Privacy Notice

Introduction

This privacy notice explains who we are, how we collect, share and use your personal information, and how we protect your data. It is intended to help you understand your privacy rights and how we comply with UK data protection laws.

Personal information is any information that can be used to identify you as a unique individual.

Who we are

This privacy notice is provided on behalf of 2plan Group Limited (“2plan”) and its subsidiaries, which includes 2plan wealth management Ltd (ICO Registration Reference: Z9770624), who can all act as data controllers of your personal information. Its principal place of business is 3rd Floor Bridgewater Place, Water Lane, Leeds, West Yorkshire, LS11 5BZ (ICO Registration Reference ZB876231).

2plan, along with several other financial service companies, is part of “The Openwork Partnership” family, a trading style of Openwork Limited (ICO Registration Reference Z8925674), with both 2plan and Openwork Limited (Openwork) being part of the Openwork Holdings Limited (“OHL”) group of companies (ICO Registration Reference Z8961113).

Scope of this privacy notice

This privacy notice covers:

2plan Group Limited, all of its partners, representatives and subsidiaries, and all other legacy legal entities by which the network was previously known, (together, “2plan”)

Financial advisory services are delivered by 2plan’s network of financial advisers who are either a Registered Individual (RI) of 2plan, or part of our network of appointed representatives firms (AR).

2plan operates under a “Joint Controllership” relationship with our RIs and AR Firms, whereby we jointly determine the purposes and means of processing our clients’ personal data. 2plan also has access to personal information that 2plan’s AR firms collect and use via 2plan’s centralised IT systems (which is required to facilitate the AR’s services).

Within this joint controller arrangement, both 2plan and its AR firms share responsibility for complying with appropriate privacy and data protection laws and partner together to ensure we have the right measures in place, protecting our clients’ data and establishing a foundation of trust, to be maintained on an ongoing basis.

Throughout the remainder of this notice , “we”, “us” and “our” shall refer to “2plan”, its RIs and its ARs in partnership as joint controllers.

Separate privacy policies exist for candidates and colleagues employed by 2plan and its AR firms and are made available to those individuals separately from this privacy notice.

How we collect your personal data

We will collect your personal data in the following ways:

  • Directly from you:
    • During fact finding meetings and any other meetings with you.
    • When you complete a form or survey or provide information on our website.
    • When you contact us by phone, in writing, by email -or electronic methods.
    • When you send us information as part of an on-going service delivery.
    • When you register to receive communications.
    • Provided by you as part of accessing 2plan services or attending 2plan events.
  • From Third Parties:
    Before you provide personal data about another individual, please ensure you have their consent.
    • When you are referred to us by an introducer or a professional service firm.
    • From policy providers, mortgage providers, or other financial institutions.
    • Via publicly available sources and online searches.
    • From other clients where it is necessary to do so e.g. where you are a beneficial owner of their assets or as an individual making payments to their account.
    • Information provided by legal firms in relation to legal proceedings.
    • Where information is passed to us as a result of us acquiring or merging with another firm or advice network; or an RI or AR joining our firm (of which you were previously a client).
  • Through Our Website
    • Using cookies and similar technologies (please see our separate Cookie Notice on our website).

The types of information we collect

  • Identity data includes your full name, title, date of birth, age, personal identifier and policy/account numbers.
  • Contact data includes your home address, email address and phone number.
  • Financial data includes your earnings, income, expenditure, bank account number, credit/debit card number, existing investments, pension and insurance products, spending habits, transaction history, tax reference number, source of wealth and source of funds.
  • Family data includes your marital status, next of kin, dependents and emergency contact details.
  • Profile data includes your sex, occupation, employment status, citizenship, residential and domicile status, property details, occupancy status and insurance information.
  • Identification data which includes your driving licence, passport, National Insurance number and other national identifiers.
  • Technical data includes internet protocol (IP) address, location data, operating system, time zone etc.

