AUTHORISED COMPLIANCE LTD
Last updated: September 2026
Authorised Compliance Ltd ("AuthorisedCompliance", "we", "us" or "our") iscommitted to handling personal data lawfully, fairly, securely andtransparently. This policy explains how we collect and use personal data whenyou visit our website, contact us, engage us for services, apply to become oract as an Appointed Representative (AR) or Introducer Appointed Representative(IAR), interact with us in a professional capacity, or otherwise deal with ourbusiness.
This policy also explains how we may useapproved artificial intelligence (AI) and cloud services as part of ourinternal business and compliance processes.
Authorised Compliance Ltd is a companyincorporated in England and Wales with company number 15833435. We areauthorised and regulated by the Financial Conduct Authority (FCA) under FirmReference Number 1025416 and registered with the Information Commissioner'sOffice (ICO) under reference ZB802407.
Registered and office address: AtlanticBusiness Centre, Atlantic Street, Broadheath, Altrincham, England, WA14 5NQ.
Privacy enquiries:support@authorisedcompliance.com.
For the processing described in thispolicy, Authorised Compliance is generally the data controller where wedetermine why and how personal data is used. In some client engagements we mayprocess personal data only on a client's documented instructions, in which casewe act as a processor and the relevant client's privacy notice will normallyprovide the primary information about that processing.
· Website visitors and people whosubmit enquiries or otherwise contact us.
· Prospective clients, clientsand their directors, owners, employees, contractors and professional contacts.
· Prospective and current ARs andIARs, and their directors, persons with significant control (PSCs),controllers, senior managers, staff and other key individuals.
· Customers or prospectivecustomers of clients, ARs or IARs whose information we review as part ofcompliance monitoring, complaints, customer-outcome reviews, audits orregulatory support.
· Complainants, includingindividuals whose circumstances or vulnerability are relevant to a complaint orcustomer-outcome assessment.
· Job applicants, employees,workers and contractors, where a separate staff or candidate privacy noticedoes not provide more specific information.
· Suppliers, professionaladvisers, business partners and other professional contacts.
· Name, title, date of birthwhere relevant, business role and employer.
· Email address, telephonenumber, postal address and other contact details.
· Identification documents andproof of address where identity verification is required.
· Company details, ownership,shareholdings, group structures, directors, PSCs and controllers.
· Employment history,professional experience, qualifications, competence, references and roleinformation.
· FCA permissions, approvals,regulatory history, complaints, breaches, disciplinary matters and otherregulatory information.
· Information from CompaniesHouse, the FCA Register and other public or official registers.
· Sanctions, insolvency, CountyCourt Judgment (CCJ), credit and financial soundness information where relevantand lawful.
· Open-source and adverse-mediainformation.
· Accounts, management accounts,bank statements, insurance information, liabilities, revenue, commissions andother financial information relevant to due diligence, onboarding, monitoringor regulatory work.
· Risk assessments, onboardingdecisions, oversight findings and remediation records.
· Customer journeys, sales andapplication records, call or communication records, scripts, disclosures,financial promotions and audit trails.
· Complaint information,root-cause analysis, resolutions and remediation.
· Customer-outcome information,including conversion, decline, cancellation, refund, service and satisfactiondata.
· Information about vulnerabilityor support needs where relevant to our compliance work.
· Regulatory applicationinformation, FCA correspondence and other records created while deliveringcompliance or principal-firm services.
· IP address, device and browserinformation, security logs and website usage information.
· Cookie and similar technologyinformation, subject to the choices described in our Cookie Policy.
· Information submitted throughwebsite forms, including your name, email address, telephone number andmessage.
· Emails, Teams messages, meetingnotes, task records, documents, comments and other communications with us.
· Information contained in filesor documents provided to us for review.
· Applications, CVs, employmenthistory, interview notes, references, qualifications, right-to-work andidentity information.
· Employment or contractoradministration information, including role details, training, performance,absence or leave information, access and equipment records, and workplacecommunications where relevant.
· Payroll, tax, payment and bankdetails, and emergency-contact information where relevant to an employment,worker or contractor relationship.
Some of our work may involve informationthat receives additional protection under data-protection law. For example,vulnerability or complaint records may contain health information, andregulatory due diligence may involve information about criminal convictions,offences, allegations or related security measures.
We only process this information where itis necessary and lawful. In addition to an Article 6 lawful basis, we identifyan applicable condition under Article 9 of the UK GDPR for special categorydata and, where relevant, an applicable condition under Schedule 1 of the DataProtection Act 2018 for special category or criminal-offence data. Depending onthe context and purpose, this may include employment and social-protectionobligations, establishing, exercising or defending legal claims, preventing ordetecting unlawful acts, protecting the public against dishonesty, meetingregulatory requirements relating to unlawful acts or dishonesty, orsafeguarding the economic well-being of an individual at economic risk. Weassess the relevant condition case by case and maintain an Appropriate PolicyDocument where the law requires one.
