Pivotal Growth Limited (we, us or our) is committed to protecting your privacy. This policy explains how we collect, use and share your personal data. It applies to personal data we handle in connection with our products and services, whether we collect it through our website, in person, or through other means.

If you have any questions about this policy or how we handle your personal data, please contact us using the details at the end of this policy.

Information we collect and process

Identity and contact details

• Name, date of birth, current and previous addresses, email address and phone number.
• Identity documents, such as passport, driving licence or birth certificate details.
• Professional details.
• Nationality and residency or immigration status. This is collected to verify your identity, to meet our legal obligations on anti-money laundering and sanctions screening, and because some providers apply residency criteria to specific products.

Service-related information

• Transaction details for products and services you’ve purchased from us or enquiries about our products and services.
• Your preferences for our services and your marketing preferences and where relevant information related to loyalty programmes.
• Feedback, complaints and compliments and survey responses.

Financial and payment information

• Income details, bank statements and account information.
• Credit history and credit reference information.
• Payment details for products and services you’ve purchased from us (including where relevant, credit reference information) and where relevant banking or payment card information.

Digital information

• IP address and general location information derived from your IP address.
• Search and browsing behaviour and user journeys.
• Website usage patterns.
• Cookie preferences and tracking.

Recordings

• Call recordings.
• Records of meetings and decisions.

Professional information (for business contacts)

• Name, role, employer and business contact details.
• Required authorisations, licences and professional registrations where relevant.

Special category data

We may collect and process the following types of sensitive personal data where the law permits:

• Health information, including medical history, critical illness information and other health conditions. This is collected where necessary to arrange or provide insurance and protection products.
• Criminal convictions and offences data where required or permitted by law including in connection with fraud prevention, anti-money laundering checks or regulatory requirements.

We handle this information with extra care and only collect and use it where we have a valid legal basis, for example, where you have given your explicit consent, where it is necessary for an insurance purpose, or where it is required to prevent or detect fraud or financial crime.

How we collect personal data

• Directly from you when you: interact with us, contact us, fill out forms.
• Automatically when you: visit our website, use our technologies, interact with our online services.
• From third parties: service providers, business partners, government organisations and organisations or people authorised by you.
• From publicly available sources: such as Companies House.

How we use your information

UK data protection law (principally the UK GDPR and the Data Protection Act 2018, as amended or replaced from time to time) requires us to have a valid legal basis for using your personal data. We can only use your information where one or more of the following applies:

• Consent – You have clearly agreed to us using your personal data for a specific purpose.
• Performance of a contract – We need to use your information to fulfil a contract with you, or because you’ve asked us to do something before entering into a contract.
• Legal duty – We must use your information to comply with the law.
• Vital interests – We need to use your information to protect someone’s life.
• Public interest – We need to use your information to perform a task in the public interest or carry out official functions that have a clear legal basis.
• Legitimate interests – We have a genuine business reason to use your information, or a third party does, but only if this doesn’t unfairly override your rights and interests. Where we rely on legitimate interests as our legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. These assessments consider:
  • The nature of our legitimate interest
  • The impact on you
  • Any safeguards we can implement
  • Your reasonable expectations
  • The broader context of our relationship

Please note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. We have listed the reasons we process your data and the legal basis below. Just ask if you would like more detail about the basis we rely on.

The scenarios where we need to process your personal data include:

• Providing our products and services.
  We use your information for setting up and managing your account, assessing your eligibility and suitability, making recommendations, handling enquiries, complaints and claims, and referring you to another company in our group or another provider better suited to your needs.
  Basis: performance of a contract, legal duty (for billing and record-keeping), legitimate interests, and consent where special category data is involved.
  The types of information we use are identity and contact details, service-related information, financial information, digital information and special category data.
• Taking you on as a client.
  We use your information for completing anti-money laundering identity checks, checking sanctions and fraud screening.
  Basis: performance of a contract, legal duty, public interest, and legitimate interests.
  The types of information we use are identity and contact details and financial information.
• Running, improving and developing our business.
  We use your information for responding to enquiries, conducting analytics, market research, service improvement and quality assurance.
  Basis: legitimate interests.
  The types of information we use are identity and contact details, digital information.
• Marketing and communications
  We use this information for telling you about products, services, events and offers, and any other information that we consider to be of interest to you.
  Basis: legitimate interests, consent (where applicable).
  The types of information we use are identity and contact details and digital information.
• Meeting our legal and regulatory obligations.
  We use this information for record-keeping, reporting, and responding to regulators, courts and law enforcement, or where we are otherwise required to or authorised to by law.
  Basis: legal duty.
  The types of information we use are all relevant personal data set out above.
• Recruitment and employment-related purposes.
  We use your information to consider applications, carry out pre-employment checks, confirm right to work, make reasonable adjustments, manage employment onboarding, and meet relevant legal or regulatory obligations.
  Basis: performance of a contract, legal duty, legitimate interests, and consent where applicable.
  We use identity and contact details, professional and employment information, right-to-work, vetting information, and diversity information where relevant.