We also collect special categories of personal data which includes:

  • Health data which includes any physical disability, mental disability or any medical condition.
  • Criminal data which includes information about criminal convictions and offences, allegations. (proven or unproven) and investigations, penalties and restrictions, County Courts Judgements and insolvency details as well as information relating to the absence of convictions.
  • Special category data includes information about your health, racial or ethnic origin, sex life, sexual orientation.
  • Biometric data – includes a fingerprint, voiceprint, or scan of hand or face geometry, retina/iris scan.

It is important that the personal information we hold about you is accurate and up to date.

We do not and will not knowingly collect any personal data from any unsupervised child under 13. If you are under 13, you must not use our websites unless your parent or legal guardian has given explicit consent for your access.

Please keep us informed of any changes to your personal information, such as change of contact details.

The types of information we collect

Purpose/Activity Types of personal information Legal Basis
Provision of financial advice and ongoing servicing.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Necessary for the performance of a contract
Provision of services relating to insurance products.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligations and substantial public interest (relating to insurance)
Managing and administering the policies you hold through us.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data
  7. Technical data

Necessary for the performance of a contract

Meeting our legal and regulatory obligations
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligations

Anti Money Laundering requirements.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligation
Preventing and investigating fraud.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data
  7. Technical data

Substantial public interest (preventing fraud)

Legal activities and advice.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligation

Legitimate interest

Dealing with complaints and enquiries raised by you.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Identification data
  5. Profile data

Legitimate interest

To send you marketing communications relating to our business, and other entities within 2plan and OHL, which we think may be of interest to you, by post or, where you have specifically agreed to this, by email or similar technology (you can inform us at any time if you no longer require marketing communications and/or you wish to withdraw your consent).
  1. Identity data
  2. Contact data

Individual consent. Provided by you as part of accessing 2plan services or attending 2plan events.

Handling data right requests, including when additional personal information is required to enable us to fulfil our obligations relating to the request.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Identification data

Legal obligation

Handling data breaches involving personal data held on 2plan systems or on third party systems.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data
  7. Technical data

Legal obligation

Managing system administration, resolve website issues, enhance site quality, and personalise your experience. To track and address user problems, customise the website, enable service access, maintain security, and prevent fraud.
  1. Technical data
  2. Identity data
  3. Contact data

Consent provided by individual

Legitimate interest to ensure our systems are working effectively and user issues can be resolved.



The types of information we collect

Purpose/Activity Types of personal information Legal Basis Additional Legal Basis
Anti Money Laundering requirements.
  1. Criminal data
  2. Biometric data

Legal obligation

Substantial public interest (suspicion of terrorist financing or money laundering)

Legal activities and advice.
  1. Health data

Legal obligation

Legitimate interest

Preventing and investigating fraud.
  1. Criminal data

Legal obligation

Substantial public interest (preventing fraud)

Provision of advice and services relating to insurance products.
  1. Health data
  2. Racial or ethnic origin data
  3. Health data
  4. Sex life data
  5. Sexual orientation data

Legal obligation

Substantial public interest (related to insurance)
To assess and accommodate our services to meet vulnerable customer needs.
  1. Health data

Explicit consent provided by the individual

Explicit consent

Automated decision making and profiling

Automated decision-making

In certain circumstances we may process your personal data through automated decision-making, including profiling, which involves computer based decisions without human involvement. This may include segmenting and tailoring the data to enable us to match our communication and products to your perceived needs. In the case we process your personal information through automated decision-making, we will inform you about the logic involved, as well as the significance and the envisaged consequences of such processing for you. You also have the right to ask for

Profiling

There may be some circumstances where we use your personal information for profiling (processing of personal information to evaluate certain things about you). For example, to assess the quality of our service to clients. Where possible we will anonymise the data by excluding information (such as your name) that makes the data personally identifiable to you. We reserve the right to use such anonymous data for any purpose and disclose anonymous data to third parties, including but not limited to our research partners, at our sole discretion.

We’ll always make sure the way we process your information is safe and not unfair to you.

You have the right to object to us using your personal information for profiling activities. Please refer to the “Your Rights” section for more information.

