Privacy Policy

Bennett-Associates Ltd is a company that operates in the United Kingdom and provides financial services. Your privacy is extremely important to us and we are committed to protecting any data we collect about you.

The information we collect about you is kept strictly confidential, held with the utmost care and not used in ways that we are not permitted to or you have not consented to. A more detailed explanation of how we collect, process, safeguard and use your personal information is also described below.

By using our services, you agree to the processing of the personal information that we collect about you in accordance with this privacy policy.

This page also includes our data protection policy.

If you have any questions please contact us.

Types of communications

By submitting your personal information to us you are consenting to receive the information you requested, as well as allowing us to send you appropriate and useful communications. This includes, but is not limited to: invitations to events and webinars, our publications (whitepapers, guides, reports, infographics, videos, case studies and surveys), information about our services, and company news.

Information collected

We collect the information you give us, which normally includes your name, company name, job title, telephone number and email address. Other information that may be needed to process a request may also be collected as indicated at the point of collection.

We take reasonable measures to ensure that your personal information is transferred from you using the most secure methods.

Information use and retention

We use the personal information collected primarily to process the task you requested. Your data is collected, stored and safeguarded in accordance with data protection laws in the UK.

We keep your personal information for as long as you agree to continue using our services (in accordance with any agreed contract) or willing to maintain a business relationship with us. We will delete your personal information once you have told us you no longer wish to receive our services or maintain a business relationship with us because we are not permitted otherwise to retain the information.  In specific cases and to retain information for company reporting or legal purposes, we may keep a basic level of information to satisfy these requirements.

Disclosing information

We do not disclose your personal information to third parties that are not involved with providing you with the service you have requested or receive or disclosed in this privacy policy.

Website cookies

Your Internet browser has the in-built facility for storing small text files called “Cookies” that hold information which allows a website to recognise you as a user. Our website takes advantage of this facility to enhance your experience and engagement with our company. We use cookies for analytical purposes to improve our website by collecting data about visitors. By using our website, you consent to the use of cookies for these purposes.

The type of cookies we use on our website are termed “persistent cookies”. These cookies enable our website to recognise visitors when they return. These cookies will be removed on a pre-determined expiry date, or when deleted by you.

Most internet browsers allow user privacy settings to block either all cookies or third-party cookies. Blocking cookies will, however, have a negative impact upon the usability of many websites. We only uses cookies to assist with the development of our website and user experience, therefore, blocking cookies will not stop you from having access to our website. Please visit for comprehensive information on how to change your cookie settings in a wide variety of different internet browsers.

Google Analytics cookies: Google Analytics is a website monitoring tool that allows users to see volumes of website visitors, their source, and to analyse how the content of their website is viewed and navigated. This allows the optimisation of the content and pages on our website and the marketing programs that drive traffic to the website. Google Analytics does not store any personal information about website visitors but does use persistent cookies to identify repeat visitors. You may universally opt-out of all Google Analytics tracking used by all websites by visiting

Updating preferences and opting out

You can update your preferences at any time by either replying to an email you receive from us or by clicking the appropriate link contained in our emails. You can also stop receiving our emails at any time by using the unsubscribe link within the email footer section. If you don’t have an email from us to hand and want to update your preferences or to unsubscribe from mailings, please contact us.

Links to other websites

Within the content on our website and in our emails there are links to other websites. We are not responsible for the data policies, or for the content, of any other website. It is recommended that you appraise yourself of the privacy policy and procedures applicable to such other websites and of persons operating and controlling those websites.

Changes to this policy

We regularly review this privacy policy and the last modified date is highlighted below. Any changes to this privacy policy will supersede the previous version of this policy and we will take reasonable steps to draw your attention to any changes. We suggest you regularly read this document to ensure that it continues to meet with your approval.

Last modified date: 20 April 2020

Complaints or queries

We try to meet the highest standards when collecting, processing, safeguarding and using personal information. For this reason, any complaints we receive about a breach of your statutory rights to privacy and data protection we will take very seriously. If you wish to register a complaint about your privacy, please contact us.

If you are not satisfied with how we deal with a complaint of this type, you can take your complaint to the supervisory authority in the UK (

General queries

If you have any questions about this privacy policy, or if you want to know what information we have collected about you, please contact us. You can also correct any factual errors in that information or require us to delete any part or all of your information.

Data Protection

Bennett-Associates Ltd takes its obligations under the Data Protection Act 2018 very seriously and strives for the highest standards. Bennett Associates’s lead data protection supervisory authority is the Information Commissioner’s Office (ICO) in the United Kingdom.