We apply additional access, minimisation,retention and security controls to this information and do not seek to collectit unless it is relevant to a defined business, regulatory, employment or legalpurpose.
We may obtain personal data directly fromyou, from an organisation you work for or represent, or from anotherorganisation involved in the relevant service or regulatory relationship. Wemay also obtain information indirectly from:
· Companies House, the FCARegister and other official or public registers. We may use relevant businessand regulatory information from these sources for due diligence, regulatorywork and, where permitted by law, proportionate business development and directmarketing.
· Sanctions, insolvency, court orcredit-reference sources where checks are relevant and lawful.
· Public websites, professionalprofiles, search engines, media and other open-source material used forproportionate due diligence or regulatory checks.
· Clients, ARs, IARs, lenders,introducers, service providers, professional advisers and other counterparties.
· Previous employers, referees orrecruitment sources where relevant.
· Our own systems, includingemail, document repositories, project-management systems and security logs.
Where we obtain personal data from anothersource, including a publicly accessible source, we will provide or bring thisprivacy information to your attention within a reasonable period and no laterthan one month after obtaining the information. If we use the information tocommunicate with you, we will provide the information at or before our firstcommunication; if we disclose it to another recipient first, we will providethe information at or before that disclosure, unless a lawful exemption applies.
Where we ask you to provide personal datain order to enter into or perform a contract, complete client or AR/IARonboarding and due diligence, meet FCA or other legal or regulatoryrequirements, support a regulatory application, administer an employment orcontractor relationship, or provide a requested service, certain informationmay be required. We will make this clear where relevant.
If you do not provide information that is required, we may be unableto onboard or continue to act for you, appoint or continue to oversee an AR orIAR, complete a regulatory application or required check, enter into or performa contract, administer an employment or contractor relationship, or provide therelevant service. Where information is optional, we will not treat it asmandatory.
Purpose
Examples
Main lawful basis / basis
Enquiries and pre-contract discussions
Responding to enquiries, scoping services, proposals and onboarding steps.
Steps at your request before contract; legitimate interests.
Delivering services and managing relationships
Compliance consultancy, audits, monitoring, permissions work, support, billing and client administration.
Contract; legitimate interests for corporate-client administration; legal obligations where applicable.
AR/IAR due diligence, appointment and oversight
Suitability, financial standing, fit-and-proper checks, scope, monitoring, reviews, supervision and regulatory reporting.
Legal obligation, including FCA requirements where applicable; legitimate interests in assessing suitability, managing regulatory risk and carrying out effective oversight.
Regulatory applications and liaison
Preparing or supporting FCA submissions, responding to regulatory requests, maintaining evidence and audit trails.
Contract where applicable; legal obligation; legitimate interests in regulatory compliance and effective client administration.
Complaints, Consumer Duty and customer outcomes
Reviewing complaints, vulnerability, customer files, outcomes, root causes and remediation.
Legal obligation, including applicable FCA requirements; contract where relevant; legitimate interests in monitoring customer outcomes and regulatory risk; Article 9/Schedule 1 conditions where required.
Security, fraud prevention and incident management
Access control, logs, account security, investigations, breach response and misuse prevention.
Legitimate interests in security and fraud prevention; legal obligations.
Supplier, adviser and contractor management
Engagement, due diligence, contracts, access, invoices and oversight.
Contract; legitimate interests in business administration and supplier risk management.
Recruitment and employment
Recruitment, employment administration, access, performance, payroll coordination and legal duties.
Steps before contract; contract; legal obligation; legitimate interests; Article 9/Schedule 1 conditions where needed.
Business development and direct marketing
Relevant B2B communications, events, follow-up and maintaining suppression records.
Legitimate interests for relevant B2B marketing where appropriate; consent or another PECR permission where required; legitimate interests and/or legal obligations for suppression and compliance records.
Website operation and analytics
Security, form operation, performance and, where enabled, analytics or preference functionality.
Legitimate interests for essential operation/security; consent for non-essential cookies/analytics where required.
AI-assisted business and compliance work
Approved AI tools used to assist drafting, summarisation, analysis, retrieval, classification and administrative work.
The lawful basis applying to the underlying business purpose, together with any additional Article 9 or Schedule 1 condition required for the data involved. AI is not treated as a separate lawful basis.
Where we rely on legitimate interests,those interests may include operating and developing our business, maintainingclient and professional relationships, carrying out proportionatebusiness-to-business marketing, managing regulatory and operational risk,assessing the suitability and financial standing of prospective or currentARs/IARs and relevant individuals, carrying out proportionate due diligence,protecting our systems and information, preventing fraud or misuse,administering suppliers and professional relationships, and establishing,exercising or defending legal claims. We consider the purpose, necessity andimpact of the processing and do not rely on legitimate interests where yourinterests, rights or freedoms override ours. We document a legitimate interestsassessment where appropriate.