Marketing

We may use your personal information to provide you with information about our products or services which may be of interest to you, if you have provided your consent for us to do so.

If you wish to opt out of marketing, you may do so by clicking on the “unsubscribe” link that appears in all emails that are sent by your Partner or by telling us when we contact you. Otherwise, you can always contact us using the details set out in the section How to Contact Us to update your contact preferences.

Please note that, even if you opt out of receiving marketing messages, you may still receive communications from your Partner in connection with the products we offer you.

Third parties we share your personal data with

We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as is reasonably necessary for the purposes set out in this privacy notice.

We may also share your data with third parties:

  • To perform services on your behalf
  • To the extent that we are required to do by law
  • In connection with any on-going or prospective legal proceedings
  • In order to establish, exercise or defend our legal rights (including providing information to others for the purpose of fraud prevention and reducing credit risk)
  • To any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such or authority would be reasonably likely to order disclosure of that personal information.

In certain circumstances, where there are internal teams providing shared services across 2plan and other entities within The Openwork Partnership, personal data of 2plan clients may be stored and accessed on Openwork systems (including the use of their systems to facilitate 2plan’s services). For certain processing activities required to provide 2plan’s services and other activities, data may be shared with other members of the Openwork Partnership who may be a processor, acting on 2plan’s behalf.

Types of third parties who may have access to your personal data include:

  • Professional service providers: when you have asked us to share your details with them.
  • Regulatory authorities, the government and tax authorities.
  • Fraud prevention and/or law enforcement agencies.
  • Product providers: The scope and extent of the sharing of information with product providers depends on the type of service you are receiving or requesting from us.
  • Purchasers/investors: We may share your information with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets or who are stakeholders or investors in our business. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this notice.
  • Advertisers and data exchanges: We may share your information with advertisers (where we are permitted to do so) and data exchanges, so that we can offer you tailored content, including more relevant advertising for products and services which may be of interest to you. These third parties may set and access their own cookies, web beacons and similar tracking technologies on your device in order to deliver customised content and advertising to you when you visit 2plan websites.
  • Social Networks: Our websites and/or applications may also allow you to log in using a social network or other third-party account. Logging into one of our sites with your social network or other third-party account may allow us to gather information that you give us permission to access from that social network or third party.
  • Third Party IT System Suppliers who may host your data on their systems and may need some level of access to resolve technical concerns.

We will never sell or share your personal information with other organisations for their direct marketing purposes without your explicit consent. Except as provided for in this Notice, we will not provide your personal information to other third parties.

We require all third parties to respect the security of your personal data and to treat it in accordance with data protection laws. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

We will only send personal data collected within the UK to foreign countries in limited circumstances such as to follow your instructions, to comply with a legal duty or to work with our suppliers, agents and advisers who we use to help run our business and services.

If we do transfer personal data outside of the UK, we will only do so to countries deemed by the UK to have adequate data protection laws or where we are satisfied that the personal data will be sufficiently protected in the destination country and through appropriate safeguards such as approved standard data protection contractual clauses.

Protecting your personal information

We are committed to protecting your personal information and implementing appropriate technical and organisational security measures to protect it against any accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against all other unlawful forms of processing.

We store all your personal data in highly secure software systems and when we share your personal data with third parties we do so in a safe and secure manner.

When collecting or transferring special category data we use a variety of additional security technologies and procedures to help protect this information.

How long do we keep your data for?

We keep your personal data for as long as it is required by us:

  • To the extent that we are required to do so by law.
  • If we believe that the information may be relevant to any on-going or prospective legal proceedings.
  • In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).
  • For the purposes set out in “How we use personal information” section.

Personal data that we process for any purpose will not be kept for longer than is necessary for that purpose. Notwithstanding the other provisions of this section, we will retain your personal data to support as specified above (with due consideration for the rights and freedoms of individuals’ privacy).

Different purposes will have different retention periods. When determining retention periods for personal data we take consideration of the following:

  • Legal and regulatory retentions periods.
  • The on-going operational needs of 2plan.
  • Our contractual rights and obligations.
  • Our IT system capabilities and any restraints.
  • Costs associated with maintaining, securing and retrieving data.
  • The types of advice clients have received and the products they hold.

