Plain Language Summary
For compliance officers and DPOs — a structured overview before the full policy
What data we hold on your institution
We hold the compliance, licensing, and AML documentation you provide during engagement, along with contact details for your nominated representatives. We do not collect personal data beyond what is operationally necessary.
Who can access your data
Your data is accessible only to the finconduit team members assigned to your engagement. We do not share client data with third parties except banking partners you have pre-authorised or as required by law.
How long we keep records
Regulatory documentation is retained for 5–10 years depending on type, in compliance with AML record-keeping obligations. Contact data for enquiries is held for 24 months from last engagement.
Your rights as a data subject
You have the right to access, correct, delete, or port your personal data. You may also object to processing or request restriction. Exercise any right by contacting dpo@finconduit.com within a 30-day response SLA.
Cross-border data transfers
Data may be transferred to banking partners and regulatory bodies in the EEA and UK. All transfers are governed by Standard Contractual Clauses (SCCs) or adequacy decisions. No data is transferred to jurisdictions without appropriate safeguards.
Breach notification
In the event of a personal data breach, we notify affected clients within 48 hours and the ICO within 72 hours where required. Our incident response team operates continuously.
Introduction
finconduit (“finconduit”, “we”, “us”, or “our”) is committed to protecting the personal data of our clients, prospective clients, website visitors, and other individuals whose data we process in connection with our regulatory advisory services.
This Privacy Policy describes how we collect, use, disclose, retain, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and where applicable, the EU GDPR.
Data Controller
finconduit acts as data controller in respect of personal data processed under this policy. We are establishing operations in the United Kingdom and ICO notification will be completed before any client data is processed. Until that registration is published, all data protection enquiries should be directed to dpo@finconduit.com.
Scope of this policy
This policy applies to all personal data processed by finconduit, including data obtained from: direct client engagements; our website at finconduit.com; marketing and communications activities; and in the course of providing regulatory, compliance, and banking access advisory services.
Where we process personal data on behalf of our clients as a data processor (for example, processing employee data during a compliance programme implementation), our obligations are governed by the relevant data processing agreement rather than this policy.
Data We Collect
Client and institutional data
In the course of providing advisory services to regulated institutions, we collect personal data relating to the individuals who represent those institutions. This typically includes:
- Contact details: name, email address, telephone number, job title, and business address
- Identity verification data: passport or national ID details for KYC purposes where required
- Professional background: qualifications, regulatory history, and fitness and propriety information
- Communications: email correspondence, meeting notes, and engagement records
- Financial information: invoicing details and payment records
Website visitors
When you visit our website, we may collect technical data including your IP address, browser type and version, operating system, referral source, length of visit, and page views. This data is collected via cookies and analytics tools (see Section 09).
- Enquiry data submitted via contact or assessment request forms
- Marketing preferences and communication consent records
- Interaction data: pages visited, content downloaded, and webinar attendance
Data Minimisation Principle
finconduit operates a strict data minimisation policy. We collect only the personal data that is necessary for the specific purpose for which it is obtained. We do not collect personal data of a sensitive nature (special category data under Art. 9 GDPR) unless strictly required by applicable regulatory obligations.
Regulatory & Sensitive Data
The nature of finconduit's advisory services means we routinely handle documentation that is commercially sensitive, legally privileged, or operationally confidential. While such institutional documentation may not always contain personal data per se, where it does we apply heightened processing standards consistent with the sensitivity of the information.
The table below classifies the principal categories of regulatory data we handle, the legal basis for processing, and applicable retention periods:
| Data Category | Classification | Retention |
|---|---|---|
Licence & Authorisation Data Regulatory licences, authorisation references, supervisory correspondence, and FCA/NCB register entries. | Highly Restricted | 7 years post-engagement |
AML / KYC Documentation Beneficial ownership records, PEP screening results, source of funds documentation, and enhanced due diligence files. | Restricted | 5 years minimum |
Compliance Assessment Data Gap analysis outputs, risk scores, control deficiency findings, and remediation tracking data. | Confidential | 5 years post-engagement |
Banking Relationship Data Correspondent banking applications, pre-approval correspondence, onboarding documentation, and declined-application data. | Restricted | 5 years post-engagement |
Regulator Communications Supervisory letters, regulatory queries, enforcement-adjacent correspondence, and submission records. | Highly Restricted | 10 years post-engagement |
AML Record-Keeping Obligations
Under Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, finconduit is legally obligated to retain certain AML and KYC records for a minimum of five years from the date on which the relevant business relationship ends. This obligation overrides any right to erasure in respect of those records.
