Privacy policy

1. Who this policy is for

factfind.net is a business-to-business platform. Financial professionals (wealth managers, financial advisers, mortgage brokers, solicitors, accountants, insurance brokers and investment managers) register their organisation and invite their own clients to complete fact-finds.

• For organisations: we are the data controller of the personal data we hold about your staff accounts.
• For end clients: the registered organisation is the data controller; we act as the data processor, processing client data on the organisation's behalf.

2. What we collect

From organisation staff (admins and team members):

• Name, email address, hashed password, role
• Organisation name, public slug (URL), logo, brand colour
• Login and activity timestamps

From end clients (collected at the organisation's direction):

• Name, email address, hashed password
• The answers provided to fact-find questions, which may include sensitive personal and financial information
• Progress, timestamps, and audit metadata

We do not knowingly collect data from children under 16.

3. Why we use your data (lawful basis)

We process personal data only where we have a lawful basis under UK GDPR:

• Contract: to provide you with the services you've signed up for.
• Legitimate interests: to secure the service, prevent abuse, communicate essential service updates, and improve the platform.
• Legal obligation: where we're required by law to retain or disclose certain data.
• Consent: where we explicitly ask for it (e.g. future marketing communications).

4. How long we keep data

We keep personal data only for as long as we need it. Typical retention periods:

• Active accounts: for the lifetime of the account.
• Closed accounts: up to 12 months after closure, then deleted or anonymised.
• System logs and audit trails: up to 12 months.
• Accounting records: up to 7 years where required by law.

End-client data held on behalf of an organisation is retained and deleted in accordance with that organisation's instructions.

5. Who we share data with

We do not sell your data. We share it only with:

• Infrastructure providers who host the application and database (UK-based).
• Email delivery services used to send transactional emails (account verifications, password resets, invitations).
• Professional advisers (such as our legal and accounting advisers) where necessary.
• Law enforcement or regulators where we are legally required to disclose data.

All processors we engage are bound by contract to keep data confidential and process it only on our instructions.

6. Where we store data

All data entered into Evolving People Ltd solutions is stored within the United Kingdom / European Economic Area, in accordance with the UK Data Protection Act 2018 and the UK GDPR. We do not routinely transfer personal data outside the UK/EEA. If we ever need to, we'll ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

7. Security

We take the security of your data seriously. Measures we apply include:

• HTTPS encryption for all traffic between your browser and our servers.
• Passwords are hashed using modern algorithms; we never store them in plain text.
• Access controls, least-privilege principles, and audit logging on administrative actions.
• Regular platform updates and security patches.
• Isolated storage per organisation to prevent cross-tenant data access.

No system is perfectly secure. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify affected users and (where required) the Information Commissioner's Office within 72 hours.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (subject to legal retention requirements).
• Restrict or object to the processing of your data.
• Portability: receive your data in a machine-readable format.
• Withdraw consent where we rely on consent as the lawful basis.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email support@factfind.net. We'll respond within one month.

If you're an end client whose fact-find is held by an organisation using our platform, please contact that organisation first — they are the data controller for your data.

9. Cookies

We use a small number of essential cookies to keep you signed in and to protect against cross-site request forgery. We do not use tracking or advertising cookies. See our cookies policy for details.

10. Changes to this policy

We may update this policy as the platform or the law changes. Material changes will be notified to active account holders by email. The "Last updated" date at the top of this page reflects when the policy was last revised.