If you would like further details on this, then please contact us directly by using the details in the “How to Contact Us” section.

Your rights

Under Data Protection Law, you have a number of rights relating to your personal data. The rights available to you depend on our reason for processing your information. You have the following rights which can be applied in certain circumstances:

  • The right to be informed about how and why your data is being collected and used.
  • The right of access to your personal data and receive a copy of it.
  • The right to rectification where you believe any of your data to be inaccurate or incomplete.
  • The right to erasure of your personal data (also known as the right to be forgotten).
  • The right to restrict processing of your personal data.
  • The right to data portability (e.g. transferring your data to a third party in in a structured, commonly used and machine readable format).
  • The right to object to processing of your personal data (including profiling) based on 2plan’s legitimate business interests, such as for direct marketing.
  • The right to withdraw your consent to data being processed about you (where processing is on the basis of your consent).
  • The right to object to decisions being taken solely by automated means, including profiling and request a human review in relation to any decision made solely through automated processing.
  • The right to make a complaint to the Information Commissioner’s Office about your data being processed.

To exercise any of these rights please email [email protected].

Alternatively, you can get in touch using the details set out in the “How to Contact Us” section.

How to raise a concern

If you are unhappy about the use of your personal data, then please contact us directly and we will try our best to resolve your concern.

If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your local data protection authority the Information Commissioners Office.

How to contact us

If you have comments or any questions about our Privacy Policy or our Cookie Policy, please contact us by email at [email protected] or by post:

The Data Protection Officer
2plan wealth management ltd
3rd floor Bridgewater Place
Water Lane
Leeds
LS11 5BZ


If you are engaging with 2plan via one of our AR firms, you can also contact your 2plan AR Firm directly using the contact details they have provided you (typically available to you on their headed paper or within the signatures of any email communication they send) if you would like any information about how they collect, store or use your personal information.

Changes to our Privacy Notice

From time to time we may need to make changes to this notice, for example, as the result of changes to law, technologies, other developments or new products and services being offered. We keep our privacy notice under regular review and we will place any updates on this web page. This privacy notice was last updated on March 2025.

Information we may collect from you

2plan are both Data Controllers and Data Processors of information you provide to us.

In order to provide you with specific advice and services we will ask you questions that tell us more about you, your situation, lifestyle and attitudes. This is called personal data, some of which will be classed as confidential, private and sensitive.

The Data Protection legislation says that personal data is defined as any data from which a living individual can be identified. Any provision of that type of data should be given freely for the purpose(s) it was intended.

We ask for your permissions to use your personal information to enable 2plan and/or one of its network of Advisers to provide you with detailed advice or proposals on the financial products and services you have asked about. In addition, where you have submitted personal information for the intention to purchase a financial product, we are asking for your permission to pass to relevant third parties in order to complete your transaction. This is classed as legitimate interests for processing. It simply means that we require your agreement to collect and process your details in order to provide you with a service or advice. Without it we would not be able to offer such advice or service to you.

Any of the consented personal and confidential detail, which will include any sensitive information you have provided, is only collected specifically for these purposes and is processed lawfully, fairly and transparently in a way which can be scrutinised.

That consent can be revoked by you at any time but it would mean that the more detailed advice that could be provided regarding these data will no longer be available to you.

All information is held and maintained in a secure format and encrypted where required to ensure controlled security. Only the minimum of relevant and adequate personal data will be collected and access is restricted to only those personnel that need to for the provision of the advice and services.

We may collect and process the following data about you:
  • Information that you provide by filling in forms on our website. This includes information
    provided at the time of registering to use our website, subscribing to our products and
    services, posting material or requesting further products and services. We may also ask
    you for information when you report a problem with our website.
  • Information attached to your I.P. address.
  • Personal details that you provide by completing in-depth information gathering, either
    remotely or face to face with one of our network of 2plan registered and approved
    advisers in relation to offering you advice on financial products and services you have
    asked us about.
  • If you contact us, we may keep securely a record of that correspondence (including email
    and phone conversations) including your name, address, telephone numbers, email
    address and other information which you supply to us.
  • We may also ask you to complete, from time to time, surveys or questionnaires which
    you have agreed to, that we use for research purposes or to improve our relationship with
    our clients.