Our disclosures of personal data to third parties

We may disclose personal data to:

• Service providers who help us run our business — including IT, hosting and data storage, client relationship management, payment processing, marketing, advertising and analytics. You can contact us directly for details of the providers we use.
• Professional advisers, such as banks, auditors, insurers and lawyers.
• Business partners, introducers, agents, contractors and product providers we work with to provide or arrange products and services for you.
• Other companies within Pivotal, including businesses we acquire or that join the group in future, so that we can provide, arrange and refer you to the right products and services. Where we merge with, are acquired by or sell our business assets, your information may be disclosed to our advisers, the potential purchaser’s advisers and included in the transferred assets.
• Credit reference and fraud prevention agencies.
• Regulators, courts, law enforcement and other public bodies, including where we have reporting obligations.
• Anyone you have asked us to share your information with (including third parties), the emergency services where necessary, and anyone else where the law requires or allows it.

Changes of Business Ownership and Control

We as a business change over time. We reserve the right to expand or reduce our business, and this may involve the sale and/or transfer of all or part of us under the Pivotal Growth Limited group of companies. If this happens, personal data held by us may be transferred to the new owner or prospective purchaser of the relevant business or assets. The new party will be permitted to use this data in accordance with applicable data protection laws. In other words, the data will only be used in accordance with how it was supplied to us in accordance with this policy.

Overseas transfers

We primarily store your personal data in the United Kingdom, but it may be transferred to or accessed from outside the UK, including where a service provider, business partner or cloud platform operates overseas, or where the law requires it.

Where that happens, we transfer only what is necessary, and we make sure it stays protected. We will only transfer your data to countries recognised under UK data protection law as providing adequate protection for personal data, putting a contract or other approved safeguard in place with the third party requiring them to comply with UK-equivalent data protection standards, or transferring data to organisations that are part of specific cross-border data transfer agreements with the UK. We will ensure the transfer is for the minimum amount of personal data necessary, that the third party only uses your data for the purposes we have agreed, that the third party allows us to monitor how they handle and use your data.

Data Retention

We keep your personal data only for as long as we need it to provide our services, to meet our legal, tax, accounting and regulatory obligations, and to deal with any complaints or legal claims.

We may be required to keep your data for longer if you lodge a complaint we need to investigate, we reasonably believe legal action involving our relationship with you might occur, or where the law requires us to.

When deciding a data retention period, we will consider how much data we have and how sensitive it is, the risk of harm if accessed without permission, whether we can achieve our purpose another way, what specific legal, accounting and regulatory requirements are, and the nature of our relationship with you.

When we no longer need your information, we securely delete or destroy it. You can ask us about the periods that apply to your information or ask us to delete it earlier where the law allows.

Your privacy rights and choices

You can choose whether to give us your personal data, but if you do not provide certain information, we may not be able to provide some services. We will tell you when information is required rather than optional.

You have the following rights over your personal data. Some apply only in certain circumstances, and we will tell you if a limitation applies to your request:

• Access: Ask for a copy of the information we hold about you, and where we got it from. We may not always have to provide all of the information requested.
• Rectification: Ask us to correct information that is inaccurate or incomplete.
• Erasure: Ask us to delete your information where the law allows (including where the data is no longer necessary or has been unlawfully processed). However, despite your request we may need to keep it for legal, regulatory or business reasons.
• Restriction: Ask us to pause how we use your information. For example, while you challenge whether it is accurate, or while we check the grounds for an objection you have made.
• Opt-out: Opt-out of receiving direct marketing. Our marketing materials will contain an unsubscribe option, or you can contact us to change your preferences. We will process your request as soon as reasonably practicable.
• Objection: Object to us using your information for our legitimate interests (which includes direct marketing). We will stop processing unless we can demonstrate strong legitimate grounds.
• Portability: Ask us to provide, or transfer, information you gave us in a commonly used electronic format.
• Withdrawing consent: Where we rely on consent, you may withdraw it at any time, though this does not affect anything we did before consent withdrawal.

How to Exercise Your Rights

To exercise any of these rights, contact us via DataProtection@pivotal.co.uk. We may ask for proof of identity and will respond within 1 month (extendable to 3 months for complex requests).

These rights are available under data protection law, though some may not apply in every situation. We’ll let you know if any limitations apply when you make a request.

