1. GDPR Compliance Policy

This GDPR Compliance Policy sets out the obligations of Estateplanningadvice.uk ("the Company", "we", "us", "our") regarding data protection and the rights of individuals ("data subjects") in respect of their personal data under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").

1.1 Data Controller

The Company is the data controller for personal data collected through the website estateplanningadvice.uk. As data controller, we determine the purposes and means of processing personal data submitted by visitors and users of this website.

1.2 Principles of Data Processing

We process all personal data in accordance with the following principles under Article 5 UK GDPR:

•       Lawfulness, fairness and transparency — data is processed on a lawful basis and in a transparent manner.

•       Purpose limitation — data is collected for specified, explicit, and legitimate purposes and not further processed incompatibly with those purposes.

•       Data minimisation — only data that is adequate, relevant, and limited to what is necessary is collected.

•       Accuracy — reasonable steps are taken to ensure personal data is accurate and kept up to date.

•       Storage limitation — data is retained only for as long as necessary for the purposes for which it was collected.

•       Integrity and confidentiality — data is processed securely to protect against unauthorised access, loss, or destruction.

•       Accountability — the Company maintains records of processing activities and can demonstrate compliance.

1.3 Lawful Basis for Processing

We rely on the following lawful bases under Article 6 UK GDPR:

•       Consent (Article 6(1)(a)) — where you have given clear consent for us to process your personal data for a specific purpose, including newsletter sign-up and marketing communications.

•       Legitimate interests (Article 6(1)(f)) — where processing is necessary for the purposes of our legitimate interests (such as operating a lead referral service and improving our website), provided these are not overridden by your interests or rights.

•       Contractual necessity (Article 6(1)(b)) — where processing is necessary to take steps at your request prior to entering into a referral arrangement.

1.4 Personal Data We Collect

Through operation of estateplanningadvice.uk, we collect and process the following categories of personal data:

•       Identity data: first name, last name.

•       Contact data: email address, telephone number.

•       Enquiry data: details of your estate planning query or requirements submitted via contact forms.

•       Marketing preferences: consent to receive newsletters and email marketing.

•       Technical data: IP address, browser type, device information, pages visited, and time of visit (collected via Google Analytics or equivalent tools).

•       Usage data: information about how you use the website, products, and services.

We do not collect any Special Category data (e.g. health, biometric, or financial data) unless explicitly volunteered by you within an enquiry form, in which case it will be treated with enhanced protection.

1.5 How We Use Your Personal Data

We use personal data for the following purposes:

•       To process your enquiry and match you with suitable estate planning professionals or firms (our core referral service).

•       To contact you regarding your enquiry and the referral service.

•       To send newsletters and marketing communications where you have provided consent.

•       To operate, maintain, and improve the website.

•       To analyse website usage and traffic via Google Analytics or equivalent tools.

•       To comply with legal obligations.

1.6 Third-Party Data Sharing

We share personal data with the following categories of third parties:

•       Referral partners — estate planning professionals, financial advisers, solicitors, or other service providers to whom your enquiry is referred. These may include both FCA-authorised and non-regulated firms. Where partners are not FCA-authorised, we will take reasonable steps to ensure they are reputable; however, you should satisfy yourself as to the suitability of any firm before engaging them.

•       CRM and email marketing platforms — such as Zoho CRM who process data on our behalf under a data processing agreement.

•       Analytics providers — such as Google Analytics (Google LLC), which may transfer data outside the UK. We have enabled IP anonymisation where available.

•       Advertising platforms — such as Google Ads and Meta Ads, used for targeted advertising. These platforms may set cookies and process data per their own privacy policies.

We do not sell personal data to third parties. All third-party processors are required to process data only on our instructions and in accordance with applicable data protection law.

1.7 International Transfers

Some of our third-party service providers (including Google) are based outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO or reliance on the UK adequacy framework.

1.8 Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

•       Enquiry and referral data: retained for up to 3 years from date of last contact, after which it is securely deleted.

•       Marketing consent and email data: retained until you withdraw consent or unsubscribe.

•       Analytics data: retained in accordance with the settings of the relevant analytics platform (typically 14 months for Google Analytics).

•       Legal and compliance records: retained for up to 6 years in accordance with the Limitation Act 1980.

1.9 Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

•       Right of access — to request a copy of personal data we hold about you (Subject Access Request).

•       Right to rectification — to request correction of inaccurate or incomplete data.

•       Right to erasure — to request deletion of personal data in certain circumstances.

•       Right to restriction — to request that we restrict processing of your data.

•       Right to data portability — to receive your data in a structured, commonly used format.

•       Right to object — to object to processing based on legitimate interests or for direct marketing purposes.

•       Right to withdraw consent — where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, contact us at compliance@estateplanningadvice.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

1.10 Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website, including:

•       Essential cookies — necessary for the website to function.

•       Analytics cookies — Google Analytics or equivalent, to understand how visitors use our site.

•       Marketing cookies — Google Ads and Meta Ads pixels for advertising and remarketing purposes.

On your first visit, you will be presented with a cookie consent banner. You may accept or decline non-essential cookies. You can manage cookie preferences at any time via your browser settings. For full details, see our Privacy Policy.

1.11 Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include SSL/HTTPS encryption on the website, access controls on systems holding personal data, and regular review of our data security arrangements. In the event of a personal data breach likely to result in risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay where required.

1.12 Policy Review

This GDPR Compliance Policy is reviewed annually or following any significant change to our processing activities, applicable law, or ICO guidance. Last reviewed: April 2026.