Uses made of the information

We may use information held about you in the following ways:

  • To ensure that content from our website is presented in the most effective manner for
    you and for your computer.
  • To provide you with information, products or services that you request from us or which
    we feel may be of interest to you, where you have consented to be contacted for such
    purposes. You may ask us to cancel this consent at any time and you will only then
    receive information specifically about your account activity with 2plan.
  • To carry out our obligations arising from any contract entered into between you and us
    and that may involve providing some of your information to a third party to carry out
    necessary background checks (including but not limited to Identity Verification / Anti
    Money Laundering / Fraud Prevention / Residency Confirmation).
  • To provide some or all of your personal information (as required) to one or more financial
    products providers in order to fulfil a detailed proposal for the services you have asked
    2plan about.
  • To provide some or all of your personal information (as required) to one or more financial
    products providers in order to fulfil a request to purchase a financial product.
  • To carry out a form of profiling that gives us a clear view of your circumstances and that
    is part of the advice process. Where this is done, you will be shown its recommendations
    and will be provided with the opportunity to review and amend its output to indicate your
    attitude to risk.
  • For training purposes, quality assurance or to record details about the products and
    services you ask us about.
  • To satisfy and meet our legal and regulatory requirements with the FCA and ICO, or as
    requested by UK security services.
  • To notify you about changes to our products and services or terms & conditions.

    Unless prescribed by law, we will retain your details for no longer than is necessary for the
    purposes for which the personal information was collected or for which it is to be further
    processed by us.

Disclosure of your information

For your security, 2plan have made the conscious decision to only manage, host and process personal information in the UK.

We may disclose your personal information to any member of the 2plan group of companies in order to fulfil any obligations to you.

Any transferring, sharing or use of personal data will only be done with approved and contracted third party companies, that have provided evidence of their own GDPR compliance, to develop the advice requested by the client with the exception of checks such as Anti-Money Laundering, Fraud Prevention and Identity Validation or from valid requests by regulatory or security bodies.

We may disclose your personal information to third parties if we are under a duty to disclose or share it in order to comply with any legal or regulatory obligation, or in order to enforce or apply our terms and conditions and other agreements; or to protect the rights, property, or safety of our customers, or others.

Your rights and how to contact us

You have a right of access to personal information which we may hold about you, to have inaccurate information about you corrected or to request we stop using your personal information for marketing and other purposes. You have the right to ask 2plan to view any information we hold about you and you can expect to receive a response from 2plan in line with the guidance laid down by the GDPR. Any requests should be either emailed to [email protected] and marked ‘Subject Access Request’ or put in writing and addressed to:

The Data Protection Officer
2plan wealth management ltd
3rd floor Bridgewater Place
Water Lane
Leeds
LS11 5BZ

We regularly review our policies and any changes will be posted on our website.
If you have comments or any questions about our GDPR, Privacy & Cookies Policy, please contact: [email protected].

FCA contact information:
www.fca.org.uk
Helpline – 0800 111 6768

ICO contact information:
ico.org.uk
Helpline – 0303 123 1113
Copyright © 2023, 2plan wealth management Ltd. All rights reserved.
The guidance and/or advice contained within this website is subject to the UK regulatory regime and is therefore targeted at consumers based in the UK.
2plan wealth management Ltd is authorised and regulated by the Financial Conduct Authority. It is entered on the Financial Services Register (www.fca.org.uk) under reference 461598.
Registered address: 3rd Floor, Bridgewater Place, Water Lane, Leeds, LS11 5BZ.
Telephone: 0113 302 1360.
Registered in England and Wales Number: 05998270.
Data Protection Registration Number: Z9770624.