We may use business contact details andrelevant business or regulatory information to send information about ourservices where permitted by data-protection and electronic-marketing laws. Thismay include information obtained from business websites, professionaldirectories, Companies House, the FCA Register and other public businesssources. Public availability of contact information is not treated as consent.
For corporate subscribers, such as limitedcompanies and limited liability partnerships, PECR generally does not requireprior consent for business-to-business marketing by electronic mail. Where thecontact information identifies an individual, we still require a lawful basisunder the UK GDPR and may rely on legitimate interests where appropriate. Forsole traders, certain partnerships and other individual subscribers, we onlysend electronic marketing where we have valid consent or another applicable PECRpermission, such as the soft opt-in. Each marketing communication will identifyus and provide a straightforward way to opt out. If you object or opt out, wemay keep the minimum information needed on a suppression list so that we canrespect your preference and avoid contacting you again for marketing purposes.
Authorised staff may use approvedAI-assisted tools, including ChatGPT Business, to support activities such asdrafting, summarising, analysing, classifying, retrieving, organising andreviewing information. Where approved connections are enabled, AI tools mayretrieve information from and, where specifically enabled, create, update ortransmit information within connected business systems such as Microsoft 365,in accordance with the permissions granted to those services and our internalaccess, approval and human-review controls.
We aim to minimise the personal datasubmitted to AI tools and use them only for defined business purposes. Materialregulatory, customer, complaint, employment, suitability, onboarding or clientdecisions are not intended to be made solely by AI without appropriate humanreview. AI output may be incomplete or inaccurate and must be validated beforeit is relied upon for material decisions or external actions.
OpenAI states that data from ChatGPTBusiness workspaces is not used to train its models by default. Where OpenAI oranother approved AI provider processes personal data on our behalf, therelevant contractual data-protection terms apply. We review AI and cloudsuppliers through our governance framework, including their securityarrangements, data handling, subprocessors, retention, international transfers,access controls and material changes to service terms. Service-layer prompts,outputs and logs are subject to our internal retention procedures, approvedworkspace settings where available, and the supplier's applicable retention anddeletion terms.
We do not currently use AI to makedecisions about individuals solely by automated means where those decisionsproduce legal or similarly significant effects without meaningful humaninvolvement. If we introduce such processing, we will assess it before implementation,provide the information required by law, and put in place any applicablesafeguards, including routes for human review and challenge.
We do not sell personal data. We maydisclose personal data where necessary and lawful to:
· The FCA, ICO, FinancialOmbudsman Service, courts, law-enforcement bodies, government authorities orother regulators where required or appropriate.
· Clients, ARs, IARs, lenders,product providers, introducers or other regulated counterparties where sharingis necessary for the relevant service, oversight or customer-outcome purpose.
· Professional advisers,insurers, accountants, auditors and legal advisers.
· Identity-verification,sanctions-screening, fraud-prevention, adverse-media, credit-reference orsimilar due-diligence providers where the relevant check is necessary andlawful.
· Approved IT, cloud,communications, website, security, document-management, project-management andAI service providers acting for us under appropriate contractual arrangements.
· Suppliers and contractors whoneed information to provide services to us, subject to appropriate access andconfidentiality controls.
· A prospective purchaser,investor or adviser in connection with a genuine corporate transaction, subjectto appropriate confidentiality and data-protection safeguards.
Material technology providers currentlyused or operating within our approved governance framework include Microsoft365 for business communications, collaboration and document storage,OpenAI/ChatGPT Business for approved AI-assisted work, and project-managementand other cloud service providers used to organise and deliver our work. Ourprocessor and supplier register is reviewed as services, subprocessors andconfigurations change.
Some of our service providers or theirsubprocessors may process personal data outside the United Kingdom. Wherepersonal data is transferred internationally, we assess the transfer and use alawful transfer mechanism where required. This may include UK adequacyregulations, the UK International Data Transfer Agreement, the UK Addendum tothe EU Standard Contractual Clauses, or another safeguard recognised under UKdata-protection law. We also take account of any additional transfer assessmentor contractual safeguards required by law and the nature of the data involved.
For example, our major cloud and AIproviders publish data-protection terms that address international processingand transfer safeguards. The precise locations and mechanisms can depend on theservice, our configuration and the provider's current subprocessorarrangements. We review these arrangements through supplier due diligence andour technology and AI governance processes.
You can contact us for further informationabout the safeguards relevant to a particular transfer.