Handling of legal privilege
Where documentation handled in the course of an engagement attracts legal professional privilege (for example, legal opinions prepared in conjunction with our legal panel), that privilege is maintained and such documentation is subject to enhanced access controls within our document management infrastructure.
Legal Basis for Processing
finconduit processes personal data only where a valid legal basis exists under Article 6 of the GDPR. For each category of processing activity, the applicable legal basis is documented in our Record of Processing Activities (RoPA), maintained by our Data Protection Officer.
Contract Performance
The primary basis for processing client data is the performance of our advisory engagement contract. This covers all processing necessary to deliver the services you have engaged us to provide.
Legal Obligation
Certain processing — particularly AML/KYC record-keeping, FATF compliance, and regulatory reporting obligations — is required by law. We must process and retain this data regardless of client preference.
Legitimate Interests
We process some data on the basis of our legitimate interests in operating a regulated advisory practice — including fraud prevention, quality assurance, and marketing communications to existing and prospective institutional clients.
Consent
Where we rely on consent — for example, for marketing emails to prospective clients — we obtain that consent explicitly and maintain clear records. You may withdraw consent at any time without prejudicing any contractual engagement.
Data Sharing & Transfers
Third parties with whom we share data
We do not sell, rent, or trade personal data. We share personal data only in the following circumstances and with the following categories of recipient:
- Banking partners and correspondent institutions: where you have engaged us to make banking introductions, we share the documentation package with pre-identified banking partners on your authorisation
- Legal panel members: solicitors and barristers engaged to prepare or review legal opinions as part of your engagement
- Regulatory authorities: where required by applicable law, supervisory body, or court order
- IT and infrastructure providers: cloud storage, document management, and communications platforms operating under appropriate DPAs
- Professional advisors: accountants, auditors, and insurers, subject to confidentiality obligations
International transfers
Where personal data is transferred outside the UK or EEA, finconduit ensures that appropriate safeguards are in place, including:
- UK adequacy regulations or EU adequacy decisions (where the recipient country has been granted adequacy status)
- Standard Contractual Clauses (SCCs) as approved by the European Commission or the ICO under the International Data Transfer Agreement (IDTA)
- Binding Corporate Rules (BCRs), where applicable
- Derogations under Article 49 GDPR for specific transfers in limited circumstances
Banking Partner Transfers
Transfers of institutional documentation to banking partners for onboarding purposes are made on the basis of your explicit instruction and consent. You will be notified of the identity of each banking partner before any transfer is made, and you may withdraw authorisation at any time prior to the transfer being completed.
Data Retention
finconduit retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Our Data Retention Schedule (available on request from dpo@finconduit.com) specifies the retention period applicable to each category of data.
Principal retention periods
- Active client engagement data: retained for the duration of the engagement plus 5 years
- AML/KYC documentation: minimum 5 years from end of business relationship (MLR 2017 obligation)
- Regulatory correspondence and licensed documentation: 7–10 years post-engagement
- Website enquiry and contact data: 24 months from last interaction
- Marketing consent records: 3 years from consent date, or until withdrawn
- Contractual documentation: 7 years from contract end (Limitation Act 1980)
- Invoice and payment records: 7 years (HMRC requirement)
Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in accordance with our Data Disposal Procedure. For cloud-hosted data, we use certified deletion processes that meet ISO 27001 standards.
Your GDPR Rights
Under the UK GDPR and EU GDPR, data subjects have clearly defined rights in respect of their personal data. The rights below apply to personal data relating to natural persons within your institution. Institutional clients should note that commercially confidential compliance documentation is not necessarily subject to these rights in full — please contact our DPO for guidance specific to your engagement.
Right of Access
You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with supplementary information about how it is processed.
