Privacy notice for Hartsfield Financial Services

Data Controller

Hartsfield Financial Services Ltd (“HFS”, “Hartsfield”, “we”, “us”, “our”) is the data controller (i.e. is responsible for the keeping and use of your personal data). Both Hartsfield Planning and Hartsfield Investment are trading styles of Hartsfield Financial Services Ltd.

We take your privacy seriously and are committed to handling your personal information lawfully, fairly and transparently under the UK GDPR and the Data Protection Act 2018.

This privacy notice explains how we collect, use, share, store and protect your personal information – including where we use artificial intelligence (AI) or automated tools.

This privacy notice also explains how you can make a complaint with us about how we handle your personal information.

Contact details

Please contact us if you have any questions about our privacy policy or personal information, we hold about you.

Via post	Data Protection Officer, The Coach House, Box House, Bath Road, Box, Wiltshire SN13 8AA
Via phone	0800 612 6633
Via email	mark.futcher@hartsfield.co.uk

What personal information we collect

In order to provide you with financial and/or tax planning advice, mortgage advice and investment services, we will collect and use your personal information when you engage us for these services.

This information may include:

• Personal identifiers – details that help us to confirm who you are, such as:
• Your name, date of birth, address, contact details
• National insurance number
• Identification documents (passport, driving licence)
• Financial and professional information – Information that helps us understand your financial position including:
• Your income and regular expenditure
• Details of your assets, liabilities, pensions and investments
• Tax information
• Bank account details
• Employment information
• We may also need to use special category information which may be particularly sensitive (such as your health for insurance purposes), but only where relevant and with your explicit consent.
• Communications – to keep accurate records and meet regulatory requirements we may record:
• Emails, notes (and recordings of telephone calls) and meeting notes
• Records required to meet our regulatory requirements

Why we collect your personal information

From the moment you first contact us, we will collect personal information to enable us to enter into, and fulfil, a contract for the provision of financial advice, planning, investment and/or tax planning services.

The information we collect is necessary to provide the services you request effectively and to meet our legal and regulatory obligations, including those relating to Financial Conduct Authority (FCA) requirements and anti-money laundering legislation.

How we collect your personal information

We collect personal information directly from you through a variety of channels. This will typically include information you provide when completing our client Discovery document or other questionnaires, during meetings, telephone or video calls, by email, through our website, or in written correspondence.

We may also record information you provide during discussions with us so that we can accurately assess your circumstances, objectives and needs. In some cases, with your knowledge and where appropriate, we may receive information from third parties, such as your accountant, solicitor, employer, pension providers, investment platforms or other financial institutions, where this is necessary to provide our services or where you have authorised us to do so.

Call and meeting recordings

Telephone calls to and from our offices may be recorded for legitimate business purposes, including staff training, quality assurance, monitoring compliance with our regulatory obligations, and maintaining accurate records of the advice and services we provide. We may also make audio recordings of meetings for the same purposes.

Where meetings are recorded, we will inform you before the recording takes place

Information from other organisations

Where necessary to provide our services, we may obtain personal information about you from other organisations. This helps us to understand your financial circumstances, verify information you have provided, and ensure that our advice is appropriate.

For example, we may obtain information from pension providers, investment managers, insurance companies, product providers, HM Revenue & Customs (HMRC), the Department for Work and Pensions (DWP), your accountant, tax adviser or solicitor, or other organisations where you have asked us to do so or where we are required or permitted by law.

In most cases, we will obtain your authority before requesting information from these organisations, unless we are legally entitled or required to obtain it without your consent.

We may also receive information from payment service providers and from organisations that provide identity verification, credit reference, fraud prevention and anti-money laundering checks, where these are necessary to comply with our legal and regulatory obligations.

 

Information about connected individuals

During the course of providing our services, you may give us personal information about other individuals, such as your spouse or partner, dependants, beneficiaries, trustees, attorneys or professional advisers. We ask that you only provide this information where it is necessary for the services we provide and, where appropriate, that you have informed those individuals that you have shared their personal information with us and directed them to this Privacy Notice.

Where you provide us with personal information about another individual, you should ensure that you have their permission, or another lawful basis, to share that information with us. Where required under data protection law, we will provide privacy information directly to those individuals, or we may ask you to provide them with a copy of this Privacy Notice.

When we receive information from other sources

Where we obtain your personal information from sources other than you, you will have the same rights in relation to that information as those described in the ‘Your rights’ section of this Privacy Notice.

Where required, we will provide you with information about the personal data we have obtained, including the source of the information and how we intend to use it. However, we may not be required to do so where you already have this information, where we are legally prohibited from providing it, or where doing so would involve disproportionate effort or would seriously impair the achievement of the purposes for which the information is processed. In all such cases, we will continue to protect your personal information in accordance with applicable data protection law.