We do not keep personal data indefinitely.We apply retention periods by record type, taking account of the purpose forwhich the information was collected, FCA record-keeping requirements,limitation periods, tax and accounting requirements, contractual needs,complaints, legal claims and security considerations.
Record category
Typical retention approach
Website enquiries and non-client prospects
Normally up to 24 months after the last meaningful interaction, unless a longer period is needed for a legal, regulatory or dispute purpose.
Client and service records
Normally up to 6 years after the client relationship or relevant engagement ends, subject to any longer legal or regulatory requirement.
AR/IAR appointment, due diligence and oversight
Core AR appointment, contract, amendment and termination records are retained for at least 3 years after the relevant termination or amendment, or for any longer period applicable under FCA rules. Records of AR reviews and the firm's SUP 12 self-assessment are retained for at least 6 years. Associated due-diligence, monitoring and oversight evidence may be retained for up to 6 years or longer where necessary to meet a regulatory, legal, complaints or claims requirement.
Complaints
At least 3 years from receipt for complaints subject to the FCA's general DISP retention rule, and longer where necessary for an ongoing regulatory matter, litigation, remediation exercise, legal hold or another applicable requirement.
Regulatory applications, reviews and FCA correspondence
Normally up to 6 years after completion, closure or the end of the relevant relationship, unless a longer period is required.
Marketing records
For as long as the contact remains relevant to our business-development purpose and subject to our marketing-retention controls, unless you object or withdraw consent where consent is relied on. Minimal suppression data may be retained for as long as needed to ensure we respect your opt-out.
Recruitment records
Unsuccessful-candidate records are normally retained for a limited period after the recruitment exercise, typically 6 months unless there is a lawful reason or agreement to retain them longer. Employee records follow our staff retention schedule and legal obligations.
Supplier and contractor records
Normally up to 6 years after the relationship ends, subject to accounting, contractual or legal requirements.
Security and technical logs
For the period necessary for security monitoring, investigation and resilience, typically no longer than reasonably required for those purposes unless an incident or legal requirement justifies longer retention.
AI-assisted working records
The underlying business record follows the retention period for its relevant category. Service-layer prompts, outputs and logs are also subject to our internal retention procedures, approved workspace settings where available, and the supplier's applicable retention and deletion terms.
We may retain information for longer wherethis is necessary to establish, exercise or defend legal claims, comply with aregulatory or legal hold, investigate misconduct or fraud, or meet anotherbinding requirement. Where no longer required, personal data is deleted,anonymised or securely disposed of in accordance with our retention controls.
We use technical and organisationalmeasures designed to protect personal data against unauthorised access,disclosure, alteration, loss or destruction. These measures includeproportionate access controls, authentication, encryption and secure communications,device and endpoint controls, backup and recovery arrangements, suppliersecurity due diligence, staff awareness and incident-response procedures.Access to sensitive information is limited to personnel who require it fortheir role.
Depending on the circumstances, you mayhave rights to:
· Request access to your personaldata.
· Ask us to correct inaccurate orincomplete personal data.
· Ask us to erase personal datawhere there is no lawful reason for us to continue using it.
· Ask us to restrict how we usepersonal data in certain circumstances.
· Object to processing based onlegitimate interests.
· Object at any time toprocessing for direct marketing; this right is absolute.
· Receive certain personal datain a portable format where the right applies.
· Withdraw consent at any timewhere we rely on consent. Withdrawal does not affect the lawfulness ofprocessing before withdrawal.
· Where the law applies, receiveinformation and safeguards in relation to significant decisions made solely byautomated means, including applicable rights to human review or to challengethe decision.
These rights are not absolute and may belimited by exemptions or by other legal and regulatory obligations. We may needto verify your identity before acting on a request.
To exercise your rights, contactsupport@authorisedcompliance.com.
If you have concerns about how we useyour personal data, you can make a data-protection complaint to us atsupport@authorisedcompliance.com. We will provide a clear route for complaints,acknowledge receipt within 30 days, make appropriate enquiries into the matter,keep you informed as appropriate and communicate the outcome without unduedelay. You also have the right to complain to the Information Commissioner'sOffice (ICO).
You do not lose any right to contact the ICO by raising the matterwith us. Further information about making a complaint is available from theICO.
We use cookies and similar technologies forwebsite operation and, where enabled, analytics or other optional features.Strictly necessary technologies may be used without consent where permitted bylaw. Non-essential cookies or similar technologies are used only where therequired consent has been obtained. Where marketing communications use trackingpixels or similar technologies, we use them only where permitted under PECR andobtain consent where required. Please see our Cookie Policy and cookie-preferencecontrols for more information.
We review this policy regularly and updateit where our processing, technology, suppliers, legal obligations or servicesmaterially change. Where a change creates a new or materially different use ofpersonal data, we will take reasonable steps to bring the change to theattention of affected individuals before the new processing begins whererequired.