For more information about our approach to data protection, please contact us.

  • Consent – Consent is given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.
  • Data Controller – The organisation or individual that determines the purpose and means of data processing.
  • Data Processor – An organisation or individual that processes data on behalf of a data controller.
  • Data Subject – An identified or identifiable natural (living) person.
  • Personal Data Breach – A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
  • Personal Data – Any data relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Processing – Any operation/set of operations which performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and ‘process’ and ‘processed’ shall be construed accordingly.

Bennett-Associates Ltd is a Data Controller registered under the Data Protection Act. Bennett-Associates Ltd is responsible for compliance with the Data Protection Principles contained within the Data Protection Act.

The six principles of the Data Protection Act for personal data are as follows.

  1. Processed lawfully, fairly and in a transparent manner in relation to individuals.
  2. Collected for specified, explicit and legitimate purposes and not processed beyond those.
  3. Adequate, relevant and limited to what’s necessary in relation to the purposes for which they are processed.
  4. Accurate and, where necessary, kept up-to-date.
  5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
  6. Processed in a manner that ensures appropriate security of the personal data.

The Data Protection Act includes the following rights for individuals.

  • The right to be informed (which is the right to be provided with clear, transparent and easily understandable information about how Bennett-Associates Ltd use your information and your rights relating to the information).
  • The right of access to the personal data which is processed and information about how it is being used.
  • The right to rectification if personal data is inaccurate or incomplete.
  • The right to erasure in certain circumstances where there is no reason for Bennett-Associates Ltd to continue to process the data.
  • The right to restrict further processing of personal data.
  • The right to data portability of personal data between different service providers.
  • The right to object to certain types of processing, such as direct marketing.
  • The right not to be subject to decisions based solely on automated decision-making, including profiling.

The six legal grounds personal data can be processed are as follows.

  1. The data subject has given consent for a specific purpose.
  2. It’s necessary for the performance of a contract with the data subject.
  3. It’s necessary for the controller to comply with a legal obligation.
  4. It’s necessary to protect the vital interest of the data subject or other natural person.
  5. It’s necessary to perform a task in the public interest or for official functions.
  6. It’s necessary for the purpose of the legitimate interest pursued by the controller or third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Bennett-Associates Ltd focuses pro-actively on compliance with data protection regulations and in addition, adheres to its own principles:

  • Our staff are kept up-to-date and trained on data protection regulations and best practices for the safe handling of personal data.
  • We only deal with reputable organisations, and where there might be any grounds for suspicion it is alert to avoid being involved in what might be an improper use of personal data.
  • We adopt best practice in the administration and security of its computer systems and keeps up-to-date with technical developments and emerging risks to network integrity.
  • We monitor its computers systems and the personal data that they hold, which includes the access to and use of that data by its staff in order to ensure that only relevant data is accessible for the roles of individual staff, there is no misuse and that data is not put at risk.
  • We have a continuous data protection programme to ensure compliance and safeguards within all operations, which include activities such as privacy impact assessments, regular audits, policy reviews and updates, and training.

Personal data covers both facts and opinions about an individual where that data identifies an individual. The personal data held by the group of companies fall into four categories:

  1. Staff and associates of Bennett-Associates Ltd, as well as possible recruits and past staff:
  2. Individuals with whom Bennett-Associates Ltd has a business relationship, such as clients, trade bodies, professional advisers, regulatory and governmental organisations and suppliers.
  3.  Individuals whose mortgage and insurance needs are analysed by Bennett-Associates in the course of its business as a professional firm.
  4. Individuals with whom Bennett-Associates Ltd might have a future business relationship.

Bennett-Associates Ltd will only process personal data when a legal basis has been clearly identified above.