How to exercise
Submit a Subject Access Request (SAR) to our DPO via email at dpo@finconduit.com. We respond within 30 days.
For institutional clients, this right applies to the personal data of natural persons within the institution, not to commercially confidential compliance documentation.
Right to Rectification
You have the right to have inaccurate personal data rectified without undue delay. Where relevant, you also have the right to have incomplete personal data completed.
How to exercise
Contact your assigned engagement manager or submit a rectification request to dpo@finconduit.com.
Rectification requests affecting compliance documentation may require corroborating evidence before amendments are made.
Right to Erasure
You have the right to have personal data erased where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis exists.
How to exercise
Submit an erasure request to dpo@finconduit.com. We will assess against applicable retention obligations.
This right is subject to overriding legal obligations, including our AML record-keeping requirements under the Money Laundering Regulations 2017.
Right to Restriction
You have the right to restrict our processing of your personal data in specified circumstances — for example, while contesting accuracy or where you have objected to processing.
How to exercise
Contact dpo@finconduit.com with the basis for your restriction request. Restricted data will be stored but not actively processed.
Restriction may affect our ability to deliver advisory services during the restriction period.
Right to Data Portability
Where processing is based on consent or contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
How to exercise
Request portability from dpo@finconduit.com, specifying the format required. We support CSV and JSON output.
This right applies to data you have provided directly. Derived data and analytical outputs are outside the scope of portability.
Right to Object
You have the right to object to processing based on legitimate interests, and to processing for direct marketing purposes at any time.
How to exercise
For marketing, use the unsubscribe link in any communication. For legitimate interest processing, contact dpo@finconduit.com.
We will cease processing unless we demonstrate compelling legitimate grounds that override your interests or the processing is for legal claims.
Rights re Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce significant legal or similarly significant effects.
How to exercise
Request human review of any automated decision by contacting your engagement manager or dpo@finconduit.com.
finconduit does not make automated compliance assessments that produce binding legal outcomes without human review.
Exercising Your Rights
All rights requests should be directed to dpo@finconduit.com. We respond within 30 calendar days (extendable to 90 days for complex requests, with notice). We do not charge a fee for rights requests unless they are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.
If you are dissatisfied with our handling of your personal data or a rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or with your local supervisory authority if you are based in the EU.
Security Measures
finconduit implements technical and organisational security measures appropriate to the risk profile of the data we process. Given the commercially and regulatory sensitive nature of our work, our security framework is designed to institutional standards.
Technical measures
- AES-256 encryption at rest for all stored client documentation
- TLS 1.3 in transit for all data transfers and communications
- Multi-factor authentication (MFA) required for all staff access to client data systems
- Zero-trust network architecture with role-based access controls (RBAC)
- Regular penetration testing and vulnerability assessments (minimum annual)
- ISO 27001-aligned information security management system
Organisational measures
- All staff complete mandatory GDPR and data protection training on engagement and annually thereafter
- Data protection impact assessments (DPIAs) conducted for all high-risk processing activities
- Confidentiality agreements in place with all staff, contractors, and third-party processors
- Incident response plan with defined notification procedures and escalation paths
- Regular internal audits of data processing activities against this policy and our RoPA
Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and in any event within 48 hours. Where required, we will notify the ICO within 72 hours of becoming aware of the breach. Our incident response team operates continuously.
Contact & DPO
For any queries relating to this Privacy Policy, to exercise your GDPR rights, or to raise a concern about how we handle your personal data, please contact our Data Protection Officer using the details below.
Data Protection Lead
- Role
- Data Protection Lead, finconduit
- dpo@finconduit.com
- Response SLA
- 30 calendar days
General Privacy Enquiries
- Response SLA
- 5 working days
- Working hours
- Mon–Fri, 09:00–18:00 BST
Supervisory Authority
- Name
- UK Information Commissioner's Office
- Website
- ico.org.uk
- Helpline
- 0303 123 1113
If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the ICO at any time. We encourage you to contact us first so we can address your concern directly.
Policy Updates
We review and update this Privacy Policy periodically to reflect changes in our processing activities, regulatory requirements, or legal interpretations. Significant changes will be communicated to active clients. The effective date at the top of this document reflects the most recent update.