Client surveys and feedback

From time to time, we may invite you to complete client satisfaction surveys or provide feedback on our services. Participation is entirely voluntary. Any information you provide will be used to help us monitor, review and improve the quality of the services we provide and, where appropriate, to meet our legitimate business interests.

If you choose not to provide information

Some of the personal information we request is required by law or is necessary for us to enter into or perform our contract with you. If you choose not to provide this information, or if the information provided is incomplete or inaccurate, we may be unable to meet our legal or regulatory obligations or provide the services you have requested.

This may mean that we are unable to provide financial, investment and/or tax planning advice, recommend or arrange financial products, or continue to service your existing arrangements.

Similarly, where we require information about another relevant individual (for example, a joint applicant, spouse or partner, trustee, attorney or beneficiary) and we are unable to obtain or use that information, this may limit our ability to provide suitable advice or deliver our services effectively.

How we use your personal information

We will only process your personal information where we have a lawful basis to do so under UK data protection law. In most cases, we do not rely on your consent because the processing is necessary to provide the services you have requested, comply with our legal and regulatory obligations, or pursue our legitimate business interests. Where we do rely on your consent, we will make this clear at the time and you will have the right to withdraw your consent at any time, although this will not affect the lawfulness of any processing carried out before your consent was withdrawn.

We may use your personal information to:

• provide financial planning, investment, pension, protection and tax planning advice and related services, including ongoing reviews of your financial circumstances and the suitability of our recommendations;
• provide tax compliance, accountancy and other professional services where you have engaged us to do so;
• assess your financial circumstances, objectives, attitude to risk and capacity for loss in order to provide suitable advice;
• verify your identity and comply with Know Your Customer (KYC), anti-money laundering, fraud prevention, sanctions screening and other legal or regulatory requirements;
• obtain information from product providers, government departments and other third parties where necessary to provide our services;
• use financial planning, cashflow modelling, risk profiling and other software tools to support our analysis and recommendations;
• communicate with you about your arrangements, respond to enquiries and administer your relationship with us;
• maintain accurate client records, monitor the quality of our services, investigate complaints and resolve disputes;
• comply with our professional, legal and regulatory obligations, including those imposed by the Financial Conduct Authority (FCA), HM Revenue & Customs (HMRC), the Information Commissioner’s Office (ICO) and other competent authorities;
• establish, exercise or defend legal claims and obtain professional advice where necessary;
• manage and improve our business operations, including internal administration, audit, compliance monitoring, risk management and business continuity; and
• send you information about our services, regulatory updates and other communications that are relevant to your relationship with us. Where marketing communications require your consent, we will obtain it via our Client Agreement, before sending them.

We will only use your personal information for the purposes for which it was collected unless we reasonably consider that we need to use it for another purpose that is compatible with the original purpose. If you would like further information about how we assess compatibility, please contact us.

If we need to use your personal information for a purpose that is not compatible with the original purpose for which it was collected, we will notify you and explain the lawful basis that permits us to do so.

There may be circumstances where we are required or permitted by law to process your personal information without your knowledge or consent, for example to comply with a legal obligation, prevent or detect crime, or meet our regulatory responsibilities.

Advice relating to children

We do not normally enter into contracts directly with children (individuals under the age of 18). However, we may provide financial planning or related services for the benefit of a child, for example where a parent, legal guardian or trustee instructs us on the child’s behalf.

In these circumstances, we will normally deal with the parent, legal guardian or other authorised representative until the child reaches the age of 18, or such other age at which they are legally able to instruct us directly. We will only collect and process a child’s personal information where it is necessary to provide our services or to comply with our legal and regulatory obligations, and we will apply appropriate safeguards to protect that information in accordance with this Privacy Notice.

Anti-money laundering and identity verification

As a regulated financial services firm, we are required by law to verify the identity of our clients and to take reasonable steps to prevent fraud, money laundering, terrorist financing and other financial crime.

To meet these obligations, we may carry out secure and encrypted electronic identity verification checks using credit reference agencies or specialist identity verification providers. We will only share the personal information necessary to complete these checks, which may include your name, address, date of birth and other identifying information, such as your National Insurance number where appropriate.

Identity verification checks may leave a record on your credit file, but they are not credit applications and will not affect your credit score or your ability to obtain credit.

We will ensure that any identity verification or screening provider we use processes your personal information in accordance with applicable data protection laws and under appropriate contractual safeguards. Further information about the organisations with whom we share your personal information is set out in the ‘Who we share your personal information with’ section of this Privacy Notice.