Making a complaint

You have the right to complain to us about how we have used your personal data, and we would encourage you to raise it with us first. If you’re unhappy, please get in touch with us via DataProtection@pivotal.co.uk.

When you contact us:

Please give us full details and let us know what outcome you are looking for. We will acknowledge your complaint within 30 days (starting the day after we receive your complaint), investigate it without undue delay (beginning as soon as we receive your complaint), and give you a point of contact.

We will keep you updated on timeframes, explain any delays, and give you an expected completion date. We may come back to you for more information if we are not sure what your complaint is about or to ask what outcome you are looking for. We will usually respond using the same method you used to contact us, unless you request we use a different method. How long it takes will depend on how complex the issue is and any harm you are suffering.

If you are not satisfied with our response to your complaint, you can also complain directly to the UK’s data protection regulator (currently the Information Commissioner’s Office, or ICO) at any time.

The ICO’s address is currently:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

You can find the regulator’s current contact details, and make a complaint, at ico.org.uk.

You don’t have to contact us first before going to the ICO, but we’d appreciate the opportunity to try to resolve your concerns directly with you.

Protecting your information

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, alteration or disclosure, and we require our service providers to do the same. Relevant technical safeguards and operational security measures employed:

• Enterprise-grade encryption for data storage and transmission
• Regular security testing and monitoring
• Automated threat detection system
• Staff training on security and privacy
• Strict access controls based on job requirements
• Regular security audits and incident response
• Equipment security protocols

Our internal data protection and information security policies set the standards we expect across the group. We keep our measures under review, and we will tell you and the regulator about a serious personal data breach where the law requires us to.

Children’s Personal Data

Our services are not directed at children, and we do not offer products or services directly to anyone under 18. We may hold information about children where an adult provides it to us (for example, dependants on a mortgage application, or children insured under a protection policy), and a parent or guardian can exercise the rights set out in this policy on their behalf.

Cookies & Analytics

We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device when you visit our website. They help us remember your preferences and understand how you use our site. We use the following types of cookies:

• Essential cookies: Necessary for the website to function properly
• Performance cookies: Help us understand how visitors interact with our website
• Functionality cookies: Remember your preferences and settings
• Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness

You can choose which cookies to accept when you first visit our website, and you can change your choices at any time using the cookie setting on our website or your browser settings. Our Cookie Policy (available at https://pivotal.co.uk/cookie-policy/) explains the cookies we use in more detail, and how to manage them.

Please note that disabling certain cookies may affect the functionality of our website and your user experience.

We use analytics tools provided by other organisations, such as Google Analytics, to understand how people engage with our website. This involves cookies that collect information about your browsing activity. You can opt out of features through your Google account settings, browser add-ons, or your device’s privacy settings. These tools provide options to control how your data is used for advertising purposes. You can learn more about how Google uses your data and your available options on Google’s privacy pages.

We also use advertising tools (such as Meta Pixel) to understand how our ads perform and to show you more relevant advertisements on Meta platforms like Facebook and Instagram when you visit our website. You can manage whether we connect information from our website with your Meta account for advertising purposes by adjusting your settings within your Meta account preferences.

Artificial Intelligence (AI) technologies

We use artificial intelligence and machine learning, including tools provided by third parties, to support activities such as analysis, drafting and content generation, improving our services, automating routine tasks, quality assurance and client support. They may also help prepare assessments, including whether a product is suitable for you, but they do not make final decisions about you, and a person is involved in decisions that significantly affect you. We only use these technologies when legally permitted and necessary for our business.

Where we use AI providers, we contractually require them to protect your information.

We check the accuracy of outputs and review the risks regularly. Your rights where automated tools are involved in a decision are set out under “Rights relating to automated decisions” below.

Rights relating to automated decisions

Some of our processes are supported by automated tools, for example, analytics on our website and AI tools that help assess eligibility or suitability. We do not make decisions with a legal or similarly significant effect on you by automated means alone. Where AI tools are used to contribute towards decisions that may significantly affect you, we will inform you of this. We maintain human oversight of all significant AI-generated decisions, and our staff are trained to understand the limitations of AI technologies and to verify outputs before relying on them.

We operate processes to ensure the accuracy and reliability of AI-generated outputs, which are subject to regular testing and monitoring. Appropriate technical and organisational measures are in place to maintain the security and integrity of your personal data throughout. We regularly assess and document the risks associated with using AI to process personal data, implement measures to address those risks, and continuously monitor AI performance to review its ongoing impact. You can ask us to explain the decision, ask for it to be reviewed by a person, and challenge the outcome.

Amendments

We may update this policy at any time by posting the revised version on our website. We recommend that you review our website regularly to stay current with any policy changes.

Our contact details

Privacy contact email: info@pivotal.co.uk

Last update: October 2026