
• Where consent is not required, you can still control or opt out of cookies through your browser settings at any time.

If you’d like to learn more about cookies, you can visit: https://allaboutcookies.org/

You can change your browser settings to block or delete cookies at any time. The website above explains how to do this. Please note that if you choose to block cookies, some parts of our website may not work as expected.

Our website may include links to other sites.

Please remember that this privacy notice only covers our website, so we recommend checking the privacy policies of any other sites you visit.

 

YOUR RIGHTS

You have several rights under data protection law. This helps you understand and control how your personal information is used:

• Right to be informed – You can ask us to explain how we collect, use, share, and store your personal information.
• Right of access – You can request a copy of the personal information we hold about you, along with details of how we use it.
• Right to rectification – If you think any of your information is wrong or incomplete, you can ask us to correct or update it.
• Right to erasure – In some situations, you can ask us to delete your personal information.
• Right to restrict processing – You can ask us to limit how we use your information in certain circumstances.
• Right to object – You can object to us using your personal information, for example for direct marketing.
• Right to data portability – You can ask us to send your personal information to you, or directly to another organisation, in a structured, commonly used electronic format.
• Rights related to automated decision‑making and profiling – If a significant decision about you is ever made without meaningful human involvement, you have the right to request human review, ask for an explanation and challenge the decision.

If you would like to exercise any of these rights please contact us using the contact details at the top of the privacy notice. We will require you to:

Provide proof of identity and address (a copy of your passport and a copy of your driving licence or a utility bill dated within the last three months) – this is to ensure we only disclose information or change your details where we know we are dealing with the right individual.

Tell us the information to which your request relates.

We may charge a fee if we think your request is unfounded, repetitive or excessive. Where a fee is necessary, we will inform you before proceeding with your request.

We aim to respond to all valid requests within one month. It may, however, take us longer if the request is particularly complicated or if you have made several requests. We will always let you know if we think a response will take longer than one month. To speed up our response, we may ask you to provide more detail about what you want to receive or are concerned about.

We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.

HOW TO CONTACT US

Please contact our Data Protection Team if you have any questions about this privacy notice or the information we hold about you.

If you wish to contact them please send an email to hello@carringtonwm.co.uk or One Chapel Place, London, W1G 0BG.

IF YOU ARE NOT HAPPY WITH HOW YOUR PERSONAL DATA IS PROCESSED

Please be assured that we treat complaints very seriously.

If you have any concerns about how we use your personal information, you have the right to raise a data protection complaint with us using the contact details below. You do not need to follow a specific process or use particular wording.

We will:

• Acknowledge your complaint promptly and at least within 30 days of receiving it
• Investigate and respond without undue delay
• Keep you informed where appropriate

Further details of our complaints process are available on request.

Phone: 020 7078 4849

Email: Stephen@carringtonwm.co.uk

Address: The Compliance Officer, Carrington Wealth Management, One Chapel Place, London, W1G 0BG

OUR SUPERVISORY AUTHORITYare not satisfied with our response, you have the right to escalate your complaint to the

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO).(ICO).

Phone: 0303 123 1113

Website: www.ico.org.uk

Address: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

HOW TO CONTACT US

Please contact our Data Protection Team if you have any questions about this privacy notice or the information we hold about you.

If you wish to contact them please send an email to hello@carringtonwm.co.uk or One Chapel Place, London, W1G 0BG.

CHANGES TO OUR PRIVACY POLICY

We keep our privacy policy under regular review and we will place any updates on this web page (and/ or) inform you of any changes when they occur. This privacy policy was last updated on 15/09/2026.