Who we share your personal information with

To provide you with our services, we sometimes need to share your personal information with trusted third parties. These may include:

• Financial product providers such as insurers, investment platforms and pension providers
• Compliance consultants, auditors and professional advisers who help us meet regulatory requirements
• Discretionary investment managers where relevant to your service
• IT service providers and secure cloud platforms that support our systems
• Regulators and authorities such as the FCA, HMRC and the Financial Ombudsman Service and, where appropriate, to support fraud prevention or safeguarding
• Credit reference agencies, but only when necessary

 

We never sell your personal information to anyone

Using artificial intelligence (AI) / automated tools to process your personal information

Where we have a lawful basis to do so, we may use AI-assisted software to help us transcribe and summarise meetings and telephone calls, and to assist our staff in preparing or improving routine client communications, such as meeting summaries, follow-up emails and general correspondence.

These tools are used solely to support our employees and do not replace human judgement or professional advice. Any transcript, summary or draft generated using AI-assisted software is reviewed by an appropriately authorised member of our team before it is added to your client file or sent to you. We remain responsible for the accuracy of the records we maintain and for all communications we send.

We do not use AI or other automated processing to make decisions about you that produce legal effects or similarly significant effects without meaningful human involvement. All recommendations and advice are considered and approved by an appropriately qualified individual.

We do not use AI tools that use your personal information to train public models.

If we use third-party AI service providers, we will ensure that appropriate contractual, technical and organisational measures are in place to protect your personal information and that your data is processed in accordance with applicable data protection laws.

We will also:

• Ensure only the minimum necessary personal information is processed
• Anonymise or pseudonymise, where possible, personal information
• Ensure processing occurs in secure, regulated systems
• Ensure that any system we use is registered with the Information Commissioner’s Office and has appropriate data protection policies and procedures in place to protect your personal information
• Personal information will only be transferred outside the UK/EEA if there is a lawful basis in which to do so with your consent, and with appropriate safeguards being in place

 

If you would prefer that we do not use AI-assisted transcription for your meetings or telephone calls, please let us know before the meeting or call. We will instead make manual notes of the discussion where reasonably practicable.

International Transfers

In providing our services, your personal information may be transferred to, accessed from, or stored in countries outside the United Kingdom. This may occur where we use third-party service providers, such as cloud-based software, technology platforms or other professional service providers, that process data using servers or support services located overseas.

If we transfer personal information outside the UK, we will ensure that appropriate safeguards are in place to protect your information in accordance with UK data protection law. These safeguards may include transferring personal information to countries that have been recognised by the UK Government as providing an adequate level of protection or using the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or other approved contractual safeguards.

If you would like further information about any international transfers we make or the safeguards we rely upon, please contact us using the details set out in this Privacy Notice.

Your data protection rights

You have several rights under data protection law. This helps you understand and control how your personal information is used.

• Right to be informed – You can ask us to explain how we collect, use, share, and store your personal information.
• Right of access – You can request a copy of the personal information we hold about you, along with details of how we use it.
• Right to rectification – If you think any of your information is wrong or incomplete, you can ask us to correct or update it.
• Right to erasure – In some situations, you can ask us to delete your personal information.
• Right to restrict processing – You can ask us to limit how we use your information in certain circumstances.
• Right to object – You can object to us using your personal information, for example for direct marketing.
• Right to data portability – You can ask us to send your personal information to you, or directly to another organisation, in a structured, commonly used electronic format.
• Rights related to automated decision‑making and profiling – If a significant decision about you is ever made without meaningful human involvement, you have the right to request human review, ask for an explanation and challenge the decision.

We will respond to any request you make about your data protection rights within one month.

To make a request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for processing your personal information

UK data protection law requires us to have a valid legal reason – called a ‘lawful basis’ – for collecting and using your personal information. The UK GDPR sets out the different lawful bases.

The lawful basis we rely on my affect which data protection rights apply to you. Below, we’ve listed your rights in brief.

You can read more about your data protection rights, including any exceptions, on the ICO’s website:

For the public | ICO

We must have a valid legal reason (a ‘lawful basis’) for collecting and using your personal information. For the financial planning, financial advice, mortgage advice and investment management services we provide, we rely on the following lawful bases:

Contractual obligations

This is the main reason we use your personal information. We need certain details from you so we can deliver the services we’ve agreed to provide.

Legal obligations

Sometimes the law requires us to collect and use specific information. For example, UK anti‑money‑laundering laws require us to verify your identity.

Consent

In some situations, we may need your explicit consent to use special category information (listed below). We will always explain why we need this information and ask for your clear agreement before using it.

Special category information (used only when relevant and only with your explicit consent):

• Health information (e.g. for insurance advice)
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic information
• Biometric information used for identification (e.g. access or payment systems)
• Sex life information
• Sexual orientation information

We also ask for your consent if you would like to receive updates about products or services that may interest you.

If we rely on your consent, you can withdraw it at any time.

