Privacy Policy

Croft and Company IFA is committed to being transparent about how we collect and use personal data. This privacy notice explains how we use the personal information collected from you in relation to your Investments, Mortgages and Pensions.

Why we collect your personal information and how we use it

We collect personal information from you to initiate a contract with you and in order

to maintain and administer our recommended product once it is open. We may also receive information about you from third parties appointed by you. We will use your personal information to:

• identify you internally

• allow adherence to our contract with you

• comply with our legal obligations as an authorised financial company.

This includes checking your personal details against an automated database in order to meet our

obligations relating to the prevention of money laundering, fraud or other financial crime.

We will rely on the necessity of processing to perform our contract, the necessity of processing to

fulfil our legal obligations and our legitimate business interests as the lawful basis for processing

the information we collect from you. These provisions are detailed in sections 1(b), 1(c) and 1(f) of

Article 6 of the General Data Protection Regulation (GDPR).

Examples of our legitimate business interests include good governance, accounting, monitoring of

communications, and managing and auditing business operations.

We will not make any decisions in relation to your Portfolio solely on an automated basis.

How we store and share your information

All information held by Croft & Company is stored on encrypted servers or at a secure physical

location. In addition, we have internal policies and controls in place to minimise the risk of your

data being lost, misused, accidentally destroyed or disclosed.

Your information is available to staff employed by Croft & Company.

Where we transmit your data to third parties we do so under a duty of confidentiality, and those

third parties are obliged to implement appropriate technical and organisational measures to ensure

the security of data. Specifically, the third party organisations in question are:

• Research Software
• Your Investment Provider
• The fund managers for any investments you make within your Portfolio
• Smartsearch powered by Equifax, Experian and Dow Jones in order to perform money laundering checks
• Crime prevention agencies where required by law
• HMRC, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA)
• under our regulatory reporting obligations
• Perrys Recycling, who dispose of our confidential waste
• JustCRS, our external compliance provider

How long we hold your information for

We will hold your information for the period for which your Portfolio is open with us and for seven

years after you terminate your relationship with us. It should be noted that we are obliged by

regulation to hold personal information in relation to discretionary payments from an estate to

charity indefinitely.

Where you hold a pension with us, we will retain your Portfolio records indefinitely in order for us to

comply with pension record keeping obligations.

Access to your information and correction

You have the right to request a copy of the information that we hold about you. If you would like

a copy of some or all of your personal information, please make a request to us in writing to our office address at Clarence Court, 14 Barnstaple Street, Bideford, Devon EX39 4AE.

It is important to us to ensure that personal information held about you is accurate and up to

date. You may, and we would encourage you to, ask us to correct or remove information about you

that you think is inaccurate. You have the right to object to our processing of any aspect of your

personal data and to request its erasure should you believe that we have no legal right to continue

processing.

In some circumstances you have the right to request that we provide certain categories of your

personal data to you or any third party in machine readable format.

If you believe that we have not complied with your data protection rights please contact us and

we will endeavour to resolve this with you. If you remain dissatisfied you can complain to the

Information Commissioner. Details can be found via their website, https://ico.org.uk/concerns/.

Changes to this privacy notice

We keep this privacy notice under regular review and we will make you aware of any changes.

Our Data Protection Officer is Stephanie Croft, who can be contacted on 01237 423363.