  • Staff, associates and potential recruits: Bennett-Associates Ltd processes employment details and other employment-related data for potential recruits, and current and former staff. Bennett-Associates Ltd carries out this processing in order to prepare for and carry out employment contracts, and to comply with legal obligations as an employer. Further details are available to employees in the staff handbook.
  • Individuals with whom Bennett-Associates Ltd has a business relationship: Bennett-Associates Ltd processes contact details of these individuals, such as names, addresses, email addresses and professional interests. If the individual has specifically opted-in, Bennett-Associates Ltd uses this information to send out communications related to its business. Other business contact information is used by Bennett-Associates Ltd for its legitimate business interests. This involves contacting specific people in connection with current business or future business issues and requirements. The information may be passed to third parties that provide services to Bennett-Associates Ltd to enable them to carry out the purposes referred to above.
  • Individuals who hold financial products or have received financial services: When Bennett-Associates Ltd provides a service to an individual who holds financial products or has received financial services, or to an individual whose financial investment and insurance needs are analysed by Bennett-Associates Ltd as part of a service contract, the only data Bennett-Associates Ltd obtains is that required to provide the service. The data will be obtained from the individual directly or from elsewhere at the specific request of the individual via the relevant data controller. Upon the evaluation of data obtained for the performance of contracts, if Bennett-Associates Ltd becomes exposed to information that is in addition to the information required to performing the required service, Bennett-Associates Ltd will only use the information that is required to provide the service and will take measures, where possible, to limit such exposure. Bennett-Associates Ltd has written contracts with the clients for whom Bennett-Associates Ltd processes this information and Bennett-Associates Ltd complies with their written instructions for how the information may be used.

Bennett-Associates Ltd may hold sensitive data about its staff which will have been provided to facilitate employment duties and information which would be relevant to their employment and relationships with other members of staff. Information relating to the use of personal information relating to staff is set out in the staff handbook (which is available to all staff).

Due to the nature of the services which Bennett-Associates Ltd provides, Bennett-Associates Ltd can hold sensitive personal data about individuals. This data may contain a variety of information including financial details (including historic), family details and health information. The situation arises because Bennett-Associates Ltd provides services to mortgage providers, insurance companies, regulators, solicitors and others who in the course of their business need to consider the holdings of investments and investment and insurance needs of individuals, sometimes on the instructions of the individual but sometimes in an adversarial, monitoring or other capacity. Bennett-Associates Ltd processes this information to comply with the service contracts that relate to the individuals.

Bennett-Associates Ltd will only accept consent as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

For further information about how Bennett-Associates Ltd collect, look after and use personal data for its marketing, please read our privacy policy above. Consent for these types of communications can be changed and withdrawn at any time through options available within these communications.

Bennett-Associates Ltd will not retain personal data for longer than it is needed for its authorised purpose. Where Bennett-Associates Ltd processes data on the basis of an individual’s consent, once consent has been withdrawn, our systems will be updated immediately and the personal data will be removed from use (as defined within the request for the withdrawal of consent) and will be deleted. For the performance of contracts, a defined period for the retention of data will be agreed with the data controller.

Bennett-Associates Ltd periodically reviews the data held about individuals with whom they maintain a business relationship to ensure that it is still relevant to business needs.

Bennett-Associates Ltd will provide access to personal data which it holds, upon request, subject to checking that the personal data may legally be provided and with agreement from the Data controller (either Bennett-Associates Ltd or client; whichever is the data controller). There will be no charge for providing this information unless they are manifestly unfounded or excessive. Bennett-Associates Ltd will ensure that the information is made available within 30 days. Bennett-Associates Ltd may require further time (up to a maximum of 2 further months) if the request for information is complex – in this case, we will inform the data subject accordingly. If Bennett-Associates Ltd refuses a request for personal data, it will inform the individual with the reasons why and that they have the right to complain to the supervisory authority and to a judicial remedy. To make a formal request to access personal data that we hold about you, please contact usBennett-Associates Ltd‘s marketing communications will contain links to access and update the data subject’s core contact details and mailing and subscription preferences.

Bennett-Associates Ltd provides highly secure computer systems, applications and devices for its staff. Large volumes of data pass over this network of computers, applications and devices which contain adequate controls for the separation and management of data. Bennett-Associates Ltd monitors the data and traffic in the capacity of a network administrator as well as in the capacity of the operator of its own business and as an employer. Bennett-Associates Ltd makes it clear to all those individuals and organisations affected what roles it carries out in the operation of the network. Staff of Bennett-Associates Ltd will only have access to personal data that is relevant to fulfil their roles and for the performance of contracts. Bennett-Associates Ltd has strict policies and procedures for its staff around the use of computer systems, applications and devices to minimise the risks to personal data, which includes the use of personal data within external communications and systems outside the control and monitoring of Bennett-Associates LtdBennett-Associates Ltd policies and procedures extend to all other methods for containing personal data, which includes printed documents and all paper files.

Bennett-Associates Ltd has procedures to effectively detect, report and investigate a personal data breach. If a personal data breach has been verified, then Bennett-Associates Ltd will take immediate action by informing the data controller (if not Bennett-Associates Ltd), and where appropriate informing affected data subjects (in liaison with the data controller), and the supervisory authority.