Legitimate interests

We may keep certain personal information because we have a legitimate business reason to do so, for example, to check the suitability of our services, respond to any complaints in the future, or to meet the requirements of our Regulators and/or Professional Indemnity insurer.

Recognised legitimate interest

In limited cases, we may rely on recognised legitimate interests for specific public‑interest purposes, such as fraud prevention or safeguarding. This is narrowly defined and unlikely to apply to most of our routine services, but where used, we will ensure the processing is necessary and appropriate.

How long we keep your personal information

We keep the personal information we need to provide our services to you, and we take reasonable steps to make sure it stays accurate and up to date. Some information must be kept minimum periods set by our regulator, the Financial Conduct Authority (FCA):

• Investment business – 5 years
• Mortgage business – 3 years
• Pension transfers and opt‑outs – kept indefinitely
• Insurance business – 3 years

We also have to keep certain records to meet UK anti‑money laundering requirements. These include identity verification documents and other information used to confirm your identity.

• We will keep this information for at least 5 years after our relationship with you ends.
• Some records relating to transactions may be kept for longer where this is necessary to meet legal, regulatory or business requirements.

Because these are legal and regulatory requirements, we cannot delete your information before these minimum time periods have passed.

We may keep your personal information for longer if we have a legitimate business reason to do so, but we will not keep personal information for longer than necessary and will assess appropriate retention periods based on the purpose for which the information is held.

You can ask us to delete your personal information.  We will do so unless we are required to keep it for regulatory, legal or legitimate business reasons.

We regularly review the information we hold to ensure it is not kept for longer than necessary.

If you would like more information about how long we keep your personal information or how we decide this, please contact us.

 

 

Using cookies

We use cookies to:

• Understand how visitors use our website
• Help us create reports and improve our site
• Where consent is not required, you can still control or opt out of cookies through your browser settings at any time.

If you’d like to learn more about cookies, you can visit:  About Us | All About Cookies

You can change your browser settings to block or delete cookies at any time. The website above explains how to do this. Please note that if you choose to block cookies, some parts of our website may not work as expected.

Communication methods and marketing preferences

When you first become a client, we will ask how you would prefer us to communicate with you, for example by telephone, email, post, text message or, where available, through a secure online portal.

 

We will record your communication preferences and, where reasonably practicable, communicate with you using your preferred method. You can update your preferences at any time by contacting us.

 

As part of the services we provide, we may send you important service communications relating to your financial planning or tax affairs. These may include information about your investments or policies, requests for information, meeting arrangements, regulatory updates, market events, changes in legislation or taxation, and other communications that are relevant to the services we provide.

 

These communications form part of our contractual relationship with you and cannot be opted out of while you remain a client, although you may choose how you receive them.

Where we would like to send you marketing communications about additional services, events, publications or other information that is not directly related to the services we provide to you, we will do so in accordance with applicable marketing laws.

 

You can opt out of receiving marketing communications at any time by using the unsubscribe link included in our emails (where available) or by contacting us using the details set out in this Privacy Notice.

 

Opting out of marketing communications will not affect the service communications we need to send you.

Other websites

Our website may include links to other sites.

Please remember that this privacy notice only covers our website, so we recommend checking the privacy policies of any other sites you visit.

 

 

 

Google Analytics

Our website uses Google Analytics which is a service provided by Google, Inc.

This service uses cookies to help the website administrators analyse how users use our site. The information stored by the cookie about your use of the website (including your IP address) will be transmitted to and retained by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.

Google will not associate your IP address with any other data held by Google.

How to make a complaint

If you have any concerns about how we use your personal information, you have the right to raise a data protection complaint with us using the contact details at the top of this privacy notice. You do not need to follow a specific process or use particular wording.

You can raise a complaint through any of our usual contact channels, including email, telephone or post. We will:

• Acknowledge your complaint promptly and at least within 30 days of receiving it
• Investigate and respond without undue delay
• Keep you informed where appropriate

Further details of our complaints process are available on request.

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO).

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

 

Please note that complaints about how we handle your personal data are dealt with under our data protection complaints process.

Complaints about the financial advice or services we provide are handled under our regulated complaints procedure in accordance with Financial Conduct Authority (FCA) requirements. Where a complaint covers both matters, we will ensure each aspect is considered under the appropriate process.

Last updated

We will update this Privacy Policy from time to time to reflect changes in technology, law, our business operations, or any other reason we determine is necessary or appropriate. When we make changes, we will update the date at the top of this section and post it on our Website. If we make material changes to it or the ways we process personal information, we will notify you (by, for example, prominently posting a notice of the changes on our website before they take effect or directly sending you a notification by email).

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

This privacy notice was last updated on 21^st July 2026 and is reviewed at least annually.